fix(security): rate-limit follow-ups — alert rule, fail-fast env, dependency tests, dead code (card 5221c63f)

.github/workflows/pr-checks.yml

@@ -79,6 +79,15 @@ jobs:
             --cov-fail-under=70 \
             -x  # Stop on first failure for fast feedback
 
+      # Backend rate-limit fail-fast + alert rules (card 5221c63f):
+      # catches invalid RATE_LIMIT_FAIL_MODE and stale alert expressions in CI.
+      - name: Backend rate-limit and alert rule checks
+        run: |
+          pip install -r dashboard/backend/requirements.txt pytest pytest-asyncio
+          cd dashboard/backend
+          pytest tests/middleware/test_rate_limit.py tests/monitoring/test_alert_rules.py \
+            -o addopts= -q --no-header
+
       - name: Comment PR with results
         if: always()
         continue-on-error: true  # Gracefully handle permission errors (e.g., dependabot PRs)
@@ -91,17 +100,17 @@ jobs:
               typecheck: '${{ steps.typecheck.outcome }}',
               tests: '${{ steps.tests.outcome }}'
             };
-            
+
             const message = `## PR Check Results
-            
+
             ✅ **Code Formatting**: ${outputs.formatting === 'success' ? 'Passed' : 'Failed'}
             ✅ **Linting**: ${outputs.linting === 'success' ? 'Passed' : 'Failed'}
             ✅ **Type Checking**: ${outputs.typecheck === 'success' ? 'Passed' : 'Failed'}
             ✅ **Tests**: ${outputs.tests === 'success' ? 'Passed' : 'Failed'}
-            
+
             ${outputs.tests === 'success' ? '' : '⚠️ Some checks failed. Please review the details above.'}
             `;
-            
+
             try {
               await github.rest.issues.createComment({
                 issue_number: context.issue.number,
@@ -133,7 +142,7 @@ jobs:
         run: |
           LINES_CHANGED=$(git diff --stat ${{ github.event.pull_request.base.sha }} ${{ github.sha }} | tail -1 | awk '{print $1}')
           echo "Lines changed: $LINES_CHANGED"
-          
+
           if [ "$LINES_CHANGED" -gt 500 ]; then
             echo "⚠️ Warning: This PR changes more than 500 lines. Consider breaking it into smaller PRs."
             exit 0

CHANGELOG.md

@@ -9,6 +9,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **Rate-limit follow-ups (PR #106)**: Prometheus alert
+  `RateLimitBackendFailures` (`rate_limit_backend_failures_total > 0`,
+  severity warning) in the dashboard monitoring rules, with rule-validation
+  tests (`dashboard/backend/tests/monitoring/test_alert_rules.py`); startup
+  fail-fast validation of `RATE_LIMIT_FAIL_MODE` (invalid value crashes boot
+  with a clear error instead of silently failing open), wired in
+  `dashboard/backend/main.py` and covered by a CI step in
+  `.github/workflows/pr-checks.yml`; tests for the `check_rate_limit`
+  dependency 503/allow paths.
+
 - **QA Visual dashboard wiring (Fase C)**: the dashboard backend mounts the
   qa-visual router behind JWT auth (`Depends(get_current_user)`) — all five
   endpoints require authentication — **gated behind `QA_VISUAL_ENABLED=1`
@@ -19,6 +29,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   ships `dashboard/backend`), guarded by a vendor-parity test that fails on
   drift between the two copies.
 
+### Removed
+
+- Dead code (0 imports, confirmed by reviewer + security + grep):
+  `dashboard/backend/middleware/granular_rate_limiting.py` (188 lines) and
+  `dashboard/backend/middleware/rate_limiting.py` (33 lines).
+
 ### Security
 
 - **S-1 (HIGH)**: router factory now accepts injectable `dependencies`;

dashboard/backend/.env.example

@@ -100,3 +100,7 @@ GROQ_API_KEY=your_groq_api_key_here
 
 # Model to use (default: llama-3.3-70b-versatile)
 BROWSER_USE_MODEL=llama-3.3-70b-versatile
+
+# Rate limiter behavior when the backing store (redis) fails (PR #106 follow-up)
+# Valid: open | closed. Invalid values fail fast at startup.
+RATE_LIMIT_FAIL_MODE=open

dashboard/backend/main.py

@@ -26,6 +26,12 @@
 configure_logging(log_level=log_level, environment=environment)
 logger = get_logger(__name__)
 
+# Fail fast on invalid config: a typo in RATE_LIMIT_FAIL_MODE must never
+# silently degrade rate limiting (security advisory L-A, PR #106 follow-up).
+from middleware.rate_limit import validate_rate_limit_fail_mode  # noqa: E402
+
+validate_rate_limit_fail_mode()
+
 app = FastAPI(
     title="QA-Framework Dashboard API",
     description="API para la dashboard unificada de QA-FRAMEWORK",