Add rate limiting to login endpoint (5 req/sec burst)

Fix syntax errors in torrent table component (missing function and closing tags)
Update default sort to Date Added (Descending) and display Added column
2026-02-07 20:31:27 +03:00 · 2026-02-07 20:19:49 +03:00 · 2026-02-07 20:16:30 +03:00 · 2026-02-07 19:54:14 +03:00
6 changed files with 392 additions and 81 deletions
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -316,6 +316,7 @@ dependencies = [
 "tokio-util",
 "tower 0.4.13",
 "tower-http",
+ "tower_governor",
 "tracing",
 "tracing-subscriber",
 "utoipa",
@@ -801,6 +802,20 @@ dependencies = [
 "parking_lot_core",
 ]

+[[package]]
+name = "dashmap"
+version = "6.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
 [[package]]
 name = "data-encoding"
 version = "2.10.0"
@@ -1084,6 +1099,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"

+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -1108,6 +1129,16 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "forwarded-header-value"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8835f84f38484cc86f110a805655697908257fb9a7af005234060891557198e9"
+dependencies = [
+ "nonempty",
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "frontend"
 version = "0.1.0"
@@ -1214,6 +1245,12 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"

+[[package]]
+name = "futures-timer"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
+
 [[package]]
 name = "futures-util"
 version = "0.3.31"
@@ -1337,6 +1374,29 @@ dependencies = [
 "web-sys",
 ]

+[[package]]
+name = "governor"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9efcab3c1958580ff1f25a2a41be1668f7603d849bb63af523b208a3cc1223b8"
+dependencies = [
+ "cfg-if",
+ "dashmap 6.1.0",
+ "futures-sink",
+ "futures-timer",
+ "futures-util",
+ "getrandom 0.3.4",
+ "hashbrown 0.16.1",
+ "nonzero_ext",
+ "parking_lot",
+ "portable-atomic",
+ "quanta",
+ "rand 0.9.2",
+ "smallvec",
+ "spinning_top",
+ "web-time",
+]
+
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -1348,6 +1408,25 @@ dependencies = [
 "subtle",
 ]

+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.4.0",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -1373,7 +1452,7 @@ checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
 "allocator-api2",
 "equivalent",
- "foldhash",
+ "foldhash 0.1.5",
 ]

 [[package]]
@@ -1381,6 +1460,11 @@ name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]

 [[package]]
 name = "hashlink"
@@ -1569,6 +1653,7 @@ dependencies = [
 "bytes",
 "futures-channel",
 "futures-core",
+ "h2",
 "http 1.4.0",
 "http-body 1.0.1",
 "httparse",
@@ -1578,6 +1663,20 @@ dependencies = [
 "pin-utils",
 "smallvec",
 "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper 1.8.1",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
 ]

 [[package]]
@@ -1600,13 +1699,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f"
 dependencies = [
 "bytes",
+ "futures-channel",
 "futures-core",
+ "futures-util",
 "http 1.4.0",
 "http-body 1.0.1",
 "hyper 1.8.1",
+ "libc",
 "pin-project-lite",
+ "socket2 0.6.2",
 "tokio",
 "tower-service",
+ "tracing",
 ]

 [[package]]
@@ -2229,6 +2333,18 @@ dependencies = [
 "minimal-lexical",
 ]

+[[package]]
+name = "nonempty"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9e591e719385e6ebaeb5ce5d3887f7d5676fceca6411d1925ccc95745f3d6f7"
+
+[[package]]
+name = "nonzero_ext"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -2700,6 +2816,21 @@ dependencies = [
 "yansi",
 ]

+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi",
+ "web-sys",
+ "winapi",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.31.0"
@@ -2806,6 +2937,15 @@ dependencies = [
 "getrandom 0.3.4",
 ]

+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -3196,7 +3336,7 @@ dependencies = [
 "bytes",
 "ciborium",
 "const_format",
- "dashmap",
+ "dashmap 5.5.3",
 "futures",
 "gloo-net 0.6.0",
 "http 1.4.0",
@@ -3375,6 +3515,15 @@ dependencies = [
 "lock_api",
 ]

