fix: stabilize auth with token invalidation, security hardening, and differentiated paste rate limits

- Invalidate old reset tokens in forgot_password (was select-only, no-op)
- Invalidate old verification tokens in resend_verification_email
- Fix TokenExpiredError to use actual token type instead of hardcoded "access token"
- Narrow get_optional_current_user exception catch to auth-specific errors
- Fix stale get_exempt_key reference in paste routes via module-level access
- Add max_length=512 to LoginRequest fields to prevent Argon2 DoS
- Broaden _verify_password to catch InvalidHashError and HashingError
- Deduplicate password validation logic into shared function
- Add differentiated rate limits: authenticated users get 20/min vs 4/min anonymous
  for paste creation, using slowapi key-based limit resolution

Author: Pdzly

backend/.env.example

@@ -103,6 +103,7 @@ APP_RATELIMIT_DEFAULT=60/minute
 # APP_RATELIMIT_GET_PASTE=10/minute
 # APP_RATELIMIT_GET_PASTE_LEGACY=10/minute
 # APP_RATELIMIT_CREATE_PASTE=4/minute
+# APP_RATELIMIT_CREATE_PASTE_AUTHENTICATED=20/minute
 # APP_RATELIMIT_EDIT_PASTE=4/minute
 # APP_RATELIMIT_DELETE_PASTE=4/minute
 
@@ -116,3 +117,65 @@ APP_RATELIMIT_DEFAULT=60/minute
 # Production deployments should set this to a strong random token
 # APP_METRICS_TOKEN=your_secure_random_token_here
 # Example generation: openssl rand -hex 32
+
+# =============================================================================
+# Authentication Configuration
+# =============================================================================
+
+# JWT Configuration (REQUIRED for auth)
+# IMPORTANT: Change this in production! Must be at least 32 characters.
+# Generate with: openssl rand -hex 32
+APP_JWT_SECRET_KEY=CHANGE_ME_IN_PRODUCTION_32_CHARS_MIN
+# Access token lifetime (default: 15 minutes)
+APP_JWT_ACCESS_TOKEN_EXPIRE_MINUTES=15
+# Refresh token lifetime (default: 7 days)
+APP_JWT_REFRESH_TOKEN_EXPIRE_DAYS=7
+# JWT algorithm (default: HS256)
+APP_JWT_ALGORITHM=HS256
+
+# SMTP Configuration (REQUIRED for email verification and password reset)
+# Leave empty to disable email sending (emails logged instead in dev)
+APP_SMTP_HOST=smtp.example.com
+APP_SMTP_PORT=587
+APP_SMTP_USERNAME=your_smtp_username
+APP_SMTP_PASSWORD=your_smtp_password
+APP_SMTP_FROM_EMAIL=noreply@devbin.dev
+APP_SMTP_USE_TLS=true
+
+# Frontend URL (REQUIRED for email links)
+# Used for verification and password reset links in emails
+APP_FRONTEND_URL=http://localhost:3000
+# Path for email verification links (default: /verify-email)
+APP_EMAIL_VERIFY_PATH=/verify-email
+# Path for password reset links (default: /reset-password)
+APP_PASSWORD_RESET_PATH=/reset-password
+
+# Email Token Expiry
+# Verification token lifetime in hours (default: 24)
+APP_EMAIL_VERIFICATION_EXPIRE_HOURS=24
+# Password reset token lifetime in hours (default: 1)
+APP_PASSWORD_RESET_EXPIRE_HOURS=1
+
+# Auth Rate Limits (optional, these are defaults)
+# Format: <number>/<second|minute|hour|day>
+# APP_RATELIMIT_AUTH_REGISTER=5/hour
+# APP_RATELIMIT_AUTH_LOGIN=10/minute
+# APP_RATELIMIT_AUTH_REFRESH=20/minute
+# APP_RATELIMIT_AUTH_VERIFY_EMAIL=10/minute
+# APP_RATELIMIT_AUTH_RESEND_VERIFICATION=3/hour
+# APP_RATELIMIT_AUTH_FORGOT_PASSWORD=3/hour
+# APP_RATELIMIT_AUTH_RESET_PASSWORD=5/hour
+# APP_RATELIMIT_AUTH_ME=60/minute
+# APP_RATELIMIT_AUTH_LOGOUT=20/minute
+
+# Password Requirements (optional, these are defaults)
+# Minimum password length
+# APP_PASSWORD_MIN_LENGTH=8
+# Require at least one uppercase letter
+# APP_PASSWORD_REQUIRE_UPPERCASE=true
+# Require at least one lowercase letter
+# APP_PASSWORD_REQUIRE_LOWERCASE=true
+# Require at least one digit
+# APP_PASSWORD_REQUIRE_DIGIT=true
+# Require at least one special character
+# APP_PASSWORD_REQUIRE_SPECIAL=false

