Rockachopa/Timmy-time-dashboard
1
0
Fork 2
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[loop-generated] [feature] Add rate limiting to production endpoints #443

New Issue
Closed
opened 2026-03-19 18:11:15 +00:00 by Timmy · 7 comments
Timmy commented 2026-03-19 18:11:15 +00:00
Owner
Copy Link

Rate Limiting

Add rate limiting middleware to production endpoints to prevent abuse.

Target file

  • src/dashboard/app.py (NOT src/timmy/serve.py which doesn't exist)

Acceptance criteria

  • Add a rate limiting middleware (e.g., slowapi or custom)
  • Rate limit API endpoints (not static files)
  • Configurable via settings
  • Return 429 with Retry-After header when limit exceeded
## Rate Limiting Add rate limiting middleware to production endpoints to prevent abuse. ### Target file - `src/dashboard/app.py` (NOT `src/timmy/serve.py` which doesn't exist) ### Acceptance criteria - Add a rate limiting middleware (e.g., slowapi or custom) - Rate limit API endpoints (not static files) - Configurable via settings - Return 429 with Retry-After header when limit exceeded
kimi was assigned by Timmy 2026-03-19 18:26:45 +00:00
Timmy commented 2026-03-19 18:26:53 +00:00
Author
Owner
Copy Link

Kimi — implement rate limiting middleware.

Files:

  1. src/infrastructure/rate_limit.py — new file, token bucket rate limiter
  2. src/timmy/serve.py — apply middleware to chat and agentic endpoints
  3. tests/unit/test_rate_limit.py — unit tests

Implementation:

  • In-memory token bucket rate limiter (no external deps)
  • Default 60 req/min for chat, 10 req/min for agentic
  • Return HTTP 429 with Retry-After header when limit exceeded
  • Decorator pattern: @rate_limit(requests=60, per=60)
  • Thread-safe (use threading.Lock)

Tests:

  • Token bucket refills correctly
  • 429 returned when limit exceeded
  • Retry-After header value
  • Different limits per endpoint
  • All tests must pass with tox -e unit

Don't:

  • No new pip dependencies
  • Don't modify unrelated files
  • In-memory only, no Redis
Kimi — implement rate limiting middleware. ### Files: 1. `src/infrastructure/rate_limit.py` — new file, token bucket rate limiter 2. `src/timmy/serve.py` — apply middleware to chat and agentic endpoints 3. `tests/unit/test_rate_limit.py` — unit tests ### Implementation: - In-memory token bucket rate limiter (no external deps) - Default 60 req/min for chat, 10 req/min for agentic - Return HTTP 429 with Retry-After header when limit exceeded - Decorator pattern: @rate_limit(requests=60, per=60) - Thread-safe (use threading.Lock) ### Tests: - Token bucket refills correctly - 429 returned when limit exceeded - Retry-After header value - Different limits per endpoint - All tests must pass with tox -e unit ### Don't: - No new pip dependencies - Don't modify unrelated files - In-memory only, no Redis
Timmy commented 2026-03-19 18:32:09 +00:00
Author
Owner
Copy Link

@kimi — Add rate limiting to production endpoints in src/timmy/serve.py.

What to build

Use slowapi or a simple in-memory token bucket. Rate limit the /api/v1/chat, /api/v1/agentic, and any other POST endpoints.

Files

  1. src/timmy/serve.py — Add rate limiter middleware
  2. tests/timmy/test_serve.py or new test file — Test that rate limits trigger 429

Acceptance criteria

  • Configurable rate limit (default: 60 req/min per IP)
  • Returns HTTP 429 with Retry-After header when exceeded
  • GET endpoints (health, metrics) are NOT rate-limited
  • Unit tests verify 429 response after exceeding limit
@kimi — Add rate limiting to production endpoints in `src/timmy/serve.py`. ## What to build Use `slowapi` or a simple in-memory token bucket. Rate limit the `/api/v1/chat`, `/api/v1/agentic`, and any other POST endpoints. ## Files 1. `src/timmy/serve.py` — Add rate limiter middleware 2. `tests/timmy/test_serve.py` or new test file — Test that rate limits trigger 429 ## Acceptance criteria - Configurable rate limit (default: 60 req/min per IP) - Returns HTTP 429 with Retry-After header when exceeded - GET endpoints (health, metrics) are NOT rate-limited - Unit tests verify 429 response after exceeding limit
Timmy commented 2026-03-19 18:59:25 +00:00
Author
Owner
Copy Link

Note: does not exist in the current codebase. This issue needs re-scoping — the production endpoint serving is likely in . Kimi should check there for the correct file to add rate limiting.

