mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-14 22:50:51 +00:00
Marc-André Bombeck
cc34cbd03d
POST /api/consent/ai, POST /api/consent/ai/web, and GET/DELETE /api/consent/ai/latest had no rate limit, so a scripted loop or a stolen session could pin the receipts table. Add a shared per-user bucket (20/min, keyed by user id) mirroring the coach-chat ceiling, checked right after requireAuth, returning 429 with the X-RateLimit headers attached. The web heal endpoint runs on every AI-settings mount, so the bucket is generous enough to never throttle normal use.