Remaining endpoints for MVP

src/api/server/meta.rs

@@ -4,6 +4,14 @@ use serde_json::json;
 
 use tracing::error;
 
+pub async fn robots_txt() -> impl IntoResponse {
+    (
+        StatusCode::OK,
+        [("content-type", "text/plain")],
+        "# Hello!\n\n# Crawling the public API is allowed\nUser-agent: *\nAllow: /\n",
+    )
+}
+
 pub async fn describe_server() -> impl IntoResponse {
     let domains_str =
         std::env::var("AVAILABLE_USER_DOMAINS").unwrap_or_else(|_| "example.com".to_string());

src/api/server/mod.rs

@@ -15,7 +15,7 @@ pub use account_status::{
 pub use app_password::{create_app_password, list_app_passwords, revoke_app_password};
 pub use email::{confirm_email, request_email_update, update_email};
 pub use invite::{create_invite_code, create_invite_codes, get_account_invite_codes};
-pub use meta::{describe_server, health};
+pub use meta::{describe_server, health, robots_txt};
 pub use password::{request_password_reset, reset_password};
 pub use service_auth::get_service_auth;
 pub use session::{create_session, delete_session, get_session, refresh_session};

src/api/server/password.rs

@@ -2,7 +2,7 @@ use crate::state::AppState;
 use axum::{
     Json,
     extract::State,
-    http::StatusCode,
+    http::{HeaderMap, StatusCode},
     response::{IntoResponse, Response},
 };
 use bcrypt::{hash, DEFAULT_COST};
@@ -15,6 +15,22 @@ fn generate_reset_code() -> String {
     crate::util::generate_token_code()
 }
 
+fn extract_client_ip(headers: &HeaderMap) -> String {
+    if let Some(forwarded) = headers.get("x-forwarded-for") {
+        if let Ok(value) = forwarded.to_str() {
+            if let Some(first_ip) = value.split(',').next() {
+                return first_ip.trim().to_string();
+            }
+        }
+    }
+    if let Some(real_ip) = headers.get("x-real-ip") {
+        if let Ok(value) = real_ip.to_str() {
+            return value.trim().to_string();
+        }
+    }
+    "unknown".to_string()
+}
+
 #[derive(Deserialize)]
 pub struct RequestPasswordResetInput {
     pub email: String,
@@ -22,8 +38,22 @@ pub struct RequestPasswordResetInput {
 
 pub async fn request_password_reset(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(input): Json<RequestPasswordResetInput>,
 ) -> Response {
+    let client_ip = extract_client_ip(&headers);
+    if state.rate_limiters.password_reset.check_key(&client_ip).is_err() {
+        warn!(ip = %client_ip, "Password reset rate limit exceeded");
+        return (
+            StatusCode::TOO_MANY_REQUESTS,
+            Json(json!({
+                "error": "RateLimitExceeded",
+                "message": "Too many password reset requests. Please try again later."
+            })),
+        )
+            .into_response();
+    }
+
     let email = input.email.trim().to_lowercase();
     if email.is_empty() {
         return (

src/api/server/session.rs

@@ -4,6 +4,7 @@ use crate::state::AppState;
 use axum::{
     Json,
     extract::State,
+    http::{HeaderMap, StatusCode},
     response::{IntoResponse, Response},
 };
 use bcrypt::verify;
@@ -11,6 +12,22 @@ use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, info, warn};
 
+fn extract_client_ip(headers: &HeaderMap) -> String {
+    if let Some(forwarded) = headers.get("x-forwarded-for") {
+        if let Ok(value) = forwarded.to_str() {
+            if let Some(first_ip) = value.split(',').next() {
+                return first_ip.trim().to_string();
+            }
+        }
+    }
+    if let Some(real_ip) = headers.get("x-real-ip") {
+        if let Ok(value) = real_ip.to_str() {
+            return value.trim().to_string();
+        }
+    }
+    "unknown".to_string()
+}
+
 #[derive(Deserialize)]
 pub struct CreateSessionInput {
     pub identifier: String,
@@ -28,10 +45,24 @@ pub struct CreateSessionOutput {
 
 pub async fn create_session(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Json(input): Json<CreateSessionInput>,
 ) -> Response {
     info!("create_session called");
 
+    let client_ip = extract_client_ip(&headers);
+    if state.rate_limiters.login.check_key(&client_ip).is_err() {
+        warn!(ip = %client_ip, "Login rate limit exceeded");
+        return (
+            StatusCode::TOO_MANY_REQUESTS,
+            Json(json!({
+                "error": "RateLimitExceeded",
+                "message": "Too many login attempts. Please try again later."
+            })),
+        )
+            .into_response();
+    }
+
     let row = match sqlx::query!(
         "SELECT u.id, u.did, u.handle, u.password_hash, k.key_bytes, k.encryption_version FROM users u JOIN user_keys k ON u.id = k.user_id WHERE u.handle = $1 OR u.email = $1",
         input.identifier