2 Commits

Author	SHA1	Message	Date
Danijel Martinek	b61bb0c11e	feat(auth): add signIn rate-limit backfill with dual ip/account budgets ... Wires the rate-limit primitive end-to-end through auth.signIn as the canonical credential-stuffing defence example: - manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case - use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError - binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed - tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure - tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit budget-1 ip + account rejection; coverage 100% on use-cases layer - ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget objects ({name,window,budget}) in addition to plain string literals, no-undeclared-rate-limit passes on both "ip" and "account" call sites Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-20 09:22:41 +00:00
Danijel Martinek	18cef2f889	feat(core-eslint): add no-undeclared-rate-limit conformance rule ... Adds the `no-undeclared-rate-limit` ESLint rule (warn severity) that enforces rate-limit drift at lint time: - Warns when rateLimit.consume("X", _) is called inside a use-case but "X" is absent from manifest.useCases[name].rateLimit - Warns when a declared rateLimit budget has no matching consume call in the use-case body (unusedDeclaration) - Is a no-op outside use-case files Extends _manifest-ast.js to extract the rateLimit[] field from both parseManifestUseCases and parseManifestFully. Updates _manifest-ast tests to include the new field in expected shapes. Registers the rule at warn severity in plugin.js and base.js. Adds RuleTester fixtures for all four cases (declared+matching, undeclared, unused, non-use-case). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-20 08:43:30 +00:00