fix(chat): add ip-based rate limiting to prevent session rotation abuse

app/(chat)/api/chat/route.ts

@@ -1,4 +1,5 @@
-import { geolocation } from "@vercel/functions";
+import { checkBotId } from "botid/server";
+import { geolocation, ipAddress } from "@vercel/functions";
 import {
   convertToModelMessages,
   createUIMessageStream,
@@ -31,6 +32,7 @@ import {
 } from "@/lib/db/queries";
 import type { DBMessage } from "@/lib/db/schema";
 import { ChatbotError } from "@/lib/errors";
+import { checkIpRateLimit } from "@/lib/ratelimit";
 import type { ChatMessage } from "@/lib/types";
 import { convertToUIMessages, generateUUID } from "@/lib/utils";
 import { generateTitleFromUserMessage } from "../../actions";
@@ -62,12 +64,18 @@ export async function POST(request: Request) {
     const { id, message, messages, selectedChatModel, selectedVisibilityType } =
       requestBody;
 
-    const session = await auth();
+    const [botResult, session] = await Promise.all([checkBotId(), auth()]);
+
+    if (botResult.isBot) {
+      return new ChatbotError("unauthorized:chat").toResponse();
+    }
 
     if (!session?.user) {
       return new ChatbotError("unauthorized:chat").toResponse();
     }
 
+    await checkIpRateLimit(ipAddress(request));
+
     const userType: UserType = session.user.type;
 
     const messageCount = await getMessageCountByUserId({

instrumentation-client.ts

@@ -0,0 +1,10 @@
+import { initBotId } from "botid/client/core";
+
+initBotId({
+  protect: [
+    {
+      path: "/api/chat",
+      method: "POST",
+    },
+  ],
+});

lib/ai/entitlements.ts

@@ -9,14 +9,14 @@ export const entitlementsByUserType: Record<UserType, Entitlements> = {
    * For users without an account
    */
   guest: {
-    maxMessagesPerDay: 20,
+    maxMessagesPerDay: 10,
   },
 
   /*
    * For users with an account
    */
   regular: {
-    maxMessagesPerDay: 50,
+    maxMessagesPerDay: 10,
   },
 
   /*

lib/ratelimit.ts

@@ -0,0 +1,42 @@
+import { createClient } from "redis";
+
+import { isProductionEnvironment } from "@/lib/constants";
+import { ChatbotError } from "@/lib/errors";
+
+const MAX_MESSAGES_PER_DAY = 10;
+const TTL_SECONDS = 60 * 60 * 24;
+
+let client: ReturnType<typeof createClient> | null = null;
+
+function getClient() {
+  if (!client && process.env.REDIS_URL) {
+    client = createClient({ url: process.env.REDIS_URL });
+    client.on("error", () => {});
+    client.connect().catch(() => {
+      client = null;
+    });
+  }
+  return client;
+}
+
+export async function checkIpRateLimit(ip: string | undefined) {
+  if (!isProductionEnvironment || !ip) return;
+
+  const redis = getClient();
+  if (!redis?.isReady) return;
+
+  try {
+    const key = `ip-rate-limit:${ip}`;
+    const [count] = await redis
+      .multi()
+      .incr(key)
+      .expire(key, TTL_SECONDS, "NX")
+      .exec();
+
+    if (typeof count === "number" && count > MAX_MESSAGES_PER_DAY) {
+      throw new ChatbotError("rate_limit:chat");
+    }
+  } catch (error) {
+    if (error instanceof ChatbotError) throw error;
+  }
+}

next.config.ts

@@ -1,4 +1,5 @@
 import type { NextConfig } from "next";
+import { withBotId } from "botid/next/config";
 
 const basePath = "/demo";
 
@@ -23,4 +24,4 @@ const nextConfig: NextConfig = {
   },
 };
 
-export default nextConfig;
+export default withBotId(nextConfig);

package.json

@@ -49,6 +49,7 @@
     "@xyflow/react": "^12.10.0",
     "ai": "6.0.37",
     "bcrypt-ts": "^5.0.2",
+    "botid": "1.5.6",
     "class-variance-authority": "^0.7.1",
     "classnames": "^2.5.1",
     "clsx": "^2.1.1",