Implement rate limiting and enhance authentication flow

- Added rate limiting configuration for authentication endpoints, allowing customizable request limits via environment variables.
- Updated authentication flow to utilize HttpRequest for cookie management, ensuring secure handling of refresh tokens.
- Introduced a new endpoint to retrieve user subscription details.
- Enhanced the handling of Telegram bot token validation to prevent errors with empty tokens.
- Updated the application to serialize enums as strings for better documentation and compatibility with TypeScript.
- Improved test coverage for new features and adjustments in command handlers.

backend/tests/PnvPanel.Application.Tests/Admin/Inbounds/PublishInboundCommandHandlerTests.cs

@@ -1,4 +1,6 @@
+using NSubstitute;
 using PnvPanel.Application.Admin.Inbounds;
+using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Tests.TestSupport;
 using PnvPanel.Domain.Inbounds;
 using Xunit;
@@ -7,6 +9,8 @@ namespace PnvPanel.Application.Tests.Admin.Inbounds;
 
 public class PublishInboundCommandHandlerTests
 {
+    private readonly ICurrentUser _currentUser = Substitute.For<ICurrentUser>();
+
     [Fact]
     public async Task Handle_WhenPublishingExistingInbound_UpdatesPublishState()
     {
@@ -16,7 +20,7 @@ public class PublishInboundCommandHandlerTests
         await dbContext.SaveChangesAsync(CancellationToken.None);
 
         var roleId = Guid.NewGuid();
-        var handler = new PublishInboundCommandHandler(dbContext);
+        var handler = new PublishInboundCommandHandler(dbContext, _currentUser);
 
         var command = new PublishInboundCommand(inbound.Id, true, "EU Fast", [roleId], 100);
 
@@ -39,7 +43,7 @@ public class PublishInboundCommandHandlerTests
         dbContext.Inbounds.Add(inbound);
         await dbContext.SaveChangesAsync(CancellationToken.None);
 
-        var handler = new PublishInboundCommandHandler(dbContext);
+        var handler = new PublishInboundCommandHandler(dbContext, _currentUser);
 
         var command = new PublishInboundCommand(inbound.Id, false, null, [], null);
 
@@ -54,7 +58,7 @@ public class PublishInboundCommandHandlerTests
     {
         using var dbContext = InMemoryDbContextFactory.Create();
 
-        var handler = new PublishInboundCommandHandler(dbContext);
+        var handler = new PublishInboundCommandHandler(dbContext, _currentUser);
 
         var command = new PublishInboundCommand(Guid.NewGuid(), true, "EU Fast", [], null);
 

backend/tests/PnvPanel.Application.Tests/Admin/Nodes/RegisterNodeCommandHandlerTests.cs

@@ -11,6 +11,7 @@ public class RegisterNodeCommandHandlerTests
 {
     private readonly IXuiPanelGateway _gateway = Substitute.For<IXuiPanelGateway>();
     private readonly ISecretProtector _secretProtector = Substitute.For<ISecretProtector>();
+    private readonly ICurrentUser _currentUser = Substitute.For<ICurrentUser>();
 
     [Fact]
     public async Task Handle_WithValidAddress_RegistersNodeWithProtectedPassword()
@@ -20,7 +21,7 @@ public class RegisterNodeCommandHandlerTests
         _gateway.ValidateBaseAddress(Arg.Any<Uri>()).Returns(Result.Success());
         _secretProtector.Protect("secret-password").Returns("protected-secret-password");
 
-        var handler = new RegisterNodeCommandHandler(dbContext, _gateway, _secretProtector);
+        var handler = new RegisterNodeCommandHandler(dbContext, _gateway, _secretProtector, _currentUser);
 
         var command = new RegisterNodeCommand("node-1", "https://node1.example.com", "admin", "secret-password", "eu-west");
 
@@ -38,7 +39,7 @@ public class RegisterNodeCommandHandlerTests
     {
         using var dbContext = InMemoryDbContextFactory.Create();
 
-        var handler = new RegisterNodeCommandHandler(dbContext, _gateway, _secretProtector);
+        var handler = new RegisterNodeCommandHandler(dbContext, _gateway, _secretProtector, _currentUser);
 
         var command = new RegisterNodeCommand("node-1", "not-a-uri", "admin", "secret-password", null);
 
@@ -58,7 +59,7 @@ public class RegisterNodeCommandHandlerTests
         var error = Error.Validation("Nodes.SchemeNotAllowed", "Разрешён только HTTPS.");
         _gateway.ValidateBaseAddress(Arg.Any<Uri>()).Returns(Result.Failure(error));
 
-        var handler = new RegisterNodeCommandHandler(dbContext, _gateway, _secretProtector);
+        var handler = new RegisterNodeCommandHandler(dbContext, _gateway, _secretProtector, _currentUser);
 
         var command = new RegisterNodeCommand("node-1", "http://node1.example.com", "admin", "secret-password", null);
 

backend/tests/PnvPanel.Application.Tests/Admin/Users/ChangeUserRoleCommandHandlerTests.cs

@@ -2,6 +2,7 @@ using NSubstitute;
 using PnvPanel.Application.Admin.Users;
 using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Models;
+using PnvPanel.Application.Tests.TestSupport;
 using Xunit;
 
 namespace PnvPanel.Application.Tests.Admin.Users;
@@ -9,35 +10,42 @@ namespace PnvPanel.Application.Tests.Admin.Users;
 public class ChangeUserRoleCommandHandlerTests
 {
     private readonly IRoleService _roleService = Substitute.For<IRoleService>();
+    private readonly ICurrentUser _currentUser = Substitute.For<ICurrentUser>();
 