+[[package]]
+name = "spinning_top"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
+dependencies = [
+ "lock_api",
+]
+
 [[package]]
 name = "spki"
 version = "0.6.0"
@@ -3917,6 +4066,35 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"

+[[package]]
+name = "tonic"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a286e33f82f8a1ee2df63f4fa35c0becf4a85a0cb03091a15fd7bf0b402dc94a"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http 1.4.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "hyper 1.8.1",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2 0.6.2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower 0.5.3",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "tower"
 version = "0.4.13"
@@ -3941,9 +4119,12 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
 "futures-core",
 "futures-util",
+ "indexmap",
 "pin-project-lite",
+ "slab",
 "sync_wrapper",
 "tokio",
+ "tokio-util",
 "tower-layer",
 "tower-service",
 "tracing",
@@ -3988,6 +4169,23 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"

+[[package]]
+name = "tower_governor"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44de9b94d849d3c46e06a883d72d408c2de6403367b39df2b1c9d9e7b6736fe6"
+dependencies = [
+ "axum",
+ "forwarded-header-value",
+ "governor",
+ "http 1.4.0",
+ "pin-project",
+ "thiserror 2.0.18",
+ "tonic",
+ "tower 0.5.3",
+ "tracing",
+]
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -4404,6 +4602,16 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "whoami"
 version = "1.6.1"
@@ -4414,6 +4622,22 @@ dependencies = [
 "wasite",
 ]

+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -4423,6 +4647,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -39,3 +39,4 @@ axum-extra = { version = "0.10", features = ["cookie"] }
 rand = "0.8"
 anyhow = "1.0.101"
 time = { version = "0.3.47", features = ["serde", "formatting", "parsing"] }
+tower_governor = "0.8.0"
--- a/backend/src/handlers/setup.rs
+++ b/backend/src/handlers/setup.rs
@@ -6,6 +6,8 @@ use axum::{
 };
 use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
+use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+use time::Duration;

 #[derive(Deserialize, ToSchema)]
 pub struct SetupRequest {
@@ -41,7 +43,7 @@ pub async fn get_setup_status_handler(State(state): State<AppState>) -> impl Int
    path = "/api/setup",
    request_body = SetupRequest,
    responses(
-        (status = 200, description = "Setup completed"),
+        (status = 200, description = "Setup completed and logged in"),
        (status = 400, description = "Invalid request"),
        (status = 403, description = "Setup already completed"),
        (status = 500, description = "Internal server error")
@@ -49,6 +51,7 @@ pub async fn get_setup_status_handler(State(state): State<AppState>) -> impl Int
 )]
 pub async fn setup_handler(
    State(state): State<AppState>,
+    jar: CookieJar,
    Json(payload): Json<SetupRequest>,
 ) -> impl IntoResponse {
    // 1. Check if setup is already completed (i.e., users exist)
@@ -68,7 +71,6 @@ pub async fn setup_handler(

    // 3. Create User
    // Lower cost for faster login on low-power devices (MIPS routers etc.)
-    // Default is usually 12, which takes ~3s on slow CPUs. 6 should be much faster.
    let password_hash = match bcrypt::hash(&payload.password, 6) {
        Ok(h) => h,
        Err(e) => {
@@ -82,5 +84,42 @@ pub async fn setup_handler(
        return (StatusCode::INTERNAL_SERVER_ERROR, "Failed to create user").into_response();
    }

