Add per-IP sliding window rate limiting to public auth endpoints

[Copilot]

Public auth endpoints had no rate limiting, leaving them open to brute force, registration spam, SES cost abuse, and resource exhaustion via trial key generation.

Changes

• app/middleware/rate_limit.py — New RateLimitMiddleware implementing a thread-safe per-IP sliding window counter. Returns 429 with Retry-After on breach. Cleans up empty keys when the internal map exceeds 10k entries to bound memory use.

  Default limits:

  Endpoint	Limit
  /auth/login	10 req / 60 s
  /auth/register	5 req / 60 s
  /auth/validate-email	5 req / 60 s
  /auth/sign-in	10 req / 60 s
  /auth/generate-trial-access	5 req / 60 s

• app/core/config.py — Adds RATE_LIMIT_ENABLED boolean (env var, default true).

• app/main.py — Registers RateLimitMiddleware early in the stack (after HTTPS redirect, before auth) when enabled.

• tests/test_rate_limit.py — Unit tests for IP extraction, sliding window allow/block logic, and per-IP/per-path isolation.

Notes

Client IP is resolved from X-Forwarded-For (first hop), falling back to the direct connection address. This assumes the upstream proxy strips client-supplied forwarding headers — consistent with the existing Lagoon deployment topology. The same assumption is already made by HTTPSRedirectMiddleware for X-Forwarded-Proto.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• amazee-test-postgres
  • Triggering command: /usr/bin/python python -m pytest tests/test_rate_limit.py -v (dns block)
  • Triggering command: /usr/bin/python python -m pytest tests/test_cache_headers.py -v (dns block)
  • Triggering command: /usr/bin/python python -m pytest tests/test_rate_limit.py::TestRateLimitMiddlewareDirect tests/test_rate_limit.py::TestRateLimitMiddlewareIntegration::test_default_rate_limits_cover_expected_endpoints tests/test_rate_limit.py::TestRateLimitMiddlewareIntegration::test_rate_limit_config_has_positive_values tests/test_rate_limit.py::TestRateLimitMiddlewareIntegration::test_login_endpoint_rate_limited_after_threshold -v (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[dan2k3k4]

@Schnitzel there is PR already: #283 but it's not merged yet