masks-server 0.12.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 74cc1568b822c061657b6625a809deb750f5503e66fa8d0f390c7a596004953e
-  data.tar.gz: 8bdb0e298ee2c901c71f654215fd0b958d36cd6e69befa231313dd2f98a5d249
+  metadata.gz: c268c36afc7aa404d7cb904ef65cb1f67db51d6b84bdb3a5f83d5aae7d84bf48
+  data.tar.gz: '09285b0606e241c323c82f16555328830421c7d97338d9aa32f38055e6972353'
 SHA512:
-  metadata.gz: e0aa16a41f23221d2274bf66aac45ba8a1c20c901526cfd79905d14a229b3614921dba96c90a4ad296f69a210c8aee6d6aa11453d063d8a07cd9b1b724f13feb
-  data.tar.gz: 4c36c8378c7d459c4c4280227d36ec6f91234d3c2db47f857b8165312af340958789373497de7aa244f8c13ceb09a33415e2de40af99eed39331d1c3161b0838
+  metadata.gz: a253ac4a9e52258b001f1a7424a189728979a5363255d1d9c4d306e70385ea2eecdd8f93e2859603f6959e43786f90be43921d5ed7bc523fa81477f06384f507
+  data.tar.gz: 844b3eb9927070dfddbea67dbbb17992772e84348c35ffdc9feba33fd1b079f718e9d986b8f9da591f77498a54a8404c7240a6dd5ad22d320a04500ec57641f6

data/app/controllers/concerns/masks/server/scim_endpoint.rb

@@ -8,9 +8,9 @@ module Masks
 
         skip_forgery_protection
 
-        rate_limit to: 600, within: 1.minute,
+        rate_limit **Throttle.limits(:scim),
                    by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                   with: -> { scim_error(Scim::Error.new(:too_many_requests, "too many provisioning requests from this address")) }
+                   with: Throttle.refused(:scim) { scim_error(Scim::Error.new(:too_many_requests, "too many provisioning requests from this address")) }
 
         rescue_from Scim::Error, with: :scim_error
         before_action :require_provisioner

data/app/controllers/masks/server/account_exports_controller.rb

@@ -1,9 +1,9 @@
 module Masks
   module Server
     class AccountExportsController < ApplicationController
-      rate_limit to: 5, within: 1.hour, only: :create,
+      rate_limit **Throttle.limits(:export), only: :create,
                  by: -> { [ current_tenant.id, current_actor&.id || request.remote_ip ].join(":") },
-                 with: -> { redirect_to root_path(anchor: "export"), alert: t("account_export.throttled") }
+                 with: Throttle.refused(:export) { redirect_to root_path(anchor: "export"), alert: t("account_export.throttled") }
 
       def create
         actor = current_actor

data/app/controllers/masks/server/addresses_controller.rb

@@ -1,10 +1,9 @@
 module Masks
   module Server
     class AddressesController < ApplicationController
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes,
+      rate_limit **Throttle.limits(:account_attempt),
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { refuse(t("addresses.too_many_attempts")) },
+                 with: Throttle.refused(:account_attempt) { refuse(t("addresses.too_many_attempts")) },
                  only: :update
 
       before_action :require_actor

data/app/controllers/masks/server/authenticator_apps_controller.rb

@@ -1,10 +1,9 @@
 module Masks
   module Server
     class AuthenticatorAppsController < ApplicationController
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes,
+      rate_limit **Throttle.limits(:account_attempt),
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { refuse(t("authenticator_apps.too_many_attempts")) },
+                 with: Throttle.refused(:account_attempt) { refuse(t("authenticator_apps.too_many_attempts")) },
                  only: :create
 
       before_action :require_actor

data/app/controllers/masks/server/authorize_controller.rb

@@ -9,9 +9,9 @@ module Masks
         refuse(bad_request(:invalid_request_object, refusal.message))
       end
 
