Throttle failed admin password attempts per client IP

[FZambia]

Summary

POST /admin/auth had no rate limiting, so an attacker with network reach could brute-force admin.password at full speed. See GHSA-8w47-3f5r-h9xm.

Adds a small, dependency-free AuthThrottle middleware (stdlib only) that limits failed attempts per client IP within a window (10/min) and wraps the auth route with it.

Design — closes brute-force without blocking a valid login

• Only failures count, and the per-IP limit is checked before the password compare. A caller with valid credentials is never throttled — including while another source is attacking — because success never accrues and each IP is tracked independently. Checking the limit first also means an over-limit request is rejected before the compare, so the response does not leak whether a guess was correct (returning 200 for a correct guess even when throttled would let an attacker test at full speed and defeat the limit).
• Memory bounded: per-IP map is reset each window and hard-capped at 10k entries.
• No spoofing / no new DoS: X-Real-IP / X-Forwarded-For are trusted only when the socket peer is a private/loopback address (a local proxy or LB). A direct public client's headers are ignored, so they can't be forged to evade throttling or lock out another IP. Header values are validated/canonicalized as IPs, so junk can't inflate map keys.

Works out of the box for both direct deployments (peer = real client) and behind-LB deployments (peer = private proxy → real client IP from the header), with no new config.

Best-effort by design

This is defense in depth. The route registration documents that the primary protection of the admin endpoint must be at the infrastructure level (firewall rules, private network, authenticating reverse proxy). The throttle raises the bar; it is not a substitute for restricting access.

Reuse

middleware.NewAuthThrottle(max, window, isFailure) + .Middleware(h) can wrap any auth-style endpoint; the isFailure func(int) bool predicate (default: any 4xx+) lets callers define what counts.

Tests

• internal/middleware/auththrottle_test.go — per-IP limiting; other IPs & successes not blocked during an attack; public peer can't spoof the header; window reset; map bounded; IP-source precedence.
• internal/admin/handlers_test.go TestAuthHandler_Throttled — end-to-end through the real /admin/auth route.

All pass; existing admin tests unchanged.