feat(auth): add rate limiting to signup, login, and google-login

backend/routes/authRoutes.js

@@ -1,5 +1,5 @@
 import express from 'express';
-import rateLimit from 'express-rate-limit';
+import rateLimit, { ipKeyGenerator } from 'express-rate-limit';
 import {
   signup,
   login,
@@ -16,21 +16,41 @@ import { authMiddleware } from '../middlewares/authMiddleware.js';
 
 const router = express.Router();
 
-// ─── Rate limiter for all 2FA endpoints ───────────────────────────────────────
-// Max 5 attempts per 15 minutes — prevents brute-force on TOTP codes
-const twoFALimiter = rateLimit({
+const RATE_LIMIT_MESSAGE = { message: 'Too many attempts, please try again later' };
+
+const baseAuthLimitOptions = {
   windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 5,
   standardHeaders: true,
   legacyHeaders: false,
-  message: { message: 'Too many attempts, please try again later' },
+  message: RATE_LIMIT_MESSAGE,
+};
+
+const normalizeEmail = (req) => String(req.body?.email ?? '').trim().toLowerCase();
+
+// Max 10 auth attempts per IP per 15 minutes — caps credential stuffing / signup spam
+const authByIpLimiter = rateLimit({
+  ...baseAuthLimitOptions,
+  max: 10,
+  keyGenerator: (req) => ipKeyGenerator(req.ip),
+});
+
+// Max 5 attempts per email per 15 minutes — protects individual accounts from brute-force
+const authByEmailLimiter = rateLimit({
+  ...baseAuthLimitOptions,
+  max: 5,
+  keyGenerator: (req) => normalizeEmail(req) || ipKeyGenerator(req.ip),
+});
+
+// Max 5 attempts per 15 minutes — prevents brute-force on TOTP codes
+const twoFALimiter = rateLimit({
+  ...baseAuthLimitOptions,
+  max: 5,
 });
-// ──────────────────────────────────────────────────────────────────────────────
 
 // Public routes
-router.post('/signup', signup);
-router.post('/login', login);
-router.post('/google-login', googleLogin);
+router.post('/signup', authByIpLimiter, authByEmailLimiter, signup);
+router.post('/login', authByIpLimiter, authByEmailLimiter, login);
+router.post('/google-login', authByIpLimiter, googleLogin);
 
 // 2FA login completion (rate limited — protects TOTP brute-force)
 router.post('/login-2fa', twoFALimiter, loginWith2FA);

backend/src/server.js

@@ -16,6 +16,8 @@ const PORT = process.env.PORT;
 // Initialize express     
 const app = express();
 
+// Required for correct req.ip behind Render / reverse proxies (used by rate limiting)
+app.set('trust proxy', 1);
 
 app.use(
   cors({