[NSOC] [GSSoC] Added Rate Limiting + Bot/Abuse Protections

[Aditya8369]

Pull Request

NSOC and GSSoC

Description

Implemented: rate limiting + abuse protections on sensitive endpoints, with per-IP + per user/session + per endpoint keying, and added targeted tests.

What I changed

1. Core limiter hardening in backend app

• Added composite limiter keying logic in app.py:
  • IP component
  • user identity (JWT) when available, otherwise session-cookie hint, otherwise anon
  • endpoint name/path component
• Added centralized 429 handler wired to Flask-Limiter breach handling so responses include Retry-After through existing rate-limit response utility.
• Registered limiter and rate-limit error handler on both app instances present in app.py, including limiter.init_app for the later app instance in that file.

2. Sensitive endpoint limits

• Auth flows set to 5 per 10 seconds:
  • register, login in app.py
• AI/cost-sensitive endpoints set to 10 per minute:
  • analyze-mood, mood-tags, mood-search, category-books, generate-note, chat in app.py
• Library/purchase-link/alert write-like and abuse-prone endpoints set to 20 per minute:
  • add-to-library, library sync, create price alert, purchase-links in app.py
• Scraping-like exposed endpoint set to 30 per minute:
  • /api/books in app.py

3. Test coverage added

• Added test_rate_limiting.py with:
  • login burst limit test verifying 429 and Retry-After
  • purchase-links burst limit test verifying 429 and Retry-After

Validation status

• Static diagnostics:
  • No syntax/editor errors in app.py
  • No syntax/editor errors in test_rate_limiting.py
• Runtime tests:
  • I attempted to run the new pytest file, but execution was blocked by missing runtime dependencies in the current venv during collection (first flask-limiter, then flask_migrate). I started dependency installation in the venv, but full backend dependency install is large and was not completed/verified in this run.

Notes

• This repository currently has two app definitions in app.py. I intentionally registered limiter/error handling for both so protections apply regardless of which app object is active.

Related Issue

Fixes #800

Type of Change

• Bug Fix
• Feature
• Enhancement
• Documentation

Checklist

• Code follows guidelines
• Tested properly
• Docs updated
• PR title includes the relevant event tag or a general contribution label

Example:
[NSoC'26] Add authentication system

[netlify]

✅ Deploy Preview for bibliodrift-dm ready!

Name	Link
🔨 Latest commit	7353b7b
🔍 Latest deploy log	https://app.netlify.com/projects/bibliodrift-dm/deploys/6a1116138bce54000846e7a0
😎 Deploy Preview	https://deploy-preview-841--bibliodrift-dm.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Aditya8369]

@devanshi14malhotra consider my PRs under both NSOC and GSSoC

[Aditya8369]

@devanshi14malhotra solved the merge conflicts, pr is ready to merge

[Aditya8369]

@devanshi14malhotra please add gssoc:approved also