supabase / auth / 11324523960

69%

Build Type

push

github

Committed by web-flow

Commit Message

feat: configurable email and sms rate limiting (#1800)

Adds two new configuration values for rate limiting the sending of
emails and sms messages:

 - GOTRUE_RATE_LIMIT_EMAIL_SENT
 - GOTRUE_RATE_LIMIT_SMS_SENT

It is implemented with a simple rate limiter that resets a counter at a
regular interval. The first intervals start time is set when the counter
is initialized. It will be reset when the server is restarted, but
preserved when the config is reloaded.

Syntax examples:
```
1.5       # Allow 1.5 events over 1 hour (legacy format)
100       # Allow 100 events over 1 hour (1h is default)
100/1h    # Allow 100 events over 1 hour (explicit duration)
100/24h   # Allow 100 events over 24 hours
100/72h   # Allow 100 events over 72 hours (use hours for days)
10/30m    # Allow 10  events over 30 minutes
3/10s     # Allow 3   events over 10 seconds
```

Syntax in ABNF to express the format as value:
```
value = count / rate
count = 1*DIGIT ["." 1*DIGIT]
rate = 1*DIGIT "/" ival
ival = ival-sec / ival-min / ival-hr
ival-sec = 1*DIGIT "s"
ival-min = 1*DIGIT "s"
ival-hr = 1*DIGIT "h"
```

This change was a continuation of
https://github.com/supabase/auth/pull/1746 adapted to support the recent
preservation of rate limiters across server reloads.

---------

Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
Co-authored-by: Stojan Dimitrovski <sdimitrovski@gmail.com>

Run Details

61 of 75 new or added lines in 6 files covered. (81.33%)

5 existing lines in 3 files now uncovered.

9509 of 16513 relevant lines covered (57.58%)

55.84 hits per line