Remove rate limiting and CORS middleware

[dceoy]

This PR removes the rate limiting and CORS middleware functionality from the MT5 API, simplifying the middleware stack and reducing external dependencies.

Summary

The rate limiting (via slowapi) and CORS middleware have been removed from the application. These features are better handled by external infrastructure (reverse proxies, API gateways) rather than at the application level.

Key Changes

• Removed rate limiting: Deleted slowapi dependency and all rate limit configuration

  • Removed _build_default_rate_limit() function from middleware
  • Removed _rate_limit_exceeded_handler() exception handler
  • Removed MT5API_RATE_LIMIT environment variable and related config functions
  • Removed rate limit test cases

• Removed CORS middleware: Deleted Starlette CORS middleware setup

  • Removed _get_cors_origins() function from main.py
  • Removed MT5API_CORS_ORIGINS environment variable and related config functions
  • Removed CORS test cases

• Simplified middleware stack: add_middleware() now only registers error handling and logging middleware

• Updated documentation: Removed references to rate limiting and CORS configuration from deployment and API docs

• Updated dependencies: Removed slowapi >= 0.1.9 from pyproject.toml

Implementation Details

The middleware stack is now simplified to only handle:

• Error handling and structured error responses
• Request/response logging with timing information

Rate limiting and CORS should be configured at the infrastructure level (e.g., nginx, API Gateway, load balancer) for better performance and flexibility.

https://claude.ai/code/session_01SC3baPqBUyQjTmKkPctbUp

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[claude]

Code Review Summary: Clean, well-scoped removal. The architectural decision to delegate rate limiting and CORS to infrastructure is sound. The application code, constants, config, and test cleanup is thorough. However, there are stale documentation references and a security documentation gap that should be addressed before merge. See inline comments for details.

[claude]

Detailed findings

Documentation: README.md not updated (4 stale references)

README.md was not touched by this PR but still contains references to the removed features:

• Line 9: project description mentions rate limiting
• Line 25: Mermaid architecture diagram labels middleware as CORS . Logging . Error Handler . Rate Limiter (should be Logging . Error Handler)
• Line 48: feature list says Optional API key authentication with per-minute rate limiting
• Line 49: feature list says Structured JSON logging and configurable CORS

Documentation: docs/index.md line 10

Overview paragraph still reads: adds optional authentication, rate limiting, and response formatting suitable for analytics workflows. Remove rate limiting reference.

Security: docs/api/rest-api.md security checklist

The security checklist previously included rate limiting as a minimum security posture item. Consider adding: Configure rate limiting at the reverse proxy or API gateway level -- to make it clear this responsibility has moved to infrastructure rather than being silently dropped.