Add Rate Limiting for Authentication and User Routes

[LEVIII007]

Rate Limiting Implementation

About

This PR adds rate limiting to protect critical API endpoints from abuse and ensure service stability. The implementation uses slowapi to enforce IP-based rate limits.

Features

• IP-based rate limiting for authentication and user endpoints
• Customized limits for different route types
• Automatic logging of rate limit violations
• Configurable enable/disable toggle

Rate Limits

Endpoint	Limit	Purpose
Auth Routes	100/minute	Prevent brute force attacks
User Routes	100/minute	Control API usage
Index	100/minute	Basic protection

Implementation Details

# Rate limiting configuration
limiter = Limiter(
    key_func=get_remote_address,
    strategy="fixed-window", 
    storage_uri="memory://",
    enabled=RATE_LIMITING_ENABLED
)

# Applied to auth routes
auth.router.dependencies.append(Depends(auth_rate_limit()))

# Applied to user routes  
user.router.dependencies.append(Depends(user_rate_limit()))

# Protected index endpoint
@app.get("/")
@limiter.limit("10 per minute")
async def index(request: Request):
    return "Welcome to Portal!"

Benefits

• Prevents abuse of authentication endpoints
• Protects against DDoS attempts
• Ensures fair API usage
• Enhanced security logging
• Maintainable codebase

Testing Done

• Verified rate limits on auth endpoints
• Tested user route restrictions
• Confirmed rate limit exceeded responses
• Validated logging functionality

Dependencies

slowapi==0.1.8

Configuration

Enable/disable rate limiting via environment variable:

RATE_LIMITING_ENABLED=True

Logging

Rate limit violations are logged with:

• Client IP
• Endpoint path
• HTTP method
• Timestamp

Response Format

When rate limit exceeded:

{
    "detail": "Rate limit exceeded",
    "retry_after": "time in seconds" 
}

Status code: 429

Future Improvements

• Add Redis backend support
• Dynamic rate limiting based on user roles
• More granular endpoint controls

DEMO

Related Issues

Closes #62

[suryabulusu]

shouldn't be part of this PR

[suryabulusu]

i think these changes are related to PR 61

[suryabulusu]

left comments.. looks good otherwise!