hyperscale-stack / security / 39652388552

98%

Build Type

push

github

Committed by web-flow

Commit Message

feat(core): add the AttemptLimiter and a bounded in-memory throttle

Add attempt limiting to the core (security audit of 2026-10-21: D-20,
and the shared basis of D-01 and F-07).

- security.AttemptLimiter: Allow reserves and charges an attempt in one
  step before any credential is checked; Record settles it (a failure
  keeps the charge, a success clears its own entry, an inconclusive
  outcome refunds). A refusal is ErrTooManyAttempts with a retry delay;
  a limiter that cannot decide wraps ErrUnavailable, so callers fail
  closed.
- throttle.MemoryLimiter: per (subject, source), per subject and per
  source budgets, IPv6 sources aggregated per /56, keys hashed and
  bounded (least throttled entry evicted, never the current attempt's),
  injected clock; an attempt no configured budget applies to (an unknown
  source with the per-subject budget off) is refused as unavailable.
- httpsec, grpcsec and connectrpcsec answer a throttled attempt with 429
  + Retry-After (ResourceExhausted over gRPC and Connect) and supply the
  client address from the transport peer unless the application sets
  it; forwarded headers are never trusted.

basic (next PR) and oauth2 wire it in; without a limiter, behaviour is
unchanged.

Audit: D-20.

Coverage Stats

289 of 290 new or added lines in 9 files covered. (99.66%)

1 existing line in 1 file now uncovered.

14295 of 14509 relevant lines covered (98.53%)

5409.21 hits per line