fix(web): rate-limit /api/docs/search

The route had zero throttling beyond a 128-char query cap, unlike every
other demo endpoint. A scripted client could hit it at unlimited req/s
from one IP. Reuse the existing in-memory clientIp/checkWebhookCooldown
pair from lib/demo-limits.ts, same pattern as /api/webhook-sample.

SearchDialog cast res.json() straight to SearchResult[] with no res.ok
check, so a 429 envelope would have been treated as a result array and
broken rendering - fixed alongside the rate limit that would trigger it.

Author: Salmatcre8

apps/web/app/api/docs/search/route.ts

@@ -3,6 +3,7 @@ import fs from 'fs'
 import path from 'path'
 import matter from 'gray-matter'
 import { docSections } from '@/lib/docroutes'
+import { checkWebhookCooldown, clientIp } from '@/lib/demo-limits'
 
 export type SearchResult = {
   title: string
@@ -100,6 +101,15 @@ function getCorpus(): IndexedDoc[] {
 const MAX_QUERY_LENGTH = 128
 
 export async function GET(request: NextRequest) {
+  const ip = clientIp(request)
+  const cooldown = checkWebhookCooldown(ip)
+  if (!cooldown.ok) {
+    return NextResponse.json(cooldown.body, {
+      status: 429,
+      headers: { 'Retry-After': String(Math.ceil(cooldown.body.retryAfterMs / 1000)) },
+    })
+  }
+
   const query = request.nextUrl.searchParams.get('q')?.trim().slice(0, MAX_QUERY_LENGTH) ?? ''
 
   if (query.length < 2) {

apps/web/components/docs/SearchDialog.tsx

@@ -66,6 +66,11 @@ export default function SearchDialog({ open, onClose }: Props) {
     debounceRef.current = setTimeout(async () => {
       try {
         const res = await fetch(`/api/docs/search?q=${encodeURIComponent(query)}`)
+        if (!res.ok) {
+          setResults([])
+          setSelected(0)
+          return
+        }
         const data: SearchResult[] = await res.json()
         setResults(data)
         setSelected(0)