security: login rate limiting, fix health endpoint, harden error handling

- Fix health endpoint returning null time (use time.Now() instead of context value)
- Add LoginRateLimiter: 5 attempts per 15min window, 5min block on brute-force
- Apply rate limiting to login/register endpoints
- Move reset-password to authenticated routes (was unauthenticated — critical vuln)
- Limit response body sizes on proxy/external API calls (prevent memory exhaustion)
- Sanitize error messages in agent chat endpoint (don't leak internal errors)
- Record login success/failure for rate limiting tracking

api/handler_user.go

@@ -136,6 +136,10 @@ func (s *Server) handleLogin(c *gin.Context) {
 
 	// Verify password
 	if !auth.CheckPassword(req.Password, user.PasswordHash) {
+		// Record failed attempt for rate limiting
+		if s.loginLimiter != nil {
+			s.loginLimiter.RecordFailure(c.ClientIP())
+		}
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "Email or password incorrect"})
 		return
 	}
@@ -147,6 +151,11 @@ func (s *Server) handleLogin(c *gin.Context) {
 		return
 	}
 
+	// Clear rate limit on success
+	if s.loginLimiter != nil {
+		s.loginLimiter.RecordSuccess(c.ClientIP())
+	}
+
 	c.JSON(http.StatusOK, gin.H{
 		"token":   token,
 		"user_id": user.ID,

api/rate_limiter.go

@@ -0,0 +1,132 @@
+package api
+
+import (
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+// loginAttempt tracks failed login attempts per IP
+type loginAttempt struct {
+	count    int
+	lastTry  time.Time
+	blockedUntil time.Time
+}
+
+// LoginRateLimiter protects login endpoint from brute-force attacks
+type LoginRateLimiter struct {
+	mu       sync.Mutex
+	attempts map[string]*loginAttempt
+
+	maxAttempts  int           // max failures before blocking
+	blockTime    time.Duration // how long to block after max failures
+	windowTime   time.Duration // time window for counting failures
+}
+
+// NewLoginRateLimiter creates a rate limiter for login attempts
+func NewLoginRateLimiter() *LoginRateLimiter {
+	rl := &LoginRateLimiter{
+		attempts:    make(map[string]*loginAttempt),
+		maxAttempts: 5,
+		blockTime:   5 * time.Minute,
+		windowTime:  15 * time.Minute,
+	}
+
+	// Clean up stale entries every 10 minutes
+	go func() {
+		ticker := time.NewTicker(10 * time.Minute)
+		defer ticker.Stop()
+		for range ticker.C {
+			rl.cleanup()
+		}
+	}()
+
+	return rl
+}
+
+// Check returns true if the IP is allowed to attempt login
+func (rl *LoginRateLimiter) Check(ip string) bool {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	a, exists := rl.attempts[ip]
+	if !exists {
+		return true
+	}
+
+	// Check if still blocked
+	if !a.blockedUntil.IsZero() && time.Now().Before(a.blockedUntil) {
+		return false
+	}
+
+	// Check if window expired — reset
+	if time.Since(a.lastTry) > rl.windowTime {
+		delete(rl.attempts, ip)
+		return true
+	}
+
+	return a.count < rl.maxAttempts
+}
+
+// RecordFailure records a failed login attempt
+func (rl *LoginRateLimiter) RecordFailure(ip string) {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	a, exists := rl.attempts[ip]
+	if !exists {
+		a = &loginAttempt{}
+		rl.attempts[ip] = a
+	}
+
+	// Reset if window expired
+	if time.Since(a.lastTry) > rl.windowTime {
+		a.count = 0
+		a.blockedUntil = time.Time{}
+	}
+
+	a.count++
+	a.lastTry = time.Now()
+
+	if a.count >= rl.maxAttempts {
+		a.blockedUntil = time.Now().Add(rl.blockTime)
+	}
+}
+
+// RecordSuccess clears failed attempts for an IP after successful login
+func (rl *LoginRateLimiter) RecordSuccess(ip string) {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+	delete(rl.attempts, ip)
+}
+
+// cleanup removes stale entries
+func (rl *LoginRateLimiter) cleanup() {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	now := time.Now()
+	for ip, a := range rl.attempts {
+		// Remove if both window and block have expired
+		if now.Sub(a.lastTry) > rl.windowTime && (a.blockedUntil.IsZero() || now.After(a.blockedUntil)) {
+			delete(rl.attempts, ip)
+		}
+	}
+}
+
+// LoginRateLimitMiddleware creates a gin middleware for login rate limiting
+func LoginRateLimitMiddleware(rl *LoginRateLimiter) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		ip := c.ClientIP()
+		if !rl.Check(ip) {
+			c.JSON(http.StatusTooManyRequests, gin.H{
+				"error": "Too many login attempts. Please try again later.",
+			})
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}

api/server.go

@@ -25,6 +25,7 @@ type Server struct {
 	httpServer       *http.Server
 	port             int
 	telegramReloadCh chan<- struct{} // signal Telegram bot to reload
+	loginLimiter     *LoginRateLimiter
 }
 
 // NewServer Creates API server
@@ -41,11 +42,12 @@ func NewServer(traderManager *manager.TraderManager, st *store.Store, cryptoServ
 	cryptoHandler := NewCryptoHandler(cryptoService)
 
 	s := &Server{
-		router:        router,
+		router:       router,
 		traderManager: traderManager,
 		store:         st,
 		cryptoHandler: cryptoHandler,
 		port:          port,
+		loginLimiter:  NewLoginRateLimiter(),
 	}
 
 	// Setup routes
@@ -111,10 +113,12 @@ func (s *Server) setupRoutes() {
 		// Public strategy market (no authentication required)
 		s.route(api, "GET", "/strategies/public", "Public strategy market", s.handlePublicStrategies)
 
-		// Authentication related routes (no authentication required)
-		s.route(api, "POST", "/register", "Register new user", s.handleRegister)
-		s.route(api, "POST", "/login", "User login, returns JWT token", s.handleLogin)
-		s.route(api, "POST", "/reset-password", "Reset password", s.handleResetPassword)
+		// Authentication related routes (no authentication required, rate-limited)
+		authLimited := api.Group("/", LoginRateLimitMiddleware(s.loginLimiter))
+		s.route(authLimited, "POST", "/register", "Register new user", s.handleRegister)
+		s.route(authLimited, "POST", "/login", "User login, returns JWT token", s.handleLogin)
+		// NOTE: reset-password requires authentication since we have no email verification.
+		// This prevents unauthenticated password reset attacks.
 
 		// Routes requiring authentication
 		protected := api.Group("/", s.authMiddleware())
@@ -126,6 +130,7 @@ func (s *Server) setupRoutes() {
 			s.routeWithSchema(protected, "PUT", "/user/password", "Change current user password",
 				`Body: {"new_password":"<string, min 8 chars>"}`,
 				s.handleChangePassword)
+			s.route(protected, "POST", "/reset-password", "Reset password (requires authentication)", s.handleResetPassword)
 
 			// Server IP query (requires authentication, for whitelist configuration)
 			s.route(protected, "GET", "/server-ip", "Get server public IP (for exchange whitelist)", s.handleGetServerIP)
@@ -355,7 +360,7 @@ Returns: {"total_trades":<int>,"winning_trades":<int>,"win_rate":<float>,"total_
 func (s *Server) handleHealth(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{
 		"status": "ok",
-		"time":   c.Request.Context().Value("time"),
+		"time":   time.Now().Format(time.RFC3339),
 	})
 }