Documentation
¶
Overview ¶
Package limiters provides domain-specific rate limiters built on top of the internal/rate primitives.
Limiters ¶
- AccountCreationLimiter — per-identifier request limiter for sign-ups.
- BackupCodeLimiter — per-user failure throttle for backup code attempts.
- EmailVerificationLimiter — request limiter + confirm failure limiter.
- TOTPLimiter — hardcoded 5 attempts / 60 s per user.
- PasswordResetLimiter — request limiter + confirm failure limiter.
All limiters are nil-safe: calling any method on a nil receiver returns nil.
Architecture boundaries ¶
Each limiter owns its own Redis key namespace and error types. Policy thresholds come from Config structs supplied at construction time.
What this package must NOT do ¶
- Import goAuth or any sibling internal package except internal/rate.
- Make policy decisions beyond counting — flow functions decide consequences.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrAccountRateLimited = errors.New("account rate limited") )
var ( ErrBackupCodeRateLimited = errors.New("backup code rate limited") )
var ( ErrVerificationRateLimited = errors.New("verification rate limited") )
var ( ErrResetRateLimited = errors.New("reset rate limited") )
var ( ErrTOTPRateLimited = errors.New("totp rate limited") )
var ( ErrLockoutUnavailable = errors.New("lockout backend unavailable") )
Functions ¶
This section is empty.
Types ¶
type AccountConfig ¶
type AccountCreationLimiter ¶
type AccountCreationLimiter struct {
// contains filtered or unexported fields
}
func NewAccountCreationLimiter ¶
func NewAccountCreationLimiter(redisClient redis.UniversalClient, cfg AccountConfig) *AccountCreationLimiter
type BackupCodeConfig ¶
type BackupCodeLimiter ¶
type BackupCodeLimiter struct {
// contains filtered or unexported fields
}
func NewBackupCodeLimiter ¶
func NewBackupCodeLimiter(redisClient redis.UniversalClient, cfg BackupCodeConfig) *BackupCodeLimiter
func (*BackupCodeLimiter) Check ¶
func (l *BackupCodeLimiter) Check(ctx context.Context, tenantID, userID string) error
func (*BackupCodeLimiter) RecordFailure ¶
func (l *BackupCodeLimiter) RecordFailure(ctx context.Context, tenantID, userID string) error
type EmailVerificationConfig ¶
type EmailVerificationLimiter ¶
type EmailVerificationLimiter struct {
// contains filtered or unexported fields
}
func NewEmailVerificationLimiter ¶
func NewEmailVerificationLimiter(redisClient redis.UniversalClient, cfg EmailVerificationConfig) *EmailVerificationLimiter
func (*EmailVerificationLimiter) CheckConfirm ¶
func (l *EmailVerificationLimiter) CheckConfirm(ctx context.Context, tenantID, verificationID string) error
func (*EmailVerificationLimiter) CheckRequest ¶
func (l *EmailVerificationLimiter) CheckRequest(ctx context.Context, tenantID, identifier string) error
type LockoutConfig ¶
type LockoutConfig struct {
Enabled bool
Threshold int
Duration time.Duration // 0 = manual unlock only
// WindowMode selects the counting algorithm (zero value = fixed window).
// With Duration = 0 the counter never expires regardless of mode.
WindowMode window.Mode
}
LockoutConfig holds configuration for the automatic account lockout limiter.
type LockoutLimiter ¶
type LockoutLimiter struct {
// contains filtered or unexported fields
}
LockoutLimiter tracks persistent failed login attempts and triggers account lockout when the configured threshold is reached.
func NewLockoutLimiter ¶
func NewLockoutLimiter(redisClient redis.UniversalClient, cfg LockoutConfig) *LockoutLimiter
NewLockoutLimiter creates a new lockout limiter.
func (*LockoutLimiter) GetFailureCount ¶
GetFailureCount returns the current failure count for a user.
func (*LockoutLimiter) RecordFailure ¶
RecordFailure increments the failure counter for a user. Returns true if the threshold has been reached (caller should lock the account).
type PasswordResetConfig ¶
type PasswordResetLimiter ¶
type PasswordResetLimiter struct {
// contains filtered or unexported fields
}
func NewPasswordResetLimiter ¶
func NewPasswordResetLimiter(redisClient redis.UniversalClient, cfg PasswordResetConfig) *PasswordResetLimiter
func (*PasswordResetLimiter) CheckConfirm ¶
func (l *PasswordResetLimiter) CheckConfirm(ctx context.Context, tenantID, resetID string) error
func (*PasswordResetLimiter) CheckRequest ¶
func (l *PasswordResetLimiter) CheckRequest(ctx context.Context, tenantID, identifier string) error
func (*PasswordResetLimiter) Cooldown ¶
func (l *PasswordResetLimiter) Cooldown() time.Duration
type TOTPLimiter ¶
type TOTPLimiter struct {
// contains filtered or unexported fields
}
func NewTOTPLimiter ¶
func NewTOTPLimiter(redisClient redis.UniversalClient, cfg TOTPLimiterConfig) *TOTPLimiter
NewTOTPLimiter creates a TOTP rate limiter. Zero-value fields in cfg fall back to defaults (5 attempts / 60s).
func (*TOTPLimiter) Check ¶
func (l *TOTPLimiter) Check(ctx context.Context, tenantID, userID string) error
func (*TOTPLimiter) RecordFailure ¶
func (l *TOTPLimiter) RecordFailure(ctx context.Context, tenantID, userID string) error