zyycnandClaude 495c19b5e4 fix(api): bucket admin login throttling by client ip ...

The AdminLoginSource extension was never injected, so every login request
fell back to the shared "unknown" failure bucket: five wrong passwords from
any unauthenticated visitor locked the real administrator out for fifteen
minutes, renewable indefinitely. Attach a login-route middleware that keys
the bucket on the socket peer IP taken from ConnectInfo; forwarded headers
are client-forgeable and stay excluded, so reverse-proxy deployments retain
the previous shared-bucket behavior. Add a router-level regression test
proving throttling of one source leaves other sources unaffected.

Co-authored-by: Claude <noreply@anthropic.com>

2026-07-26 23:18:26 +08:00

..

api.md

docs: refresh v3 provider and deployment guides

2026-07-25 03:26:18 +08:00

architecture.md

docs: refresh v3 provider and deployment guides

2026-07-25 03:26:18 +08:00

audit-2026-07-26.md

fix(api): bucket admin login throttling by client ip

2026-07-26 23:18:26 +08:00