Skip to main content

internal/api/auth_audit.go

internal/api · 76 lines · 4 declarations · source

Declarations​

const refusedAuthSamplesPerMinute​

const refusedAuthSamplesPerMinute = 16

source

type refusedAuthBudget​

type refusedAuthBudget struct {
	mu         sync.Mutex
	resetAt    time.Time
	samples    int
	suppressed int
}

refusedAuthBudget bounds anonymous ledger writes per server, without keeping an attacker-keyed map. Suppressed attempts contribute to the next sample's magnitude. Counts saturate at PostgreSQL's integer limit; pending counts are best effort and disappear on restart, unlike committed samples. This is an audit sampling bound, not an authentication request or fleet-wide admission limit.

source

method refusedAuthBudget.take​

func (b *refusedAuthBudget) take(now time.Time) (magnitude int, firstSuppressed bool)

source

method Server.recordRefusedAuth​

func (s *Server) recordRefusedAuth(r *http.Request)

recordRefusedAuth never receives the presented credential. Even its prefix is arbitrary input, and copying it would let an unauthenticated caller put personal content into permanent storage. A fixed principal records the failed boundary without claiming to identify an unknown person.

source