fix: implement rate limiting for analysis endpoints to prevent abuse

app/routes/analyze.py

@@ -8,8 +8,9 @@ from __future__ import annotations
 
 import time
 import uuid
+from collections import defaultdict
 from typing import Optional, List, Dict, Any, Literal
-from fastapi import APIRouter, File, UploadFile, Form
+from fastapi import APIRouter, File, UploadFile, Form, Request, Depends, HTTPException, status
 from pydantic import BaseModel, Field
 
 from ..services.youtube_analysis import YouTubeAnalysisService
@@ -18,6 +19,34 @@ from ..services.logging_config import get_logger
 
 router = APIRouter()
 logger = get_logger(__name__)
+
+# Rate limiter for public heavy endpoints
+_analyze_rate_store: dict[str, list[float]] = defaultdict(list)
+_ANALYZE_RATE_WINDOW = 60  # seconds
+_ANALYZE_RATE_MAX = 20  # requests per minute per IP
+_ANALYZE_MAX_IPS = 10_000
+
+
+async def _analyze_rate_limit(request: Request) -> None:
+    """Rate limit for analysis endpoints."""
+    client_ip = request.client.host if request.client else "unknown"
+    now = time.time()
+    cutoff = now - _ANALYZE_RATE_WINDOW
+
+    # Evict stale IPs when map grows large
+    if len(_analyze_rate_store) > _ANALYZE_MAX_IPS:
+        stale = [ip for ip, ts in _analyze_rate_store.items() if all(t <= cutoff for t in ts)]
+        for ip in stale:
+            del _analyze_rate_store[ip]
+
+    hits = [t for t in _analyze_rate_store[client_ip] if t > cutoff]
+    if len(hits) >= _ANALYZE_RATE_MAX:
+        raise HTTPException(
+            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            detail={"code": "rate_limit_exceeded", "message": "Too many analysis requests. Please wait before trying again."}
+        )
+    hits.append(now)
+    _analyze_rate_store[client_ip] = hits
 youtube_service = YouTubeAnalysisService()
 preview_model = PreviewModel()
 
@@ -66,7 +95,7 @@ class AnalyzeResponse(BaseModel):
     errors: List[str] = Field(default_factory=list)
 
 
-@router.post("/api/analyze", response_model=AnalyzeResponse)
+@router.post("/api/analyze", response_model=AnalyzeResponse, dependencies=[Depends(_analyze_rate_limit)])
 async def analyze(
     sourceType: str = Form(...),
     url: Optional[str] = Form(None),