3 people bb74071dc2 fix(server): throttle the cost-bearing proxies by default ...

The OpenAI endpoints (/api/realtime/token, /api/openai/hud-summary) now
allow 30 requests per minute per client IP and the Google Places endpoints
120, the caps the Pinokio build already ships. GEV_RATELIMIT_OPENAI_PER_MIN
and GEV_RATELIMIT_GOOGLE_PER_MIN still override them and exactly 0 disables
them; an unreadable value falls back to the default rather than to
unlimited.

Salvaged from #683 onto current main.

Co-authored-by: Sameh Khamis <[email protected]>
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-02 19:57:29 -07:00

..

geo.js

style: format extracted place and route modules

2026-09-11 19:57:22 -07:00

http.js

refactor: separate transit sources and request service

2026-09-15 07:41:56 -07:00

query.js

refactor: separate aircraft and vessel server providers

2026-09-11 19:06:09 -07:00

rate-limit.js

fix(server): throttle the cost-bearing proxies by default

2026-10-02 19:57:29 -07:00

request.js

fix: complete debug-log request bounds

2026-09-20 19:21:22 -07:00

same-site.js

fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP

2026-10-02 19:56:42 -07:00

source-root.js

style: format extracted local services

2026-09-12 13:01:49 -07:00