OTWO-7704 Rate-limiting on password reset request

[bd-vaibhav]

No description provided.

[Copilot]

Pull request overview

Adds account-level rate limiting for password reset requests to reduce abuse, including persistence for rate-limit state, controller enforcement, user-facing messaging, and controller test coverage.

Changes:

• Adds password_reset_count and password_reset_requested_at columns to accounts to persist rate-limit state.
• Introduces cooldown + rolling-window enforcement around PasswordResetsController#create, and records reset-request attempts.
• Expands controller tests and adds i18n strings for rate-limit error messaging.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
test/controllers/password_resets_controller_test.rb	Adds boundary/behavior tests for cooldown and rolling-window limits.
db/migrate/20260804172050_add_password_reset_rate_limit_to_accounts.rb	Adds persistent counters/timestamps needed for per-account rate limiting.
config/locales/en.yml	Adds i18n strings for password reset rate-limit messages and template-relative keys.
app/controllers/password_resets_controller.rb	Implements rate-limit checks and request recording around password reset creation.

Suppressed comments (1)

test/controllers/password_resets_controller_test.rb:66

• The example says it resets the counter "at exactly 10 minute boundary" but the time travel uses 10.minutes + 1.second. This misses the exact boundary condition your controller logic depends on (last > RESET_WINDOW.ago).

      travel_to base_time + 10.minutes + 1.second do

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.