general rate limit for all endpoints

src/api/dependencies/clients.py

@@ -43,7 +43,6 @@ def get_redis_client() -> RedisClient:
 
 @lru_cache()
 def get_reranker_client() -> RerankerClient | None:
-    """Get reranker client if enabled."""
     if not settings.reranker_enabled:
         return None
     return RerankerClient(model_name=settings.reranker_model)

src/api/dependencies/rate_limit.py

@@ -29,19 +29,25 @@ async def ip_identifier(request: Request) -> str:
     return f"ip:{ip}"
 
 anonymous_rag_rate_limiter = RateLimiter(
-    times=7 if settings.env == "production" else 100,  
+    times=10 if settings.env == "production" else 100,  
     seconds=3600,  
     identifier=ip_identifier
 )
 
 authenticated_rag_rate_limiter = RateLimiter(
-    times=15 if settings.env == "production" else 100,  
+    times=25 if settings.env == "production" else 100,  
     seconds=3600,  
     identifier=user_id_identifier
 )
 
 login_rate_limiter = RateLimiter(
-    times=10,
+    times=25,
     seconds=300,
     identifier=ip_identifier
+)
+
+general_rate_limiter = RateLimiter(
+    times=100,
+    seconds=3600,
+    identifier=user_id_identifier
 )

src/api/routers/auth.py

@@ -12,6 +12,7 @@ from src.api.selectors.user.add_user import add_user
 from src.api.models.user import User
 from src.api.schemas.auth import RegisterRequest, LoginRequest, TokenResponse
 import redis.asyncio as redis
+from src.api.dependencies.rate_limit import login_rate_limiter
 
 
 router = APIRouter(
@@ -19,7 +20,7 @@ router = APIRouter(
     tags=["auth"]
 )
 
-@router.post("/register", response_model=TokenResponse)
+@router.post("/register", response_model=TokenResponse, dependencies=[Depends(login_rate_limiter)])
 async def register(
     request: RegisterRequest,
     auth_service: Annotated[AuthService, Depends(get_auth_service)],
@@ -43,7 +44,7 @@ async def register(
 
     return TokenResponse(access_token=access_token)
     
-@router.post("/login", response_model=TokenResponse)
+@router.post("/login", response_model=TokenResponse, dependencies=[Depends(login_rate_limiter)])
 async def login(
     request: LoginRequest,
     auth_service: Annotated[AuthService, Depends(get_auth_service)],
@@ -68,7 +69,7 @@ async def login(
     access_token = auth_service.create_access_token(data={"sub": user.email})
     return TokenResponse(access_token=access_token)
 
-@router.post("/token", response_model=TokenResponse, include_in_schema=False)
+@router.post("/token", response_model=TokenResponse, include_in_schema=False, dependencies=[Depends(login_rate_limiter)])
 async def login_for_swagger(
     form_data: Annotated[OAuth2PasswordRequestForm, Depends()],
     db: Annotated[AsyncSession, Depends(get_db)],

src/api/routers/sessions.py

@@ -10,6 +10,7 @@ from src.api.schemas.session import ChatSessionList, ChatMessageRead
 from src.api.services.chat_history_service import ChatHistoryService
 from llama_index.core.llms import MessageRole
 import uuid
+from src.api.dependencies.rate_limit import general_rate_limiter
 
 router = APIRouter(
     prefix="/api/v1",
@@ -24,7 +25,7 @@ def _llama_role_to_chat_role(role: MessageRole) -> ChatMessageRole:
     }
     return mapping.get(role, ChatMessageRole.USER)
 
-@router.get("/sessions", response_model=List[ChatSessionList])
+@router.get("/sessions", response_model=List[ChatSessionList], dependencies=[Depends(general_rate_limiter)])
 async def list_sessions(
     user: Annotated[User, Depends(get_current_user_required)],
     db: Annotated[AsyncSession, Depends(get_db)],
@@ -38,7 +39,7 @@ async def list_sessions(
         offset=offset
     )
 
-@router.get("/sessions/{session_id}/messages", response_model=List[ChatMessageRead])
+@router.get("/sessions/{session_id}/messages", response_model=List[ChatMessageRead], dependencies=[Depends(general_rate_limiter)])
 async def get_messages(
     session_id: uuid.UUID,
     chat_history_service: Annotated[ChatHistoryService, Depends(get_chat_history_service)],
@@ -58,7 +59,7 @@ async def get_messages(
         for msg in messages
     ]
 
-@router.delete("/sessions/{session_id}")
+@router.delete("/sessions/{session_id}", dependencies=[Depends(general_rate_limiter)])
 async def delete_session(
     session_id: uuid.UUID,
     chat_history_service: Annotated[ChatHistoryService, Depends(get_chat_history_service)],

src/api/routers/user.py

@@ -3,12 +3,13 @@ from src.api.dependencies.auth import get_current_user_required
 from src.api.models.user import User
 from src.api.schemas.user import UserRead
 from typing import Annotated
+from src.api.dependencies.rate_limit import general_rate_limiter
 
 router = APIRouter(
     prefix="/api/v1/user",
     tags=["user"],
 )
-@router.get("/me", response_model=UserRead)
+@router.get("/me", response_model=UserRead, dependencies=[Depends(general_rate_limiter)])
 async def get_me(
     user: Annotated[User, Depends(get_current_user_required)],
 ):