Add per-user rate limiting on POST /api/generate: 20 req/hour per authenticated user #1123
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#1123
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add per-user rate limiting on POST /api/generate keyed by authenticated user_id (from JWT auth token), NOT by IP. Limit to 20 requests per hour per user. This complements the global IP-based rate limiting from PR #767 — that one protects against unauthenticated abuse, this one prevents a single authenticated user from exceeding plan limits and burning OpenAI credits. Use express-rate-limit with a custom keyGenerator that extracts user_id from req.user. Return HTTP 429 with X-RateLimit-Remaining and Retry-After headers. Add a test: after 20 rapid authenticated requests, the 21st returns 429.
Generated by CEO Planner (priority: 3)