fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)

test/runtime_settings_from_env_test.go

@@ -3,6 +3,7 @@ package test
 import (
 	"RenewCMS/internal/infrastructure/config"
 	"testing"
+	"time"
 )
 
 func setBaseSettingsEnv(t *testing.T) {
@@ -18,6 +19,8 @@ func setBaseSettingsEnv(t *testing.T) {
 	t.Setenv("SMTP_HOST", "smtp.example.com")
 	t.Setenv("SMTP_PORT", "465")
 	t.Setenv("CORS_ALLOWED_ORIGINS", "")
+	t.Setenv("AUTH_RATE_LIMIT_MAX_ATTEMPTS", "5")
+	t.Setenv("AUTH_RATE_LIMIT_WINDOW_SECONDS", "60")
 }
 
 func TestNewSettingsFromEnvReadsAllFields(t *testing.T) {
@@ -59,6 +62,12 @@ func TestNewSettingsFromEnvReadsAllFields(t *testing.T) {
 	if settings.Smtp.Port != 465 {
 		t.Errorf("expected Smtp.Port %d, got %d", 465, settings.Smtp.Port)
 	}
+	if settings.AuthRateLimit.MaxAttempts != 5 {
+		t.Errorf("expected AuthRateLimit.MaxAttempts %d, got %d", 5, settings.AuthRateLimit.MaxAttempts)
+	}
+	if settings.AuthRateLimit.Window != 60*time.Second {
+		t.Errorf("expected AuthRateLimit.Window %v, got %v", 60*time.Second, settings.AuthRateLimit.Window)
+	}
 	expectedOrigins := []string{"https://cms.example.com", "https://admin.example.com"}
 	if len(settings.CorsAllowedOrigins) != len(expectedOrigins) {
 		t.Fatalf("expected %d origins, got %v", len(expectedOrigins), settings.CorsAllowedOrigins)
@@ -105,6 +114,26 @@ func TestNewSettingsFromEnvInvalidSmtpPortReturnsError(t *testing.T) {
 	}
 }
 
+func TestNewSettingsFromEnvInvalidAuthRateLimitMaxAttemptsReturnsError(t *testing.T) {
+	setBaseSettingsEnv(t)
+	t.Setenv("AUTH_RATE_LIMIT_MAX_ATTEMPTS", "not-a-number")
+
+	_, err := config.NewSettingsFromEnv()
+	if err == nil {
+		t.Fatal("expected an error for a non-numeric AUTH_RATE_LIMIT_MAX_ATTEMPTS")
+	}
+}
+
+func TestNewSettingsFromEnvInvalidAuthRateLimitWindowSecondsReturnsError(t *testing.T) {
+	setBaseSettingsEnv(t)
+	t.Setenv("AUTH_RATE_LIMIT_WINDOW_SECONDS", "not-a-number")
+
+	_, err := config.NewSettingsFromEnv()
+	if err == nil {
+		t.Fatal("expected an error for a non-numeric AUTH_RATE_LIMIT_WINDOW_SECONDS")
+	}
+}
+
 func TestSettingsIsProductionFalseForNonProductionEnvironment(t *testing.T) {
 	settings := config.Settings{Environment: "development"}
 	if settings.IsProduction() {