backend/app/core/limiter.py

import os
from slowapi import Limiter
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded

# Initialize Limiter
# Use in-memory storage for local dev (Redis for production)
redis_url = os.getenv("REDIS_URL")

# For local testing without Redis, use memory storage
if redis_url and redis_url.strip():
    try:
        import redis
        r = redis.from_url(redis_url)
        r.ping()  # Test connection
        storage_uri = redis_url
    except Exception:
        # Redis not available, fall back to memory
        storage_uri = "memory://"
else:
    storage_uri = "memory://"

limiter = Limiter(
    key_func=get_remote_address,
    storage_uri=storage_uri,
    default_limits=["60/minute"]  # Global limit: 60 req/min per IP
)