introduce to gateway node rate limits in limits package

pkg/settings/cresettings/README.md

@@ -37,6 +37,12 @@ flowchart
         GatewayIncomingPayloadSizeLimit{{GatewayIncomingPayloadSizeLimit}}:::bound
 %%        TODO GatewayVaultManagementEnabled
     end
+
+    subgraph HandleNodeMessage[gatewayHandler.HandleNodeMessage]
+%%      DON nodes → gateway (separate from the inbound trigger flow)
+        GatewayHTTPGlobalRate[\GatewayHTTPGlobalRate/]:::rate
+        GatewayHTTPPerNodeRate[\GatewayHTTPPerNodeRate/]:::rate
+    end
 %%    WorkflowLimit - Deprecated
 %%    TODO unused
 %%    PerOrg.ZeroBalancePruningTimeout
@@ -181,6 +187,9 @@ flowchart
     Engine.startExecution-->ExecutionHelper.CallCapability-->actions
     Engine.startExecution-->PerWorkflow.SecretsConcurrencyLimit-->vault
 
+%%  DON nodes → gateway is a separate entry point, not connected to the trigger/execution chain above
+    HandleNodeMessage
+
     classDef bound stroke:#f00
     classDef gate stroke:#0f0
     classDef queue stroke:#00f

pkg/settings/cresettings/defaults.json

@@ -3,6 +3,8 @@
 	"WorkflowExecutionConcurrencyLimit": "200",
 	"GatewayIncomingPayloadSizeLimit": "1mb",
 	"GatewayVaultManagementEnabled": "true",
+	"GatewayHTTPGlobalRate": "500rps:500",
+	"GatewayHTTPPerNodeRate": "100rps:100",
 	"TriggerRegistrationStatusUpdateTimeout": "0s",
 	"VaultCiphertextSizeLimit": "2kb",
 	"VaultIdentifierKeySizeLimit": "64b",

pkg/settings/cresettings/defaults.toml

@@ -2,6 +2,8 @@ WorkflowLimit = '200'
 WorkflowExecutionConcurrencyLimit = '200'
 GatewayIncomingPayloadSizeLimit = '1mb'
 GatewayVaultManagementEnabled = 'true'
+GatewayHTTPGlobalRate = '500rps:500'
+GatewayHTTPPerNodeRate = '100rps:100'
 TriggerRegistrationStatusUpdateTimeout = '0s'
 VaultCiphertextSizeLimit = '2kb'
 VaultIdentifierKeySizeLimit = '64b'

pkg/settings/cresettings/settings.go

@@ -56,8 +56,9 @@ var Default = Schema{
 	WorkflowExecutionConcurrencyLimit:      Int(200),
 	GatewayIncomingPayloadSizeLimit:        Size(1 * config.MByte),
 	GatewayVaultManagementEnabled:          Bool(true),
+	GatewayHTTPGlobalRate:                  Rate(rate.Limit(500), 500),
+	GatewayHTTPPerNodeRate:                 Rate(rate.Limit(100), 100),
 	TriggerRegistrationStatusUpdateTimeout: Duration(0 * time.Second),
-
 	// DANGER(cedric): Be extremely careful changing these vault limits as they act as a default value
 	// used by the Vault OCR plugin -- changing these values could cause issues with the plugin during an image
 	// upgrade as nodes apply the old and new values inconsistently. A safe upgrade path
@@ -171,6 +172,8 @@ type Schema struct {
 	WorkflowExecutionConcurrencyLimit      Setting[int] `unit:"{workflow}"`
 	GatewayIncomingPayloadSizeLimit        Setting[config.Size]
 	GatewayVaultManagementEnabled          Setting[bool]
+	GatewayHTTPGlobalRate                  Setting[config.Rate]
+	GatewayHTTPPerNodeRate                 Setting[config.Rate]
 	TriggerRegistrationStatusUpdateTimeout Setting[time.Duration]
 
 	VaultCiphertextSizeLimit          Setting[config.Size]