List of mentions runs into API rate limit

Description:

When opening the list of mentions for a channel, the frontend fetches all mentions via REST API in chunks of 50 items. In case the number of mentions exceeds a certain limit (around 500), these requests will fail and no mentions will be shown.

Steps to reproduce:

You will need a user without the "Bypass rate limit for REST API" permission who has more than 500 mentions in a channel.

1. Log into Rocket.Chat and navigate to the channel.
2. Click the @ symbol to view the user's mentions for that channel.

Expected behavior:

A list of mentions is shown.

Actual behavior:

Nothing is shown.

Server Setup Information:

• Version of Rocket.Chat Server: 6.6.1
• Deployment Method: Docker
• Number of Running Instances: 1
• MongoDB Version: 6.0.13

Client Setup Information

The issue is client-agnostic; I just verified it using:

• Desktop App or Browser Version:
  • Electron client 3.9.14
  • Firefox 123.0 (64-bit)
  • Google Chrome Version 122.0.6261.95 (Offizieller Build) (64-Bit)
• Operating System: Windows 10

Additional context

In Chrome's DevTools, the issue looks like this:

When the first HTTP 429 error is returned from the backend, the frontend takes no further action. The payload of the 429 error looks like this:

{"success":false,"error":"Error, too many requests. Please slow down. You must wait 60 seconds before trying this endpoint again. [error-too-many-requests]"}

When giving the user the "Bypass rate limit for REST API" permission, the mentions will be loaded and shown. Chrome's DevTools then look like this:

Actually I don't think it makes sense to load all mentions since the dawn of civilization.

Start at the frontend channel mention list and the REST requests that fetch mentions in chunks of 50; inspect how the first HTTP 429 response is handled. Done means users with more than 500 mentions can open the list without it failing at the rate limit, with appropriate loading behavior for the available results.