No rate limiting at TTS server level — unprotected against burst requests

[hman38705]

Labels: tts, security, reliability

Priority: Medium

Description

services/tts/src/server.ts does not configure any rate limiting middleware. Burst requests to the TTS service can exhaust provider API quota or the job queue, causing failures for legitimate users.

Acceptance Criteria

• Add express-rate-limit middleware with configurable TTS_RATE_LIMIT_PER_MINUTE (default 60)
• Add IP-based rate limiting for anonymous callers and API-key-based limits for authenticated callers
• Return 429 with a Retry-After header when the limit is exceeded
• Add a test verifying the rate limit fires on the N+1 request

[Micheal-Blessed]

@Micheal-Blessed has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I will love to work on this issue. I work effectively and on time.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Micheal-Blessed to this issue.

[Grace-CODE-D]

@Grace-CODE-D has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Grace-CODE-D to this issue.

[drips-wave]

Congratulations, @Grace-CODE-D! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @Grace-CODE-D: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