-      rate_limit to: 1, within: 1.hour, only: :ask,
+      rate_limit **Throttle.limits(:access_request), only: :ask,
                  by: -> { [ current_tenant.id, current_actor&.id, refused_request(params[:rid])&.client_id ].join(":") },
-                 with: -> { redirect_to authorize_refused_path(rid: params[:rid]), alert: t("authorize.error.slow_down") }
+                 with: Throttle.refused(:access_request) { redirect_to authorize_refused_path(rid: params[:rid]), alert: t("authorize.error.slow_down") }
 
       def show
         authorization = Authorization.from_request(request)

data/app/controllers/masks/server/device_authorizations_controller.rb

@@ -4,9 +4,9 @@ module Masks
       include RackOAuth2Endpoint
       include TokenPresented
 
-      rate_limit to: 60, within: 1.minute,
+      rate_limit **Throttle.limits(:device_authorization),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { slow_down }
+                 with: Throttle.refused(:device_authorization) { slow_down }
 
       def create
         client = authenticate_client!

data/app/controllers/masks/server/device_verifications_controller.rb

@@ -6,10 +6,10 @@ module Masks
 
       before_action :establish_device
 
-      rate_limit to: ::Rails.configuration.masks.device_code_limit, within: 3.minutes,
+      rate_limit **Throttle.limits(:device_code),
                  if: -> { params[:user_code].present? },
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { asking(UNKNOWN, status: :too_many_requests) }
+                 with: Throttle.refused(:device_code) { asking(UNKNOWN, status: :too_many_requests) }
 
       def show
         return asking(params[:refused].presence) if params[:user_code].blank?

data/app/controllers/masks/server/enrollments_controller.rb

@@ -3,18 +3,18 @@ module Masks
     class EnrollmentsController < ApplicationController
       include TokenPresented
 
-      rate_limit to: 30, within: 1.minute,
+      rate_limit **Throttle.limits(:enrollment),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> {
+                 with: Throttle.refused(:enrollment) {
                    render json: {
                      "error" => "too_many_requests",
                      "error_description" => "too many enrollment tokens asked for from this address"
                    }, status: :too_many_requests
                  }
 
-      rate_limit to: 60, within: 1.hour, only: :create, name: "app",
+      rate_limit **Throttle.limits(:app_enrollment), only: :create, name: "app",
                  by: -> { [ current_tenant.id, claimed_client_id ].join(":") },
-                 with: -> {
+                 with: Throttle.refused(:app_enrollment) {
                    render json: {
                      "error" => "too_many_requests",
                      "error_description" => "too many enrollment tokens asked for by this app"

data/app/controllers/masks/server/forward_auth_controller.rb

@@ -4,9 +4,9 @@ module Masks
       skip_forgery_protection
       before_action -> { request.session_options[:skip] = true }, only: %i[check callback]
 
-      rate_limit to: 30, within: 1.minute, only: %i[start callback],
+      rate_limit **Throttle.limits(:forward_auth), only: %i[start callback],
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { head :too_many_requests }
+                 with: Throttle.refused(:forward_auth) { head :too_many_requests }
 
       def check
         target = Forwarded.target(request)

data/app/controllers/masks/server/introspections_controller.rb

@@ -5,9 +5,9 @@ module Masks
 
       INACTIVE = { "active" => false }.freeze
 
-      rate_limit to: 120, within: 1.minute,
+      rate_limit **Throttle.limits(:introspection),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { render json: INACTIVE, status: :too_many_requests }
+                 with: Throttle.refused(:introspection) { render json: INACTIVE, status: :too_many_requests }
 
       def create
         client = authenticate_client!

data/app/controllers/masks/server/logins_controller.rb

@@ -8,26 +8,22 @@ module Masks
 
       skip_forgery_protection
 
-      rate_limit to: ::Rails.configuration.masks.attempt_limit,
-                 within: 3.minutes, only: :update, if: -> { verifying? },
+      rate_limit **Throttle.limits(:attempt), only: :update, if: -> { verifying? },
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { too_many("too-many-attempts") }
+                 with: Throttle.refused(:attempt) { too_many("too-many-attempts") }
 
