Implement secure CORS configuration system

internal/auth/bootstrap.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/igodwin/notifier/internal/logging"
@@ -68,13 +69,13 @@ func BootstrapAdminKey(ctx context.Context, keyStore *HybridKeyStore, cfg *Boots
 
 	// Print to stdout if configured (DANGEROUS - only for interactive setup)
 	if cfg.PrintToStdout {
-		fmt.Println("\n" + "="*60)
+		fmt.Println("\n" + strings.Repeat("=", 60))
 		fmt.Println("NOTIFIER BOOTSTRAP: ADMIN KEY CREATED")
-		fmt.Println("="*60)
+		fmt.Println(strings.Repeat("=", 60))
 		fmt.Printf("Key: %s\n", apiKey.Key)
 		fmt.Println("\nSave this key in a secure location. You will not be able to see it again.")
 		fmt.Println("Use this key to create additional API keys via the key management API.")
-		fmt.Println("="*60 + "\n")
+		fmt.Println(strings.Repeat("=", 60) + "\n")
 	}
 
 	logger.Infof("Bootstrap admin key created successfully")

internal/auth/keystore_hybrid.go

@@ -127,16 +127,35 @@ func (h *HybridKeyStore) UpdateLastUsed(ctx context.Context, keyStr string) erro
 }
 
 // CheckRateLimit checks if a key has exceeded its rate limit
-func (h *HybridKeyStore) CheckRateLimit(keyStr string) error {
+func (h *HybridKeyStore) CheckRateLimit(keyStr string) (bool, error) {
 	h.cache.mu.RLock()
 	defer h.cache.mu.RUnlock()
 
 	limiter, exists := h.cache.rateLimits[keyStr]
 	if !exists {
-		return fmt.Errorf("rate limiter not found")
+		return false, fmt.Errorf("rate limiter not found")
 	}
 
-	return limiter.Check()
+	// Check if we're under the rate limit
+	if limiter.maxRequests == 0 {
+		return true, nil // Unlimited
+	}
+
+	limiter.mu.Lock()
+	defer limiter.mu.Unlock()
+
+	now := time.Now()
+	if now.After(limiter.resetTime) {
+		limiter.resetTime = now.Add(limiter.window)
+		limiter.count = 0
+	}
+
+	if limiter.count >= limiter.maxRequests {
+		return false, nil
+	}
+
+	limiter.count++
+	return true, nil
 }
 
 // GetAuditLog retrieves audit log for a key