v1: add rate limits

[peterdudfield]

We need to add rate limits to the v1 api.

They should be the same as uk_national ones.

Note they should all be the default, apart from the large gsp all routes which should have a rate limit of once a minute
see example here

Note we shouldnt put them on each route, but check the default is applied

Need to update the docs too, to say what these rate limits are

CHECK DEFAULT routes might already be applied

[peterdudfield]

It looks like default rate limit is already on v1 app - https://github.com/openclimatefix/quartz-api/blob/main/src/quartz_api/cmd/main.py#L173

[peterdudfield]

one-minute rate limits could be added on the forecast and generation timestamp and gsps routes

They are here and here

[peterdudfield]

@PavanRaghavendraKulkarni could you add details here about the test you did (please)

[PavanRaghavendraKulkarni]

I started by checking whether rate limiting was already in place for v1 routes. The SlowAPIMiddleware and ratelimit.limiter were registered on the parent app, and v1_app.state.limiter was already being set — so it looked correct at first glance.

To confirm, I ran 25 rapid requests against the local server with the v1 router enabled:

for i in {1..25}; do
  curl -s -o /dev/null -w "Request $i: HTTP %{http_code}\n" \
       -H "Authorization: Bearer <TOKEN>" \
       http://localhost:8000/v1/sources
done

Before the fix — all 25 returned 200 OK, no 429 triggered:

Request 1:  HTTP 200
...
Request 25: HTTP 200

Root cause:

The v1 app is mounted as a sub-application inside the parent FastAPI app via app.mount("/v1", v1_app). When a request for /v1/sources arrives at the parent app, SlowAPIMiddleware looks up the route and finds a Mount object (not an endpoint function). Since slowapi uses the endpoint function name as the rate limit key, it resolves to an empty string and silently skips rate enforcement. The parent's middleware never reaches into the sub-app's routes.

The fix:

Registered both SlowAPIMiddleware and RateLimitExceeded exception handler directly on v1_app inside _create_v1_app:

v1_app.state.limiter = ratelimit.limiter
v1_app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
v1_app.add_middleware(SlowAPIMiddleware)
v1_app.include_router(v1_mod.router)

The same shared ratelimit.limiter singleton is reused — no new limits were introduced.

After the fix — 429 correctly triggers at request 21:

Request 1:  HTTP 200
...
Request 20: HTTP 200
Request 21: HTTP 429
Request 22: HTTP 429
Request 23: HTTP 429
Request 24: HTTP 429
Request 25: HTTP 429

Server logs also confirm the slowapi warning at the 21st call:

WARNING slowapi: ratelimit 20 per 1 second (google-oauth2|...) exceeded at endpoint: quartz_api.internal.service.v1.routes.discovery.get_sources

[peterdudfield]

Noted in https://github.com/openclimatefix/client-private/issues/560