feat(rate-limiting): implement rate limiting for login attempts and enhance configuration

- Added environment variables for `RATE_LIMIT_MAX_FAILED_ATTEMPTS` and `RATE_LIMIT_LOCKOUT_TIME`
- Integrated rate limiting into the login process with a maximum of 5 failed attempts
- Refactored login attempt recording into the `authRouter`
- Removed deprecated `recordLogin` middleware and adjusted related logic

server/src/middleware/rateLimiter.ts

@@ -2,8 +2,8 @@ import rateLimit from 'express-rate-limit'
 import type { Options } from 'express-rate-limit'
 import type { Request, Response, NextFunction } from 'express'
 import config from '../config.js'
-import { recordLogin } from './recordLogin.js'
 import { LoginAttempt } from '../../../packages/models'
+import logger from '../utils/logger.js'
 
 function createRateLimiter(options: Partial<Options>) {
   if (config.testing.enabled) {
@@ -16,18 +16,11 @@ export const globalRateLimit = createRateLimiter({
   windowMs: 60 * 1000,
   max: 100,
 })
-export const authenticateRateLimit = config.testing.enabled
-  ? (req: Request, res: Response, next: NextFunction) => next()
-  : rateLimit({
-      windowMs: 1 * 1000,
-      max: 5,
-      handler: async (req: Request, res: Response, _next: NextFunction) => {
-        recordLogin(req, false, 'rate limit')
-        res.status(429).json({
-          error: 'Too many login attempts. Please try again later.',
-        })
-      },
-    })
+
+export const authenticateRateLimit = createRateLimiter({
+  windowMs: 10 * 1000,
+  max: 5,
+})
 
 export const sessionRateLimit = createRateLimiter({
   windowMs: 10 * 1000,
@@ -52,10 +45,14 @@ export async function rateLimitByAccount(
   const recentFailedCount = await LoginAttempt.countDocuments({
     username,
     success: false,
+    ip: req.ip,
     time: { $gte: since },
   })
 
-  if (recentFailedCount >= 10) {
+  if (recentFailedCount >= 5) {
+    logger.warn(
+      `Too many failed login attempts for "${username}" from ${req.ip}`
+    )
     return res.status(429).json({
       error: 'Too many failed login attempts. Please try again later.',
     })

server/src/middleware/recordLogin.ts

@@ -1,17 +0,0 @@
-import { Request, Response, NextFunction } from 'express'
-import { LoginAttempt } from '../../../packages/models'
-
-export async function recordLogin(
-  req: Request,
-  success: boolean,
-  message: string
-) {
-  await LoginAttempt.create({
-    ip: req.ip,
-    userAgent: req.headers['user-agent'] || '',
-    success,
-    time: new Date(),
-    username: req.body.username,
-    message,
-  })
-}

server/src/middleware/validator.ts

@@ -1,7 +1,5 @@
 import { validationResult } from 'express-validator'
 import type { Request, Response, NextFunction } from 'express'
-import { recordLogin } from './recordLogin.js'
-
 
 export function noError(req: Request, res: Response, next: NextFunction) {
   const result = validationResult(req)
@@ -9,7 +7,6 @@ export function noError(req: Request, res: Response, next: NextFunction) {
     next()
     return
   }
-  recordLogin(req, false, 'valid error'); 
   res.status(400).json({
     message: 'Validation failed',
     errors: result.array(),