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes, only: :update, name: "identifier", if: -> { verifying? },
+      rate_limit **Throttle.limits(:account_attempt), only: :update, name: "identifier", if: -> { verifying? },
                  by: -> { [ current_tenant.id, attempted_account ].join(":") },
-                 with: -> { too_many("too-many-attempts-for-account") }
+                 with: Throttle.refused(:account_attempt) { too_many("too-many-attempts-for-account") }
 
-      rate_limit to: ::Rails.configuration.masks.recovery_limit,
-                 within: 15.minutes, only: :update, name: "recovery",
+      rate_limit **Throttle.limits(:recovery), only: :update, name: "recovery",
                  if: -> { Login.limit_for(params[:event]) == :sending },
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { too_many("too-many-attempts") }
+                 with: Throttle.refused(:recovery) { too_many("too-many-attempts") }
 
-      rate_limit to: ::Rails.configuration.masks.attempt_limit,
-                 within: 3.minutes, only: %i[provider posted_provider], name: "provider",
+      rate_limit **Throttle.limits(:attempt), only: %i[provider posted_provider], name: "provider",
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { too_many("too-many-attempts") }
+                 with: Throttle.refused(:attempt) { too_many("too-many-attempts") }
 
       before_action :refuse_blocked_agent
       before_action :verify_authenticity_token, except: :posted_provider
@@ -108,6 +104,8 @@ module Masks
         end
 
         def take_posted(handle)
+          return {} unless Replay.first?("provider-callback", handle, expires_in: POSTED_WINDOW)
+
           key = posted_key(handle)
           held = ::Rails.cache.read(key)
           ::Rails.cache.delete(key)

data/app/controllers/masks/server/organization_members_controller.rb

@@ -7,9 +7,9 @@ module Masks
         back(alert: t("organization_members.owners_only", organization: @organization.name))
       end
 
-      rate_limit to: 30, within: 1.minute, only: %i[create resend],
+      rate_limit **Throttle.limits(:invitation), only: %i[create resend],
                  by: -> { [ current_tenant.id, current_actor&.id || request.remote_ip ].join(":") },
-                 with: -> { back(alert: t("organization_members.slow_down")) }
+                 with: Throttle.refused(:invitation) { back(alert: t("organization_members.slow_down")) }
 
       before_action :require_actor
       before_action :require_membership

data/app/controllers/masks/server/passwords_controller.rb

@@ -1,10 +1,9 @@
 module Masks
   module Server
     class PasswordsController < ApplicationController
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes,
+      rate_limit **Throttle.limits(:account_attempt),
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { refuse(t("passwords.too_many_attempts")) }
+                 with: Throttle.refused(:account_attempt) { refuse(t("passwords.too_many_attempts")) }
 
       before_action :require_actor
 

data/app/controllers/masks/server/pushed_authorizations_controller.rb

@@ -3,9 +3,9 @@ module Masks
     class PushedAuthorizationsController < ApplicationController
       include TokenPresented
 
-      rate_limit to: 60, within: 1.minute,
+      rate_limit **Throttle.limits(:pushed_authorization),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { slow_down }
+                 with: Throttle.refused(:pushed_authorization) { slow_down }
 
       def create
         client = authenticate_client!

data/app/controllers/masks/server/received_signals_controller.rb

@@ -3,9 +3,9 @@ module Masks
     class ReceivedSignalsController < ApplicationController
       skip_forgery_protection
 
-      rate_limit to: 600, within: 1.minute, only: :create,
+      rate_limit **Throttle.limits(:signal), only: :create,
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { render json: { "err" => "invalid_request", "description" => "too many events from this address" }, status: :too_many_requests }
+                 with: Throttle.refused(:signal) { render json: { "err" => "invalid_request", "description" => "too many events from this address" }, status: :too_many_requests }
 
       def create
         ReceivedSignal.new(request.raw_post, issuer: issuer).receive!

