Create Post: AI Rate Limit

[henryajisegiri]

Context

Nothing caps how often description generation can be triggered, so a loop or a script hitting the endpoint runs up model cost.

Figma Link

---

Requirements

Enforce server-side

• Limit enforced at the endpoint, not by disabling the button. Client-side state is UX, not a control.
• Applies to both input types: body content and link.

The limit

• One limit: [20] generations per user, per day
• Resets at midnight UTC

Admin interface

• Admin-only settings screen holding the value, editable without a deploy or restart
• Changes take effect on the next request
• Validation: positive integer only
• Audit trail — who changed the value, from what to what, and when
• Current usage shown alongside it: generations so far today, and the number of users who hit the cap

Behaviour at the limit

• Message as specified below, not a generic error
• Draft content is preserved — hitting the limit must not lose what the user has written
• Manual description entry stays available; the limit applies to generation, not to the field

Copy

You've used all your description generations for today. The limit resets at midnight UTC. You can write the description yourself in the meantime — your draft is saved.

---

Logging

• Log every generation attempt: user, input type, input size, outcome
• Log limit rejections separately so the number can be tuned from real usage

---

Acceptance criteria

• A user exceeding the daily cap sees the message above, and their draft is intact
• Calling the endpoint directly, bypassing the UI, is rejected regardless of the cap
• The count resets at midnight UTC
• The limit changes from the admin screen and applies on the next request, with no deploy or restart
• An admin can see the day's generation count without leaving that screen
• A limit change is attributable — who, what value, when

---

Out of scope

• Per-hour or burst limits
• Site-wide ceiling across all users
• Queueing rejected requests for later processing
• Prompt or output quality changes — separate ticket

[henryajisegiri]

@henryajisegiri add the exceptions rule

• all superusers should be exempt.