security: harden auth sessions and rate limits

apps/gateway/src/main.rs

@@ -167,23 +167,26 @@ async fn list_document_jobs(
 
 async fn register(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(payload): Json<Value>,
 ) -> Result<impl IntoResponse, StatusCode> {
-    proxy_json(&state.client, &state.services.auth, "/auth/register", payload).await
+    proxy_json_with_headers(&state.client, &state.services.auth, "/auth/register", payload, &headers).await
 }
 
 async fn login(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(payload): Json<Value>,
 ) -> Result<impl IntoResponse, StatusCode> {
-    proxy_json(&state.client, &state.services.auth, "/auth/login", payload).await
+    proxy_json_with_headers(&state.client, &state.services.auth, "/auth/login", payload, &headers).await
 }
 
 async fn refresh(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(payload): Json<Value>,
 ) -> Result<impl IntoResponse, StatusCode> {
-    proxy_json(&state.client, &state.services.auth, "/auth/refresh", payload).await
+    proxy_json_with_headers(&state.client, &state.services.auth, "/auth/refresh", payload, &headers).await
 }
 
 async fn logout(
@@ -209,30 +212,34 @@ async fn me(
 
 async fn verify_email(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(payload): Json<Value>,
 ) -> Result<impl IntoResponse, StatusCode> {
-    proxy_json(&state.client, &state.services.auth, "/auth/email/verify", payload).await
+    proxy_json_with_headers(&state.client, &state.services.auth, "/auth/email/verify", payload, &headers).await
 }
 
 async fn resend_verification(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(payload): Json<Value>,
 ) -> Result<impl IntoResponse, StatusCode> {
-    proxy_json(&state.client, &state.services.auth, "/auth/email/resend", payload).await
+    proxy_json_with_headers(&state.client, &state.services.auth, "/auth/email/resend", payload, &headers).await
 }
 
 async fn forgot_password(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(payload): Json<Value>,
 ) -> Result<impl IntoResponse, StatusCode> {
-    proxy_json(&state.client, &state.services.auth, "/auth/password/forgot", payload).await
+    proxy_json_with_headers(&state.client, &state.services.auth, "/auth/password/forgot", payload, &headers).await
 }
 
 async fn reset_password(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(payload): Json<Value>,
 ) -> Result<impl IntoResponse, StatusCode> {
-    proxy_json(&state.client, &state.services.auth, "/auth/password/reset", payload).await
+    proxy_json_with_headers(&state.client, &state.services.auth, "/auth/password/reset", payload, &headers).await
 }
 
 async fn change_password(
@@ -308,28 +315,6 @@ async fn answer_question(
     .await
 }
 
-async fn proxy_json<T: Serialize>(
-    client: &Client,
-    base_url: &str,
-    path: &str,
-    payload: T,
-) -> Result<impl IntoResponse, StatusCode> {
-    let response = client
-        .post(format!("{base_url}{path}"))
-        .json(&payload)
-        .send()
-        .await
-        .map_err(|_| StatusCode::BAD_GATEWAY)?;
-
-    let status = response.status();
-    let body = response
-        .json::<serde_json::Value>()
-        .await
-        .map_err(|_| StatusCode::BAD_GATEWAY)?;
-
-    Ok((status, Json(body)))
-}
-
 async fn proxy_json_with_headers<T: Serialize>(
     client: &Client,
     base_url: &str,
@@ -339,9 +324,7 @@ async fn proxy_json_with_headers<T: Serialize>(
 ) -> Result<impl IntoResponse, StatusCode> {
     let mut request = client.post(format!("{base_url}{path}")).json(&payload);
 
-    if let Some(value) = headers.get(header::AUTHORIZATION) {
-        request = request.header(header::AUTHORIZATION.as_str(), value.as_bytes());
-    }
+    request = apply_forwarded_headers(request, headers);
 
     let response = request.send().await.map_err(|_| StatusCode::BAD_GATEWAY)?;
     let status = response.status();
@@ -361,9 +344,7 @@ async fn proxy_get(
 ) -> Result<impl IntoResponse, StatusCode> {
     let mut request = client.get(format!("{base_url}{path}"));
 
-    if let Some(value) = headers.get(header::AUTHORIZATION) {
-        request = request.header(header::AUTHORIZATION.as_str(), value.as_bytes());
-    }
+    request = apply_forwarded_headers(request, headers);
 
     let response = request.send().await.map_err(|_| StatusCode::BAD_GATEWAY)?;
     let status = response.status();
@@ -383,9 +364,7 @@ async fn proxy_delete(
 ) -> Result<impl IntoResponse, StatusCode> {
     let mut request = client.delete(format!("{base_url}{path}"));
 
-    if let Some(value) = headers.get(header::AUTHORIZATION) {
-        request = request.header(header::AUTHORIZATION.as_str(), value.as_bytes());
-    }
+    request = apply_forwarded_headers(request, headers);
 
     let response = request.send().await.map_err(|_| StatusCode::BAD_GATEWAY)?;
     let status = response.status();
@@ -397,6 +376,21 @@ async fn proxy_delete(
     Ok((status, Json(body)))
 }
 
