completion-kit 0.5.28 → 0.5.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5b7b1f667eb85b17d7ae6302671129a1e68821bffd1a83f667a7336776f5927
-  data.tar.gz: 2f0e3642574d60e69a466bf0fe097c3287a104ba2a049c33afa6462a83dccaf2
+  metadata.gz: f1c4a2e5c9305e6f54a09266a8e7896231c6518dbe576a76c1f0d3db6511f18f
+  data.tar.gz: 1127b9f555ef7ef483302522cfb9039ec9d274cfa32aff2789301562ea0d1043
 SHA512:
-  metadata.gz: 19bc73fa1f422a5bee002c10681966fa263fe8a69f8928bb48d9630d53feca65721cbc81b3b3415c4dac9d60dc67a616dde7ac1d5e3154b2aa136b73e25a7077
-  data.tar.gz: 5ba36b81ebc2a7df4421423dc8614c624c73f8dde0477bf4a579e914a36ed7c36821840f8c2aed963eb04a50cf840db14119a81a794a251576026731648e49d8
+  metadata.gz: 3e6018c3d6d44ae68d64646f4d7272013f065203c765c68444800fd9b528b137582a4b4c6872a1b3e33325ab66a1dc5f67dd59536185320f602bc9875be8c101
+  data.tar.gz: 856868da4c6d9aa78fbf3b0a0d7ead23065c3f4b50970aed1056849650f9cffe1e62e01ddaeca2e595e2cc2837c67f077f5e3fd1820f74348cc4fd23d3dffaa1

data/README.md

@@ -111,7 +111,7 @@ Or add them to `config/credentials.yml.enc` under `active_record_encryption`. In
 
 ## Authentication
 
-CompletionKit requires authentication in production. In development, routes are open by default (with a log warning).
+CompletionKit requires authentication in any deployed environment. In development and test, routes are open by default (with a log warning); every other environment returns 403 until auth is configured.
 
 ### Basic Auth (recommended for simple setups)
 
@@ -132,6 +132,19 @@ end
 
 Only one mode can be active.
 
+## Rate limiting
+
+The REST API, the MCP endpoint, and the web UI are rate limited per IP, per minute. The defaults are generous; tune them in the initializer:
+
+```ruby
+CompletionKit.configure do |c|
+  c.api_rate_limit = 120  # REST API + MCP, requests per minute (default 120)
+  c.web_rate_limit = 300  # web UI, requests per minute (default 300)
+end
+```
+
+Limiting uses `Rails.cache`. A shared cache store (Solid Cache, Redis) throttles accurately across multiple app instances; a per-process store still throttles each instance independently.
+
 ## How it works
 
 1. **Create a prompt** with `{{variable}}` placeholders

data/app/controllers/completion_kit/api/v1/base_controller.rb

@@ -2,6 +2,8 @@ module CompletionKit
   module Api
     module V1
       class BaseController < ActionController::API
+        rate_limit to: CompletionKit.config.api_rate_limit, within: 1.minute,
+                   with: -> { render json: {error: "Rate limit exceeded"}, status: :too_many_requests }
         before_action :authenticate_api!
 
         private

data/app/controllers/completion_kit/application_controller.rb

@@ -3,6 +3,8 @@ module CompletionKit
     helper Heroicons::IconsHelper
     layout "completion_kit/application"
 
+    rate_limit to: CompletionKit.config.web_rate_limit, within: 1.minute,
+               with: -> { render plain: "Rate limit exceeded. Please slow down.", status: :too_many_requests }
     before_action :authenticate_completion_kit!
 
     private

data/lib/completion_kit/version.rb

@@ -1,3 +1,3 @@
 module CompletionKit
-  VERSION = "0.5.28"
+  VERSION = "0.5.29"
 end

data/lib/completion_kit.rb

@@ -10,6 +10,7 @@ module CompletionKit
     attr_accessor :username, :password, :auth_strategy, :api_token
     attr_accessor :tenant_scope, :tenant_scope_columns
     attr_accessor :api_reference_authentication_partial
+    attr_accessor :api_rate_limit, :web_rate_limit
 
     def initialize
       @openai_api_key = ENV['OPENAI_API_KEY']
@@ -21,6 +22,9 @@ module CompletionKit
       @high_quality_threshold = 4
       @medium_quality_threshold = 3
 
+      @api_rate_limit = 120
+      @web_rate_limit = 300
+
       @api_reference_authentication_partial = "completion_kit/api_reference/authentication"
     end
 

data/lib/generators/completion_kit/templates/initializer.rb

@@ -44,4 +44,10 @@ CompletionKit.configure do |config|
   # Web UI Authentication
   # config.username = "admin"
   # config.password = ENV['COMPLETION_KIT_PASSWORD']
+
+  # Rate limiting (requests per minute, per IP)
+  # The REST API and MCP endpoint share api_rate_limit; the web UI uses
+  # web_rate_limit. Both are enforced through Rails.cache.
+  # config.api_rate_limit = 120
+  # config.web_rate_limit = 300
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: completion-kit
 version: !ruby/object:Gem::Version
-  version: 0.5.28
+  version: 0.5.29
 platform: ruby
 authors:
 - Damien Bastin