-    (StatusCode::OK, "Setup completed successfully").into_response()
+    // 4. Auto-Login (Create Session)
+    // Get the created user's ID
+    let user = match state.db.get_user_by_username(&payload.username).await {
+        Ok(Some(u)) => u,
+        Ok(None) => return (StatusCode::INTERNAL_SERVER_ERROR, "User created but not found").into_response(),
+        Err(e) => {
+            tracing::error!("DB error fetching new user: {}", e);
+            return (StatusCode::INTERNAL_SERVER_ERROR, "Database error").into_response();
+        }
+    };
+    let (user_id, _) = user;
+
+    // Create session token
+    let token: String = (0..32).map(|_| {
+        use rand::{distributions::Alphanumeric, Rng};
+        rand::thread_rng().sample(Alphanumeric) as char
+    }).collect();
+
+    // Default expiration: 1 day (since it's not "remember me")
+    let expires_in = 60 * 60 * 24;
+    let expires_at = time::OffsetDateTime::now_utc().unix_timestamp() + expires_in;
+
+    if let Err(e) = state.db.create_session(user_id, &token, expires_at).await {
+        tracing::error!("Failed to create session for new user: {}", e);
+        // Even if session fails, setup is technically complete, but login failed.
+        // We return OK but user will have to login manually.
+        return (StatusCode::OK, "Setup completed, please login").into_response();
+    }
+
+    let mut cookie = Cookie::build(("auth_token", token))
+        .path("/")
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .build();
+
+    cookie.set_max_age(Duration::seconds(expires_in));
+
+    (StatusCode::OK, jar.add(cookie), "Setup completed and logged in").into_response()
 }
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -32,6 +32,7 @@ use tower_http::{
 };
 use utoipa::OpenApi;
 use utoipa_swagger_ui::SwaggerUi;
+use tower_governor::{governor::GovernorConfigBuilder, GovernorLayer};

 #[derive(Clone)]
 pub struct AppState {
@@ -450,12 +451,27 @@ async fn main() {
        }
    });

+    // Rate Limit Configuration for Login
+    // Allow 5 login attempts per IP, regenerating 1 token every second (effectively 5 attempts burst, then 1/sec)
+    let governor_conf = Box::new(
+        GovernorConfigBuilder::default()
+            .per_second(1)
+            .burst_size(5)
+            .finish()
+            .unwrap(),
+    );
+
    let app = Router::new()
        .merge(SwaggerUi::new("/swagger-ui").url("/api-docs/openapi.json", ApiDoc::openapi()))
        // Setup & Auth Routes
        .route("/api/setup/status", get(handlers::setup::get_setup_status_handler))
        .route("/api/setup", post(handlers::setup::setup_handler))
-        .route("/api/auth/login", post(handlers::auth::login_handler))
+        .route(
+            "/api/auth/login",
+            post(handlers::auth::login_handler).layer(GovernorLayer {
+                config: Box::leak(governor_conf),
+            })
+        )
        .route("/api/auth/logout", post(handlers::auth::logout_handler))
        .route("/api/auth/check", get(handlers::auth::check_auth_handler))
        // App Routes
--- a/frontend/src/components/auth/setup.rs
+++ b/frontend/src/components/auth/setup.rs
@@ -48,8 +48,9 @@ pub fn Setup() -> impl IntoView {
            match client.send().await {
                Ok(resp) => {
                    if resp.ok() {
-                        // Redirect to login after setup (full reload to be safe)
-                        let _ = window().location().set_href("/login");
+                        // Redirect to home after setup (auto-login handled by backend)
+                        // Full reload to ensure auth state is refreshed
+                        let _ = window().location().set_href("/");
                    } else {
                        let text = resp.text().await.unwrap_or_default();
                        set_error.set(Some(format!("Hata: {}", text)));
--- a/frontend/src/components/torrent/table.rs
+++ b/frontend/src/components/torrent/table.rs
@@ -45,6 +45,22 @@ fn format_duration(seconds: i64) -> String {
    }
 }

+fn format_date(timestamp: i64) -> String {
+    if timestamp <= 0 {
+        return "-".to_string();
+    }
+    let date = js_sys::Date::new(&wasm_bindgen::JsValue::from_f64((timestamp * 1000) as f64));
+
+    // Simple formatting: YYYY-MM-DD HH:mm
+    let year = date.get_full_year();
+    let month = date.get_month() + 1; // 0-based
+    let day = date.get_date();
+    let hours = date.get_hours();
+    let minutes = date.get_minutes();
+
+    format!("{:04}-{:02}-{:02} {:02}:{:02}", year, month, day, hours, minutes)
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum SortColumn {
    Name,
@@ -54,6 +70,7 @@ enum SortColumn {
    DownSpeed,
    UpSpeed,
    ETA,
+    Added,
 }

 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -66,8 +83,8 @@ enum SortDirection {
 pub fn TorrentTable() -> impl IntoView {
    let store = use_context::<crate::store::TorrentStore>().expect("store not provided");

