feat(security): add route-specific rate limits for /auth and /r/:reference (#153)

[Muhd010]

Overview

This PR adds route-specific rate limits for the sensitive /auth route and the public receipt route /r/:reference to prevent abuse and improve security posture.

Related Issue

Closes #153

Changes

[MODIFY] apps/api/src/index.ts

• Apply strictRateLimit (20/min per IP) to the /auth route. This route triggers Horizon account lookups on every attempt, making it both an authentication surface and an outbound-traffic amplifier. At the previous global cap of 120/min, IP rotation made brute-force or credential-stuffing attacks trivially scalable.

• Create a receipt-specific rate limiter for /r/* routes (60/min per IP) — tighter than the global 120 cap but looser than the strict 20/min bucket, since buyers legitimately refresh public receipts.

[ADD] apps/api/test/routes/rate-limit.test.ts

• Test that the 21st POST request to /auth within the rate limit window returns 429.
• Test that the 21st GET request to /auth within the rate limit window returns 429.
• Test that /r/:reference has its own rate limiter distinct from the global cap (4th request returns 429 when limit is 3).

Verification Results

pnpm --filter @checkout/api typecheck
✅ TypeScript type check passed

pnpm --filter @checkout/api vitest run
✅ 46 test files passed (366 tests total)
✅ 3 new rate-limit tests passed
✅ All existing auth and receipt tests still pass

Acceptance Criteria

Criteria	Status
/auth returns 429 past the strict limit	✅ Verified via test (21st request returns 429)
/r/:reference has a limiter distinct from the global cap	✅ Receipt limiter at 60/min (half of global 120)
Existing auth and receipt tests still pass	✅ All 366 tests passing

[drips-wave]

@Muhd010 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
quay-web	Skipped		Aug 29, 2026 3:56am