feat: authLimiter on POST /login, GET /callback, POST /dev-login (10 req / 5 min)

src/routes/auth.js

@@ -39,7 +39,7 @@ function safeReturn(target) {
   return '/';
 }
 
-function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, MOCK_USERS }) {
+function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, MOCK_USERS, authLimiter }) {
   const router = Router();
 
   // ── GET /login ─────────────────────────────────────────────────────────────
@@ -63,7 +63,7 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, MOCK_USER
   });
 
   // ── POST /login (только mock-режим) ────────────────────────────────────────
-  router.post('/login', doubleCsrfProtection, (req, res) => {
+  router.post('/login', authLimiter, doubleCsrfProtection, (req, res) => {
     if (auth.isOidc) return res.redirect('/login');
 
     const user = MOCK_USERS.find(u => u.id === req.body.user);
@@ -92,7 +92,7 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, MOCK_USER
   });
 
   // ── GET /callback (только OIDC-режим) ──────────────────────────────────────
-  router.get('/callback', async (req, res) => {
+  router.get('/callback', authLimiter, async (req, res) => {
     if (!auth.isOidc) return res.redirect('/login');
 
     const { code, state, error } = req.query;
@@ -152,7 +152,7 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, MOCK_USER
   });
 
   // ── POST /dev-login ────────────────────────────────────────────────────────
-  router.post('/dev-login', doubleCsrfProtection, (req, res) => {
+  router.post('/dev-login', authLimiter, doubleCsrfProtection, (req, res) => {
     if (!auth.devLoginEnabled) return res.status(404).send('Not Found');
 
     if (auth.DEV_SECRET && req.session.devKey !== auth.DEV_SECRET) {