bot: apply global rate limit before AD check; admins bypass

Author: kepan1n

bot/telegram_jwt_bot.py

@@ -446,6 +446,11 @@ async def reply_invalid_access() -> None:
         await update.message.reply_text("Too many requests for this username. Try again later.")
         return
 
+    # Global rate limit (across all chat IDs) - checked before AD to protect LDAP from spam
+    if not is_admin and not _global_rate_limit_ok():
+        await update.message.reply_text("Global rate limit exceeded. Try again later.")
+        return
+
     try:
         is_enabled, in_group = await asyncio.to_thread(_is_user_enabled_and_in_group, username)
     except Exception as exc:
@@ -457,11 +462,6 @@ async def reply_invalid_access() -> None:
         await reply_invalid_access()
         return
 
-    # Global rate limit (across all chat IDs)
-    if not _global_rate_limit_ok():
-        await update.message.reply_text("Global rate limit exceeded. Try again later.")
-        return
-
     INVALID_IDENTITY_ATTEMPTS.pop(chat_id, None)
     _save_state()