app/api/limiter.py

from slowapi import Limiter
from slowapi.util import get_remote_address
from starlette.requests import Request

# Tier definitions — referenced by name in route decorators
# Sync analyze:  expensive full pipeline, strict limit
# Async submit:  just queues a Celery task, more generous
# Job poll:      read-only status check, very generous
# Health/metrics: unrestricted (no decorator applied)

LIMIT_SYNC_ANALYZE  = "5/minute"
LIMIT_ASYNC_SUBMIT  = "20/minute"
LIMIT_JOB_POLL     = "120/minute"


def get_rate_limit_key(request: Request) -> str:
    """Rate limit by API key if present, fall back to IP address."""
    api_key = request.headers.get("X-API-Key")
    if api_key:
        return f"key:{api_key}"
    return f"ip:{get_remote_address(request)}"


limiter = Limiter(key_func=get_rate_limit_key)