[Lakshya-2440]

Summary

This PR addresses Issue 4 (Tier 1 Core Architecture, Edge Security & Cryptography): feat(auth): add rate limiting for sensitive endpoints using Durable Object or KV.

Currently, in-memory rate limiting (_AUTH_RATE_LIMIT_STATE) is isolate-local and resets whenever Cloudflare recycles the Worker isolate. This change introduces persistent, sliding-window rate limiting backed by a Durable Object actor (RateLimiterDO), with KV storage support and in-memory fallback.

Key Changes

1. RateLimiterDO Actor (src/worker.py):
   • Implemented a lightweight DurableObject actor tracking sliding-window attempt timestamps.
   • Calculates dynamic Retry-After header values based on the oldest attempt falling outside the window.
   • Supports both RPC method calls (check_limit) and HTTP requests (on_fetch/fetch).
   • Also integrated rate-limiting route handling into PresenceDO if used as the DO binding.
2. wrangler.toml:
   • Registered RATE_LIMITER_DO binding (class_name = "RateLimiterDO").
   • Added v3 migration with new_sqlite_classes = ["RateLimiterDO"].
3. Multi-Backend Sliding Window (src/worker.py):
   • Evaluates rate limiting in order: RATE_LIMITER_DO -> RATE_LIMIT_KV -> in-memory bounded sliding window.
   • Handles unit test mock environments gracefully without failing on auto-mock attributes.
4. Two-Layer Sensitive Endpoint Protection:
   • Protected /api/login, /api/register, /api/forgot-password, /api/profile/password, and /api/confirm-password-change.
   • Checks client IP (CF-Connecting-IP) to block volumetric burst attacks.
   • Checks user blind index (username_hash / email_hash) to prevent distributed credential-stuffing across rotated IPs.
   • Enforces 429 Too Many Requests with Retry-After header when attempts exceed 5 attempts/failures per minute.
5. Testing Suite (tests/test_dispatcher.py):
   • Added TestAuthRateLimiting with comprehensive end-to-end routing tests:
     • Burst login rate limiting (returns 429 on attempt 6 after 5 failures).
     • Burst registration rate limiting.
     • Burst forgot-password rate limiting.
     • Rate limiting via RateLimiterDO actor.
     • Rate limiting via RATE_LIMIT_KV store.
     • User-hash rate limiting across rotated IPs.
     • DO actor sliding-window expiry verification.
     • Missing CF-Connecting-IP guard check.

Verification

• pytest tests/test_dispatcher.py passes 100% (43 passed).
• pytest tests/test_api_auth.py passes 100% (21 passed).
• All crypto and auth test suites pass cleanly.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: alphaonelabs/coderabbit/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 13a2ae7b-815f-48d3-a836-152ce619b5e1

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}