Caluru

openai-proxy rate limiting

The Edge Function enforces a per-user, per-hour request cap using the openai_rate_limit table and increment_openai_usage() RPC (migration 20250219000000_openai_rate_limit.sql).

openai_rate_limit has RLS enabled with no client policies (intentional lockout). The proxy never queries the table directly; only the SECURITY DEFINER RPC may read/write it. See Docs/BACKEND.md → Intentional RLS lockout.

Defaults

Setting	Default	Where to change
Hourly limit	50 requests / user / UTC hour	Edge Function secret OPENAI_HOURLY_LIMIT
Retry window	3600 seconds	Returned as Retry-After on HTTP 429

Behavior

1. Authenticated user calls openai-proxy with a valid Supabase JWT.
2. Function calls increment_openai_usage(p_limit) with the user’s JWT (RPC uses auth.uid()).
3. RPC upserts the current UTC hour bucket and returns true if under the limit.
4. When over limit, the function returns 429 with Retry-After: 3600.

Changing the limit

# Supabase Dashboard → Edge Functions → openai-proxy → Secrets
OPENAI_HOURLY_LIMIT=100

Or via CLI after linking the project:

supabase secrets set OPENAI_HOURLY_LIMIT=100

Verify migration is applied

select to_regclass('public.openai_rate_limit');
select proname from pg_proc where proname = 'increment_openai_usage';

Both should return a row in the Caluru project (opxqcnxiqbitezragpch).