[HIGH] No rate limiting configured for API endpoints

[aatmmr]

Summary

The API does not implement any rate limiting, violating the project's own security requirement that "Rate limiting must be in place for all API endpoints." This exposes the application to brute-force attacks, denial-of-service (DoS), and resource exhaustion.

Description

The src/Program.cs file does not call builder.Services.AddRateLimiter() or app.UseRateLimiter(). No rate limiting middleware is configured anywhere in the application pipeline.

Without rate limiting:

• An attacker can flood POST /api/v1/gods with requests to exhaust database resources.
• The DELETE /api/v1/gods endpoint can be called repeatedly.
• GET endpoints can be abused for scraping or DoS attacks.
• Search endpoints (GET /api/v1/gods/search/{name}) can be abused for enumeration.

Implementation

1. Add the rate limiter service in src/Program.cs:

   builder.Services.AddRateLimiter(options =>
   {
       options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
       options.AddFixedWindowLimiter("fixed", opt =>
       {
           opt.PermitLimit = 100;
           opt.Window = TimeSpan.FromMinutes(1);
           opt.QueueLimit = 0;
       });
   });

2. Add app.UseRateLimiter() to the middleware pipeline before endpoint mapping.
3. Apply rate limiting to endpoint groups:

   gods.RequireRateLimiting("fixed");

4. Consider different rate limits for read vs. write operations.
5. Add integration tests that verify 429 Too Many Requests is returned when limits are exceeded.

References

• src/Program.cs — missing rate limiter configuration
• .github/copilot-instructions.md — "Rate limiting must be in place for all API endpoints"
• ASP.NET Core Rate Limiting docs: https://learn.microsoft.com/en-us/aspnet/core/performance/rate-limit