fix(deploy): add rate limiting to Vercel deploy endpoint to match Netlify route

[Xenon010101]

What changed

Added per-user rate limiting to the Vercel deploy endpoint, matching the existing rate limit on the Netlify deploy endpoint.

Closes #517

Why

The Netlify deploy route (app/api/deploy/netlify/route.ts line 14) enforces rateLimit(deploy-netlify:..., 5, 60_000) — max 5 deploys per minute per user. The Vercel deploy route (app/api/deploy/vercel/route.ts) has no rate limiting at all. Both endpoints make external API calls using shared credentials (the VERCEL_MASTER_TOKEN fallback), so a single user or bot could send unlimited deploy requests and exhaust the Vercel account's deployment quota.

Fix

Added import { rateLimit } from "@/lib/api-utils" and the same rateLimit() call pattern used in the Netlify route. Also tightened the auth check from session?.user to session?.user?.id to match the Netlify route's guard, since the rate limit key requires a user ID.

Verification

• npm run lint — 0 errors
• npm test — 112/112 tests pass
• npm run build — builds successfully

[coderabbitai]

Warning

Review limit reached

@Xenon010101, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 18 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b14b9bc8-5c76-445e-b63f-3a3d2629a108

📥 Commits

Reviewing files that changed from the base of the PR and between 4ffe26f and 52ee16c.

📒 Files selected for processing (1)

• app/api/deploy/vercel/route.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

👋 Thanks for opening a PR, @Xenon010101!

Your PR has entered the 🚦 PR Review Pipeline.

⚪ Standard PR detected — your PR will follow the standard review pipeline.

---

What happens next

Stage	Reviewer	Checks
Stage 1 — Automated Validation	🤖 Bot	DCO · Format · AI/Slop · Duplicate
Stage 2 — Human Review	👥 Maintainer	Code + Quality Review
Stage 3 — PA / Maintainer Review	🔑 Project Admin	Final Merge Decision

A pipeline status comment will appear below and update automatically as your PR progresses.

---

While you wait

• Sign all commits (git commit -s)
• Link your issue (Closes #123)
• Use a feature branch (not main)
• Avoid unrelated changes

This comment is posted only once.

[qodo-code-review]

PR Summary by Qodo

Add per-user rate limiting to Vercel deploy API endpoint

🐞 Bug fix 🕐 10-20 Minutes

AI Description

• Enforce 5 deploys/minute per user on the Vercel deploy endpoint to prevent quota abuse.
• Align Vercel route auth guard to require a user id for rate-limit keying.
• Return 429 responses with Retry-After and X-RateLimit-* headers when exceeded.

Diagram

graph TD
  C([Client]) --> R["app/api/deploy/vercel/route.ts"] --> A["auth()"] --> D{"Has user id?"}
  D -- "no" --> U["401 Unauthorized"]
  D -- "yes" --> L["rateLimit(deploy-vercel:{userId}, 5/60s)"] --> OK{"Allowed?"}
  OK -- "no" --> RL["429 Rate limited"]
  OK -- "yes" --> V{{"Vercel Deployments API"}} --> Resp["200 Deploy response"]
  L -. "optional backend" .-> Redis[("Upstash Redis")]
  subgraph Legend
    direction LR
    _svc["API/Function"] ~~~ _dec{"Decision"} ~~~ _db[("Database")] ~~~ _ext{{"External"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Shared deploy middleware/helper for Netlify + Vercel

• ➕ Eliminates drift between deploy endpoints (auth guard, limit values, headers)
• ➕ Makes it easy to apply consistent behavior to future deploy providers
• ➖ Small upfront refactor and another abstraction to maintain
• ➖ Might be overkill if deploy endpoints remain few and stable

2. Route-group level middleware rate limiting (/api/deploy/*)

• ➕ Centralizes protection for all deploy endpoints automatically
• ➕ Reduces chance of missing rate limits on new deploy routes
• ➖ Harder to customize per-provider limits/keys without extra wiring
• ➖ Middleware constraints may complicate access to session/user id depending on auth setup

Recommendation: Current approach (copying the established Netlify pattern into the Vercel route) is appropriate and low-risk for closing the immediate abuse vector. If more deploy providers or deploy routes are expected, consider a shared helper/middleware next to keep auth + rate-limiting behavior consistent across all deploy endpoints.

Files changed (1) +18 / -1

Bug fix (1) +18 / -1

route.tsAdd per-user rate limiting and tighten auth guard +18/-1

Add per-user rate limiting and tighten auth guard

• Requires an authenticated session with a user id, then applies a 5-per-minute per-user rate limit before calling the Vercel deployments API. Returns a 429 response with Retry-After and X-RateLimit-* headers when the limit is exceeded.

app/api/deploy/vercel/route.ts

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review