Struct AuthLimiter 

pub struct AuthLimiter { /* private fields */ }

Shared throttle state, built once at startup.

Implementations

impl AuthLimiter

pub fn new(trusted: TrustedProxies) -> Self

pub fn check( &self, peer: Option<SocketAddr>, forwarded_for: Option<&str>, ) -> Decision

Records an attempt from peer, honouring forwarded_for only if the peer is a trusted proxy.

The per-client ceiling is charged first, and the global one only if the client had budget left.

That order is load-bearing. Charging global first spends it on requests that are about to be refused anyway, so one address sitting on its own exhausted bucket could drain the site-wide budget and deny login to everyone — a cheaper attack than the identity rotation the global ceiling exists to stop.

A poisoned lock denies: the limiter failing open would silently restore the unmetered oracle this exists to close.

pub fn check_verification( &self, peer: Option<SocketAddr>, forwarded_for: Option<&str>, ) -> Decision

Records a token verification from peer.

Separate from the login budget: these are ordinary authenticated requests, so the ceiling is far higher and exhausting it must not lock a client out of logging in.