feat: add rate limiting middleware to Rust backend

[Rayyanah0]

Summary

Closes #198

Adds per-IP sliding-window rate limiting to the Rust backend service, matching the shape of the existing TypeScript middleware/rateLimiter.ts.

---

What changed

New: backend/src/rate_limiter.rs

A hand-rolled tower::Layer / tower::Service implementation:

• Per-IP bucketing using Arc<Mutex<HashMap<String, Bucket>>> (no extra runtime deps)
• Sliding window — timestamps of in-window requests are kept per IP; stale entries are pruned on each request
• Configurable via environment variables (mirrors the TS implementation):

Env var	Default	Description
RATE_LIMIT_POINTS	60	Max requests per window
RATE_LIMIT_DURATION	60	Window size in seconds

• X-Forwarded-For header used as IP key when present (first entry), falls back to socket peer address
• Returns 429 Too Many Requests with:
  • Retry-After: <seconds> header
  • JSON body { "error": "Too many requests…", "retryAfter": <seconds> }

Modified: backend/src/main.rs

Wires the RateLimiterLayer onto all routes; fixes missing cancel_invoice import.

Modified: backend/Cargo.toml

Adds tower = { version = "0.5", features = ["util"] }.

Other fixes (pre-existing bugs unblocked by compilation)

• routes/mod.rs: cancel module was not declared (compile error)
• routes/cancel.rs, refund.rs: SorobanClient::new called with 2 args instead of 3
• routes/health.rs: type mismatch in mock server handler; axum::serve usage fixed
• routes/pay.rs, cancel.rs, refund.rs: 415 vs 422 assertion made accurate
• src/routes.rs renamed to src/handlers.rs to resolve module-name conflict with src/routes/ directory

---

Test output

running 14 tests
test rate_limiter::tests::test_429_response_body_contains_error_and_retry_after ... ok
test rate_limiter::tests::test_429_response_has_retry_after_header ... ok
test rate_limiter::tests::test_request_beyond_limit_returns_429 ... ok
test rate_limiter::tests::test_requests_within_limit_are_allowed ... ok
test rate_limiter::tests::test_x_forwarded_for_used_for_ip_key ... ok
test rate_limiter::tests::test_limit_resets_after_window_expires ... ok
test routes::cancel::tests::test_cancel_invoice_missing_body_returns_422 ... ok
test routes::cancel::tests::test_cancel_invoice_unreachable_rpc_returns_error ... ok
test routes::health::tests::returns_200_when_all_dependencies_are_healthy ... ok
test routes::health::tests::returns_503_when_any_dependency_is_degraded ... ok
test routes::pay::tests::test_pay_invoice_missing_body_returns_422 ... ok
test routes::pay::tests::test_pay_invoice_unreachable_rpc_returns_5xx_or_404 ... ok
test routes::refund::tests::test_refund_invoice_missing_body_returns_422 ... ok
test routes::refund::tests::test_refund_invoice_unreachable_rpc_returns_error ... ok

test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.46s

---

Request / Response examples

Request within limit — passes through normally

POST /invoices/42/pay HTTP/1.1
Content-Type: application/json

{ "payer": "GPAYER…", "signed_xdr": "AAAA==" }

Response: 200 OK (normal route handling)

Request beyond limit — 429

GET /invoices/42 HTTP/1.1
X-Forwarded-For: 1.2.3.4

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 58

{
  "error": "Too many requests. Please retry after the indicated number of seconds.",
  "retryAfter": 58
}

---

Configuration

# Optional — defaults shown
RATE_LIMIT_POINTS=60
RATE_LIMIT_DURATION=60

[drips-wave]

@Rayyanah0 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits