feat(security): implement persistent session secret and DB-backed sliding-window rate limiting

tests/test_server.py

@@ -510,6 +510,43 @@ class TestServerComponent(unittest.TestCase):
         info_disabled = Server.get_user_totp_info("admin", db_path=self.test_db)
         self.assertFalse(info_disabled["enabled"])
 
+    def test_persistent_session_secret_and_rate_limiting(self):
+        """Tests DB persistence of session secret and sliding window rate limiting."""
+        Server.init_db(self.test_db)
+
+        # 1. Session secret persistence
+        sec1 = Server.get_session_secret(self.test_db)
+        self.assertTrue(len(sec1) >= 32)
+        conn = sqlite3.connect(self.test_db)
+        c = conn.cursor()
+        c.execute("SELECT value FROM server_meta WHERE key = 'session_secret'")
+        row = c.fetchone()
+        conn.close()
+        self.assertIsNotNone(row)
+        self.assertEqual(row[0], sec1)
+
+        # Token generated with test_db
+        token = Server.generate_session_token("admin", db_path=self.test_db)
+        self.assertEqual(Server.verify_session_token(token, db_path=self.test_db), "admin")
+
+        # 2. Rate limiting
+        test_ip = "10.0.0.99"
+        Server.reset_failed_ip_attempts(test_ip, scope="login", db_path=self.test_db)
+
+        self.assertTrue(Server.check_ip_rate_limit(test_ip, max_attempts=3, window_seconds=60, scope="login", db_path=self.test_db))
+        Server.record_failed_ip_attempt(test_ip, scope="login", db_path=self.test_db)
+        Server.record_failed_ip_attempt(test_ip, scope="login", db_path=self.test_db)
+        self.assertTrue(Server.check_ip_rate_limit(test_ip, max_attempts=3, window_seconds=60, scope="login", db_path=self.test_db))
+
+        Server.record_failed_ip_attempt(test_ip, scope="login", db_path=self.test_db)
+        self.assertFalse(Server.check_ip_rate_limit(test_ip, max_attempts=3, window_seconds=60, scope="login", db_path=self.test_db))
+
+        # Different scope ('enroll') should still be allowed
+        self.assertTrue(Server.check_ip_rate_limit(test_ip, max_attempts=3, window_seconds=60, scope="enroll", db_path=self.test_db))
+
+        Server.reset_failed_ip_attempts(test_ip, scope="login", db_path=self.test_db)
+        self.assertTrue(Server.check_ip_rate_limit(test_ip, max_attempts=3, window_seconds=60, scope="login", db_path=self.test_db))
+
 
 if __name__ == "__main__":
     unittest.main()