Add playwright rate limiter test

app/playwright.config.ts

@@ -46,6 +46,12 @@ export default defineConfig({
       name: "webkit",
       use: { ...devices["Desktop Safari"] },
     },
+    {
+      name: "rate limit",
+      use: { ...devices["Desktop Chrome"] },
+      dependencies: ["chromium", "firefox", "webkit"],
+      testMatch: "**/*.rate-limit.spec.ts",
+    },
     /* Test against mobile viewports. */
     // {
     //   name: 'Mobile Chrome',

app/src/pages/auth/LoginForm.tsx

@@ -39,7 +39,10 @@ export function LoginForm(props: LoginFormProps) {
           body: JSON.stringify(params),
         });
         if (!response.ok) {
-          setError("Invalid login");
+          const errorMessage = response.status === 429 
+            ? "Too many requests. Please try again later." 
+            : "Invalid login";
+          setError(errorMessage);
           return;
         }
       } catch (error) {

app/tests/login.rate-limit.spec.ts

@@ -0,0 +1,17 @@
+import { expect, test } from "@playwright/test";
+
+test("that login gets rate limited after too many attempts", async ({ page }) => {
+  await page.goto("/login");
+  await page.waitForURL("**/login");
+
+  const email = `[email protected]`;
+  // Add the user
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password *", { exact: true }).fill("not-a-password");
+
+  const numberOfAttempts = 10;
+  for (let i = 0; i < numberOfAttempts; i++) {
+    await page.getByRole("button", { name: "Login" }).click();
+  }
+  await expect(page.getByText("Too many requests. Please try again later.")).toBeVisible();
+});

src/phoenix/server/api/routers/auth.py

@@ -48,7 +48,7 @@
 
 rate_limiter = ServerRateLimiter(
     per_second_rate_limit=0.2,
-    enforcement_window_seconds=30,
+    enforcement_window_seconds=60,
     partition_seconds=60,
     active_partitions=2,
 )