Add rate limiting to v5 API routes

[philosophercode]

Summary

Adds IP-based rate limiting to the v5 API routes to prevent abuse of the
chat and upload endpoints.

• Ports v5/src/lib/rate-limit.ts from the v4 root implementation: an
  in-memory sliding-window limiter with an optional Upstash Redis backend
  (auto-detected from UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN),
  failing open on Redis errors, plus a getClientIp(req) helper. This is
  the canonical rate-limit util for v5.
• Adds a small entry guard at the top of each route's POST handler — before
  any Notion fetch or model call — returning 429 when the limit is exceeded.
• /api/admin/revalidate is left alone (already secret-gated).

Limits

Endpoint	Key	Limit	Window
POST /api/chat	chat:<ip>	20	60s
POST /api/upload-notion	upload:<ip>	15	60s

The 21st chat request (16th upload) from one IP within a minute gets a 429.

Env vars

Both optional, documented in v5/.env.example:

• UPSTASH_REDIS_REST_URL
• UPSTASH_REDIS_REST_TOKEN

When both are set, limits are enforced across all serverless instances via
Upstash. Without them, the limiter falls back to an in-memory store (resets on
cold start; fine for basic abuse prevention).

429 response shape:

{ "error": "Too many requests. Please slow down." }

with a Retry-After: 60 header.

Test plan

• cd v5 && npm install && npm run typecheck && npm run lint && npm run build — all pass.
• Reasoned through: the 21st /api/chat request in a minute from one IP returns 429; Upstash-absent path uses the in-memory limiter; getClientIp reads x-forwarded-for first, then x-real-ip, then "unknown".

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
makerlab-tools	Error		May 29, 2026 5:50am
makerlab-tools-g4gb	Ready	Preview, Comment	May 29, 2026 5:50am

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7388048bbe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add server-only to the v5 dependency graph

This new import is not resolvable when the v5 app is installed/built from its own manifest: v5/package.json does not list server-only, and v5/package-lock.json has no node_modules/server-only entry. Since both API routes now import this module through rate-limit.ts, a clean v5 build or deployment will fail module resolution before those routes can run; add the dependency to the v5 package/lock or avoid the import here.

Useful? React with 👍 / 👎.