data/app/controllers/masks/server/registrations_controller.rb

@@ -3,9 +3,9 @@ module Masks
     class RegistrationsController < ApplicationController
       skip_forgery_protection
 
-      rate_limit to: ::Rails.configuration.masks.registration_limit, within: 10.minutes, only: :create,
+      rate_limit **Throttle.limits(:registration), only: :create,
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> {
+                 with: Throttle.refused(:registration) {
                    render json: {
                      "error" => "too_many_requests",
                      "error_description" => "too many registrations from this address"

data/app/controllers/masks/server/revocations_controller.rb

@@ -3,9 +3,9 @@ module Masks
     class RevocationsController < ApplicationController
       include TokenPresented
 
-      rate_limit to: 120, within: 1.minute,
+      rate_limit **Throttle.limits(:revocation),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> {
+                 with: Throttle.refused(:revocation) {
                    render json: {
                      "error" => "slow_down",
                      "error_description" => "too many revocation requests from this address"

data/app/controllers/masks/server/saml_controller.rb

@@ -5,9 +5,9 @@ module Masks
 
       skip_forgery_protection only: %i[sso slo]
 
-      rate_limit to: 60, within: 1.minute, only: %i[sso initiate slo],
+      rate_limit **Throttle.limits(:saml), only: %i[sso initiate slo],
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { refuse("too many sign-in requests from this address", status: :too_many_requests) }
+                 with: Throttle.refused(:saml) { refuse("too many sign-in requests from this address", status: :too_many_requests) }
 
       rescue_from SamlIdentity::Refused do |refusal|
         refuse(refusal.message)

data/app/controllers/masks/server/sign_in_approvals_controller.rb

@@ -5,11 +5,10 @@ module Masks
 
       before_action :require_trusted_device
 
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes,
+      rate_limit **Throttle.limits(:account_attempt),
                  only: :create,
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { refuse(t("sign_in_approvals.too_many_attempts")) }
+                 with: Throttle.refused(:account_attempt) { refuse(t("sign_in_approvals.too_many_attempts")) }
 
       def create
         approval = SignInApproval.matching(actor: current_actor, code: params[:code], from: current_device)

data/app/controllers/masks/server/tokens_controller.rb

@@ -9,9 +9,9 @@ module Masks
 
       skip_forgery_protection
 
-      rate_limit to: 60, within: 1.minute,
+      rate_limit **Throttle.limits(:token),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { slow_down }
+                 with: Throttle.refused(:token) { slow_down }
 
       def create
         return unsupported_grant_type unless Client::GRANT_TYPES.include?(params[:grant_type].to_s)

data/app/controllers/masks/server/verifications_controller.rb

@@ -1,10 +1,9 @@
 module Masks
   module Server
     class VerificationsController < ApplicationController
-      rate_limit to: ::Rails.configuration.masks.recovery_limit,
-                 within: 15.minutes,
+      rate_limit **Throttle.limits(:recovery),
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { redirect_to root_path, alert: t("verifications.too_many_requests") }
+                 with: Throttle.refused(:recovery) { redirect_to root_path, alert: t("verifications.too_many_requests") }
 
       before_action :require_actor
 

data/app/graphql/masks/server/manage/types/health_check_type.rb

@@ -5,7 +5,7 @@ module Masks
         class HealthCheckType < BaseObject
           description "The latest result of one health check. Checks run every 10 minutes."
 
