feat: implement short-lived grant system for OTP verification and enhance rate limiting across authentication endpoints

config/packages/lexik_jwt_authentication.yaml

@@ -2,4 +2,5 @@ lexik_jwt_authentication:
     secret_key: '%env(resolve:JWT_SECRET_KEY)%'
     public_key: '%env(resolve:JWT_PUBLIC_KEY)%'
     pass_phrase: '%env(JWT_PASSPHRASE)%'
-    token_ttl: 604800
+    token_ttl: 900
+    clock_skew: 5

config/packages/rate_limiter.yaml

@@ -11,3 +11,21 @@ framework:
             policy: 'fixed_window'
             limit: 10
             interval: '1 minute'
+
+        # OTP verify: max 10 attempts per 15 minutes per IP
+        verify_code:
+            policy: 'sliding_window'
+            limit: 10
+            interval: '15 minutes'
+
+        # Token issuance (oauth/token, otp-login): max 10 per 5 minutes per IP
+        token_issue:
+            policy: 'sliding_window'
+            limit: 10
+            interval: '5 minutes'
+
+        # Password reset: max 5 per hour per IP
+        password_reset:
+            policy: 'sliding_window'
+            limit: 5
+            interval: '60 minutes'

config/services.yaml

@@ -48,6 +48,9 @@ services:
     App\Auth\Controller\AuthController:
         arguments:
             $sendCodeLimiter: '@limiter.send_code'
+            $verifyCodeLimiter: '@limiter.verify_code'
+            $tokenIssueLimiter: '@limiter.token_issue'
+            $passwordResetLimiter: '@limiter.password_reset'
 
     App\Payment\Gateway\MellatGateway:
         arguments: