fix: 업로드 시간당 총량 제한 적용

[dh2906]

🔍 개요

• 비로그인 업로드가 열린 뒤에도 같은 IP가 1시간에 60개를 넘겨 계속 업로드할 수 없도록 서버 측 총량 제한을 적용했습니다.

---

🚀 주요 변경 내용

• 업로드 이미지 API에 Redis 기반 rate limit을 다시 적용했습니다.
• 로그인 사용자 ID 대신 프록시가 복원한 클라이언트 IP를 제한 키로 사용합니다.
• 1시간에 60개를 초과한 업로드 요청은 TOO_MANY_REQUESTS 429로 응답합니다.
• 같은 IP의 61번째 업로드가 차단되는 통합 테스트를 추가했습니다.

---

💬 참고 사항

• server.forward-headers-strategy: framework 설정이 있어 Nginx의 X-Forwarded-For 기반 클라이언트 IP 복원 흐름을 전제로 합니다.
• Nginx limit_req는 순간 폭주 방어로 남기고, 시간당 총량 제한은 애플리케이션 Redis 카운터가 담당합니다.

---

✅ Checklist (완료 조건)

• 코드 스타일 가이드 준수
• 테스트 코드 포함됨
• Reviewers / Assignees / Labels 지정 완료
• 보안 및 민감 정보 검증 (API 키, 환경 변수, 개인정보 등)

[coderabbitai]

Warning

Review limit reached

@dh2906, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 11 minutes and 3 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 014dc295-d1d8-49f0-96d9-613b7de2eff2

📥 Commits

Reviewing files that changed from the base of the PR and between c6b3a36 and de17eaf.

📒 Files selected for processing (5)

• src/main/java/gg/agit/konect/domain/upload/controller/UploadApi.java
• src/main/java/gg/agit/konect/domain/upload/controller/UploadController.java
• src/main/java/gg/agit/konect/global/ratelimit/aspect/RateLimitAspect.java
• src/test/java/gg/agit/konect/integration/domain/upload/UploadApiTest.java
• src/test/java/gg/agit/konect/unit/global/ratelimit/aspect/RateLimitAspectTest.java

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/public-upload-api

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🧪 JaCoCo Coverage Report (Changed Files)

Summary

• Overall Coverage: 78.8% ✅
• Covered Lines: 41 / 52
• Changed Files: 3

Coverage by File

Class	Coverage	Lines	Status
RateLimitAspect gg.agit.konect.global.ratelimit.aspect	78.4%	40/51	✅
UploadController gg.agit.konect.domain.upload.controller	100.0%	1/1	✅

📊 View Workflow Run