[ranjan1969x]

Summary

This PR adds comprehensive unit and regression test coverage for rateLimiter middleware in backend/src/middleware/__tests__/rateLimiter.test.ts, addressing Redis outages / fail-open resilience, key isolation across identity dimensions, and reset header contracts.

Closes #2091

Details of Changes

• Identity Key Isolation:
  • loginRateLimiter: Tests compound key generator (${ip}:${publicKey}) ensuring distinct public keys on the same client IP do not share rate limit budgets.
  • ipLoginRateLimiter: Tests aggregate IP-based limiting enforcing max attempts across all public keys from a single IP.
• Reset Headers & Standard 429 Contract:
  • challengeRateLimiter: Validates standard RateLimit-* headers on accepted requests and verifies that exhausting the budget returns HTTP 429 with compliant Retry-After: 60 header and error JSON.
  • verifyRateLimiter: Validates 429 response structure and Retry-After reset header when verification limit is exceeded.
• Redis Outages & Fail-Open Resilience:
  • Verifies that when Redis sendCommand times out or rejects with ETIMEDOUT, the middleware fails open gracefully (passOnStoreError: true), allowing incoming requests through to next() rather than returning 500 errors.

Verification & CI Proof

• npm run lint: Passed (0 errors)
• npm run build: Passed (0 errors)
• npm test -- src/middleware/__tests__/rateLimiter.test.ts: 8/8 tests passing (100% green)