     [Fact]
     public async Task Handle_DelegatesToRoleServiceAndReturnsSuccess()
     {
+        using var dbContext = InMemoryDbContextFactory.Create();
+
         var userId = Guid.NewGuid();
         var roleId = Guid.NewGuid();
         _roleService.ChangeUserRoleAsync(userId, roleId, Arg.Any<CancellationToken>()).Returns(Result.Success());
 
-        var handler = new ChangeUserRoleCommandHandler(_roleService);
+        var handler = new ChangeUserRoleCommandHandler(_roleService, dbContext, _currentUser);
 
         var result = await handler.Handle(new ChangeUserRoleCommand(userId, roleId), CancellationToken.None);
 
         Assert.True(result.IsSuccess);
         await _roleService.Received(1).ChangeUserRoleAsync(userId, roleId, Arg.Any<CancellationToken>());
+        Assert.Single(dbContext.AuditLogs.Local);
     }
 
     [Fact]
     public async Task Handle_WhenRoleServiceFails_PropagatesFailure()
     {
+        using var dbContext = InMemoryDbContextFactory.Create();
+
         var userId = Guid.NewGuid();
         var roleId = Guid.NewGuid();
         var error = UserErrors.NotFound;
         _roleService.ChangeUserRoleAsync(userId, roleId, Arg.Any<CancellationToken>()).Returns(Result.Failure(error));
 
-        var handler = new ChangeUserRoleCommandHandler(_roleService);
+        var handler = new ChangeUserRoleCommandHandler(_roleService, dbContext, _currentUser);
 
         var result = await handler.Handle(new ChangeUserRoleCommand(userId, roleId), CancellationToken.None);
 
         Assert.False(result.IsSuccess);
         Assert.Equal(error, result.Error);
+        Assert.Empty(dbContext.AuditLogs.Local);
     }
 }

backend/tests/PnvPanel.Application.Tests/Auth/GetCurrentUserQueryHandlerTests.cs

@@ -40,7 +40,7 @@ public class GetCurrentUserQueryHandlerTests
     public async Task Handle_AuthenticatedWithProfile_ReturnsCurrentUserDto()
     {
         var userId = Guid.NewGuid();
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 3);
+        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 3, "sub-token");
         _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);
         _identityService.GetTelegramLinkInfoAsync(userId, Arg.Any<CancellationToken>())
             .Returns(new TelegramLinkInfo(true, 42, "alice_tg"));

backend/tests/PnvPanel.Application.Tests/Auth/LoginCommandHandlerTests.cs

@@ -20,7 +20,7 @@ public class LoginCommandHandlerTests
     {
         var userId = Guid.NewGuid();
         var authUser = new AuthenticatedUser(userId, "alice", "user");
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", IsActivated: true, IsBlocked: false, MaxConfigs: 3);
+        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", IsActivated: true, IsBlocked: false, MaxConfigs: 3, SubscriptionToken: "sub-token");
 
         _identityService.ValidateCredentialsAsync("alice", "P@ssw0rd", Arg.Any<CancellationToken>())
             .Returns(Result.Success(authUser));

backend/tests/PnvPanel.Application.Tests/Auth/RefreshCommandHandlerTests.cs

@@ -19,7 +19,7 @@ public class RefreshCommandHandlerTests
     public async Task Handle_WithValidToken_RotatesAndReturnsNewAuthResult()
     {
         var userId = Guid.NewGuid();
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", IsActivated: true, IsBlocked: false, MaxConfigs: 3);
+        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", IsActivated: true, IsBlocked: false, MaxConfigs: 3, SubscriptionToken: "sub-token");
         var rotated = new RotatedRefreshToken(userId, "new-refresh-token", DateTimeOffset.UtcNow.AddDays(30));
 
         _refreshTokenService.RotateAsync("old-token", Arg.Any<CancellationToken>()).Returns(Result.Success(rotated));

backend/tests/PnvPanel.Application.Tests/Configs/GetMyConfigs/GetMyConfigsQueryHandlerTests.cs

@@ -32,7 +32,7 @@ public class GetMyConfigsQueryHandlerTests
         dbContext.VpnConfigs.AddRange(activeConfig, revokedConfig, otherUsersConfig);
         await dbContext.SaveChangesAsync(CancellationToken.None);
 
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 5);
+        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 5, "sub-token");
         _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);
 
         var handler = new GetMyConfigsQueryHandler(dbContext, _identityService, FakeCurrentUser.Authenticated(userId));

backend/tests/PnvPanel.Application.Tests/Telegram/GetLoginRequestStatusQueryHandlerTests.cs

@@ -75,7 +75,7 @@ public class GetLoginRequestStatusQueryHandlerTests
         dbContext.TelegramLoginRequests.Add(request);
         await dbContext.SaveChangesAsync(CancellationToken.None);
 
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 3);
+        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 3, "sub-token");
         _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);
         _jwtTokenService.GenerateAccessToken(Arg.Any<AuthenticatedUser>())
             .Returns(("access-token", DateTimeOffset.UtcNow.AddMinutes(15)));