music_library/backlog/completed/ml-32 - OpenAI-API-uses-unsafe-bang-methods-and-lacks-rate-limiting.md

id, title, status, assignee, created_date, labels, dependencies, references, priority

id	title	status	assignee	created_date	labels	dependencies	references	priority
ML-32	OpenAI API uses unsafe bang methods and lacks rate limiting	Done		2026-04-20 08:52			https://github.com/cloud8421/music_library/issues/147	high

Description

GitHub: created 2026-04-05 · updated 2026-04-05 · closed 2026-04-05

Summary

The OpenAI API client is the only integration that uses Req.post!() (bang methods) which raise on failure instead of returning error tuples. It also lacks rate limiting, breaking the pattern established by all other API integrations.

Why This Matters

• Req.post!() raises on HTTP errors instead of returning {:error, reason} tuples, risking unhandled crashes in production
• Every other API client (MusicBrainz, Last.fm, Discogs, Wikipedia, Brave Search) attaches Req.RateLimiter — OpenAI does not
• OpenAI.Config is missing the api_cooldown field present in all other Config modules
• This is the only integration that breaks the three-module pattern (Facade/API/Config)

Affected Files

• lib/open_ai/api.ex (lines 20, 79 — Req.post!() calls)
• lib/open_ai/config.ex (missing api_cooldown field)

Suggested Fix

1. Replace Req.post!() with Req.post() and handle error tuples
2. Add api_cooldown to OpenAI.Config
3. Attach Req.RateLimiter in the request pipeline

Acceptance Criteria

• OpenAI API calls return {:ok, _} / {:error, _} tuples like all other integrations
• Rate limiter is attached with a configurable cooldown
• OpenAI.Config follows the same structure as other API Config modules

• #1 OpenAI API calls return {:ok, _} / {:error, _} tuples like all other integrations
• #2 Rate limiter is attached with a configurable cooldown
• #3 OpenAI.Config follows the same structure as other API Config modules