case 4681 - rate limits on the anonymous trial and licence routes, stricter email check, cryptographic codes

Anonymous trial requests could be sent without limit, each one emailing a
verification link to any address (bounces from made-up domains), and the
verification and v7 fetch codes came from System.Random (AyaNova security
review F40).
- ASP.NET Core rate limiter per client address: trial requests (rvr,
  subscription-server-trial-request) 5 per hour; verify, rvf and the legacy v7
  fetch 30 per 10 minutes; 429 over the limit. Runs after routing and after
  forwarded headers.
- rvr: the email must be a valid address (MailAddress) before anything is
  stored or sent.
- GenFetchCode: RandomNumberGenerator, same 10-letter format.
rvf is unchanged (still one-shot): repeatable fetch needs an AyaNova-side change
for older servers and is a separate later case.

Checked on the local server with invalid addresses only (no email sent, no
request stored): 6th trial request 429, 31st fetch 429, auth unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/Startup.cs

@@ -28,6 +28,10 @@ namespace Sockeye
 {
     public class Startup
     {
+        //case 4681: rate limit policy names used on the anonymous trial and licence routes
+        internal const string RATE_LIMIT_TRIAL_REQUESTS = "trial-requests";
+        internal const string RATE_LIMIT_LICENSE_FETCH = "license-fetch";
+
         /////////////////////////////////////////////////////////////
         //
         public Startup(Microsoft.AspNetCore.Hosting.IWebHostEnvironment hostingEnvironment)
@@ -174,6 +178,19 @@ namespace Sockeye
                     );
             });
 
+            //case 4681: per client address limits on the anonymous trial request and licence fetch routes
+            _newLog.LogDebug("Rate limiting");
+            services.AddRateLimiter(options =>
+            {
+                options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+                options.AddPolicy(RATE_LIMIT_TRIAL_REQUESTS, context => System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
+                    context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
+                    _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions { PermitLimit = 5, Window = TimeSpan.FromHours(1), QueueLimit = 0 }));
+                options.AddPolicy(RATE_LIMIT_LICENSE_FETCH, context => System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
+                    context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
+                    _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions { PermitLimit = 30, Window = TimeSpan.FromMinutes(10), QueueLimit = 0 }));
+            });
+
 
 
 
@@ -375,7 +392,10 @@ namespace Sockeye
             #endregion
 
             _newLog.LogDebug("Routing pipeline");
-            app.UseRouting();//this wasn't here for 2.2 but added for 3.0, needs to come before the stuff after 
+            app.UseRouting();//this wasn't here for 2.2 but added for 3.0, needs to come before the stuff after
+
+            //case 4681: after routing so the per-route policies apply (and after forwarded headers so the client address is the real one)
+            app.UseRateLimiter();
 
             _newLog.LogDebug("CORS pipeline");
             app.UseCors("CorsPolicy");