fix(auth): add rate limiting for authentication endpoints

[Ridanshi]

Closes #1303

Security analysis

DevTrack authenticates exclusively via GitHub OAuth — there is no password, email, OTP, or magic-link authentication. Despite this, the NextAuth endpoints responsible for initiating and completing the OAuth handshake were completely unprotected:

Endpoint	Risk
POST /api/auth/signin/github	OAuth initiation — flooding exhausts GitHub token-exchange quota
GET /api/auth/callback/github	Code exchange — flooding can probe for valid OAuth codes
GET /api/auth/link-github	Secondary account link initiation
GET /api/auth/link-github/callback	Secondary account link code exchange

Endpoints intentionally excluded from rate limiting (they are called on every page render and are not attack surfaces):

• GET /api/auth/session
• GET /api/auth/csrf
• GET /api/auth/signout

Authentication flows discovered

GitHub OAuth only. No password, email/OTP, or magic-link flows exist in this codebase.

Rate limiting strategy

5 requests per IP per 15-minute fixed window (matching issue #1303).

A complete GitHub OAuth sign-in consumes 2 requests (initiation + callback), so the limit allows two full sign-in attempts plus one spare before throttling. In NODE_ENV=development the limit is relaxed to 1 000 so test suites and local sign-in flows are never blocked.

The implementation uses the shared createMemoryFixedWindowRateLimiter factory already present in the codebase (@/lib/rate-limit), keeping behaviour consistent with the metrics and contact rate limiters. The key namespace auth:<ip> is isolated from metrics-rate-limit:* to prevent any interference.

429 responses include X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and Retry-After headers. Response body:

{ "error": "Too many authentication attempts. Please try again later." }

Files changed

src/lib/auth-rate-limit.ts (new)
Standalone auth rate limiter module. Exports checkAuthRateLimit(), isAuthSensitivePath(), AUTH_LIMIT, AUTH_WINDOW_MS, and AUTH_SENSITIVE_PREFIXES. No new dependencies.

src/middleware.ts (modified)

• Imports checkAuthRateLimit, isAuthSensitivePath, AUTH_LIMIT from @/lib/auth-rate-limit.
• Inserts an auth rate-limit block after the protected-route check and before the general metrics limiter.
• Adds the four auth-sensitive paths to the config.matcher array.

Tests added

test/auth-rate-limit.test.ts — 22 tests:

• isAuthSensitivePath (9 tests) — correct classification of protected paths (signin, callback, link-github) and excluded paths (session, csrf, signout, unrelated API routes); consistency with AUTH_SENSITIVE_PREFIXES.
• Basic behaviour (5 tests) — first request allowed; remaining decrements; exactly AUTH_LIMIT requests then blocks; 429-compatible status when blocked; continued blocking after limit hit.
• Window expiry (2 tests) — counter resets after AUTH_WINDOW_MS, does not reset before window ends.
• IP isolation (2 tests) — independent counters per IP; blocking one IP does not affect another.
• Custom limit override (2 tests) — higher limit (dev/test mode); limit of 1 blocks after one request.
• Reset timestamp (2 tests) — reset points to window boundary; all requests in same window share the same reset epoch.

Verification

tsc --noEmit    # clean (no errors in changed files)
next lint       # warnings only (all pre-existing)
vitest run test/auth-rate-limit.test.ts  # 22/22 passed

[vercel]

@Ridanshi is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[Priyanshu-byte-coder]

This PR has merge conflicts with main. Please rebase:

git fetch origin
git rebase origin/main
git push --force-with-lease