Drop the per-IP registration limiter and the per-user MCP limiter along
with the shared in-memory/Redis helper. Request throttling is an
infrastructure concern (reverse proxy, CDN) rather than something each
endpoint should reimplement.
Replace the process-wide registration counter used without Redis with a
shared per-key fixed-window limiter, so one requester can no longer
exhaust the registration budget for every other client on the process.
The in-memory fallback is bounded (expired windows are swept, then the
oldest keys are shed) so memory stays constant under key churn.
Also fixes checkMcpRateLimit inverting redis.rateLimit's result: it
resolves true once the counter reaches its threshold, so with Redis the
MCP endpoint was denying requests below the limit and allowing those
above it. Both call sites now share the same limiter and semantics.
The trailing-slash regex also matched the leading slash of the root URL, so with REMOVE_TRAILING_SLASH set every home page view was stored with an empty url_path: the home page vanished from the paths/entry/exit reports and could not be selected as a funnel step. Skip the match at the start of the path so "/" and "/#hash" are preserved while "/blog/" and "/blog/#hash" are still trimmed.
Closes#4152
The trailing-slash regex also matched the leading slash of the root URL, so with REMOVE_TRAILING_SLASH set every home page view was stored with an empty url_path: the home page vanished from the paths/entry/exit reports and could not be selected as a funnel step. Skip the match at the start of the path so "/" and "/#hash" are preserved while "/blog/" and "/blog/#hash" are still trimmed.
Closes#4152
TWO_FACTOR_ENCRYPTION_KEY has no default, so instances upgrading to 3.3
without setting it hit an unhandled throw from encryptSecret: the setup
dialog only reported "Something went wrong", and where 2FA was required
the blocking dialog made the whole app unusable. The status endpoint now
reports 2FA as not required while the key is missing or invalid, and
setup initiation returns 503 with a two-factor-error-not-configured code
that the setup dialog renders as a readable message. Also documents the
variable in the README and the example compose file.
Closes#4443
Jamal