security

type Lockout struct {
	// contains filtered or unexported fields
}

type LockoutConfig struct {
	// MaxAttempts is the number of failed attempts before lockout.
	// Default: 5
	MaxAttempts int

	// LockoutDuration is how long the account stays locked.
	// Default: 15 minutes
	LockoutDuration time.Duration

	// AttemptWindow is the time window for counting attempts.
	// Attempts older than this are not counted.
	// Default: 15 minutes
	AttemptWindow time.Duration

	// CleanupInterval is how often to clean up old attempts.
	// Default: 5 minutes
	CleanupInterval time.Duration
}

type LockoutOption func(*Lockout)

type LockoutStatus struct {
	// IsLocked is true if the account is currently locked.
	IsLocked bool

	// FailedAttempts is the number of failed attempts in the window.
	FailedAttempts int

	// RemainingAttempts is how many attempts remain before lockout.
	RemainingAttempts int

	// LockedUntil is when the lockout expires (only set if IsLocked).
	LockedUntil time.Time

	// LastAttempt is when the last failed attempt occurred.
	LastAttempt time.Time
}

type LockoutStore interface {
	// RecordAttempt records a login attempt (success or failure).
	RecordAttempt(ctx context.Context, identifier string, success bool) error

	// GetStatus returns the current lockout status for an identifier.
	GetStatus(ctx context.Context, identifier string, cfg LockoutConfig) (LockoutStatus, error)

	// Lock explicitly locks an account.
	Lock(ctx context.Context, identifier string, until time.Time) error

	// Unlock explicitly unlocks an account.
	Unlock(ctx context.Context, identifier string) error

	// Reset clears all attempt history for an identifier.
	Reset(ctx context.Context, identifier string) error

	// Close releases resources.
	Close() error
}

type MemoryLockoutOption func(*MemoryLockoutStore)

type MemoryLockoutStore struct {
	// contains filtered or unexported fields
}

type RedisLockoutOption func(*RedisLockoutStore)

type RedisLockoutStore struct {
	// contains filtered or unexported fields
}