-          field :name, ID, null: false, description: "jobs, worker, queue, ldap, metrics, mail, origin, domains, or keys."
+          field :name, ID, null: false, description: "jobs, worker, queue, ldap, metrics, mail, origin, domains, keys, or proxy."
           field :status, String, null: false, description: "ok, warning, or failing."
           field :summary, String, null: false, description: "A short word for what the check found, such as none, stale, or silent."
           field :details, GraphQL::Types::JSON, null: false, description: "The figures and names behind the summary."

data/app/ldap/masks/server/ldap/gate.rb

@@ -2,7 +2,6 @@ module Masks
   module Server
     module Ldap
       class Gate
-        WINDOW = 3.minutes
         VIA = "ldap".freeze
 
         Bound = Data.define(:kind, :tenant, :dn, :subject, :client_id) do
@@ -30,7 +29,7 @@ module Masks
           password = password.to_s
           return anonymous if name.blank? && password.empty?
           return refused(Protocol::UNWILLING_TO_PERFORM, "unauthenticated binds are refused") if password.empty?
-          return throttled if failures(ip_key) >= ::Rails.configuration.masks.attempt_limit
+          return throttled(:attempt) if Throttle.exceeded?(:attempt, ip_key)
 
           dn = parse(name)
           tenant = dn && Directory.tenant_for(dn)
@@ -93,8 +92,8 @@ module Masks
           def person(tenant, directory, uid, password)
             account = account_key(tenant, uid)
 
-            if failures(account) >= ::Rails.configuration.masks.account_attempt_limit
-              Event.record!(Event::LOGIN_THROTTLED, actor: Actor.locate(uid), by: nil, identifier: uid, via: VIA)
+            if Throttle.exceeded?(:account_attempt, account)
+              Throttle.hit!(:account_attempt, actor: Actor.locate(uid), address: @ip_address, identifier: uid, via: VIA)
               return throttled
             end
 
@@ -102,7 +101,7 @@ module Masks
             return app_password(tenant, directory, uid, password, account) if actor.nil? && app_password?(password)
 
             if actor.nil?
-              failed!(ip_key, account)
+              failed!(account)
               return refuse(uid, "password")
             end
 
@@ -125,7 +124,7 @@ module Masks
             return throttled if outcome.throttled?
             return bound(tenant, directory, outcome.actor, factor: AppPasswords::FACTOR) if outcome.actor
 
-            failed!(ip_key, account) if outcome.wrong?
+            failed!(account) if outcome.wrong?
             invalid
           end
 
@@ -159,7 +158,7 @@ module Masks
 
           def decoy(password)
             BCrypt::Password.new(Actor.decoy_digest) == password
-            failed!(ip_key)
+            Throttle.count!(:attempt, ip_key)
             invalid
           end
 
@@ -167,7 +166,9 @@ module Masks
             refused(Protocol::INVALID_CREDENTIALS, "invalid credentials")
           end
 
-          def throttled
+          def throttled(limit = nil)
+            Throttle.hit!(limit, address: @ip_address) if limit
+
             refused(Protocol::UNWILLING_TO_PERFORM, "too many attempts; wait a few minutes")
           end
 
@@ -176,19 +177,16 @@ module Masks
           end
 
           def ip_key
-            "ldap-attempts:ip:#{@ip_address}"
+            "ldap:#{@ip_address}"
           end
 
           def account_key(tenant, uid)
-            "ldap-attempts:#{tenant.id}:#{Digest::SHA256.hexdigest(uid.to_s.strip.downcase)}"
-          end
-
-          def failures(key)
-            ::Rails.cache.read(key).to_i
+            "ldap:#{tenant.id}:#{Digest::SHA256.hexdigest(uid.to_s.strip.downcase)}"
           end
 
-          def failed!(*keys)
-            keys.each { |key| ::Rails.cache.increment(key, 1, expires_in: WINDOW) }
+          def failed!(account)
+            Throttle.count!(:attempt, ip_key)
+            Throttle.count!(:account_attempt, account)
           end
       end
     end

data/app/models/masks/server/app_passwords.rb

@@ -3,7 +3,6 @@ module Masks
     module AppPasswords
       FACTOR = "app_password".freeze
       THROTTLED = "throttled".freeze
-      WINDOW = 3.minutes
       SCOPE = "masks/server/logins".freeze
 
       Outcome = Data.define(:actor, :refusal) do
@@ -21,10 +20,11 @@ module Masks
           return refused(nil, identifier, "factor-not-offered", via, client) unless client&.app_passwords? && !client.archived?
 
