security: add IP rate limiting + account lockout on auth endpoints

- Rate limit login (5/min), register (3/hr), refresh (10/min) per IP
- Account lockout after 5 consecutive failed logins (15 min cooldown)
- Fix stored XSS in admin panel (escapeHtml on all user-controlled data)
- All limits configurable via OXICLOUD_RATE_LIMIT_* / OXICLOUD_LOCKOUT_* env vars
- Zero new dependencies (uses existing moka crate for in-memory caches)
- Includes unit tests for lockout service

src/interfaces/api/handlers/auth_handler.rs

@@ -19,9 +19,6 @@ use crate::interfaces::middleware::auth::CurrentUserId;
 pub fn auth_routes() -> Router<Arc<AppState>> {
     // Routes that do NOT require authentication
     let public_routes = Router::new()
-        .route("/register", post(register))
-        .route("/login", post(login))
-        .route("/refresh", post(refresh_token))
         .route("/status", get(get_system_status))
         // OIDC endpoints (all public)
         .route("/oidc/providers", get(oidc_providers))
@@ -40,6 +37,20 @@ pub fn auth_routes() -> Router<Arc<AppState>> {
     public_routes.merge(protected_routes)
 }
 
+/// Rate-limited auth routes — split out so main.rs can apply per-endpoint
+/// rate limiting middleware independently.
+pub fn login_route() -> Router<Arc<AppState>> {
+    Router::new().route("/login", post(login))
+}
+
+pub fn register_route() -> Router<Arc<AppState>> {
+    Router::new().route("/register", post(register))
+}
+
+pub fn refresh_route() -> Router<Arc<AppState>> {
+    Router::new().route("/refresh", post(refresh_token))
+}
+
 async fn register(
     State(state): State<Arc<AppState>>,
     Json(dto): Json<RegisterDto>,
@@ -123,6 +134,25 @@ async fn login(
         }
     };
 
+    // ── Account lockout check ──────────────────────────────────────────
+    // Reject immediately if the account has too many consecutive failures.
+    // This runs BEFORE Argon2 to save CPU under brute-force attacks.
+    if let Err(lockout_secs) = auth_service.login_lockout.check(&dto.username) {
+        tracing::warn!(
+            username = %dto.username,
+            lockout_secs = lockout_secs,
+            "Login rejected — account temporarily locked"
+        );
+        return Err(AppError::new(
+            StatusCode::TOO_MANY_REQUESTS,
+            &format!(
+                "Account temporarily locked due to too many failed attempts. Try again in {} seconds.",
+                lockout_secs
+            ),
+            "AccountLocked",
+        ));
+    }
+
     // Check if password login is disabled (OIDC-only mode)
     if auth_service
         .auth_application_service
@@ -140,6 +170,9 @@ async fn login(
         .await
     {
         Ok(auth_response) => {
+            // ── Successful login — reset lockout counter ──
+            auth_service.login_lockout.record_success(&dto.username);
+
             tracing::info!("Login successful for user: {}", dto.username);
             // Log the response structure for debugging
             tracing::debug!("Auth response: {:?}", &auth_response);
@@ -171,6 +204,8 @@ async fn login(
             Ok(response)
         }
         Err(err) => {
+            // ── Record failed attempt for lockout tracking ──
+            auth_service.login_lockout.record_failure(&dto.username);
             tracing::error!("Login failed for user {}: {}", dto.username, err);
             Err(err.into())
         }

src/interfaces/middleware/mod.rs

@@ -1,2 +1,3 @@
 pub mod auth;
 pub mod csrf;
+pub mod rate_limit;

