recipe: harden auth/metrics, add rate limiting and tests

gemini_proxy/app.py

@@ -25,7 +25,6 @@ async def recognize(
     image: Annotated[UploadFile, File(...)],
     prompt: Annotated[str, Form(...)],
     generation_config: Annotated[str, Form()] = "{}",
-    api_key_override: Annotated[str | None, Form()] = None,
 ) -> dict:
     if image.content_type not in ALLOWED_TYPES:
         raise HTTPException(status_code=415, detail="Unsupported image type")
@@ -34,7 +33,7 @@ async def recognize(
     if len(image_data) > MAX_IMAGE_BYTES:
         raise HTTPException(status_code=413, detail="Image is too large")
 
-    api_key = api_key_override or os.getenv("GEMINI_API_KEY")
+    api_key = os.getenv("GEMINI_API_KEY")
     if not api_key:
         raise HTTPException(status_code=503, detail="Gemini is not configured")
 

gemini_proxy/test_app.py

@@ -28,4 +28,19 @@ def test_missing_key_returns_service_unavailable(monkeypatch) -> None:
         files={"image": ("input.png", b"not-an-image", "image/png")},
         data={"prompt": "test", "generation_config": "{}"},
     )
+    assert response.status_code == 503
+
+
+def test_rejects_when_only_override_provided(monkeypatch) -> None:
+    monkeypatch.delenv("GEMINI_API_KEY", raising=False)
+    client = TestClient(app)
+    response = client.post(
+        "/gemini",
+        files={"image": ("input.png", b"not-an-image", "image/png")},
+        data={
+            "prompt": "test",
+            "generation_config": "{}",
+            "api_key_override": "manual-key",
+        },
+    )
     assert response.status_code == 503