feat(gateway): rate limiting + replay/idempotency protection for session + webhook endpoints

[aguilar1x]

Context

The gateway is the only component that talks to the live Pacto API, holding pk_/sk_ credentials on behalf of every merchant. Today /v1/session and outbound webhooks have no rate limiting or replay protection, leaving them open to abuse and duplicate-processing bugs once real merchant traffic hits it.

Scope

• Rate limit /v1/session and other public gateway endpoints per publishable key (sliding window, configurable).
• Replay protection for signed webhooks: nonce/timestamp validation, reject requests outside a tolerance window.
• Idempotency keys honored end-to-end so retried requests never create duplicate escrows or double-fire webhooks.

Acceptance criteria

• A burst of requests beyond the configured limit returns 429 with a Retry-After header.
• A replayed webhook payload (same signature, past its tolerance window) is rejected and logged.
• Sending the same idempotency key twice returns the original result, not a duplicate side effect.

[KaruG1999]

Hi, I'm Karen, a backend developer focused on API security and robust payment architectures
If this issue is still open for contributors, I can start by analyzing the current session creation and webhook handlers in the gateway. I can try to investigate where to integrate an idempotency middleware to cache request signatures, check how to implement a sliding-window rate limiter per publishable key, and verify the cleanest way to enforce timestamp/nonce validation for signed webhooks

[jean1222312432]

Hello hello

Software Engineer with 5+ years of experience building scalable backend systems and enterprise applications. Currently working at Oracle, specializing in Node.js, NestJS, Express, and cloud-based solutions.

[Heazzy500]

Hi, I’d appreciate the opportunity to contribute to this issue. I’m detail-oriented and committed to delivering quality work.

[grantfox-oss]

🦊 GrantFox — @jean1222312432 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #34)
2. Your PR will be reviewed by the PACTO-LAT maintainers

Good luck! Track your progress on GrantFox.