-    let sort_col = create_rw_signal(SortColumn::Name);
-    let sort_dir = create_rw_signal(SortDirection::Ascending);
+    let sort_col = create_rw_signal(SortColumn::Added);
+    let sort_dir = create_rw_signal(SortDirection::Descending);

    let filtered_torrents = move || {
        let mut torrents = store
@@ -127,6 +144,7 @@ pub fn TorrentTable() -> impl IntoView {
                    let b_eta = if b.eta <= 0 { i64::MAX } else { b.eta };
                    a_eta.cmp(&b_eta)
                }
+                SortColumn::Added => a.added_date.cmp(&b.added_date),
            };
            if dir == SortDirection::Descending {
                cmp.reverse()
@@ -264,6 +282,9 @@ pub fn TorrentTable() -> impl IntoView {
                            <th class="w-24 cursor-pointer hover:bg-base-300 group select-none" on:click=move |_| handle_sort(SortColumn::ETA)>
                                 <div class="flex items-center">"ETA" {move || sort_arrow(SortColumn::ETA)}</div>
                            </th>
+                            <th class="w-32 cursor-pointer hover:bg-base-300 group select-none" on:click=move |_| handle_sort(SortColumn::Added)>
+                                 <div class="flex items-center">"Added" {move || sort_arrow(SortColumn::Added)}</div>
+                            </th>
                        </tr>
                    </thead>
                    <tbody>
@@ -317,6 +338,7 @@ pub fn TorrentTable() -> impl IntoView {
                                    <td class="text-right font-mono text-[11px] opacity-80 text-success">{format_speed(t.down_rate)}</td>
                                    <td class="text-right font-mono text-[11px] opacity-80 text-primary">{format_speed(t.up_rate)}</td>
                                    <td class="text-right font-mono text-[11px] opacity-80">{format_duration(t.eta)}</td>
+                                    <td class="text-right font-mono text-[11px] opacity-60 whitespace-nowrap">{format_date(t.added_date)}</td>
                                </tr>
                            }
                        }).collect::<Vec<_>>()}
@@ -359,6 +381,7 @@ pub fn TorrentTable() -> impl IntoView {
                             <li class="menu-title px-2 py-1 opacity-50 text-[10px] uppercase font-bold">"Sort By"</li>
                             {
                                 let columns = vec![
+                                     (SortColumn::Added, "Date Added"),
                                     (SortColumn::Name, "Name"),
                                     (SortColumn::Size, "Size"),
                                     (SortColumn::Progress, "Progress"),
@@ -400,7 +423,8 @@ pub fn TorrentTable() -> impl IntoView {
                    </div>
                </div>

-                            <div class="overflow-y-auto p-3 pb-20 flex-1 grid grid-cols-1 content-start gap-3">                {move || filtered_torrents().into_iter().map(|t| {
+                <div class="overflow-y-auto p-3 pb-20 flex-1 grid grid-cols-1 content-start gap-3">
+                {move || filtered_torrents().into_iter().map(|t| {
                    let progress_class = if t.percent_complete >= 100.0 { "progress-success" } else { "progress-primary" };
                    let status_str = format!("{:?}", t.status);
                    let status_badge_class = match t.status {
Author	SHA1	Message	Date
spinline	37d13f14d8	Add rate limiting to login endpoint (5 req/sec burst) Some checks failed Build MIPS Binary / build (push) Failing after 3m37s Details	2026-02-07 20:31:27 +03:00
spinline	e23585dfea	Fix syntax errors in torrent table component (missing function and closing tags) All checks were successful Build MIPS Binary / build (push) Successful in 4m23s Details	2026-02-07 20:19:49 +03:00
spinline	9d5092649f	Update default sort to Date Added (Descending) and display Added column Some checks failed Build MIPS Binary / build (push) Failing after 1m18s Details	2026-02-07 20:16:30 +03:00
spinline	9f009bc18b	Auto-login user after setup and redirect to dashboard All checks were successful Build MIPS Binary / build (push) Successful in 4m16s Details	2026-02-07 19:54:14 +03:00