fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)

internal/infrastructure/config/settings.go

@@ -4,6 +4,7 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"time"
 )
 
 type SmtpSettings struct {
@@ -13,6 +14,11 @@ type SmtpSettings struct {
 	Port     int
 }
 
+type AuthRateLimitSettings struct {
+	MaxAttempts int
+	Window      time.Duration
+}
+
 type Settings struct {
 	Environment        string
 	CorsAllowedOrigins []string
@@ -22,6 +28,7 @@ type Settings struct {
 	DBFile             string
 	Port               string
 	Smtp               SmtpSettings
+	AuthRateLimit      AuthRateLimitSettings
 }
 
 func (s Settings) IsProduction() bool {
@@ -29,7 +36,17 @@ func (s Settings) IsProduction() bool {
 }
 
 func NewSettingsFromEnv() (Settings, error) {
-	smtpPort, err := strconv.Atoi(os.Getenv("SMTP_PORT"))
+	smtpPort, err := intEnv("SMTP_PORT")
+	if err != nil {
+		return Settings{}, err
+	}
+
+	authRateLimitMaxAttempts, err := intEnv("AUTH_RATE_LIMIT_MAX_ATTEMPTS")
+	if err != nil {
+		return Settings{}, err
+	}
+
+	authRateLimitWindowSeconds, err := intEnv("AUTH_RATE_LIMIT_WINDOW_SECONDS")
 	if err != nil {
 		return Settings{}, err
 	}
@@ -48,9 +65,17 @@ func NewSettingsFromEnv() (Settings, error) {
 			Host:     os.Getenv("SMTP_HOST"),
 			Port:     smtpPort,
 		},
+		AuthRateLimit: AuthRateLimitSettings{
+			MaxAttempts: authRateLimitMaxAttempts,
+			Window:      time.Duration(authRateLimitWindowSeconds) * time.Second,
+		},
 	}, nil
 }
 
+func intEnv(name string) (int, error) {
+	return strconv.Atoi(os.Getenv(name))
+}
+
 func parseCorsAllowedOrigins(raw string) []string {
 	if raw == "" {
 		return nil