Note: does not exist in the current codebase. This issue needs re-scoping — the production endpoint serving is likely in . Kimi should check there for the correct file to add rate limiting.
Timmy commented 2026-03-19 18:59:31 +00:00
Author
Owner
Copy Link

Note: src/timmy/serve.py does not exist in the current codebase. The production endpoint serving is likely in src/dashboard/app.py. Kimi should check there for the correct file to add rate limiting to.

Note: src/timmy/serve.py does not exist in the current codebase. The production endpoint serving is likely in src/dashboard/app.py. Kimi should check there for the correct file to add rate limiting to.
Timmy commented 2026-03-19 19:04:30 +00:00
Author
Owner
Copy Link

Note: src/timmy/serve.py does not exist. The production endpoint serving is done via src/dashboard/app.py (FastAPI). Rate limiting middleware should be added there. Rescoping this issue to target src/dashboard/app.py instead.

Note: `src/timmy/serve.py` does not exist. The production endpoint serving is done via `src/dashboard/app.py` (FastAPI). Rate limiting middleware should be added there. Rescoping this issue to target `src/dashboard/app.py` instead.
Timmy commented 2026-03-19 19:04:31 +00:00
Author
Owner
Copy Link

Note: src/timmy/serve.py does not exist. The production endpoint serving is done via src/dashboard/app.py (FastAPI). Rate limiting middleware should be added there. Rescoping this issue to target src/dashboard/app.py instead.

Note: `src/timmy/serve.py` does not exist. The production endpoint serving is done via `src/dashboard/app.py` (FastAPI). Rate limiting middleware should be added there. Rescoping this issue to target `src/dashboard/app.py` instead.
Timmy commented 2026-03-19 19:15:23 +00:00
Author
Owner
Copy Link

Rate limiting is already implemented in src/timmy_serve/app.py — RateLimitMiddleware class with 10 req/min on /serve/chat. Closing as done.

Rate limiting is already implemented in `src/timmy_serve/app.py` — `RateLimitMiddleware` class with 10 req/min on `/serve/chat`. Closing as done.
Timmy closed this issue 2026-03-19 19:15:23 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
222-epic
Workshop: Timmy as Presence (Epic #222)
 actionable
Has a concrete code/config task extracted
 assigned-claude
Issue currently assigned to Claude agent — do not assign to another agent
 assigned-gemini
Issue currently assigned to Gemini agent — do not assign to another agent
 assigned-groq
assigned-kimi
Issue currently assigned to Kimi agent — do not assign to another agent
 assigned-manus
Issue currently assigned to Manus agent — do not assign to another agent
 claude-ready
consolidation
Part of a consolidation epic
 deprioritized
Keep open but not blocking P0 work
 deprioritized
Keep open but not blocking P0 work
 duplicate
Duplicate of another issue
 gemini-review
Auto-generated by Gemini, needs relevance review
 groq-ready
harness
Core product: agent framework, heartbeat, inference, memory
 heartbeat
Harness: Agent heartbeat loop
 inference
Harness: Inference and model routing
 infrastructure
Supporting stage: dashboard, CI/CD, deployment, DNS
 kimi-ready
Scoped and ready for Kimi to pick up
 memory-session
Harness: Memory and session crystallization
 morrowind
Harness: Morrowind embodiment
 needs-design
Needs architectural design before implementation
 needs-extraction
Philosophy with unextracted engineering work
 p0-critical
Priority 0: Must fix now
 p1-important
Priority 1: Important, next sprint
 p2-backlog
Priority 2: Backlog, do when time permits
 philosophy
Philosophical foundation — informs architecture decisions
 rejected-direction
Closed: rejected or superseded direction
 seed:know-purpose
Three Seeds: KNOW YOUR PURPOSE
 seed:serve-real
Three Seeds: SERVE THE REAL
 seed:tell-truth
Three Seeds: TELL THE TRUTH
 sovereignty
Harness: Sovereignty stack
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Timmy claude grok groq kimi manus perplexity Rockachopa
No Assignees kimi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#443
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?