Prepare GeoIntel for public release

backend/app/main.py

@@ -127,6 +127,7 @@ def create_app() -> FastAPI:
         token = set_request_id(request_id)
         started_at = time.perf_counter()
         raw_path = str(request.scope.get("path") or "")
+        guest_compute_acquired = False
         try:
             host = request.headers.get("host", "")
             content_type = request.headers.get("content-type", "").split(";", 1)[0].strip().lower()
@@ -234,6 +235,20 @@ def create_app() -> FastAPI:
                     )
                     is_read_request = request.method in {"GET", "HEAD", "OPTIONS"}
                     if is_read_request:
+                        if (
+                            normalized_path == f"{settings.api_prefix}/detection/yolo/preflight"
+                            and request.query_params.get("check_model_load", "").lower() in {"1", "true", "yes", "on"}
+                        ):
+                            response = JSONResponse(
+                                status_code=403,
+                                content=_to_error_payload(
+                                    "GUEST_MODEL_LOAD_FORBIDDEN",
+                                    "Model loading is available to authenticated operators only.",
+                                    request_id=request_id,
+                                ),
+                            )
+                            response.headers["x-request-id"] = request_id
+                            return response
                         guest_scoped_analysis_read = (
                             query_project_id == str(principal.project_id)
                             and normalized_path.startswith(
@@ -325,6 +340,37 @@ def create_app() -> FastAPI:
                             )
                             response.headers["x-request-id"] = request_id
                             return response
+                        retry_after = AuthService.consume_guest_request(
+                            f"guest-compute:{principal.session_id}",
+                            max_requests=settings.guest_compute_requests_per_minute,
+                        )
+                        if retry_after:
+                            response = JSONResponse(
+                                status_code=429,
+                                content=_to_error_payload(
+                                    "GUEST_COMPUTE_RATE_LIMITED",
+                                    "The public demo compute budget is temporarily exhausted.",
+                                    request_id=request_id,
+                                ),
+                            )
+                            response.headers["retry-after"] = str(retry_after)
+                            response.headers["x-request-id"] = request_id
+                            return response
+                        guest_compute_acquired = AuthService.try_acquire_guest_compute(
+                            max_concurrency=settings.guest_compute_max_concurrency,
+                        )
+                        if not guest_compute_acquired:
+                            response = JSONResponse(
+                                status_code=429,
+                                content=_to_error_payload(
+                                    "GUEST_COMPUTE_BUSY",
+                                    "The public demo is already processing its maximum number of jobs.",
+                                    request_id=request_id,
+                                ),
+                            )
+                            response.headers["retry-after"] = "10"
+                            response.headers["x-request-id"] = request_id
+                            return response
             response = await call_next(request)
             response.headers["x-request-id"] = request_id
             logger.info(
@@ -337,6 +383,8 @@ def create_app() -> FastAPI:
             )
             return response
         finally:
+            if guest_compute_acquired:
+                AuthService.release_guest_compute()
             reset_request_id(token)
 
     @app.exception_handler(AppError)