Designed and shipped plan-based limits and a rate-limit engine for an inherited chatbot
Role
Backend development and deployment
Period
2026.06
Status
In production
Stack
Python, Node.js, RAG, ECR, EC2
Context
I inherited the backend of a university’s AAC (augmentative and alternative communication) chatbot: a Node frontend and a Python RAG API deployed separately on EC2.
What I built
Plan engine: Basic/Plus/Premium monthly limits plus rate limiting. Chat and OCR are counted separately; OCR is blocked with plan.consume right before the Vision call.
Direct RAG calls blocked (internal secret header), a real OpenAI check in /health, hydration errors and chat quota reflected in the frontend.
26 tests (vitest), pinned requirements.
Deployment
With CI billing blocked, I set up a manual SSH deployment: the frontend as an amd64 ECR build with a container swap, the RAG API as a native EC2 build.
Handed over
From a security audit: stored XSS in notices (HIGH), unauthenticated usage logs, CORS and login rate limiting, a JWT fallback: documented as follow-ups.