From 5dd683fa0acbf713e833217aea7db05bc763224d Mon Sep 17 00:00:00 2001
From: Riley Martine <rmartine@integralads.com>
Date: Thu, 12 Feb 2026 03:24:24 -0700
Subject: [PATCH] Export `createRateLimitMiddleware` from
 `@backstage/backend-defaults/httpRouter` (#32789)

When attempting to follow the directions in the [docs to customize the HTTP router](https://backstage.io/docs/backend-system/core-services/http-router/#configuring-the-service), I found that I could not follow them because `createRateLimitMiddleware` was not exported as the code suggested it should be. This patch exports it.

Signed-off-by: Riley Martine <rmartine@integralads.com>
Co-authored-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
---
 .changeset/open-cameras-smoke.md                    |  5 +++++
 packages/backend-defaults/report-httpRouter.api.md  |  6 ++++++
 .../httpRouter/http/createRateLimitMiddleware.ts    | 13 +++++++++----
 .../src/entrypoints/httpRouter/http/index.ts        |  1 +
 4 files changed, 21 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/open-cameras-smoke.md

diff --git a/.changeset/open-cameras-smoke.md b/.changeset/open-cameras-smoke.md
new file mode 100644
index 0000000000..f174e806ed
--- /dev/null
+++ b/.changeset/open-cameras-smoke.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+`createRateLimitMiddleware` is now exported from `@backstage/backend-defaults/httpRouter`
diff --git a/packages/backend-defaults/report-httpRouter.api.md b/packages/backend-defaults/report-httpRouter.api.md
index 484d71325e..e486b975c9 100644
--- a/packages/backend-defaults/report-httpRouter.api.md
+++ b/packages/backend-defaults/report-httpRouter.api.md
@@ -39,6 +39,12 @@ export function createLifecycleMiddleware(
   options: LifecycleMiddlewareOptions,
 ): RequestHandler;
 
+// @public
+export const createRateLimitMiddleware: (options: {
+  pluginId: string;
+  config: RootConfigService;
+}) => RequestHandler;
+
 // @public
 export const httpRouterServiceFactory: ServiceFactory<
   HttpRouterService,
diff --git a/packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts b/packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts
index b139b212d2..eada510e5f 100644
--- a/packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts
+++ b/packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts
@@ -13,15 +13,20 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { NextFunction, Request, Response } from 'express';
+import { NextFunction, Request, Response, RequestHandler } from 'express';
 import { RateLimitStoreFactory } from '../../../lib/RateLimitStoreFactory.ts';
-import { Config } from '@backstage/config';
+import { RootConfigService } from '@backstage/backend-plugin-api';
+
 import { rateLimitMiddleware } from '../../../lib/rateLimitMiddleware.ts';
 
+/**
+ * @public
+ * Creates a middleware that applies rate limiting to requests based on the provided configuration.
+ */
 export const createRateLimitMiddleware = (options: {
   pluginId: string;
-  config: Config;
-}) => {
+  config: RootConfigService;
+}): RequestHandler => {
   const { pluginId, config } = options;
   const configKey = `backend.rateLimit.plugin.${pluginId}`;
   const enabled = config.has(configKey);
diff --git a/packages/backend-defaults/src/entrypoints/httpRouter/http/index.ts b/packages/backend-defaults/src/entrypoints/httpRouter/http/index.ts
index d31ea74fe8..b4ead1df97 100644
--- a/packages/backend-defaults/src/entrypoints/httpRouter/http/index.ts
+++ b/packages/backend-defaults/src/entrypoints/httpRouter/http/index.ts
@@ -18,3 +18,4 @@ export { createCredentialsBarrier } from './createCredentialsBarrier';
 export { createLifecycleMiddleware } from './createLifecycleMiddleware';
 export type { LifecycleMiddlewareOptions } from './createLifecycleMiddleware';
 export { createCookieAuthRefreshMiddleware } from './createCookieAuthRefreshMiddleware';
+export { createRateLimitMiddleware } from './createRateLimitMiddleware';