+fn apply_forwarded_headers(mut request: reqwest::RequestBuilder, headers: &HeaderMap) -> reqwest::RequestBuilder {
+    for name in [
+        header::AUTHORIZATION.as_str(),
+        header::USER_AGENT.as_str(),
+        "x-forwarded-for",
+        "x-real-ip",
+    ] {
+        if let Some(value) = headers.get(name) {
+            request = request.header(name, value.as_bytes());
+        }
+    }
+
+    request
+}
+
 async fn check_service(client: &Client, base_url: &str) -> DependencyHealth {
     let url = format!("{base_url}/health");
     let status = match client.get(&url).send().await {

apps/web/app/api/web/auth/email/verify/route.ts

@@ -5,6 +5,7 @@ export async function POST(request: NextRequest) {
   return proxyPublic({
     method: "POST",
     path: "/api/auth/email/verify",
+    request,
     body: await request.json()
   });
 }

apps/web/app/api/web/auth/login/route.ts

@@ -2,5 +2,5 @@ import { NextRequest } from "next/server";
 import { loginThroughGateway } from "@/lib/server-gateway";
 
 export async function POST(request: NextRequest) {
-  return loginThroughGateway(await request.json());
+  return loginThroughGateway(request, await request.json());
 }

apps/web/app/api/web/auth/logout/route.ts

@@ -1,5 +1,6 @@
+import { NextRequest } from "next/server";
 import { logoutThroughGateway } from "@/lib/server-gateway";
 
-export async function POST() {
-  return logoutThroughGateway();
+export async function POST(request: NextRequest) {
+  return logoutThroughGateway(request);
 }

apps/web/app/api/web/auth/me/route.ts

@@ -1,8 +1,10 @@
+import { NextRequest } from "next/server";
 import { proxyPrivate } from "@/lib/server-gateway";
 
-export async function GET() {
+export async function GET(request: NextRequest) {
   return proxyPrivate({
     method: "GET",
-    path: "/api/auth/me"
+    path: "/api/auth/me",
+    request
   });
 }

apps/web/app/api/web/auth/register/route.ts

@@ -5,6 +5,7 @@ export async function POST(request: NextRequest) {
   return proxyPublic({
     method: "POST",
     path: "/api/auth/register",
+    request,
     body: await request.json()
   });
 }

apps/web/app/api/web/documents/route.ts

@@ -1,17 +1,19 @@
 import { NextRequest } from "next/server";
 import { proxyPrivate } from "@/lib/server-gateway";
 
-export async function GET() {
+export async function GET(request: NextRequest) {
   return proxyPrivate({
     method: "GET",
-    path: "/api/documents"
+    path: "/api/documents",
+    request
   });
 }
 
 export async function POST(request: NextRequest) {
   return proxyPrivate({
     method: "POST",
     path: "/api/documents",
+    request,
     body: await request.json()
   });
 }

apps/web/app/api/web/questions/route.ts

@@ -5,6 +5,7 @@ export async function POST(request: NextRequest) {
   return proxyPrivate({
     method: "POST",
     path: "/api/questions",
+    request,
     body: await request.json()
   });
 }

apps/web/lib/server-gateway.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
 import { clearAuthCookies, getAccessToken, getRefreshToken, setAuthCookies } from "@/lib/server-auth";
 import { parseResponse, resolveErrorMessage } from "@/lib/http";
 
@@ -7,6 +8,7 @@ const gatewayUrl = process.env.GROUNDED_GATEWAY_URL ?? process.env.NEXT_PUBLIC_G
 type ProxyOptions = {
   method: "GET" | "POST" | "DELETE";
   path: string;
+  request?: NextRequest;
   body?: unknown;
 };
 
@@ -54,8 +56,8 @@ export async function proxyPrivate(options: ProxyOptions) {
   return nextResponse;
 }
 
-export async function loginThroughGateway(body: unknown) {
-  const response = await callGateway({ method: "POST", path: "/api/auth/login", body });
+export async function loginThroughGateway(request: NextRequest, body: unknown) {
+  const response = await callGateway({ method: "POST", path: "/api/auth/login", request, body });
   const payload = await parseResponse(response);
   const nextResponse = NextResponse.json(sanitizeAuthPayload(payload), { status: response.status });
 
@@ -66,11 +68,11 @@ export async function loginThroughGateway(body: unknown) {
   return nextResponse;
 }
 
-export async function logoutThroughGateway() {
+export async function logoutThroughGateway(request: NextRequest) {
   const accessToken = await getAccessToken();
 
   if (accessToken) {
-    await callGateway({ method: "POST", path: "/api/auth/logout" }, accessToken);
+    await callGateway({ method: "POST", path: "/api/auth/logout", request }, accessToken);
   }
 
   const response = NextResponse.json({ message: "Logged out." });
@@ -110,6 +112,10 @@ async function callGateway(options: ProxyOptions, accessToken?: string) {
     headers.set("Authorization", `Bearer ${accessToken}`);
   }
 
