No AI Rate Limiting

// BAD: no rate limiting on AI endpoint
export async function POST(req: Request) {
  const { message } = await req.json();
  // Anyone authenticated can call this unlimited times
  const response = await openai.chat.completions.create({ messages: [{ role: 'user', content: message }] });
  return Response.json({ result: response.choices[0].message.content });
}

// GOOD: enforce per-user rate limits before calling the AI
export async function POST(req: Request) {
  const user = await getAuthUser(req);
  const usage = await getUserAiUsage(user.id); // check Redis/DB counter
  if (usage.requestsThisHour > 20) {
    return Response.json({ error: 'Rate limit exceeded' }, { status: 429 });
  }
  await incrementAiUsage(user.id);
  const response = await openai.chat.completions.create({ messages: [{ role: 'user', content: message }] });
  return Response.json({ result: response.choices[0].message.content });
}