fix/reentrancy-and-rate-limiting

.tool-versions

@@ -0,0 +1 @@
+rust 1.95.0

contracts/teachlink/src/lib.rs

@@ -88,6 +88,7 @@
 #![allow(clippy::trivially_copy_pass_by_ref)]
 #![allow(clippy::needless_borrow)]
 
+use crate::score::ScoreError;
 use soroban_sdk::{contract, contractimpl, Address, Bytes, Env, Map, String, Symbol, Vec};
 
 mod access_control;
@@ -102,14 +103,14 @@ mod backup;
 mod bft_consensus;
 mod bridge;
 mod bulk_limits;
-mod config;
 mod dos_protection;
 // TODO: Fix collaboration module compilation errors (pre-existing issue)
 // mod collaboration;
 // TODO: Fix content_nft module compilation errors (pre-existing issue)
 // mod content_nft;
 // TODO: Fix content_quality module compilation errors (pre-existing issue - symbol too long)
 // mod content_quality;
+mod config;
 mod emergency;
 mod feature_flags;
 mod errors;

contracts/teachlink/src/notification.rs

@@ -8,6 +8,7 @@ use crate::notification_events_basic::{
     NotificationDeliveredEvent, NotificationFailedEvent, NotificationPrefUpdatedEvent,
     NotificationScheduledEvent,
 };
+use crate::rate_limiting::RateLimiter;
 use crate::safe_stats::safe_inc_u64;
 use crate::storage::{
     NOTIFICATION_COUNTER, NOTIFICATION_LAST_CLEANUP, NOTIFICATION_LOGS, NOTIFICATION_MAX_SIZE,
@@ -19,6 +20,8 @@ use crate::types::{
     NotificationPreference, NotificationSchedule, NotificationTemplate, NotificationTracking,
     UserNotificationSettings,
 };
+use soroban_sdk::symbol_short;
+use soroban_sdk::Symbol;
 use soroban_sdk::{contracttype, vec, Address, Bytes, Env, IntoVal, Map, String, Vec};
 
 pub use crate::config::NOTIF_BATCH_SIZE as BATCH_SIZE;
@@ -35,6 +38,25 @@ pub const CLEANUP_INTERVAL_SECONDS: u64 = 3600; // 1 hour
 pub struct NotificationManager;
 
 impl NotificationManager {
+    /// Set rate limit config for notification creation (admin only)
+    pub fn set_notification_rate_limit(
+        env: &Env,
+        admin: Address,
+        max_calls: u32,
+        window_ledgers: u32,
+        endpoint: Symbol,
+    ) -> Result<(), BridgeError> {
+        admin.require_auth();
+        RateLimiter::set_endpoint_config(
+            env,
+            &endpoint,
+            crate::rate_limiting::EndpointConfig {
+                max_calls,
+                window_ledgers,
+            },
+        )
+        .map_err(|_| BridgeError::StorageError)
+    }
     /// Initialize notification system
     pub fn initialize(env: &Env) -> Result<(), BridgeError> {
         if env.storage().instance().has(&NOTIFICATION_COUNTER) {
@@ -107,6 +129,10 @@ impl NotificationManager {
         channel: NotificationChannel,
         content: NotificationContent,
     ) -> Result<u64, BridgeError> {
+        // Rate limit: per-user for send_notification
+        let endpoint = symbol_short!("NOTISEND");
+        RateLimiter::check_rate_limit(env, &recipient, &endpoint)?;
+
         let notification_id = Self::get_next_notification_id(env);
 
         // Check user preferences
@@ -184,6 +210,10 @@ impl NotificationManager {
         content: NotificationContent,
         schedule: NotificationSchedule,
     ) -> Result<u64, BridgeError> {
+        // Rate limit: per-user for schedule_notification
+        let endpoint = symbol_short!("NOTISCHD");
+        RateLimiter::check_rate_limit(env, &recipient, &endpoint)?;
+
         let notification_id = Self::get_next_notification_id(env);
 
         // Validate schedule