rate limit cp auth routes

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jasonvarga

routes/cp.php

@@ -122,12 +122,12 @@
 Route::group(['prefix' => 'auth'], function () {
     if (config('statamic.cp.auth.enabled', true)) {
         Route::get('login', [LoginController::class, 'showLoginForm'])->name('login');
-        Route::post('login', [LoginController::class, 'login']);
+        Route::post('login', [LoginController::class, 'login'])->middleware('throttle:statamic.cp.auth');
 
         Route::get('password/reset', [ForgotPasswordController::class, 'showLinkRequestForm'])->name('password.request');
-        Route::post('password/email', [ForgotPasswordController::class, 'sendResetLinkEmail'])->name('password.email');
+        Route::post('password/email', [ForgotPasswordController::class, 'sendResetLinkEmail'])->middleware('throttle:statamic.cp.auth')->name('password.email');
         Route::get('password/reset/{token}', [ResetPasswordController::class, 'showResetForm'])->name('password.reset');
-        Route::post('password/reset', [ResetPasswordController::class, 'reset'])->name('password.reset.action');
+        Route::post('password/reset', [ResetPasswordController::class, 'reset'])->middleware('throttle:statamic.cp.auth')->name('password.reset.action');
 
         if (TwoFactor::enabled()) {
             Route::get('two-factor-challenge', [TwoFactorChallengeController::class, 'index'])->name('two-factor-challenge');

src/Providers/AuthServiceProvider.php

@@ -175,6 +175,10 @@ public function boot()
             return Limit::perMinute(4)->by($request->ip());
         });
 
+        RateLimiter::for('statamic.cp.auth', function (Request $request) {
+            return RateLimiter::limiter('statamic.auth')($request);
+        });
+
         RateLimiter::for('statamic.forms', function (Request $request) {
             return Limit::perMinute(10)->by($request->ip());
         });

tests/Feature/RateLimitingTest.php

@@ -54,6 +54,36 @@ public function forms_endpoint_is_rate_limited()
         $this->post('/!/forms/contact')->assertRateLimited();
     }
 
+    #[Test]
+    public function cp_login_endpoint_is_rate_limited()
+    {
+        collect(range(1, 4))->each(fn () => $this->post('/cp/auth/login')->assertNotRateLimited());
+        $this->post('/cp/auth/login')->assertRateLimited();
+    }
+
+    #[Test]
+    public function cp_password_email_endpoint_is_rate_limited()
+    {
+        collect(range(1, 4))->each(fn () => $this->post('/cp/auth/password/email')->assertNotRateLimited());
+        $this->post('/cp/auth/password/email')->assertRateLimited();
+    }
+
+    #[Test]
+    public function cp_password_reset_endpoint_is_rate_limited()
+    {
+        collect(range(1, 4))->each(fn () => $this->post('/cp/auth/password/reset')->assertNotRateLimited());
+        $this->post('/cp/auth/password/reset')->assertRateLimited();
+    }
+
+    #[Test]
+    public function cp_and_frontend_auth_have_independent_buckets()
+    {
+        collect(range(1, 4))->each(fn () => $this->post('/!/auth/login')->assertNotRateLimited());
+        $this->post('/!/auth/login')->assertRateLimited();
+
+        $this->post('/cp/auth/login')->assertNotRateLimited();
+    }
+
     #[Test]
     public function auth_rate_limiter_can_be_overridden()
     {
@@ -65,6 +95,29 @@ public function auth_rate_limiter_can_be_overridden()
         $this->post('/!/auth/login')->assertRateLimited();
     }
 
+    #[Test]
+    public function cp_auth_rate_limiter_inherits_overrides_to_statamic_auth()
+    {
+        RateLimiter::for('statamic.auth', fn ($request) => Limit::perMinute(2)->by($request->ip()));
+
+        $this->post('/cp/auth/login')->assertNotRateLimited();
+        $this->post('/cp/auth/login')->assertNotRateLimited();
+        $this->post('/cp/auth/login')->assertRateLimited();
+    }
+
+    #[Test]
+    public function cp_auth_rate_limiter_can_be_overridden_independently()
+    {
+        RateLimiter::for('statamic.cp.auth', fn ($request) => Limit::perMinute(2)->by($request->ip()));
+
+        $this->post('/cp/auth/login')->assertNotRateLimited();
+        $this->post('/cp/auth/login')->assertNotRateLimited();
+        $this->post('/cp/auth/login')->assertRateLimited();
+
+        // Frontend auth still uses the default 4/min
+        collect(range(1, 4))->each(fn () => $this->post('/!/auth/login')->assertNotRateLimited());
+    }
+
     #[Test]
     public function forms_rate_limiter_can_be_overridden()
     {