Documentation
¶
Overview ¶
Package security provides pure functions for security and lockout calculations.
Index ¶
- Constants
- func CalculateLockout(failedAttempts int64, now int64, lockoutDurationSec int64, ...) sql.NullInt64
- func EffectiveLoginRateLimitPerIP(cfgMax int) int
- func FormatLockoutDuration(lockedUntil int64, now int64) string
- func IncrementFailedAttempts(current int64) int64
- func IsLocked(lockedUntil sql.NullInt64, now int64) bool
- func RateLimitFromRequestKey(remoteAddr string) string
- func ShouldClearLockout(lockedUntil sql.NullInt64, now int64) bool
- type IPRateLimiter
- type UnlockAccountTask
Constants ¶
const ( DefaultLoginRateLimitPerIP = 10 // max login attempts per IP per window DefaultRateLimitWindow = 60 // window in seconds (1 minute) )
Default IP rate limiting values.
const LockoutThreshold = 3
LockoutThreshold is the number of failed attempts before account lockout.
Variables ¶
This section is empty.
Functions ¶
func CalculateLockout ¶
func CalculateLockout(failedAttempts int64, now int64, lockoutDurationSec int64, lockoutThreshold int64) sql.NullInt64
CalculateLockout calculates the lockout expiration timestamp based on failed attempts and the configured lockout duration (in seconds). Returns nil (invalid) if failed attempts < lockoutThreshold. Returns the expiration timestamp if failed attempts >= lockoutThreshold.
func EffectiveLoginRateLimitPerIP ¶ added in v0.9.0
EffectiveLoginRateLimitPerIP converts the configured login rate limit into the effective per-IP maximum. A config value <= 0 means unlimited (0).
func FormatLockoutDuration ¶
FormatLockoutDuration converts the lockout duration to a human-readable string.
func IncrementFailedAttempts ¶
IncrementFailedAttempts increments the failed attempt counter.
func IsLocked ¶
IsLocked checks if an account is currently locked based on lockedUntil timestamp. Returns true if locked (lockedUntil is valid and in the future). Returns false if not locked or lockout has expired.
func RateLimitFromRequestKey ¶ added in v0.9.0
RateLimitFromRequestKey extracts the client IP from a request's RemoteAddr (host portion of "host:port"). Uses the direct connection address only; X-Forwarded-For is intentionally not consulted (see config modal help text).
Types ¶
type IPRateLimiter ¶ added in v0.9.0
type IPRateLimiter struct {
// contains filtered or unexported fields
}
IPRateLimiter implements a per-IP sliding window rate limiter. It is safe for concurrent use.
func NewIPRateLimiter ¶ added in v0.9.0
func NewIPRateLimiter(max int, windowSec int64) *IPRateLimiter
NewIPRateLimiter creates a new IPRateLimiter. If max <= 0, rate limiting is disabled (unlimited). If windowSec <= 0, DefaultRateLimitWindow is used.
func (*IPRateLimiter) Allow ¶ added in v0.9.0
func (rl *IPRateLimiter) Allow(ip string) bool
Allow checks if the given IP is allowed to proceed. It records the attempt and returns true if within the limit. Returns false if the IP has exceeded the rate limit. If rl.max <= 0, rate limiting is disabled and always returns true.
func (*IPRateLimiter) Clear ¶ added in v0.9.0
func (rl *IPRateLimiter) Clear()
Clear drops all recorded attempts (starts a fresh window).
func (*IPRateLimiter) SetMax ¶ added in v0.9.0
func (rl *IPRateLimiter) SetMax(max int)
SetMax updates the per-IP attempt cap without resetting in-window history. If max <= 0, subsequent Allow calls are unlimited until max is raised again.
type UnlockAccountTask ¶
type UnlockAccountTask struct {
Username string
UnlockFn func(ctx context.Context, username string) error
}
UnlockAccountTask unlocks a user account when the scheduled lockout period expires. It calls the database to clear failed attempts and reset the locked_until timestamp.
Source Files