feat: add API rate limiting to protect against request abuse#451
Open
Arijit429 wants to merge 9 commits intofireform-core:mainfrom
Open
feat: add API rate limiting to protect against request abuse#451Arijit429 wants to merge 9 commits intofireform-core:mainfrom
Arijit429 wants to merge 9 commits intofireform-core:mainfrom
Conversation
- Add HTTPException handler for consistent error shape across all routes
- Add RequestValidationError handler with human-readable error messages
- Add catch-all Exception handler to prevent stack trace leakage
- Fix duplicate get_template() call in forms.py (was querying DB twice)
- Wrap Controller errors in AppError for safe client-facing messages
- All errors now return uniform {success, error: {code, message}} envelope
…file - Add GET /health liveness probe for Docker and container orchestration - Migrate database init from module-level to FastAPI lifespan context manager - Fix Dockerfile: start uvicorn server instead of tail -f /dev/null - Fix Dockerfile: correct PYTHONPATH from /app/src to /app - Add Docker HEALTHCHECK directive using /health endpoint - Add EXPOSE 8000 for container port documentation - Add FastAPI metadata (title, description, version) for API docs
- Enforce 20 MB max upload size (returns 413 if exceeded) - Validate PDF magic bytes to reject non-PDF files renamed to .pdf - Reject empty file uploads with clear 400 error - Add matching client-side size and empty file checks for instant UX feedback - Server-side validation is the security authority, client checks are UX only
- Add 120s timeout to prevent indefinite request hangs - Add retry logic (3 attempts) with exponential backoff (2s, 4s, 8s) - Retry on timeouts, connection errors, and 5xx server errors - Do not retry on 4xx client errors (permanent failures) - Extract _call_ollama() method for testability - Replace print() statements with structured logging - Add per-field logging for extraction debugging
…itization - Add min_length=1 and max_length=50000 to input_text field - Add whitespace-only rejection via field_validator - Auto-strip leading/trailing whitespace from input before LLM - Add template name validation (min 1, max 200 chars) - Add pdf_path minimum length validation - Fix deprecated class Config to model_config in both schema files - Prevents empty prompts and oversized payloads reaching LLM pipeline
- Run pytest on every push to main and every pull request - Run ruff linter for Python code quality checks - Cache pip dependencies for faster CI runs - Set PYTHONPATH for correct module resolution - Two parallel jobs: test and lint
…utc) Closes fireform-core#444 - Replace datetime.utcnow() in models.py default_factory - Replace datetime.utcnow() in templates.py timestamp generation - Fixes DeprecationWarning visible in pytest output on Python 3.12+
Closes fireform-core#442 - Add slowapi-based rate limiting middleware - Limit /forms/fill to 20 requests/minute per client IP - Return uniform 429 response matching ErrorResponse schema - Register rate limiter in app startup - Prevents DoS via repeated LLM extraction requests
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #442
Closes #272
Summary
Adds rate limiting middleware using slowapi to protect API endpoints
from abuse and denial-of-service via repeated requests.
Problem
The API has no rate limiting. A single client can send unlimited
requests per second to
/forms/fill, which:Changes
api/middleware/rate_limiter.py(NEW)Limiterinstance using client IP as keyregister_rate_limiter()to attach middleware and error handlerErrorResponseschemaapi/main.pyapi/routes/forms.py@limiter.limit("20/minute")to/forms/fillendpointRequestparameter for IP-based limitingTesting
Changes Summary
api/middleware/rate_limiter.pyapi/main.pyapi/routes/forms.py