Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)

internal/shared/errors/errors.go

@@ -3,9 +3,9 @@ package errors
 import "errors"
 
 var (
-	ErrNotFound          = errors.New("resource not found")
-	ErrAlreadyExists     = errors.New("resource already exists")
-	ErrInvalidInput      = errors.New("invalid input")
-	ErrUnauthorized      = errors.New("unauthorized")
+	ErrNotFound           = errors.New("resource not found")
+	ErrAlreadyExists      = errors.New("resource already exists")
+	ErrInvalidInput       = errors.New("invalid input")
+	ErrUnauthorized       = errors.New("unauthorized")
 	ErrInvalidCredentials = errors.New("invalid credentials")
 )

internal/shared/utils/date_utils_test.go

@@ -21,25 +21,25 @@ func TestShouldAppearToday_Weekly(t *testing.T) {
 	}{
 		{
 			name:         "Monday when Monday is specified",
-			specificDays: []int{1}, // Monday
+			specificDays: []int{1},                                    // Monday
 			targetDate:   time.Date(2025, 1, 6, 0, 0, 0, 0, time.UTC), // Monday
 			expected:     true,
 		},
 		{
 			name:         "Tuesday when Monday is specified",
-			specificDays: []int{1}, // Monday
+			specificDays: []int{1},                                    // Monday
 			targetDate:   time.Date(2025, 1, 7, 0, 0, 0, 0, time.UTC), // Tuesday
 			expected:     false,
 		},
 		{
 			name:         "Wednesday when Mon/Wed/Fri specified",
-			specificDays: []int{1, 3, 5}, // Mon, Wed, Fri
+			specificDays: []int{1, 3, 5},                              // Mon, Wed, Fri
 			targetDate:   time.Date(2025, 1, 8, 0, 0, 0, 0, time.UTC), // Wednesday
 			expected:     true,
 		},
 		{
 			name:         "Sunday when Mon/Wed/Fri specified",
-			specificDays: []int{1, 3, 5}, // Mon, Wed, Fri
+			specificDays: []int{1, 3, 5},                              // Mon, Wed, Fri
 			targetDate:   time.Date(2025, 1, 5, 0, 0, 0, 0, time.UTC), // Sunday
 			expected:     false,
 		},

internal/shared/validation/common_passwords.go

@@ -0,0 +1,63 @@
+package validation
+
+import "strings"
+
+var commonPasswords = map[string]bool{
+	"123456":      true,
+	"password":    true,
+	"123456789":   true,
+	"12345678":    true,
+	"12345":       true,
+	"1234567":     true,
+	"password1":   true,
+	"123123":      true,
+	"1234567890":  true,
+	"000000":      true,
+	"abc123":      true,
+	"1234":        true,
+	"qwerty":      true,
+	"111111":      true,
+	"123321":      true,
+	"dragon":      true,
+	"master":      true,
+	"monkey":      true,
+	"letmein":     true,
+	"login":       true,
+	"princess":    true,
+	"qwertyuiop":  true,
+	"solo":        true,
+	"passw0rd":    true,
+	"starwars":    true,
+	"iloveyou":    true,
+	"welcome":     true,
+	"admin":       true,
+	"sunshine":    true,
+	"password123": true,
+	"123qwe":      true,
+	"654321":      true,
+	"superman":    true,
+	"1qaz2wsx":    true,
+	"trustno1":    true,
+	"charlie":     true,
+	"666666":      true,
+	"qazwsx":      true,
+	"freedom":     true,
+	"football":    true,
+	"baseball":    true,
+	"whatever":    true,
+	"jordan":      true,
+	"killer":      true,
+	"summer":      true,
+	"hockey":      true,
+	"bailey":      true,
+	"shadow":      true,
+	"master123":   true,
+	"ninja":       true,
+	"mustang":     true,
+	"password!":   true,
+}
+
+func IsCommonPassword(password string) bool {
+	lower := strings.ToLower(password)
+	return commonPasswords[lower]
+}

internal/shared/validation/validator.go

@@ -92,6 +92,10 @@ func ValidatePassword(password string) error {
 		return ValidationError{Field: "password", Message: "password must contain at least one special character"}
 	}
 
+	if IsCommonPassword(password) {
+		return ValidationError{Field: "password", Message: "password is too common, please choose a more secure password"}
+	}
+
 	return nil
 }