fix: Add rate limiting to AI endpoints

Author: yogayataverma

app.py

@@ -4,6 +4,8 @@
 from flask import Flask, request, jsonify
 from flask_cors import CORS
 from ai_service import generate_book_note, get_ai_recommendations, get_book_mood_tags_safe
+import time
+from collections import defaultdict, deque
 
 # Try to import enhanced mood analysis
 try:
@@ -16,13 +18,43 @@
 app = Flask(__name__)
 CORS(app)
 
+
+RATE_LIMIT_WINDOW_SECONDS = 60
+RATE_LIMIT_REQUESTS = 30
+_request_log = defaultdict(deque)
+
+
+def _check_rate_limit():
+    """Return a 429 response if the client exceeded the rate limit."""
+    client_id = request.remote_addr or "unknown"
+    now = time.time()
+    entries = _request_log[client_id]
+
+    while entries and now - entries[0] > RATE_LIMIT_WINDOW_SECONDS:
+        entries.popleft()
+
+    if len(entries) >= RATE_LIMIT_REQUESTS:
+        retry_after = int(RATE_LIMIT_WINDOW_SECONDS - (now - entries[0])) + 1
+        response = jsonify({
+            "success": False,
+            "error": "Rate limit exceeded. Please try again soon."
+        })
+        return response, 429, {"Retry-After": str(retry_after)}
+
+    entries.append(now)
+    return None
+
 # Initialize AI service if available
 if MOOD_ANALYSIS_AVAILABLE:
     ai_service = AIBookService()
 
 @app.route('/api/v1/analyze-mood', methods=['POST'])
 def handle_analyze_mood():
     """Analyze book mood using GoodReads reviews."""
+    limited = _check_rate_limit()
+    if limited:
+        return limited
+
     if not MOOD_ANALYSIS_AVAILABLE:
         return jsonify({
             "success": False,
@@ -62,6 +94,10 @@ def handle_analyze_mood():
 @app.route('/api/v1/mood-tags', methods=['POST'])
 def handle_mood_tags():
     """Get mood tags for a book."""
+    limited = _check_rate_limit()
+    if limited:
+        return limited
+
     try:
         data = request.get_json()
         if not data:
@@ -88,6 +124,10 @@ def handle_mood_tags():
 @app.route('/api/v1/mood-search', methods=['POST'])
 def handle_mood_search():
     """Search for books based on mood/vibe."""
+    limited = _check_rate_limit()
+    if limited:
+        return limited
+
     try:
         data = request.get_json()
         if not data:
@@ -114,6 +154,10 @@ def handle_mood_search():
 @app.route('/api/v1/generate-note', methods=['POST'])
 def handle_generate_note():
     """Generate AI-powered book note with optional mood analysis."""
+    limited = _check_rate_limit()
+    if limited:
+        return limited
+
     try:
         data = request.get_json()
         if not data: