From e742df0bfaa3e318c2f494332301ee6bdc6938df Mon Sep 17 00:00:00 2001
From: Jacques Ikot <jacquesikot@gmail.com>
Date: Wed, 24 Sep 2025 12:36:36 +0100
Subject: [PATCH] feat: add account suspension error message for rate limiting
 (#41254)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

This PR adds a new error message constant
`AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT` to handle cases where user
accounts are suspended due to rate limiting violations.

## Changes

- Added `AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT` message constant in
`messages.ts`
- Added the new error message to the approved error messages list in
`approvedErrorMessages.ts`
- The message informs users that their account is suspended for 24 hours
and suggests resetting their password to continue

## Message Content

> "Your account is suspended for 24 hours. Please reset your password to
continue"

This provides clear guidance to users on both the suspension duration
and the action they can take to resolve it.
## Automation

/ok-to-test tags="@tag.Sanity, @tag.Authentication"

### :mag: Cypress test results
<!-- This is an auto-generated comment: Cypress test results  -->
> [!TIP]
> 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
> Workflow run:
<https://github.com/appsmithorg/appsmith/actions/runs/17939195425>
> Commit: 5b1a651df3483315ebea7f4096eb22e485a9a9d7
> <a
href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=17939195425&attempt=1"
target="_blank">Cypress dashboard</a>.
> Tags: `@tag.Sanity, @tag.Authentication`
> Spec:
> <hr>Tue, 23 Sep 2025 08:25:35 UTC
<!-- end of auto-generated comment: Cypress test results  -->


## Communication
Should the DevRel and Marketing teams inform users about this change?
- [ ] Yes
- [ ] No


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added a clear authentication message when an account is temporarily
suspended due to rate limiting (24-hour lockout). This message is now
displayed as a standard, user-visible error, helping users understand
why sign-in is blocked and when they can retry. This improves feedback
after too many attempts or excessive requests, reducing confusion and
support inquiries.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 app/client/src/ce/constants/approvedErrorMessages.ts | 2 ++
 app/client/src/ce/constants/messages.ts              | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/app/client/src/ce/constants/approvedErrorMessages.ts b/app/client/src/ce/constants/approvedErrorMessages.ts
index 9eb9fb7a30..b7d20e032f 100644
--- a/app/client/src/ce/constants/approvedErrorMessages.ts
+++ b/app/client/src/ce/constants/approvedErrorMessages.ts
@@ -9,6 +9,7 @@ import {
   VERIFY_ERROR_MISMATCH_TITLE,
   FORM_VALIDATION_EMPTY_EMAIL,
   AUTH_LOGIN_TOO_MANY_ATTEMPTS,
+  AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT,
   AUTH_INVALID_CREDENTIALS,
   AUTH_UNAUTHORIZED,
   AUTH_NOT_LOGGED_IN,
@@ -39,6 +40,7 @@ export const APPROVED_ERROR_MESSAGES = {
     // Authentication & Authorization
     ERROR_401,
     AUTH_LOGIN_TOO_MANY_ATTEMPTS,
+    AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT,
     AUTH_INVALID_CREDENTIALS,
     AUTH_UNAUTHORIZED,
     AUTH_NOT_LOGGED_IN,
diff --git a/app/client/src/ce/constants/messages.ts b/app/client/src/ce/constants/messages.ts
index d8cf8cc3dd..95e3220a90 100644
--- a/app/client/src/ce/constants/messages.ts
+++ b/app/client/src/ce/constants/messages.ts
@@ -2679,6 +2679,8 @@ export const CUSTOM_ACTION_LABEL = () => "Custom Action";
 
 export const AUTH_LOGIN_TOO_MANY_ATTEMPTS = () =>
   "Too many login attempts. Please try again after some time.";
+export const AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT = () =>
+  "Your account is suspended for 24 hours. Please reset your password to continue";
 export const AUTH_INVALID_CREDENTIALS = () =>
   "Invalid credentials provided. Did you input the credentials correctly?";
 export const AUTH_UNAUTHORIZED = () => "Unauthorized access";