src/interfaces/middleware/rate_limit.rs

@@ -0,0 +1,202 @@
+//! IP-based rate limiting middleware for authentication endpoints.
+//!
+//! Uses `moka` TTL caches (already a project dependency) to track request
+//! counts per client IP.  Each protected endpoint group gets its own
+//! [`RateLimiter`] instance with independently tuneable limits.
+//!
+//! The middleware extracts the client IP from (in order):
+//! 1. `X-Forwarded-For` header (first entry — set by reverse proxies)
+//! 2. `X-Real-Ip` header
+//! 3. The TCP peer address from the connection info
+//!
+//! When the limit is exceeded a `429 Too Many Requests` response is returned
+//! with a `Retry-After` header indicating how many seconds to wait.
+
+use axum::{
+    extract::ConnectInfo,
+    http::{HeaderValue, Request, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+use moka::sync::Cache;
+use std::net::SocketAddr;
+use std::sync::Arc;
+use std::time::Duration;
+
+/// A simple sliding-window counter keyed by IP address.
+///
+/// Each key lives for `window` seconds; every request increments the counter.
+/// Once the counter reaches `max_requests` the request is rejected.
+#[derive(Clone)]
+pub struct RateLimiter {
+    /// Maps `IP -> request_count` with automatic TTL expiration.
+    cache: Cache<String, u32>,
+    /// Maximum requests allowed within the window.
+    max_requests: u32,
+    /// Window duration in seconds (also used for `Retry-After`).
+    window_secs: u64,
+}
+
+impl RateLimiter {
+    /// Create a new rate limiter.
+    ///
+    /// * `max_requests` — ceiling per IP within the window
+    /// * `window_secs`  — sliding window duration
+    /// * `max_entries`  — upper bound on tracked IPs (evicts LRU when exceeded)
+    pub fn new(max_requests: u32, window_secs: u64, max_entries: u64) -> Self {
+        let cache = Cache::builder()
+            .time_to_live(Duration::from_secs(window_secs))
+            .max_capacity(max_entries)
+            .build();
+        Self {
+            cache,
+            max_requests,
+            window_secs,
+        }
+    }
+
+    /// Check whether the IP is allowed. Returns `Ok(current_count)` or
+    /// `Err(StatusCode::TOO_MANY_REQUESTS)`.
+    pub fn check_and_increment(&self, ip: &str) -> Result<u32, ()> {
+        let key = ip.to_string();
+        // moka's entry API lets us atomically read-modify-write.
+        // On first access the entry is inserted with count = 1 and the TTL
+        // starts. Subsequent accesses within the window increment the count.
+        let count = self
+            .cache
+            .entry(key)
+            .or_insert_with(|| 0)
+            .into_value()
+            + 1;
+
+        // Write back the incremented value.  Because `or_insert_with` returns
+        // the *existing* value when the key was already present, we must always
+        // re-insert so the counter actually advances. The TTL of the **first**
+        // insert still governs eviction because moka uses insert-time TTL.
+        // However, on re-insert moka resets the TTL — for rate limiting this
+        // is fine because it means the window "slides" forward on activity.
+        self.cache
+            .insert(ip.to_string(), count);
+
+        if count > self.max_requests {
+            Err(())
+        } else {
+            Ok(count)
+        }
+    }
+
+    /// Seconds the client should wait before retrying.
+    pub fn retry_after(&self) -> u64 {
+        self.window_secs
+    }
+}
+
+// ─── Axum middleware factories ──────────────────────────────────────────────
+
+/// Extract the most-likely real client IP from headers / connection info.
+pub fn extract_client_ip<B>(req: &Request<B>) -> String {
+    let headers = req.headers();
+
+    // 1. X-Forwarded-For (first entry — closest to the client)
+    if let Some(xff) = headers.get("x-forwarded-for").and_then(|v| v.to_str().ok()) {
+        if let Some(first) = xff.split(',').next() {
+            let ip = first.trim();
+            if !ip.is_empty() {
+                return ip.to_string();
+            }
+        }
+    }
+
+    // 2. X-Real-Ip
+    if let Some(xri) = headers.get("x-real-ip").and_then(|v| v.to_str().ok()) {
+        let ip = xri.trim();
+        if !ip.is_empty() {
+            return ip.to_string();
+        }
+    }
+
+    // 3. TCP peer (ConnectInfo extension set by axum::serve)
+    if let Some(addr) = req.extensions().get::<ConnectInfo<SocketAddr>>() {
+        return addr.0.ip().to_string();
+    }
+
+    // Fallback — should never happen behind axum::serve
+    "unknown".to_string()
+}
+
+/// Build a rate-limit response with the standard `Retry-After` header.
+fn too_many_requests(retry_after: u64) -> Response {
+    let body = serde_json::json!({
+        "error": "Too many requests",
+        "retry_after_secs": retry_after,
+    });
+    let mut resp = (StatusCode::TOO_MANY_REQUESTS, axum::Json(body)).into_response();
+    if let Ok(val) = HeaderValue::from_str(&retry_after.to_string()) {
+        resp.headers_mut().insert("retry-after", val);
+    }
+    resp
+}
+
+/// Axum middleware: rate-limit login attempts.
+///
+/// Inject via:
+/// ```ignore
+/// .layer(axum::middleware::from_fn_with_state(limiter, rate_limit_login))
+/// ```
+pub async fn rate_limit_login(
+    State(limiter): axum::extract::State<Arc<RateLimiter>>,
+    req: Request<axum::body::Body>,
+    next: Next,
+) -> Response {
+    let ip = extract_client_ip(&req);
+    match limiter.check_and_increment(&ip) {
+        Ok(_) => next.run(req).await,
+        Err(()) => {
+            tracing::warn!(
+                ip = %ip,
+                "Rate limit exceeded on login endpoint"
+            );
+            too_many_requests(limiter.retry_after())
+        }
+    }
+}
+
+/// Axum middleware: rate-limit registration attempts.
+pub async fn rate_limit_register(
+    State(limiter): axum::extract::State<Arc<RateLimiter>>,
+    req: Request<axum::body::Body>,
+    next: Next,
+) -> Response {
+    let ip = extract_client_ip(&req);
+    match limiter.check_and_increment(&ip) {
+        Ok(_) => next.run(req).await,
+        Err(()) => {
+            tracing::warn!(
+                ip = %ip,
+                "Rate limit exceeded on register endpoint"
+            );
+            too_many_requests(limiter.retry_after())
+        }
+    }
+}
+
+/// Axum middleware: rate-limit token refresh attempts.
+pub async fn rate_limit_refresh(
+    State(limiter): axum::extract::State<Arc<RateLimiter>>,
+    req: Request<axum::body::Body>,
+    next: Next,
+) -> Response {
+    let ip = extract_client_ip(&req);
+    match limiter.check_and_increment(&ip) {
+        Ok(_) => next.run(req).await,
+        Err(()) => {
+            tracing::warn!(
+                ip = %ip,
+                "Rate limit exceeded on refresh endpoint"
+            );
+            too_many_requests(limiter.retry_after())
+        }
+    }
+}
+
+use axum::extract::State;