Rate Limit Guard Middleware

[veeqtoh]

Is your middleware request related to a problem? Please describe.

The Laravel AI SDK has no per-user, per-agent, or per-IP rate limiting at the middleware layer. In production, this exposes applications to abuse, accidental loops, and runaway costs.

Proposed solution

A RateLimitGuard middleware that leverages Laravel's RateLimiter facade to enforce configurable limits before the prompt reaches the provider.

API Design

public function middleware(): array
{
    return [
        new RateLimitGuard(
            limiter: 'ai-agent', // key in RateLimiter
            maxAttempts: 10,
            decayMinutes: 1,
            keyResolver: fn ($request) => Auth::id() ?? $request->ip(),
            onExceeded: 'block', // 'block' | 'log' | Closure
        ),
    ];
}

Configuration

'rate_limit' => [
    'default' => [
        'max_attempts' => 10,
        'decay_minutes' => 1,
    ],
    'agents' => [
        'public-chat' => ['max_attempts' => 5, 'decay_minutes' => 1],
        'admin-copilot' => ['max_attempts' => 100, 'decay_minutes' => 1],
    ],
],

Behavior

• Uses RateLimiter::tooManyAttempts() under the hood.
• On exceed: throws RateLimitExceededException (extends InterceptException) or executes a custom callback.
• Respects Laravel's Retry-After headers if exposed to the client.

Describe the middleware's supported actions you'd like

• block
• log
• callback