Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests. Security improvements: - Rate limiting by user ID for /habits and /stats endpoints - X-RateLimit-Limit header in responses - Common password blacklist in password validation - Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)
2025-11-27 10:33:01 +01:00
parent bbe0757ab6
commit 7cb2756b67
17 changed files with 350 additions and 71 deletions
@@ -278,4 +278,3 @@ func TestGetHabitEntriesHandler_RequiresPaginationWithLongDateRange(t *testing.T
 		t.Errorf("Expected ErrInvalidInput for date range > 1 year without pagination, got %v", err)
 	}
 }
-