Estimated Effort: 4 weeks / 5 days
Impacted Subsystems / Files:
middleware.ts
lib/rate-limit.ts
app/api/forge-agent/route.ts
app/api/faucet/route.ts
Context & Problem Statement: None of the 47 API routes in PHASE enforce rate limiting. Expensive endpoints like /api/forge-agent (which calls Google Gemini and Nano Banana APIs) and /api/faucet (which executes testnet token transfers) are vulnerable to automated denial-of-wallet and API key quota exhaustion attacks.
Technical Requirements & Scope:
Build an edge-compatible sliding window rate limiter in lib/rate-limit.ts using memory or Redis.
Apply global rate limits in middleware.ts (e.g. 100 req/min per IP).
Enforce strict per-wallet throttling on /api/forge-agent (max 5 requests/min) and /api/faucet (max 3 claims/hour).
Return HTTP 429 Too Many Requests with standardized Retry-After headers and narrative error JSON.
Multi-File Change Surface: Adds root middleware.ts, lib/rate-limit.ts, and updates error response handlers in app/api/forge-agent/route.ts, app/api/faucet/route.ts, and app/api/narrator/route.ts.
Acceptance Criteria:
[ ] Excessive requests triggered via script receive HTTP 429 response instantly.
[ ] Rate limit state overhead stays under 1ms per incoming request.
[ ] Legitimate users experience zero false positives during normal Chamber usage.
Suggested Approach / Investigation Steps:
Benchmark endpoint execution costs and define tier policy per route.
Implement memory sliding window algorithm handling IP and Wallet keys.
Hook rate limiter into Next.js middleware pipeline.
Validate HTTP 429 header compliance and UI error toast handling.
Estimated Effort: 4 weeks / 5 days
Impacted Subsystems / Files:
middleware.ts
lib/rate-limit.ts
app/api/forge-agent/route.ts
app/api/faucet/route.ts
Context & Problem Statement: None of the 47 API routes in PHASE enforce rate limiting. Expensive endpoints like /api/forge-agent (which calls Google Gemini and Nano Banana APIs) and /api/faucet (which executes testnet token transfers) are vulnerable to automated denial-of-wallet and API key quota exhaustion attacks.
Technical Requirements & Scope:
Build an edge-compatible sliding window rate limiter in lib/rate-limit.ts using memory or Redis.
Apply global rate limits in middleware.ts (e.g. 100 req/min per IP).
Enforce strict per-wallet throttling on /api/forge-agent (max 5 requests/min) and /api/faucet (max 3 claims/hour).
Return HTTP 429 Too Many Requests with standardized Retry-After headers and narrative error JSON.
Multi-File Change Surface: Adds root middleware.ts, lib/rate-limit.ts, and updates error response handlers in app/api/forge-agent/route.ts, app/api/faucet/route.ts, and app/api/narrator/route.ts.
Acceptance Criteria:
[ ] Excessive requests triggered via script receive HTTP 429 response instantly.
[ ] Rate limit state overhead stays under 1ms per incoming request.
[ ] Legitimate users experience zero false positives during normal Chamber usage.
Suggested Approach / Investigation Steps:
Benchmark endpoint execution costs and define tier policy per route.
Implement memory sliding window algorithm handling IP and Wallet keys.
Hook rate limiter into Next.js middleware pipeline.
Validate HTTP 429 header compliance and UI error toast handling.