Rate limit public API endpoints

README.md

@@ -100,6 +100,9 @@ evaluates all questions against the same state. The dispatcher then:
 4. Solves a maximum-weight assignment across all teams and slots.
 5. Returns both the model's top choice and the applied assignment.
 
+The server limits all API traffic to 120 requests per minute per client. Dispatch calls
+have a separate limit of 20 requests per minute to bound paid model usage.
+
 When Jev mode is active, the browser also evaluates the local policy from the same
 snapshot. Both plans are simulated for 20 seconds with identical future incident
 arrivals. The comparison ranks outcomes in this order:

package.json

@@ -38,6 +38,7 @@
     "@typesafe-ai/sdk": "^0.6.0",
     "dotenv": "^18.0.1",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.7.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {

server/app.ts

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import express, { type NextFunction, type Request, type Response } from "express";
+import { rateLimit } from "express-rate-limit";
 import { ZodError, z } from "zod";
 import { CrisisSnapshotSchema } from "../src/shared/crisis";
 import type { ServerStatus } from "../src/shared/decision-types";
@@ -36,9 +37,28 @@ export function createApplication(options: ApplicationOptions = {}): express.Exp
       })
     : undefined;
   const app = express();
+  const apiRateLimit = rateLimit({
+    windowMs: 60_000,
+    limit: 120,
+    standardHeaders: "draft-8",
+    legacyHeaders: false,
+    message: {
+      error: "API request limit exceeded. Try again shortly.",
+    },
+  });
+  const dispatchRateLimit = rateLimit({
+    windowMs: 60_000,
+    limit: 20,
+    standardHeaders: "draft-8",
+    legacyHeaders: false,
+    message: {
+      error: "Dispatch request limit exceeded. Try again shortly.",
+    },
+  });
 
   app.disable("x-powered-by");
   app.use(express.json({ limit: "64kb" }));
+  app.use("/api", apiRateLimit);
 
   app.get("/api/status", (_request, response) => {
     const status: ServerStatus = {
@@ -64,7 +84,7 @@ export function createApplication(options: ApplicationOptions = {}): express.Exp
     }
   });
 
-  app.post("/api/dispatch", async (request, response) => {
+  app.post("/api/dispatch", dispatchRateLimit, async (request, response) => {
     const input = DispatchRequestSchema.parse(request.body);
 
     if (input.mode === "jev" && !jevClient) {

tests/api.test.ts

@@ -89,6 +89,34 @@ describe("HTTP API", () => {
       questions: 35,
     });
   });
+
+  it("rate limits dispatch requests", async () => {
+    const { rootDirectory, baseUrl } = await startTestApplication();
+    cleanupDirectories.push(rootDirectory);
+    const snapshot = createCrisisSnapshot(4, 445);
+    const request = {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        snapshot,
+        doctrine: "Protect civilians.",
+        mode: "local",
+      }),
+    };
+
+    for (let index = 0; index < 20; index += 1) {
+      const response = await fetch(`${baseUrl}/api/dispatch`, request);
+      expect(response.status).toBe(200);
+    }
+
+    const limited = await fetch(`${baseUrl}/api/dispatch`, request);
+    expect(limited.status).toBe(429);
+    await expect(limited.json()).resolves.toEqual({
+      error: "Dispatch request limit exceeded. Try again shortly.",
+    });
+  });
 });
 
 async function startTestApplication(