security: rate limit POST /api/auth with Rack::Attack

Gemfile

@@ -85,6 +85,7 @@ gem 'bunny-pub-sub', '0.5.2'
 gem 'ci_reporter'
 gem 'dotenv'
 gem 'rack-cors', require: 'rack/cors'
+gem 'rack-attack'
 gem 'require_all', '>=1.3.3'
 
 # Excel support

Gemfile.lock

@@ -318,6 +318,8 @@ GEM
     raabro (1.4.0)
     racc (1.8.1)
     rack (3.1.12)
+    rack-attack (6.8.0)
+      rack (>= 1.0, < 4)
     rack-cors (2.0.2)
       rack (>= 2.0.0)
     rack-session (2.1.0)
@@ -593,6 +595,7 @@ DEPENDENCIES
   oauth2
   pdf-reader
   puma
+  rack-attack
   rack-cors
   rails (~> 8.0)
   rails-latex

config/application.rb

@@ -250,6 +250,7 @@ def self.fetch_boolean_env(name)
         resource '*', headers: :any, methods: %i(get post put delete options)
       end
     end
+    config.middleware.use Rack::Attack
 
     config.active_support.to_time_preserves_timezone = :zone
 

config/initializers/rack_attack.rb

@@ -0,0 +1,32 @@
+class Rack::Attack
+  # Rack::Attack depends on cache to persist counters.
+  # In development/test the app cache can be NullStore, which disables throttling.
+  Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
+
+  # Limit repeated login attempts against the API auth endpoint.
+  throttle('auth/ip', limit: 5, period: 20.seconds) do |req|
+    req.ip if req.path.start_with?('/api/auth') && req.post?
+  end
+
+  # Return a consistent API-friendly throttling response.
+  self.throttled_responder = lambda do |request|
+    rack_env =
+      if request.respond_to?(:env)
+        request.env
+      elsif request.respond_to?(:[])
+        request
+      else
+        {}
+      end
+
+    match_data = rack_env['rack.attack.match_data'] || {}
+    now = match_data[:epoch_time] || Time.now.to_i
+    retry_after = match_data[:period].to_i - (now % match_data[:period].to_i) if match_data[:period].to_i.positive?
+
+    body = { error: 'Too many login attempts. Please try again shortly.' }.to_json
+    headers = { 'Content-Type' => 'application/json' }
+    headers['Retry-After'] = retry_after.to_s if retry_after
+
+    [429, headers, [body]]
+  end
+end