rate limits for demo (#695)

examples/demo/app/api/browse/route.ts

@@ -1,17 +1,29 @@
 import { NextRequest, NextResponse } from "next/server";
 import * as ab from "@/lib/agent-browser";
+import { ALLOWED_URLS } from "@/lib/constants";
+import { minuteRateLimit, dailyRateLimit } from "@/lib/rate-limit";
 
-/**
- * POST /api/browse
- *
- * Programmatic API route for browser automation.
- * Uses @sparticuz/chromium + puppeteer-core directly in the function.
- *
- * Body: { "action": "screenshot", "url": "https://example.com" }
- * Or:   { "action": "snapshot", "url": "https://example.com" }
- */
 export async function POST(req: NextRequest) {
   try {
+    const ip =
+      req.headers.get("x-forwarded-for")?.split(",")[0] ?? "anonymous";
+
+    const minute = await minuteRateLimit.limit(ip);
+    if (!minute.success) {
+      return NextResponse.json(
+        { error: "Too many requests. Please wait a moment before trying again." },
+        { status: 429 },
+      );
+    }
+
+    const daily = await dailyRateLimit.limit(ip);
+    if (!daily.success) {
+      return NextResponse.json(
+        { error: "Daily limit reached. Please try again tomorrow." },
+        { status: 429 },
+      );
+    }
+
     const body = await req.json();
     const url = body.url;
 
@@ -19,6 +31,10 @@ export async function POST(req: NextRequest) {
       return NextResponse.json({ error: "Provide a 'url'" }, { status: 400 });
     }
 
+    if (!(ALLOWED_URLS as readonly string[]).includes(url)) {
+      return NextResponse.json({ error: "URL not allowed" }, { status: 400 });
+    }
+
     if (body.action === "screenshot") {
       const result = await ab.screenshotUrl(url, {
         fullPage: body.fullPage,