Fix #11: Bounty Claim: Gateway rate limiting middleware ($65)

[Nexussyn]

Closes #11

Summary

Implemented a sliding window rate limiter middleware for the market gateway with configurable limits via environment variables, proper HTTP 429 responses with standard rate limit headers, and comprehensive test coverage.

Changes

Gateway Rate Limiting Middleware

Summary

Implements a sliding window rate limiter for the market gateway to protect against traffic abuse and ensure fair resource allocation across clients.

Changes Made

• market/gateway/middleware.go: Core rate limiting implementation

  • Sliding window algorithm tracking requests per IP address
  • Default limit: 120 requests/minute per IP
  • Configurable via environment variables:
    • MARKET_RATE_LIMIT_PER_MINUTE - requests allowed per minute (default: 120)
    • MARKET_RATE_LIMIT_BURST - burst allowance (default: 10)
  • Automatic cleanup of stale entries every 5 minutes
  • Proper client IP detection (X-Forwarded-For, X-Real-IP, RemoteAddr)

• market/gateway/middleware_test.go: Comprehensive test coverage

  • TestRateLimitAllowedTraffic - verifies normal requests pass through
  • TestRateLimitBlockedTraffic - verifies 429 response when limit exceeded
  • TestRateLimitEnvOverride - verifies environment variable configuration
  • TestRateLimitPerIPIsolation - verifies per-IP tracking isolation

• market/gateway/api.go: Cleaned up unused imports and integrated middleware

Response Headers

Header	Description
X-RateLimit-Limit	Maximum requests allowed per window
X-RateLimit-Remaining	Requests remaining in current window
Retry-After	Seconds until rate limit resets (

[Nexussyn]

Automated Submission

This PR addresses issue #11.

Summary: Implemented a sliding window rate limiter middleware for the market gateway with configurable limits via environment variables, proper HTTP 429 responses with standard rate limit headers, and comprehensive test coverage.

Please review the changes. If adjustments are needed, comment here.