SA-005 addressed by updateing ratelimiting

backend/tests/test_api.py

@@ -13,6 +13,7 @@ from fastapi.testclient import TestClient
 from backend.app.main import app
 from backend.app.database import get_connection
 from backend.app.services.email_service import get_smtp_settings
+from backend.app.services.login_throttle import clear_login_failures
 from backend.app.services.password_reset import create_reset_token
 from backend.app.services.token_service import issue_token
 
@@ -53,6 +54,20 @@ def test_login_returns_token():
     assert client.get('/api/auth/me', params={'token': payload['access_token']}).status_code == 401
 
 
+def test_login_rate_limit_locks_out_after_five_failures_and_resets_on_success():
+    email = f'unknown-{uuid4().hex}@example.com'
+    for attempt in range(5):
+        response = client.post('/api/auth/login', json={'email': email, 'password': 'wrong-password'})
+        assert response.status_code == 401, attempt
+    locked = client.post('/api/auth/login', json={'email': email, 'password': 'wrong-password'})
+    assert locked.status_code == 429
+    assert int(locked.headers['Retry-After']) > 0
+
+    clear_login_failures('testclient', email)
+    valid = client.post('/api/auth/login', json={'email': 'alice@example.com', 'password': 'secret123'})
+    assert valid.status_code == 200
+
+
 def test_password_hashes_are_salted_and_legacy_hashes_upgrade_on_login():
     from hashlib import sha256
     from backend.app.database import hash_password