Fix: secure paid Groq API route and enforce rate limits #163 - #214
Merged
Premshaw23 merged 1 commit intoMay 21, 2026
Merged
Conversation
Contributor
|
@omnipotentchaos is attempting to deploy a commit to the Prem Shaw's projects Team on Vercel. A member of the Team first needs to authorize it. |
Premshaw23
approved these changes
May 20, 2026
Premshaw23
added
good first issue
Contributor
There was a problem hiding this comment.
Pull request overview
This PR secures the paid /api/groq Next.js route by enforcing Firebase authentication and adding a per-user rate limit, with a new Jest suite to validate key security/abuse-prevention behaviors.
Changes:
- Require a Firebase ID token (via
verifyFirebaseToken) for/api/groqrequests and return401when unauthenticated. - Add a sliding-window, per-user rate limiter (10 requests/min) returning
429when exceeded. - Add a Jest test suite for auth/validation/rate-limiting behavior of the route.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
app/api/groq/route.js |
Adds Firebase auth enforcement, in-memory per-user rate limiting, and audit logging for the paid Groq endpoint. |
components/_tests_/groqRoute.test.js |
Introduces Jest coverage for the /api/groq route’s auth, validation, rate limiting, and success path. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+34
to
+41
| const authorization = request.headers.get("authorization"); | ||
| const token = authorization?.split(" ")[1]; | ||
|
|
||
| const decodedToken = await verifyFirebaseToken(token); | ||
|
|
||
| if (!decodedToken) { | ||
| return jsonError("Unauthorized", 401); | ||
| } |
Comment on lines
+8
to
+29
| const RATE_LIMIT_WINDOW = 60 * 1000; // 1 minute | ||
| const MAX_REQUESTS_PER_WINDOW = 10; // max 10 requests per minute | ||
| const rateLimitMap = new Map(); | ||
|
|
||
| const isRateLimited = (userId) => { | ||
| const now = Date.now(); | ||
| if (!rateLimitMap.has(userId)) { | ||
| rateLimitMap.set(userId, [now]); | ||
| return false; | ||
| } | ||
|
|
||
| const timestamps = rateLimitMap.get(userId); | ||
| const validTimestamps = timestamps.filter((t) => now - t < RATE_LIMIT_WINDOW); | ||
|
|
||
| if (validTimestamps.length >= MAX_REQUESTS_PER_WINDOW) { | ||
| rateLimitMap.set(userId, validTimestamps); | ||
| return true; | ||
| } | ||
|
|
||
| validTimestamps.push(now); | ||
| rateLimitMap.set(userId, validTimestamps); | ||
| return false; |
| } | ||
|
|
||
| // Usage logging with user ID for audit/quota tracking | ||
| console.log(`[nova-ai-quota-tracker] Paid Groq API request by User UID: ${decodedToken.uid} (${decodedToken.email}) at ${new Date().toISOString()}`); |
Comment on lines
+22
to
+26
| describe("POST /api/groq - Paid API Security, Authentication, and Rate Limiting Tests", () => { | ||
| beforeEach(() => { | ||
| jest.clearAllMocks(); | ||
| process.env.GROQ_API_KEY = "mock-groq-key"; | ||
| }); |
omnipotentchaos
force-pushed
the
feature/secure-groq-api
branch
from
May 20, 2026 19:09
4edf3c5 to
0179c8c
Compare
Owner
|
There is merge conflict fix it |
Owner
|
Sync to the live repo |
omnipotentchaos
force-pushed
the
feature/secure-groq-api
branch
from
May 20, 2026 20:00
0179c8c to
db38d40
Compare
Owner
|
done👍 |
github-actions
Bot
added
GSSoC'26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
Description
Secures the paid
/api/groqendpoint by introducing authentication middleware, input length constraints, server-side per-user rate limiting, and detailed usage logging to prevent quota abuse and billing spikes.Related Issues
Closes #163
Changes Made
/api/groq/route.jsto parse theAuthorizationheader and authenticate the requests with Firebase Admin SDK (verifyFirebaseToken).10 requests per minutereturning429 Too Many Requestsupon limit violation.2000characters.Testing
How did you test these changes?
npm test- all 46 tests across 5 suites pass successfully)npm run buildTest Suite Output