Improve onboarding

gateway/app/main.py

@@ -21,6 +21,7 @@ from app.middleware.request_id import RequestIDMiddleware
 from app.middleware.auth import AuthMiddleware
 from app.middleware.logging import LoggingMiddleware
 from app.middleware.rate_limit import RateLimitMiddleware
+from app.middleware.rate_limiting import APIRateLimitMiddleware
 from app.middleware.subscription import SubscriptionMiddleware
 from app.middleware.demo_middleware import DemoMiddleware
 from app.middleware.read_only_mode import ReadOnlyModeMiddleware
@@ -90,9 +91,10 @@ app.add_middleware(
 )
 
 # Custom middleware - Add in REVERSE order (last added = first executed)
-# Execution order: RequestIDMiddleware -> DemoMiddleware -> AuthMiddleware -> ReadOnlyModeMiddleware -> SubscriptionMiddleware -> RateLimitMiddleware -> LoggingMiddleware
-app.add_middleware(LoggingMiddleware)          # Executes 7th (outermost)
-app.add_middleware(RateLimitMiddleware, calls_per_minute=300)  # Executes 6th
+# Execution order: RequestIDMiddleware -> DemoMiddleware -> AuthMiddleware -> ReadOnlyModeMiddleware -> SubscriptionMiddleware -> APIRateLimitMiddleware -> RateLimitMiddleware -> LoggingMiddleware
+app.add_middleware(LoggingMiddleware)          # Executes 8th (outermost)
+app.add_middleware(RateLimitMiddleware, calls_per_minute=300)  # Executes 7th - Simple rate limit
+# Note: APIRateLimitMiddleware will be added on startup with Redis client
 app.add_middleware(SubscriptionMiddleware, tenant_service_url=settings.TENANT_SERVICE_URL)  # Executes 5th
 app.add_middleware(ReadOnlyModeMiddleware, tenant_service_url=settings.TENANT_SERVICE_URL)  # Executes 4th - Enforce read-only mode
 app.add_middleware(AuthMiddleware)             # Executes 3rd - Checks for demo context
@@ -123,8 +125,13 @@ async def startup_event():
         await initialize_redis(settings.REDIS_URL, db=0, max_connections=50)
         redis_client = await get_redis_client()
         logger.info("Connected to Redis for SSE streaming")
+
+        # Add API rate limiting middleware with Redis client
+        app.add_middleware(APIRateLimitMiddleware, redis_client=redis_client)
+        logger.info("API rate limiting middleware enabled with subscription-based quotas")
     except Exception as e:
         logger.error(f"Failed to connect to Redis: {e}")
+        logger.warning("API rate limiting middleware will fail open (allow all requests)")
 
     metrics_collector.register_counter(
         "gateway_auth_requests_total",