+  forwardHeader(options.request, headers, "user-agent");
+  forwardHeader(options.request, headers, "x-forwarded-for");
+  forwardHeader(options.request, headers, "x-real-ip");
+
   return fetch(`${gatewayUrl}${options.path}`, {
     method: options.method,
     headers,
@@ -118,6 +124,14 @@ async function callGateway(options: ProxyOptions, accessToken?: string) {
   });
 }
 
+function forwardHeader(request: NextRequest | undefined, headers: Headers, name: string) {
+  const value = request?.headers.get(name);
+
+  if (value) {
+    headers.set(name, value);
+  }
+}
+
 function sanitizeAuthPayload(payload: unknown) {
   if (!isAuthPayload(payload)) {
     return payload;

packages/database/prisma/migrations/0003_auth_hardening/migration.sql

@@ -0,0 +1,18 @@
+CREATE TABLE "AuthRateLimit" (
+  "key" TEXT NOT NULL,
+  "action" TEXT NOT NULL,
+  "attempts" INTEGER NOT NULL DEFAULT 0,
+  "windowStart" TIMESTAMP(3) NOT NULL,
+  "lockedUntil" TIMESTAMP(3),
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt" TIMESTAMP(3) NOT NULL,
+  CONSTRAINT "AuthRateLimit_pkey" PRIMARY KEY ("key")
+);
+
+CREATE INDEX "AuthRateLimit_action_lockedUntil_idx" ON "AuthRateLimit"("action", "lockedUntil");
+CREATE INDEX "AuthRateLimit_updatedAt_idx" ON "AuthRateLimit"("updatedAt");
+
+ALTER TYPE "AuthAuditEventType" ADD VALUE 'register_failed';
+ALTER TYPE "AuthAuditEventType" ADD VALUE 'password_change_failed';
+ALTER TYPE "AuthAuditEventType" ADD VALUE 'session_rejected';
+ALTER TYPE "AuthAuditEventType" ADD VALUE 'rate_limit_exceeded';

packages/database/prisma/schema.prisma

@@ -69,12 +69,16 @@ enum AuthAuditEventType {
   email_verified
   login_succeeded
   login_failed
+  register_failed
   token_refreshed
   refresh_reuse_detected
   password_change_succeeded
+  password_change_failed
   password_reset_requested
   password_reset_completed
   session_revoked
+  session_rejected
+  rate_limit_exceeded
   logout
   logout_all
 }
@@ -204,6 +208,19 @@ model AuthAuditEvent {
   @@index([eventType, createdAt])
 }
 
+model AuthRateLimit {
+  key         String    @id
+  action      String
+  attempts    Int       @default(0)
+  windowStart DateTime
+  lockedUntil DateTime?
+  createdAt   DateTime  @default(now())
+  updatedAt   DateTime  @updatedAt
+
+  @@index([action, lockedUntil])
+  @@index([updatedAt])
+}
+
 model DevEmailOutbox {
   id        String   @id @default(cuid())
   recipient String

services/auth/app/config.py

@@ -13,6 +13,10 @@ class Settings(BaseSettings):
     email_verification_hours: int = Field(default=24)
     password_reset_minutes: int = Field(default=30)
     expose_dev_tokens: bool = Field(default=True)
+    auth_rate_limit_window_minutes: int = Field(default=15)
+    auth_rate_limit_lockout_minutes: int = Field(default=15)
+    auth_rate_limit_ip_attempts: int = Field(default=20)
+    auth_rate_limit_email_attempts: int = Field(default=5)
 
 
 @lru_cache

services/auth/app/dependencies.py

@@ -18,13 +18,18 @@ async def identity_service(session: Annotated[AsyncSession, Depends(get_session)
     return IdentityService(IdentityRepository(session))
 
 
-async def current_claims(credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(bearer)]) -> dict:
+async def current_claims(
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(bearer)],
+    context: Annotated[RequestContext, Depends(request_context)],
+    service: Annotated[IdentityService, Depends(identity_service)],
+) -> dict:
     if not credentials:
         raise AuthError.invalid_token()
-    return TokenService().decode_access_token(credentials.credentials)
+    claims = TokenService().decode_access_token(credentials.credentials)
+    return await service.require_active_session(claims, context)
 
 
 async def request_context(request: Request) -> RequestContext:
     forwarded_for = request.headers.get("x-forwarded-for")
     ip_address = forwarded_for.split(",")[0].strip() if forwarded_for else (request.client.host if request.client else None)
-    return RequestContext(ip_address=ip_address, user_agent=request.headers.get("user-agent"))
+    return RequestContext(ip_address=ip_address, user_agent=request.headers.get("user-agent"), route=request.url.path, action=request.method)

services/auth/app/errors.py

@@ -10,6 +10,10 @@ def invalid_credentials() -> HTTPException:
     def invalid_token() -> HTTPException:
         return HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
 
+    @staticmethod
+    def rate_limited() -> HTTPException:
+        return HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail="Too many attempts. Try again later")
+
     @staticmethod
     def email_not_verified() -> HTTPException:
         return HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Email verification is required")