zyycnandClaude 495c19b5e4 fix(api): bucket admin login throttling by client ip ...

The AdminLoginSource extension was never injected, so every login request
fell back to the shared "unknown" failure bucket: five wrong passwords from
any unauthenticated visitor locked the real administrator out for fifteen
minutes, renewable indefinitely. Attach a login-route middleware that keys
the bucket on the socket peer IP taken from ConnectInfo; forwarded headers
are client-forgeable and stay excluded, so reverse-proxy deployments retain
the previous shared-bucket behavior. Add a router-level regression test
proving throttling of one source leaves other sources unaffected.

Co-authored-by: Claude <noreply@anthropic.com>

2026-07-26 23:18:26 +08:00

..

src

fix(api): bucket admin login throttling by client ip

2026-07-26 23:18:26 +08:00

tests

fix(api): bucket admin login throttling by client ip

2026-07-26 23:18:26 +08:00

Cargo.toml

chore(release): prepare v3.0.0

2026-07-25 01:54:18 +08:00