Passport rate limiting: enforce per-agent limits on credential operations

[leocagli]

Context

There is no rate limit on credential operations — an agent can call POST /api/credentials/issue or POST /api/credentials/verify in a tight loop with no back-pressure. This creates a DoS vector and makes it hard to detect brute-force attempts.

What to implement

In-memory sliding window limiter

Per-agent limits (keyed by agentId or caller IP for unauthenticated routes):

• Issue: 10 requests / minute
• Verify: 60 requests / minute
• Revoke: 5 requests / minute

Response when limit exceeded

429 Too Many Requests with:

{ "ok": false, "error": "rate_limit_exceeded", "retryAfterSec": 42 }

And header: Retry-After: 42

Store design

Map<agentId, { windowStart: number, count: number }> — reset window on each new minute boundary.

Acceptance criteria

• 11th issue request within 60s returns 429
• 61st verify request within 60s returns 429
• Response includes retryAfterSec and Retry-After header
• Counter resets after the minute window passes
• Unit test: burst of 15 issue calls → first 10 pass, next 5 all 429

🎁 Evidencia visual = reward extra

• Si tu PR incluye video demo o capturas de pantalla mostrando la funcionalidad pedida funcionando end-to-end, va a ser considerado para rewards de GrantFox en esta issue. No es obligatorio, pero suma mucho para la evaluación.

[aliyuHabibu]

Hi, Please assign the issue to me