[App - Virtual Tutor] Rate limiting

[iarandrd]

Can't send more than 4000 requests. The chatbot will refuse to answer.

[Jenspetersen99]

Acceptance Criteria for Rate Limiting

1. Request Threshold

• The rate limiter should allow a maximum of 5 requests per 10 second time period for each client, and a 100 per hour.

2. Blocked Responses

• If a client exceeds the request threshold:
  • The API should return an error with a message Too Many Requests.
  • The response should include a Retry-After header indicating when the client can send the next request.

3. Critical Endpoints Coverage

• The rate limiting should be applied to the following endpoint:
  • /api/ai/

    4. IP-Based Limiting

• The rate limiter should track usage based on the client’s IP address.

5. Graceful Handling

• Legitimate users should not experience blocking under normal use.

8. Performance Impact

• Rate limiting should not degrade the API’s overall performance or introduce significant latency.