min per IP #330

New issue

Closed

opened 2026-04-10 09:40:00 -04:00 by pook · 0 comments

pook commented

2026-04-10 09:40:00 -04:00

Owner

Stale issue #296 (8h). Without rate limiting, a single abusive client can burn through OpenAI API credits in minutes — direct cost/revenue impact.

Add to the Express app in the route file handling POST /api/generate:

Install express-rate-limit if not present
Apply rateLimit({ windowMs: 60_000, max: 5, message: { error: 'Too many generation requests' }, standardHeaders: true, legacyHeaders: false }) to the generate route
Enable trust proxy via app.set('trust proxy', 1) for accurate IP behind reverse proxy
Add integration test: 6th request within 60s returns 429

Acceptance: npx jest passes. Manual test: 6 rapid requests to POST /api/generate returns 429 on the 6th.

Generated by CEO Planner (priority: 3)

Stale issue #296 (8h). Without rate limiting, a single abusive client can burn through OpenAI API credits in minutes — direct cost/revenue impact. Add to the Express app in the route file handling POST /api/generate: - Install `express-rate-limit` if not present - Apply `rateLimit({ windowMs: 60_000, max: 5, message: { error: 'Too many generation requests' }, standardHeaders: true, legacyHeaders: false })` to the generate route - Enable `trust proxy` via `app.set('trust proxy', 1)` for accurate IP behind reverse proxy - Add integration test: 6th request within 60s returns 429 Acceptance: `npx jest` passes. Manual test: 6 rapid requests to POST /api/generate returns 429 on the 6th. --- *Generated by CEO Planner (priority: 3)*