Phase 7

src/features/auth/actions/register.ts

@@ -4,6 +4,8 @@ import bcrypt from "bcryptjs";
 import { signIn } from "@/auth";
 import { prisma } from "@/lib/db/prisma";
 import { registerSchema } from "@/features/auth/schemas";
+import { checkRateLimit } from "@/lib/security/rate-limit";
+import { getRequestIp } from "@/lib/security/request-ip";
 
 export interface RegisterResult {
   success: boolean;
@@ -19,6 +21,12 @@ export interface RegisterResult {
  * docs/implementation-plan.md §15, Question 3-adjacent).
  */
 export async function registerAction(formData: FormData): Promise<RegisterResult> {
+  const ip = await getRequestIp();
+  const { allowed } = checkRateLimit(`register:${ip}`, { maxAttempts: 5, windowMs: 60 * 60 * 1000 });
+  if (!allowed) {
+    return { success: false, error: "Too many attempts. Please try again later." };
+  }
+
   const parsed = registerSchema.safeParse({
     firstName: formData.get("firstName"),
     lastName: formData.get("lastName"),