feat(security): add strict rate limiting and failure logging to auth endpoint #188

[bamiebot-maker]

Description

This PR addresses issue #188 by implementing strict rate limiting and structured security audit logging for sensitive authentication endpoints (POST /auth/login and POST /auth/register). These changes mitigate brute-force and credential-stuffing vulnerabilities while preserving the global rate limits for the rest of the application routes.

Changes Made

🔒 Rate Limiting (api/src/auth/auth.controller.ts)

• Applied NestJS @Throttle({ default: { limit: 5, ttl: 900000 } }) to authentication endpoints.
• Restricted access from a single IP to a maximum of 5 attempts per 15 minutes.
• Injected the Express @Req() req: Request context into controllers to capture necessary metadata.

🔌 Dependency Wiring (api/src/auth/auth.module.ts)

• Registered the AuditService within the authentication scope to allow access during the validation steps.

📝 Structured Failure Logging (api/src/auth/auth.service.ts)

• Intercepted authentication failures within the login pipeline.
• Extracted structural network metadata (IP Address and User-Agent) from the incoming request.
• Forwarded failure payloads to the centralized system logger for active threat monitoring.

🧪 Test Suite Enhancements

• Unit Tests (auth.service.spec.ts): Updated existing mocks to support the new request context argument without breaking existing tests.
• Integration Tests (auth-rate-limit.integration.spec.ts): Created a dedicated test script to simulate rapid traffic and verify that a 429 Too Many Requests status code is correctly triggered on the 6th consecutive attempt.

Acceptance Criteria Verified

• Strict 5 req / 15 min limit applied exclusively to auth routes.
• Non-auth endpoints still maintain the default global 100 req / 60s window.
• Threat monitoring logs capture structured IP and User-Agent telemetry.
• Retry-After header is correctly present on rate-limited responses.
• Comprehensive integration tests added and implemented.

closes #188

[bamiebot-maker]

kindly review pr

[bamiebot-maker]

kindly review pr

[Xhristin3]

Hey @bamiebot-maker \u2014 strong work. 5/15min on login + register, structured audit logging with IP/UA, and the integration spec proving the 429s hit every acceptance criterion in #188. Closes #188 and merged. Thanks for the security pass! \ud83d\udee1\ufe0f