1 files changed, 21 insertions, 8 deletions
diff --git a/services/api/src/trading_api/routers/orders.py b/services/api/src/trading_api/routers/orders.py
index c69dc10..b664e2a 100644
--- a/services/api/src/trading_api/routers/orders.py
+++ b/services/api/src/trading_api/routers/orders.py
@@ -2,17 +2,23 @@
 
 import logging
 
-from fastapi import APIRouter, HTTPException, Request
-from shared.sa_models import OrderRow, SignalRow
+from fastapi import APIRouter, HTTPException, Query, Request
+from slowapi import Limiter
+from slowapi.util import get_remote_address
 from sqlalchemy import select
+from sqlalchemy.exc import OperationalError
+
+from shared.sa_models import OrderRow, SignalRow
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter()
+limiter = Limiter(key_func=get_remote_address)
 
 
 @router.get("/")
-async def get_orders(request: Request, limit: int = 50):
+@limiter.limit("60/minute")
+async def get_orders(request: Request, limit: int = Query(50, ge=1, le=1000)):
     """Get recent orders."""
     try:
         db = request.app.state.db
@@ -35,13 +41,17 @@ async def get_orders(request: Request, limit: int = 50):
                 }
                 for r in rows
             ]
+    except OperationalError as exc:
+        logger.error("Database error fetching orders: %s", exc)
+        raise HTTPException(status_code=503, detail="Database unavailable") from exc
     except Exception as exc:
-        logger.error("Failed to get orders: %s", exc)
-        raise HTTPException(status_code=500, detail="Failed to retrieve orders")
+        logger.error("Failed to get orders: %s", exc, exc_info=True)
+        raise HTTPException(status_code=500, detail="Failed to retrieve orders") from exc
 
 
 @router.get("/signals")
-async def get_signals(request: Request, limit: int = 50):
+@limiter.limit("60/minute")
+async def get_signals(request: Request, limit: int = Query(50, ge=1, le=1000)):
     """Get recent signals."""
     try:
         db = request.app.state.db
@@ -62,6 +72,9 @@ async def get_signals(request: Request, limit: int = 50):
                 }
                 for r in rows
             ]
+    except OperationalError as exc:
+        logger.error("Database error fetching signals: %s", exc)
+        raise HTTPException(status_code=503, detail="Database unavailable") from exc
     except Exception as exc:
-        logger.error("Failed to get signals: %s", exc)
-        raise HTTPException(status_code=500, detail="Failed to retrieve signals")
+        logger.error("Failed to get signals: %s", exc, exc_info=True)
+        raise HTTPException(status_code=500, detail="Failed to retrieve signals") from exc