fix(ai): require auth, rate limit and credits on AI endpoints (#69)

app/api/ai/chat/explain/route.ts

@@ -1,7 +1,7 @@
 export const dynamic = "force-dynamic"
 
 import { NextRequest, NextResponse } from "next/server"
-import { getUser } from "@/lib/auth-server"
+import { requireAiAccess } from "@/lib/ai-guard"
 import { generateAlternateExplanation, EXPLAIN_STYLE_LABELS, type ExplainStyle } from "@/lib/ai"
 import { logUsage } from "@/lib/database"
 import { getSupabaseAdmin } from "@/lib/supabase-server"
@@ -10,6 +10,10 @@ const VALID_STYLES: ExplainStyle[] = ["simpler", "analogy", "step-by-step", "rea
 
 export async function POST(req: NextRequest) {
   try {
+    const guard = await requireAiAccess()
+    if (guard.error) return guard.error
+    const { user } = guard
+
     const body = await req.json().catch(() => null)
     const question = typeof body?.question === "string" ? body.question.trim() : ""
     const previousAnswer = typeof body?.previousAnswer === "string" ? body.previousAnswer.trim() : ""
@@ -30,9 +34,7 @@ export async function POST(req: NextRequest) {
     const explanation = await generateAlternateExplanation(question, previousAnswer, style)
     const reply = `> **Explained differently — ${EXPLAIN_STYLE_LABELS[style]}**\n\n${explanation}`
 
-    const user = await getUser()
-
-    if (user && sessionId) {
+    if (sessionId) {
       const admin = await getSupabaseAdmin()
       const now = new Date().toISOString()
 

app/api/ai/chat/route.ts

@@ -1,7 +1,7 @@
 export const dynamic = "force-dynamic";
 
 import { NextRequest, NextResponse } from "next/server";
-import { getUser } from "@/lib/auth-server";
+import { requireAiAccess } from "@/lib/ai-guard";
 import { generateAIResponse } from "@/lib/ai";
 import { logUsage } from "@/lib/database";
 import { getSupabaseAdmin } from "@/lib/supabase-server";
@@ -43,6 +43,10 @@ function formatReplyWithSources(reply: string, sources: ResourceLink[]) {
 
 export async function POST(req: NextRequest) {
   try {
+    const guard = await requireAiAccess();
+    if (guard.error) return guard.error;
+    const { user } = guard;
+
     const body = await req.json();
     const message = body.message;
     const sessionId = body.sessionId as string | undefined;
@@ -108,10 +112,9 @@ export async function POST(req: NextRequest) {
 
     const finalReply = formatReplyWithSources(aiResponse, sources);
 
-    const user = await getUser();
     let savedSessionId: string | null = null;
 
-    if (user) {
+    {
       const admin = await getSupabaseAdmin();
       let currentSessionId = sessionId;
 

app/api/ai/image/route.ts

@@ -1,10 +1,14 @@
 export const dynamic = "force-dynamic"
 
 import { NextRequest, NextResponse } from "next/server"
+import { requireAiAccess } from "@/lib/ai-guard"
 import { generateImageWithGemini } from "@/lib/ai-tools"
 
 export async function POST(req: NextRequest) {
   try {
+    const guard = await requireAiAccess()
+    if (guard.error) return guard.error
+
     const { prompt } = await req.json()
 
     if (!prompt || typeof prompt !== "string" || prompt.trim().length === 0) {

app/api/ai/notes/route.ts

@@ -2,6 +2,7 @@ export const dynamic = "force-dynamic"
 
 import { NextRequest, NextResponse } from "next/server"
 import { getUser } from "@/lib/auth-server"
+import { requireAiAccess } from "@/lib/ai-guard"
 import {
   analyzeAttachmentsWithGemini,
   searchWithTavily,
@@ -195,6 +196,10 @@ export async function GET() {
 
 export async function POST(req: NextRequest) {
   try {
+    const guard = await requireAiAccess()
+    if (guard.error) return guard.error
+    const { user } = guard
+
     const body = await req.json()
 
     const sourceMode = body?.sourceMode as SourceMode
@@ -255,7 +260,6 @@ export async function POST(req: NextRequest) {
       studyMaterial,
     })
 
-    const user = await getUser()
     let savedNote = null
     let saveWarning: string | null = null
 

app/api/ai/transcribe/route.ts

@@ -1,11 +1,15 @@
 export const dynamic = "force-dynamic"
 
 import { NextRequest, NextResponse } from "next/server"
+import { requireAiAccess } from "@/lib/ai-guard"
 
 const GROQ_TRANSCRIPTION_URL = "https://api.groq.com/openai/v1/audio/transcriptions"
 
 export async function POST(req: NextRequest) {
   try {
+    const guard = await requireAiAccess()
+    if (guard.error) return guard.error
+
     const apiKey = process.env.GROQ_API_KEY
 
     if (!apiKey) {

lib/ai-guard.ts

@@ -0,0 +1,67 @@
+import { NextResponse } from "next/server"
+import type { User } from "@supabase/supabase-js"
+import { getUser } from "@/lib/auth-server"
+import { rateLimit } from "@/lib/rate-limit"
+import { consumeCredit } from "@/lib/credits"
+import type { FeatureKey } from "@/types"
+
+type GuardSuccess = { user: User; error?: never }
+type GuardFailure = { user?: never; error: NextResponse }
+
+/**
+ * Guards paid AI-generation endpoints against cost abuse.
+ *
+ * Runs three checks in order, BEFORE any external AI API is called:
+ *   1. Authentication  -> 401 for anonymous requests
+ *   2. Rate limiting    -> 429 when the per-user burst limit is exceeded
+ *   3. Credit consumption -> 402 when the user is out of credits
+ *
+ * On success it returns the authenticated user. On failure it returns a
+ * ready-to-return NextResponse so callers can simply do:
+ *
+ *   const guard = await requireAiAccess()
+ *   if (guard.error) return guard.error
+ *   const { user } = guard
+ */
+export async function requireAiAccess(
+  feature: FeatureKey = "ai_chat",
+  options: { consume?: boolean } = {}
+): Promise<GuardSuccess | GuardFailure> {
+  const user = await getUser()
+
+  if (!user) {
+    return {
+      error: NextResponse.json(
+        { error: "Login required to use this feature.", code: "UNAUTHORIZED", requiresLogin: true },
+        { status: 401 }
+      ),
+    }
+  }
+
+  if (!rateLimit(user.id)) {
+    return {
+      error: NextResponse.json(
+        { error: "Too many requests. Please wait a minute and try again.", code: "RATE_LIMITED" },
+        { status: 429 }
+      ),
+    }
+  }
+
+  if (options.consume !== false) {
+    const credit = await consumeCredit(user.id, feature)
+    if (!credit.allowed) {
+      return {
+        error: NextResponse.json(
+          {
+            error: "You've run out of AI credits. Upgrade your plan or wait for your credits to refresh.",
+            code: "NO_CREDITS",
+            requiresUpgrade: true,
+          },
+          { status: 402 }
+        ),
+      }
+    }
+  }
+
+  return { user }
+}