Documentation
¶
Overview ¶
Package lockout provides account lockout tracking for AuthSome.
Index ¶
- type KVTracker
- func (t *KVTracker) IsLocked(ctx context.Context, key string) (bool, time.Time, error)
- func (t *KVTracker) RecordFailure(ctx context.Context, key string) (int, error)
- func (t *KVTracker) Reset(ctx context.Context, key string) error
- func (t *KVTracker) ResetPrefix(ctx context.Context, prefix string) error
- type MemoryOption
- type MemoryTracker
- func (t *MemoryTracker) IsLocked(_ context.Context, key string) (bool, time.Time, error)
- func (t *MemoryTracker) RecordFailure(_ context.Context, key string) (int, error)
- func (t *MemoryTracker) Reset(_ context.Context, key string) error
- func (t *MemoryTracker) ResetPrefix(_ context.Context, prefix string) error
- type NoopTracker
- type Tracker
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type KVTracker ¶
type KVTracker struct {
// contains filtered or unexported fields
}
KVTracker keeps lockout state in the shared KV store so a lockout holds across every replica.
Per key it keeps a failure counter that expires after the reset window and, once the threshold is crossed, a lock marker that expires with the lockout. Keys are grouped under a prefix (app:identifier) with the client's network as the suffix; an index row per prefix records the suffixes seen so ResetPrefix can clear them without scanning the store.
func NewKVTracker ¶
func NewKVTracker(kv store.KV, opts ...MemoryOption) *KVTracker
NewKVTracker builds a tracker on kv. The options are the same ones the memory tracker takes.
func (*KVTracker) RecordFailure ¶
RecordFailure counts a failed attempt and sets the lock once the threshold is reached.
type MemoryOption ¶
type MemoryOption func(*MemoryTracker)
MemoryOption configures the memory tracker.
func WithLockoutDuration ¶
func WithLockoutDuration(d time.Duration) MemoryOption
WithLockoutDuration sets how long the lockout lasts.
func WithMaxAttempts ¶
func WithMaxAttempts(n int) MemoryOption
WithMaxAttempts sets the max failed attempts before lockout.
func WithResetAfter ¶
func WithResetAfter(d time.Duration) MemoryOption
WithResetAfter sets the inactivity period after which the failure count resets.
type MemoryTracker ¶
type MemoryTracker struct {
// contains filtered or unexported fields
}
MemoryTracker is an in-memory account lockout tracker.
func NewMemoryTracker ¶
func NewMemoryTracker(opts ...MemoryOption) *MemoryTracker
NewMemoryTracker creates an in-memory lockout tracker.
func (*MemoryTracker) RecordFailure ¶
RecordFailure records a failed attempt.
func (*MemoryTracker) Reset ¶
func (t *MemoryTracker) Reset(_ context.Context, key string) error
Reset clears the failure count for a key.
func (*MemoryTracker) ResetPrefix ¶
func (t *MemoryTracker) ResetPrefix(_ context.Context, prefix string) error
ResetPrefix clears every key that starts with prefix.
type NoopTracker ¶
type NoopTracker struct{}
NoopTracker is a lockout tracker that never locks out.
func NewNoopTracker ¶
func NewNoopTracker() *NoopTracker
NewNoopTracker creates a no-op lockout tracker.
func (*NoopTracker) RecordFailure ¶
RecordFailure always returns 0 attempts.
func (*NoopTracker) Reset ¶
func (*NoopTracker) Reset(context.Context, string) error
Reset is a no-op.
func (*NoopTracker) ResetPrefix ¶
func (*NoopTracker) ResetPrefix(context.Context, string) error
ResetPrefix is a no-op.
type Tracker ¶
type Tracker interface {
// RecordFailure records a failed authentication attempt. Returns the
// current failure count for the key.
RecordFailure(ctx context.Context, key string) (attempts int, err error)
// IsLocked checks if the key is currently locked out. Returns true if
// locked, along with the time the lockout expires.
IsLocked(ctx context.Context, key string) (locked bool, until time.Time, err error)
// Reset clears the failure count for a key (called on successful auth).
Reset(ctx context.Context, key string) error
// ResetPrefix clears every key that starts with prefix. Lockout keys
// end in the client's network, so an operator unlocking an account
// clears all of that account's networks at once.
ResetPrefix(ctx context.Context, prefix string) error
}
Tracker tracks failed authentication attempts and lockouts.
Source Files