packages/api/src/trpc.ts (2)

80-84: Avoid constructing a new Ratelimit instance on every request

Instantiating Ratelimit per call adds overhead. Cache per unique (namespace, limit, duration) triple.

Apply this diff to use a cached instance:

-  const limiter = new Ratelimit({
-    namespace: meta.ratelimit.namespace,
-    limit: meta.ratelimit.limit,
-    duration: meta.ratelimit.duration,
-    rootKey: env.UNKEY_ROOT_KEY,
-  });
+  const limiter = getLimiterFor(meta, env.UNKEY_ROOT_KEY);

Add this helper near the top-level (outside the middleware):

// cache: one limiter per (namespace,limit,duration)
const limiterCache = new Map<string, Ratelimit>();
function getLimiterFor(meta: Meta, rootKey: string) {
  const key = `${meta.ratelimit.namespace}:${meta.ratelimit.limit}:${meta.ratelimit.duration}`;
  let limiter = limiterCache.get(key);
  if (!limiter) {
    limiter = new Ratelimit({
      namespace: meta.ratelimit.namespace,
      limit: meta.ratelimit.limit,
      duration: meta.ratelimit.duration,
      rootKey,
    });
    limiterCache.set(key, limiter);
  }
  return limiter;
}

---

86-88: Fail-open path on limiter outages to preserve availability

A transient Unkey outage would currently 500 the request if limit() throws. Consider failing open and letting Sentry capture the error.

-  const result = await limiter.limit(identifier);
+  let result;
+  try {
+    result = await limiter.limit(identifier);
+  } catch (err) {
+    // Preserve availability on limiter errors; telemetry will be captured by Sentry middleware.
+    return next();
+  }

packages/api/src/routers/places.ts (2)

16-20: Resolver no longer needs ctx: fine; consider upstream failure mapping and provider reuse.

• Dropping ctx from the handler is fine since rate limiting moved to middleware. Ensure the middleware still has access to the same ctx to derive identifiers.
• Optional hardening:
  • Map upstream provider failures to a stable tRPC error (e.g., BAD_GATEWAY) and log once. This prevents leaking upstream error shapes and keeps clients consistent.
  • Reuse a module-scoped GooglePlacesProvider to keep the HTTP agent/DNS warm and slightly reduce per-request overhead.

Module-scoped provider (outside this range, near imports):

// At module scope:
const placesProvider = new GooglePlacesProvider();

Then remove the per-request instantiation here:

-      const placesProvider = new GooglePlacesProvider();
+      // use module-scoped `placesProvider` (declared above) to reuse connections

If you decide to add upstream error mapping, you can minimally wrap the call:

-    .query(async ({ input }) => {
+    .query(async ({ input }) => {
       // ...
-      return await placesProvider.autocomplete(input.input, {
-        languageCode: input.languageCode,
-        limit: input.limit,
-      });
+      try {
+        return await placesProvider.autocomplete(input.input, {
+          languageCode: input.languageCode,
+          limit: input.limit,
+        });
+      } catch (err) {
+        // import { TRPCError } from "@trpc/server" at the top if you adopt this
+        throw new TRPCError({ code: "BAD_GATEWAY", message: "Places upstream failed" });
+      }
     }),

Consider verifying whether your provider already implements timeouts/abort signals to avoid hanging calls that waste quota.

---

7-14: Meta-driven rate limiting verification complete

• Duration parsing
  • The Meta.ratelimit.duration field is typed as a string literal (${number}${Unit} or ${number} ${Unit}) and is passed directly into Unkey’s Ratelimit constructor. Unkey’s implementation natively understands humanized strings like "1m" and will convert to milliseconds at runtime.
• Identifier scope
  • In createTRPCContext we set ctx.rateLimit.id = session.user?.id ?? getIp(headers), and in the middleware we build the key as ${procedureName}:${ctx.rateLimit.id}. That ensures authenticated users and unauthenticated clients are bucketed separately with a clear precedence (userId → IP).
• Namespace granularity
  • The "google-places" namespace is only used by this single places.autocomplete endpoint. If your intention is to share a global quota across all Google Places calls, it’s fine as-is. For per-endpoint isolation, consider a more specific namespace (e.g. "places:autocomplete") and a lower limit to tighten the budget:

 .meta({
   procedureName: "places.autocomplete",
   ratelimit: {
-    namespace: "google-places",
-    limit: 20,
+    namespace: "places:autocomplete",
+    limit: 10,
     duration: "1m",
   },
 })

No further changes are required unless you want to adopt the optional tighter scope above.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.