ratelimit

type Decider ¶ added in v0.3.0

type Decider interface {
	Limiter
	// Decide counts one attempt and returns the decision.
	Decide(ctx context.Context, key Key) (Decision, error)
}

Decider is an optional limiter interface that names a retry time.

A limiter that implements it drives the Retry-After header of a refused request. A limiter that implements Limiter only keeps the v1 behavior, and Auth-All sends Retry-After: 60.

type Decision ¶ added in v0.3.0

type Decision struct {
	// Allowed reports whether the attempt can proceed.
	Allowed bool
	// RetryAfter is the time until the next attempt can succeed. It is zero
	// when the attempt is allowed.
	RetryAfter time.Duration
}

Decision is the answer of a Decider.

type Key ¶

type Key struct {
	Operation Operation
	IP        string
	Email     string
	UserID    string
	Provider  string
}

Key identifies one rate-limited attempt. Fields are set when relevant.

type Limiter ¶

type Limiter interface {
	Allow(ctx context.Context, key Key) (bool, error)
}

Limiter decides whether one attempt can proceed.

type LimiterFunc ¶

type LimiterFunc func(ctx context.Context, key Key) (bool, error)

LimiterFunc adapts a function to the Limiter interface.

func (f LimiterFunc) Allow(ctx context.Context, k Key) (bool, error)

type Memory ¶

type Memory struct {
	// contains filtered or unexported fields
}

Memory is an in-process fixed-window limiter.

Memory is for local development and tests only. It is not sufficient for a distributed production deployment because each process keeps its own counters.

func NewMemory(limit int, window time.Duration) *Memory

func (m *Memory) Allow(_ context.Context, k Key) (bool, error)

type Operation ¶

type Operation string

Operation names a sensitive flow.

const (
	OpSignIn           Operation = "sign-in"
	OpSignUp           Operation = "sign-up"
	OpPasswordForgot   Operation = "password-forgot"
	OpEmailVerify      Operation = "email-verification-send"
	OpMagicLinkRequest Operation = "magic-link-request"
	OpPasswordChange   Operation = "password-change"
	OpEmailChange      Operation = "email-change"
	OpUserDelete       Operation = "user-delete"
	OpTOTP             Operation = "totp"
)

type Rule ¶ added in v0.3.0

type Rule struct {
	// Operation names the flow that the rule counts.
	Operation Operation
	// Scope names the counted subject.
	Scope Scope
	// Limit is the number of accepted attempts in one window.
	Limit int
	// Window is the length of the counting window.
	Window time.Duration
}

Rule is one limit of one operation.

func DefaultSignInRules() []Rule

type Scope ¶ added in v0.3.0

type Scope string

Scope names the subject that one rule counts.

const (
	// ScopeIP counts the attempts of one client address. An IPv6 address
	// counts per /64 block.
	ScopeIP Scope = "ip"
	// ScopeEmail counts the attempts for one email address. The store keeps a
	// digest of the address and never the address.
	ScopeEmail Scope = "email"
)