[BUG] /api/ai/roast endpoint lacks authentication and rate limiting, allowing unlimited AI API abuse

[codecrafted1]

Bug Description

The /api/ai/roast API route currently does not require an authenticated session or enforce any rate limiting. As a result, anyone can repeatedly send POST requests to this endpoint, causing unlimited invocations of the Gemini API and potentially consuming a large number of paid AI tokens.

The expected behavior is that only authenticated users should be able to access this endpoint, with appropriate per-user rate limits to prevent abuse.

Steps to Reproduce

1. Start the application or use a deployed instance.
2. Without logging in, send repeated POST requests to /api/ai/roast.

Example:

for i in {1..100000}; do
curl -X POST https:///api/ai/roast
-H "Content-Type: application/json"
-d '{"mode":"roast","stats":{"commits":1,"languages":["ts"]}}'
done
3. Observe that every request succeeds and triggers a new Gemini API call without requiring authentication or applying any rate limit.

Affected Area

Authentication / Sign-in

Screenshots

No response

Browser & OS

No response

Environment

Local Development

Additional Context

No response

[codecrafted1]

please assign this issue to me under gssoc'26

[github-actions]

Assigned to @codecrafted1! You have 7 days to open a PR. No PR after 7 days = auto-unassigned so others can pick it up. Good luck!

[PanakjtTiwari]

please assign this issue to me under gssoc'26

[github-actions]

@PanakjtTiwari This issue is already taken by @codecrafted1. Check other open issues!