backend/app/api/dto/auth_dto.py

@@ -0,0 +1,161 @@
+"""Authentication DTOs for request/response models."""
+
+import re
+from datetime import datetime
+
+from pydantic import UUID4, BaseModel, EmailStr, Field, field_validator
+
+from app.config import config
+
+
+def validate_password_requirements(v: str) -> str:
+    """Validate password meets configured requirements."""
+    errors = []
+
+    if config.PASSWORD_REQUIRE_UPPERCASE and not re.search(r"[A-Z]", v):
+        errors.append("at least one uppercase letter")
+
+    if config.PASSWORD_REQUIRE_LOWERCASE and not re.search(r"[a-z]", v):
+        errors.append("at least one lowercase letter")
+
+    if config.PASSWORD_REQUIRE_DIGIT and not re.search(r"\d", v):
+        errors.append("at least one digit")
+
+    if config.PASSWORD_REQUIRE_SPECIAL and not re.search(
+        r"[!@#$%^&*(),.?\":{}|<>]", v
+    ):
+        errors.append("at least one special character")
+
+    if errors:
+        raise ValueError(f"Password must contain {', '.join(errors)}")
+
+    return v
+
+
+class RegisterRequest(BaseModel):
+    """Request model for user registration."""
+
+    username: str = Field(
+        min_length=3,
+        max_length=50,
+        description="Username (3-50 characters, alphanumeric and underscores)",
+        examples=["john_doe"],
+    )
+    email: EmailStr = Field(
+        description="Valid email address",
+        examples=["john@example.com"],
+    )
+    password: str = Field(
+        min_length=config.PASSWORD_MIN_LENGTH,
+        max_length=128,
+        description="Password meeting security requirements",
+    )
+
+    @field_validator("username")
+    @classmethod
+    def validate_username(cls, v: str) -> str:
+        """Validate username format."""
+        if not re.match(r"^[a-zA-Z][a-zA-Z0-9_]*$", v):
+            raise ValueError(
+                "Username must start with a letter and contain only letters, numbers, and underscores"
+            )
+        return v.lower()
+
+    @field_validator("password")
+    @classmethod
+    def validate_password(cls, v: str) -> str:
+        """Validate password meets requirements."""
+        return validate_password_requirements(v)
+
+
+class LoginRequest(BaseModel):
+    """Request model for user login."""
+
+    username: str = Field(
+        min_length=1,
+        max_length=512,
+        description="Username or email",
+        examples=["john_doe"],
+    )
+    password: str = Field(
+        min_length=1,
+        max_length=512,
+        description="User password",
+    )
+
+
+class TokenResponse(BaseModel):
+    """Response model for authentication tokens."""
+
+    access_token: str = Field(description="JWT access token")
+    refresh_token: str = Field(
+        description="JWT refresh token for obtaining new access tokens"
+    )
+    token_type: str = Field(default="Bearer", description="Token type")
+    expires_in: int = Field(description="Access token expiration time in seconds")
+
+
+class RefreshTokenRequest(BaseModel):
+    """Request model for token refresh."""
+
+    refresh_token: str = Field(description="Refresh token to exchange for new tokens")
+
+
+class VerifyEmailRequest(BaseModel):
+    """Request model for email verification."""
+
+    token: str = Field(description="Email verification token")
+
+
+class ForgotPasswordRequest(BaseModel):
+    """Request model for forgot password."""
+
+    email: EmailStr = Field(
+        description="Email address associated with the account",
+        examples=["john@example.com"],
+    )
+
+
+class ResetPasswordRequest(BaseModel):
+    """Request model for password reset."""
+
+    token: str = Field(description="Password reset token")
+    new_password: str = Field(
+        min_length=config.PASSWORD_MIN_LENGTH,
+        max_length=128,
+        description="New password meeting security requirements",
+    )
+
+    @field_validator("new_password")
+    @classmethod
+    def validate_password(cls, v: str) -> str:
+        """Validate password meets requirements."""
+        return validate_password_requirements(v)
+
+
+class ResendVerificationRequest(BaseModel):
+    """Request model for resending verification email."""
+
+    email: EmailStr = Field(
+        description="Email address to resend verification to",
+        examples=["john@example.com"],
+    )
+
+
+class UserResponse(BaseModel):
+    """Response model for user profile."""
+
+    id: UUID4 = Field(description="User UUID")
+    username: str = Field(description="Username")
+    email: EmailStr = Field(description="Email address")
+    is_verified: bool = Field(description="Whether email is verified")
+    created_at: datetime = Field(description="Account creation timestamp")
+    last_login_at: datetime | None = Field(description="Last login timestamp")
+
+    model_config = {"from_attributes": True}
+
+
+class MessageResponse(BaseModel):
+    """Generic message response."""
+
+    message: str = Field(description="Response message")

backend/app/api/subroutes/pastes.py

@@ -9,6 +9,7 @@
 from starlette.requests import Request
 from starlette.responses import PlainTextResponse, Response
 
