[bryanshao07]

Summary

This adds a new POST /api/llm-search endpoint that takes a natural language query (like "cheap studio near campus") and turns it into structured search filters using Gemini 3.5 Flash-Lite.

• Parses out area, beds, baths, price range, and sort preference from english query
• Treats the user's query as untrusted, as it's kept separate from the system prompt instead of being pasted directly into it
• Re-validates whatever Gemini sends back with Zod (schema validation library)
• Rate limited per-IP and globally
• Cleaned up error codes so retryable failures (timeouts, Gemini being down) return 503 instead of generic 500
• Frontend implementation

Test Plan

Wrote 35 Jest (our test runner) tests covering the main stuff: bad input handling, making sure the query can't hijack the prompt, what happens when Gemini returns garbage or times out, and the rate limiter working

yarn tsc and yarn lint both run successfully

To run it: yarn jest llmSearch.test.ts from backend/, just needs any non-empty value for GEMINI_API_KEY since all the Gemini calls are mocked (no real API key is needed for test)

Haven't done a full manual test against the live Gemini API yet

Notes

Added two new deps: express-rate-limit and zod

To run in prod, it needs a real GEMINI_API_KEY

[dti-github-bot]

[diff-counting] Significant lines: 1007. This diff might be too big! Developer leads are invited to review the code.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[NigelTatem]

Nice work overall the endpoint is well structured, and I especially like the response validation. I ran the focused test suite locally and all 35 tests passed.

I found a one thing I think you should address before merging:

1. The global limiter runs before request validation, so malformed requests still consume the 1,000-request daily allowance. That means distributed invalid requests could disable LLM search without ever calling Gemini. Maybe we can validate the body before applying the global limiter?

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: a44f84d0-50da-4469-8c19-e6e62041ea52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[bryanshao07]

@NigelTatem Thanks for the review! I just added the fix to your comment. The order per-IP limiter → body validation → global limiter → handler, and I added additional tests for that.