Inboxintel/src/InboxIntel.Api/Controllers/AiController.cs

using InboxIntel.Application.Abstractions;
using Microsoft.AspNetCore.Mvc;

namespace InboxIntel.Api.Controllers;

/// <summary>
/// AI endpoints are read-only / advisory. They never trigger destructive
/// actions - suggestions are returned for the user to act on via /cleanup.
/// </summary>
[Microsoft.AspNetCore.RateLimiting.EnableRateLimiting("expensive")]  // AUDIT H-2: LLM calls are the most expensive path
public class AiController : ApiControllerBase
{
    private readonly IAiService _ai;
    public AiController(IAiService ai) => _ai = ai;

    [HttpGet("status")]
    public IActionResult Status() => Ok(new { enabled = _ai.IsEnabled });

    [HttpPost("classify/{emailId:guid}")]
    public async Task<IActionResult> Classify(Guid emailId, CancellationToken ct)
        => Ok(await _ai.ClassifyAsync(UserId, emailId, ct));

    [HttpGet("summary")]
    public async Task<IActionResult> Summary(CancellationToken ct)
        => Ok(await _ai.SummarizeInboxAsync(UserId, ct));

    [HttpGet("suggestions")]
    public async Task<IActionResult> Suggestions(CancellationToken ct)
        => Ok(await _ai.SuggestCleanupAsync(UserId, ct));

    [HttpPost("generate-query")]
    public async Task<IActionResult> GenerateQuery([FromBody] string naturalLanguage, CancellationToken ct)
        => Ok(await _ai.GenerateQueryAsync(UserId, naturalLanguage, ct));
}