feat(query): per-user rate limiting (#14)

* feat(query): add in-memory sliding window rate limiter

* feat(query): apply rate limit to the query endpoint

* test(query): verify 429 rate limit and per-user isolation

app/rate_limit.py

@@ -0,0 +1,33 @@
+import time
+from collections import defaultdict, deque
+from fastapi import Depends
+from uuid import UUID
+from app.models import User
+from app.deps import get_current_user
+from app.errors import AppError
+
+# Dictionary mapping user_id -> deque of timestamps
+_hits: dict[UUID, deque] = defaultdict(deque)
+
+def check_query_rate(current_user: User = Depends(get_current_user)) -> None:
+    """Sliding window rate limiter: 10 queries per 60 seconds per user."""
+    limit = 10
+    window = 60
+    user_id = current_user.id
+    
+    now = time.monotonic()
+    q = _hits[user_id]
+    
+    # Remove timestamps older than the window
+    while q and now - q[0] > window:
+        q.popleft()
+        
+    if len(q) >= limit:
+        raise AppError(
+            429, 
+            "RATE_LIMITED", 
+            f"At most {limit} queries per {window} seconds.",
+            headers={"Retry-After": str(window)}
+        )
+        
+    q.append(now)

app/routers/hubs.py

@@ -19,6 +19,7 @@ from app.services.embeddings import embed_texts
 from app.services.gemini import hub_insights, answer_question, expand_query
 from app.services.observability import log_ai_call
 from app.config import settings
+from app.rate_limit import check_query_rate
 
 router = APIRouter(prefix="/hubs", tags=["hubs"])
 
@@ -148,7 +149,8 @@ def query_hub(
     hub_id: UUID,
     req: QueryRequest,
     current_user: User = Depends(get_current_user),
-    db: Session = Depends(get_db)
+    db: Session = Depends(get_db),
+    _rate_limit: None = Depends(check_query_rate)
 ):
     hub = repo.get_hub_for_owner(db, hub_id, current_user.id)
     if not hub:

tests/test_rate_limit.py

@@ -0,0 +1,42 @@
+import pytest
+from uuid import uuid4
+from unittest.mock import patch
+from app.rate_limit import _hits
+
+def test_query_rate_limit(client, db_session):
+    # Clear the in-memory rate limit dictionary between tests
+    _hits.clear()
+    
+    client.post("/api/v1/auth/signup", json={"email": "ratelimit@test.com", "password": "Password123"})
+    token = client.post("/api/v1/auth/login", json={"email": "ratelimit@test.com", "password": "Password123"}).json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    
+    hub_res = client.post("/api/v1/hubs", headers={**headers, "X-Idempotency-Key": str(uuid4())}, json={"name": "Rate Limit Hub"})
+    hub_id = hub_res.json()["id"]
+
+    # We mock the AI to be fast so we can make 10 rapid requests
+    with patch("app.routers.hubs.expand_query", return_value=[]), \
+         patch("app.routers.hubs.embed_texts", return_value=[[0.1]*768]), \
+         patch("app.routers.hubs.answer_question", return_value={"answer": "Test", "evidence": None, "grounded": False}):
+        
+        # Make 10 successful queries
+        for _ in range(10):
+            res = client.post(f"/api/v1/hubs/{hub_id}/query", headers=headers, json={"question": "Test query?"})
+            assert res.status_code == 200
+
+        # The 11th query should be rate limited
+        res_11 = client.post(f"/api/v1/hubs/{hub_id}/query", headers=headers, json={"question": "Test query?"})
+        assert res_11.status_code == 429
+        assert res_11.json()["error"]["code"] == "RATE_LIMITED"
+        assert "Retry-After" in res_11.headers
+
+    # A different user should not be rate limited (per-user isolation)
+    client.post("/api/v1/auth/signup", json={"email": "ratelimit2@test.com", "password": "Password123"})
+    token2 = client.post("/api/v1/auth/login", json={"email": "ratelimit2@test.com", "password": "Password123"}).json()["access_token"]
+    
+    with patch("app.routers.hubs.expand_query", return_value=[]), \
+         patch("app.routers.hubs.embed_texts", return_value=[[0.1]*768]), \
+         patch("app.routers.hubs.answer_question", return_value={"answer": "Test", "evidence": None, "grounded": False}):
+         
+        res_other = client.post(f"/api/v1/hubs/{hub_id}/query", headers={"Authorization": f"Bearer {token2}"}, json={"question": "Test query?"})
+        assert res_other.status_code == 404 # Because User 2 doesn't own Hub 1