Add rate limiting to POST /api/generate to prevent OpenAI cost abuse #611

New issue

Open

opened 2026-04-11 05:25:17 -04:00 by pook · 0 comments

pook commented

2026-04-11 05:25:17 -04:00

Owner

Add rate limiting middleware on POST /api/generate. Revenue-critical: every request invokes OpenAI for document generation (direct API cost), and abuse bypasses billing controls by overwhelming a single account. Implementation: 1) Install express-rate-limit if not present. 2) Create middleware: 10 requests/min per authenticated user (key: req.user?.id), 100/min global. 3) Return 429 with { error: 'Rate limit exceeded', retryAfter: }. 4) Apply only to POST /api/generate. 5) Integration test: 11 rapid requests → 429 on 11th.

Generated by CEO Planner (priority: 3)

Add rate limiting middleware on POST /api/generate. Revenue-critical: every request invokes OpenAI for document generation (direct API cost), and abuse bypasses billing controls by overwhelming a single account. Implementation: 1) Install express-rate-limit if not present. 2) Create middleware: 10 requests/min per authenticated user (key: req.user?.id), 100/min global. 3) Return 429 with { error: 'Rate limit exceeded', retryAfter: <seconds> }. 4) Apply only to POST /api/generate. 5) Integration test: 11 rapid requests → 429 on 11th. --- *Generated by CEO Planner (priority: 3)*