+import app.ratelimit as ratelimit
 from app.api.dto.Error import ErrorResponse
 from app.api.dto.paste_dto import (
     CreatePaste,
@@ -19,8 +20,9 @@
 )
 from app.config import config
 from app.containers import Container
+from app.dependencies.auth import get_optional_current_user
 from app.exceptions import PasteNotFoundError
-from app.ratelimit import create_limit_resolver, get_exempt_key, limiter
+from app.ratelimit import create_auth_aware_key_func, create_auth_aware_limit_resolver, create_limit_resolver, limiter
 from app.services.paste_service import PasteService
 from app.utils.LRUMemoryCache import LRUMemoryCache
 from app.utils.metrics import cache_operations
@@ -43,6 +45,15 @@ def set_cache(cache_instance: "RedisCache | LRUMemoryCache"):
     cache = cache_instance
 
 
+async def _resolve_optional_user(
+    request: Request,
+    user=Depends(get_optional_current_user),
+):
+    """Resolve optional user and attach to request.state for rate limiter access."""
+    request.state.current_user = user
+    return user
+
+
 edit_token_key_header = APIKeyHeader(name="Authorization", scheme_name="Edit Token")
 delete_token_key_header = APIKeyHeader(name="Authorization", scheme_name="Delete Token")
 
@@ -53,7 +64,7 @@ def set_cache(cache_instance: "RedisCache | LRUMemoryCache"):
     summary="Get legacy Hastebin-format paste",
     description="Retrieve a paste stored in legacy Hastebin format by its ID.",
 )
-@limiter.limit(create_limit_resolver(config, "get_paste_legacy"), key_func=get_exempt_key)
+@limiter.limit(create_limit_resolver(config, "get_paste_legacy"), key_func=lambda r: ratelimit.get_exempt_key(r))
 @inject
 async def get_legacy_paste(
     request: Request,
@@ -96,7 +107,7 @@ async def get_legacy_paste(
     summary="Get paste by UUID",
     description="Retrieve a paste by its UUID identifier.",
 )
-@limiter.limit(create_limit_resolver(config, "get_paste"), key_func=get_exempt_key)
+@limiter.limit(create_limit_resolver(config, "get_paste"), key_func=lambda r: ratelimit.get_exempt_key(r))
 @inject
 async def get_paste_by_uuid(
     request: Request,
@@ -140,7 +151,7 @@ async def get_paste_by_uuid(
     summary="Get raw paste content",
     description="Retrieve only the raw text content of a paste. Useful for curl/wget users.",
 )
-@limiter.limit(create_limit_resolver(config, "get_paste"), key_func=get_exempt_key)
+@limiter.limit(create_limit_resolver(config, "get_paste"), key_func=lambda r: ratelimit.get_exempt_key(r))
 @inject
 async def get_paste_raw(
     request: Request,
@@ -189,12 +200,16 @@ async def get_paste_raw(
     summary="Create a new paste",
     description="Create a new paste with the provided content and metadata.",
 )
-@limiter.limit(create_limit_resolver(config, "create_paste"), key_func=get_exempt_key)
+@limiter.limit(
+    create_auth_aware_limit_resolver(config, "create_paste", "create_paste_authenticated"),
+    key_func=create_auth_aware_key_func(config),
+)
 @inject
 async def create_paste(
     request: Request,
     create_paste_body: CreatePaste,
     paste_service: PasteService = Depends(Provide[Container.paste_service]),
+    _current_user=Depends(_resolve_optional_user),
 ):
     """Create a new paste and return edit/delete tokens."""
     return await paste_service.create_paste(create_paste_body, request.state.user_metadata)
@@ -206,7 +221,7 @@ async def create_paste(
     summary="Edit an existing paste",
     description="Update a paste's content or metadata. Requires a valid edit token.",
 )
-@limiter.limit(create_limit_resolver(config, "edit_paste"), key_func=get_exempt_key)
+@limiter.limit(create_limit_resolver(config, "edit_paste"), key_func=lambda r: ratelimit.get_exempt_key(r))
 @inject
 async def edit_paste(
     request: Request,
@@ -230,7 +245,7 @@ async def edit_paste(
     summary="Delete a paste",
     description="Permanently delete a paste. Requires a valid delete token.",
 )
-@limiter.limit(create_limit_resolver(config, "delete_paste"), key_func=get_exempt_key)
+@limiter.limit(create_limit_resolver(config, "delete_paste"), key_func=lambda r: ratelimit.get_exempt_key(r))
 @inject
 async def delete_paste(
     request: Request,