limiters

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 12, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Documentation

Overview

Package limiters provides domain-specific rate limiters built on top of the internal/rate primitives.

Limiters

All limiters are nil-safe: calling any method on a nil receiver returns nil.

Architecture boundaries

Each limiter owns its own Redis key namespace and error types. Policy thresholds come from Config structs supplied at construction time.

What this package must NOT do

  • Import goAuth or any sibling internal package except internal/rate.
  • Make policy decisions beyond counting — flow functions decide consequences.

Index

Constants

This section is empty.

Variables

View Source
var (
	ErrAccountRateLimited      = errors.New("account rate limited")
	ErrAccountRedisUnavailable = errors.New("account redis unavailable")
)
View Source
var (
	ErrBackupCodeRateLimited = errors.New("backup code rate limited")
	ErrBackupCodeUnavailable = errors.New("backup code unavailable")
)
View Source
var (
	ErrVerificationRateLimited        = errors.New("verification rate limited")
	ErrVerificationLimiterUnavailable = errors.New("verification limiter unavailable")
)
View Source
var (
	ErrResetRateLimited      = errors.New("reset rate limited")
	ErrResetRedisUnavailable = errors.New("reset redis unavailable")
)
View Source
var (
	ErrTOTPRateLimited = errors.New("totp rate limited")
	ErrTOTPUnavailable = errors.New("totp unavailable")
)
View Source
var (
	// ErrLockoutUnavailable indicates the lockout backend is unreachable.
	ErrLockoutUnavailable = errors.New("lockout backend unavailable")
)

Functions

This section is empty.

Types

type AccountConfig

type AccountConfig struct {
	EnableLimiter bool
	MaxAttempts   int
	Cooldown      time.Duration
	// WindowMode selects the counting algorithm (zero value = fixed window).
	WindowMode window.Mode
}

type AccountCreationLimiter

type AccountCreationLimiter struct {
	// contains filtered or unexported fields
}

func NewAccountCreationLimiter

func NewAccountCreationLimiter(redisClient redis.UniversalClient, cfg AccountConfig) *AccountCreationLimiter

func (*AccountCreationLimiter) Enforce

func (l *AccountCreationLimiter) Enforce(ctx context.Context, tenantID, identifier string) error

type BackupCodeConfig

type BackupCodeConfig struct {
	MaxAttempts int
	Cooldown    time.Duration
	// WindowMode selects the counting algorithm (zero value = fixed window).
	WindowMode window.Mode
}

type BackupCodeLimiter

type BackupCodeLimiter struct {
	// contains filtered or unexported fields
}

func NewBackupCodeLimiter

func NewBackupCodeLimiter(redisClient redis.UniversalClient, cfg BackupCodeConfig) *BackupCodeLimiter

func (*BackupCodeLimiter) Check

func (l *BackupCodeLimiter) Check(ctx context.Context, tenantID, userID string) error

func (*BackupCodeLimiter) RecordFailure

func (l *BackupCodeLimiter) RecordFailure(ctx context.Context, tenantID, userID string) error

func (*BackupCodeLimiter) Reset

func (l *BackupCodeLimiter) Reset(ctx context.Context, tenantID, userID string) error

type EmailVerificationConfig

type EmailVerificationConfig struct {
	EnableRequestLimiter        bool
	EnableConfirmFailureLimiter bool
	VerificationTTL             time.Duration
	MaxAttempts                 int
	// WindowMode selects the counting algorithm (zero value = fixed window).
	WindowMode window.Mode
}

type EmailVerificationLimiter

type EmailVerificationLimiter struct {
	// contains filtered or unexported fields
}

func NewEmailVerificationLimiter

func NewEmailVerificationLimiter(redisClient redis.UniversalClient, cfg EmailVerificationConfig) *EmailVerificationLimiter

func (*EmailVerificationLimiter) CheckConfirm

func (l *EmailVerificationLimiter) CheckConfirm(ctx context.Context, tenantID, verificationID string) error

func (*EmailVerificationLimiter) CheckRequest

func (l *EmailVerificationLimiter) CheckRequest(ctx context.Context, tenantID, identifier string) error

type LockoutConfig

type LockoutConfig struct {
	Enabled   bool
	Threshold int
	Duration  time.Duration // 0 = manual unlock only
	// WindowMode selects the counting algorithm (zero value = fixed window).
	// With Duration = 0 the counter never expires regardless of mode.
	WindowMode window.Mode
}

LockoutConfig holds configuration for the automatic account lockout limiter.

type LockoutLimiter

type LockoutLimiter struct {
	// contains filtered or unexported fields
}

LockoutLimiter tracks persistent failed login attempts and triggers account lockout when the configured threshold is reached.

func NewLockoutLimiter

func NewLockoutLimiter(redisClient redis.UniversalClient, cfg LockoutConfig) *LockoutLimiter

NewLockoutLimiter creates a new lockout limiter.

func (*LockoutLimiter) GetFailureCount

func (l *LockoutLimiter) GetFailureCount(ctx context.Context, tenantID, userID string) (int, error)

GetFailureCount returns the current failure count for a user.

func (*LockoutLimiter) RecordFailure

func (l *LockoutLimiter) RecordFailure(ctx context.Context, tenantID, userID string) (bool, error)

RecordFailure increments the failure counter for a user. Returns true if the threshold has been reached (caller should lock the account).

func (*LockoutLimiter) Reset

func (l *LockoutLimiter) Reset(ctx context.Context, tenantID, userID string) error

Reset clears the failure counter for a user (e.g., after successful login or manual unlock).

type PasswordResetConfig

type PasswordResetConfig struct {
	EnableRequestLimiter        bool
	EnableConfirmFailureLimiter bool
	ResetTTL                    time.Duration
	MaxAttempts                 int
	// WindowMode selects the counting algorithm (zero value = fixed window).
	WindowMode window.Mode
}

type PasswordResetLimiter

type PasswordResetLimiter struct {
	// contains filtered or unexported fields
}

func NewPasswordResetLimiter

func NewPasswordResetLimiter(redisClient redis.UniversalClient, cfg PasswordResetConfig) *PasswordResetLimiter

func (*PasswordResetLimiter) CheckConfirm

func (l *PasswordResetLimiter) CheckConfirm(ctx context.Context, tenantID, resetID string) error

func (*PasswordResetLimiter) CheckRequest

func (l *PasswordResetLimiter) CheckRequest(ctx context.Context, tenantID, identifier string) error

func (*PasswordResetLimiter) Cooldown

func (l *PasswordResetLimiter) Cooldown() time.Duration

type TOTPLimiter

type TOTPLimiter struct {
	// contains filtered or unexported fields
}

func NewTOTPLimiter

func NewTOTPLimiter(redisClient redis.UniversalClient, cfg TOTPLimiterConfig) *TOTPLimiter

NewTOTPLimiter creates a TOTP rate limiter. Zero-value fields in cfg fall back to defaults (5 attempts / 60s).

func (*TOTPLimiter) Check

func (l *TOTPLimiter) Check(ctx context.Context, tenantID, userID string) error

func (*TOTPLimiter) RecordFailure

func (l *TOTPLimiter) RecordFailure(ctx context.Context, tenantID, userID string) error

func (*TOTPLimiter) Reset

func (l *TOTPLimiter) Reset(ctx context.Context, tenantID, userID string) error

type TOTPLimiterConfig

type TOTPLimiterConfig struct {
	MaxAttempts int
	Cooldown    time.Duration
	// WindowMode selects the counting algorithm (zero value = fixed window).
	WindowMode window.Mode
}

TOTPLimiterConfig holds configurable thresholds for the TOTP rate limiter.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL