Harden validation, improve runtime security and refactor core services

server/src/routes/init.rs

@@ -10,18 +10,35 @@ pub async fn handler(
 ) -> Result<Json<InitResponse>, SessionError> {
     let start_http = std::time::Instant::now();
     let config = state.get_config();
-    
+
+    // Rate limit session creation by public key to prevent storage exhaustion.
+    if !state.rate_limiter.check(
+        &payload.public_key,
+        config.rate_limit_count,
+        config.rate_limit_window_secs,
+    ) {
+        return Err(SessionError::RateLimited);
+    }
+
     let start_db = std::time::Instant::now();
     let resp = crate::session::create_session(&state.db_pool, &config, &payload.public_key);
     let db_dur = start_db.elapsed().as_nanos() as u64;
-    state.storage_latency_ns.fetch_add(db_dur, std::sync::atomic::Ordering::Relaxed);
-    state.storage_ops_count.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    state
+        .storage_latency_ns
+        .fetch_add(db_dur, std::sync::atomic::Ordering::Relaxed);
+    state
+        .storage_ops_count
+        .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
 
     let resp = resp?;
 
     let http_dur = start_http.elapsed().as_nanos() as u64;
-    state.http_latency_ns.fetch_add(http_dur, std::sync::atomic::Ordering::Relaxed);
-    state.http_ops_count.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    state
+        .http_latency_ns
+        .fetch_add(http_dur, std::sync::atomic::Ordering::Relaxed);
+    state
+        .http_ops_count
+        .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
 
     Ok(Json(resp))
 }