Rate Limiting Implementation

This project uses database-backed rate limiting via the usage_tracking table.

Current Implementation

Located in app/api/generate-image/route.ts:

• Limit: 2 premium images per user per 24 hours
• Identification: SHA-256 hash of IP + User-Agent (anonymous)
• Reset: Automatic after 24 hours

Instructions

1. Create user identifier (anonymous hash):

typescript
1const getUserIdentifier = async (req: NextRequest): Promise<string> => {
2  const ip = req.headers.get('x-forwarded-for')?.split(',')[0]
3    || req.headers.get('x-real-ip')
4    || 'unknown';
5  const userAgent = req.headers.get('user-agent') || 'unknown';
6
7  const encoder = new TextEncoder();
8  const data = encoder.encode(ip + userAgent);
9  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
10  const hashArray = Array.from(new Uint8Array(hashBuffer));
11  return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
12};

2. Check and update usage:

typescript
1import { db, usageTracking } from '@/db';
2import { eq } from 'drizzle-orm';
3
4const checkUsage = async (identifier: string, limit: number) => {
5  const existing = await db
6    .select()
7    .from(usageTracking)
8    .where(eq(usageTracking.userIdentifier, identifier))
9    .limit(1);
10
11  let usage = existing[0] || null;
12  const now = new Date();
13  const resetNeeded = !usage ||
14    now.getTime() - new Date(usage.lastResetAt!).getTime() > 24 * 60 * 60 * 1000;
15
16  if (!usage) {
17    const [inserted] = await db
18      .insert(usageTracking)
19      .values({ userIdentifier: identifier, premiumImagesCount: 0, lastResetAt: now })
20      .returning();
21    usage = inserted;
22  } else if (resetNeeded) {
23    const [updated] = await db
24      .update(usageTracking)
25      .set({ premiumImagesCount: 0, lastResetAt: now, updatedAt: now })
26      .where(eq(usageTracking.userIdentifier, identifier))
27      .returning();
28    usage = updated;
29  }
30
31  const withinLimit = (usage?.premiumImagesCount || 0) < limit;
32  return { withinLimit, usage };
33};

3. Increment counter after successful action:

typescript
1await db
2  .update(usageTracking)
3  .set({
4    premiumImagesCount: (usage?.premiumImagesCount || 0) + 1,
5    updatedAt: new Date(),
6  })
7  .where(eq(usageTracking.userIdentifier, userIdentifier));

4. Return appropriate response when limited:

typescript
1if (!withinLimit) {
2  return NextResponse.json(
3    { error: 'Rate limit exceeded. Try again in 24 hours.' },
4    { status: 429, headers: corsHeaders }
5  );
6}

For New Rate-Limited Features

If tracking a different resource, add a new column to usage_tracking or create a new table:

typescript
1// In db/schema.ts
2featureCount: integer('feature_count').default(0),

Examples

• "Limit roasts to 5 per day" → Add roastCount column, apply pattern above
• "Add API request throttling" → Create new tracking table for general requests

Guardrails

• Never expose user identifiers in responses
• Log usage counts, not full hashes
• Use 429 status code for rate limit responses
• Include reset time info in rate limit responses when possible
• Test reset logic carefully (24-hour boundary)