fix: search rate limit now properly applies stricter limits for semantic search

src/app/api/search/route.ts

@@ -24,16 +24,28 @@ export async function GET(request: NextRequest) {
             )
         }
 
-        // Rate limit — semantic search is expensive, stricter limit
+        // Rate limit — semantic search is expensive, use a stricter key prefix
         const authUser = await getAuthUser()
         const identifier = getClientIdentifier(request, authUser?.id ?? undefined)
-        const preset = semantic ? `search-semantic:${identifier}` : `search:${identifier}`
-        const maxReqs = semantic ? 10 : 60
-        const rateLimit = await checkRateLimit(preset, !!authUser)
+        const rateLimitKey = semantic ? `search-semantic:${identifier}` : `search:${identifier}`
+        const rateLimit = await checkRateLimit(rateLimitKey, !!authUser, false)
+
         if (!rateLimit.success) {
             return NextResponse.json({ error: rateLimit.error }, { status: 429 })
         }
 
+        // For semantic search, apply a secondary per-minute burst limit
+        if (semantic) {
+            const burstKey = `search-semantic-burst:${identifier}`
+            const burstLimit = await checkRateLimit(burstKey, !!authUser, false)
+            if (!burstLimit.success) {
+                return NextResponse.json(
+                    { error: "Semantic search rate limit exceeded. Please wait a moment." },
+                    { status: 429 }
+                )
+            }
+        }
+
         // Build base query
         const whereClause: Record<string, unknown> = {
             visibility: "public",
@@ -81,7 +93,7 @@ Return ONLY a comma-separated list of terms, nothing else.`,
             }
         }
 
-        // Build OR clause for search — exclude template field (too expensive for ILIKE)
+        // Build OR clause for search
         const orClause = searchTerms.flatMap(term => [
             { title: { contains: term, mode: "insensitive" as const } },
             { description: { contains: term, mode: "insensitive" as const } },
@@ -175,7 +187,6 @@ Return ONLY a comma-separated list of terms, nothing else.`,
             hasMore: offset + prompts.length < total,
         }, {
             headers: {
-                // Short cache for search results
                 'Cache-Control': 'public, s-maxage=60, stale-while-revalidate=300',
             },
         })