mrleo1nidandClaude Opus 5.5
ed4a492dba
ci / contract / contract (сгенерированный код совпадает с openapi.yaml) (push) Successful in 1m15s
ci / api / api (push) Successful in 1m31s
ci / mobile / mobile (Metro-бандл Android) (push) Successful in 47s
ci / ts / ts (packages + web) (push) Successful in 39s
ci / docker / docker (образы собираются — их сервер собирает сам при обновлении) (push) Successful in 26s
- users, refresh_tokens and audit_log schema (migration 00002) - argon2id passwords with rehash on login, password policy, lockout with exponential back-off and a per-IP rate limit in Redis - Ed25519 JWT access tokens with kid-based key rotation; rotating refresh tokens with reuse detection (cookie for web, body for Android) - bootstrap admin on first start; must_change_credentials and must_change_password gate every other endpoint - /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password, /me/bootstrap-credentials, /me/sessions; server-info reports bootstrap_required - role policy from docs/auth-and-roles.md with table tests - problem+json errors with field errors; ru/en translations of the codes - install.sh and update.sh generate JWT_PRIVATE_KEY Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
1.2 KiB
Go
42 lines
1.2 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/redis/go-redis/v9"
|
|
)
|
|
|
|
// RedisLimiter — счётчик попыток с фиксированным окном в Redis.
|
|
type RedisLimiter struct{ rdb redis.Cmdable }
|
|
|
|
// NewRedisLimiter создаёт лимитер.
|
|
func NewRedisLimiter(rdb redis.Cmdable) *RedisLimiter { return &RedisLimiter{rdb: rdb} }
|
|
|
|
// Первый INCR ставит срок окна; ответ — {счётчик, оставшийся TTL в мс}.
|
|
var incrWindow = redis.NewScript(`
|
|
local n = redis.call('INCR', KEYS[1])
|
|
if n == 1 then redis.call('PEXPIRE', KEYS[1], ARGV[1]) end
|
|
return {n, redis.call('PTTL', KEYS[1])}
|
|
`)
|
|
|
|
// Allow реализует Limiter.
|
|
func (l *RedisLimiter) Allow(ctx context.Context, key string, limit int, window time.Duration) (bool, int, error) {
|
|
res, err := incrWindow.Run(ctx, l.rdb, []string{"rl:" + key}, window.Milliseconds()).Int64Slice()
|
|
if err != nil {
|
|
return false, 0, fmt.Errorf("auth: rate limit: %w", err)
|
|
}
|
|
if len(res) != 2 {
|
|
return false, 0, fmt.Errorf("auth: rate limit: unexpected reply %v", res)
|
|
}
|
|
if res[0] <= int64(limit) {
|
|
return true, 0, nil
|
|
}
|
|
retry := int((res[1] + 999) / 1000)
|
|
if retry < 1 {
|
|
retry = 1
|
|
}
|
|
return false, retry, nil
|
|
}
|