           actor = Actor.locate(identifier)
-          keys = [ account_key(tenant, actor, identifier), address_key(tenant, ip_address) ]
+          keys = { account_attempt: [ account_key(tenant, actor, identifier), "identifier" ], attempt: [ address_key(tenant, ip_address), nil ] }
+          exceeded = keys.find { |limit, (by, named)| Throttle.exceeded?(limit, by, scope: SCOPE, named: named) }&.first
 
-          if throttled?(keys)
-            Event.record!(Event::LOGIN_THROTTLED, actor: actor, by: nil, client: client, identifier: identifier, via: via)
+          if exceeded
+            Throttle.hit!(exceeded, actor: actor, client: client, address: ip_address, identifier: identifier, via: via)
             return Outcome.new(actor: nil, refusal: THROTTLED)
           end
 
@@ -60,21 +60,15 @@ module Masks
           end
 
           def account_key(tenant, actor, identifier)
-            [ "rate-limit", SCOPE, "identifier", tenant.id, actor&.id || identifier.to_s.strip.downcase ].join(":")
+            [ tenant.id, actor&.id || identifier.to_s.strip.downcase ].join(":")
           end
 
           def address_key(tenant, ip_address)
-            [ "rate-limit", SCOPE, tenant.id, ip_address ].join(":")
-          end
-
-          def throttled?(keys)
-            limits = [ ::Rails.configuration.masks.account_attempt_limit, ::Rails.configuration.masks.attempt_limit ]
-
-            keys.zip(limits).any? { |key, limit| ::Rails.cache.read(key).to_i >= limit }
+            [ tenant.id, ip_address ].join(":")
           end
 
           def failed!(keys)
-            keys.each { |key| ::Rails.cache.increment(key, 1, expires_in: WINDOW) }
+            keys.each { |limit, (by, named)| Throttle.count!(limit, by, scope: SCOPE, named: named) }
           end
       end
     end

data/app/models/masks/server/client_metadata_document.rb

@@ -12,7 +12,6 @@ module Masks
       LONGEST = 24.hours
       REFUSAL_LIFETIME = 5.minutes
       NAME_LIMIT = 100
-      WINDOW = 10.minutes
       TENANT_FACTOR = 10
       AUTH_METHODS = %w[none private_key_jwt].freeze
       DEFAULT_AUTH_METHOD = "none".freeze
@@ -62,14 +61,11 @@ module Masks
         end
 
         def crowded?
-          limit = ::Rails.configuration.masks.registration_limit
-          key = "masks:client-metadata-documents:#{Current.tenant&.id}:#{Time.current.to_i / WINDOW.to_i}"
-          here = ::Rails.cache.increment("#{key}:#{Current.ip_address}", 1, expires_in: WINDOW)
-          anywhere = ::Rails.cache.increment(key, 1, expires_in: WINDOW)
+          tenant = Current.tenant&.id
+          here = Throttle.crowded?(:registration, "documents:#{tenant}:#{Current.ip_address}")
+          anywhere = Throttle.crowded?(:registration, "documents:#{tenant}", times: TENANT_FACTOR)
 
-          (here.to_i > limit || anywhere.to_i > limit * TENANT_FACTOR).tap do |crowded|
-            ::Rails.logger.info("masks: too many new client metadata documents") if crowded
-          end
+          (here || anywhere).tap { |crowded| Throttle.hit!(:registration, document: true) if crowded }
         end
 
         def refusal_key(client_id)

data/app/models/masks/server/confirmation_code.rb

@@ -31,7 +31,7 @@ module Masks
 
         def inbox_crowded?(address:, ip: nil)
           recent = inbox.where(created_at: WINDOW.ago..)
-          limit = ::Rails.configuration.masks.recovery_limit
+          limit = Throttle.limit(:recovery)
 
           recent.where("payload->>'address' = ?", address).count >= limit ||
             (ip.present? && recent.where("payload->>'ip' = ?", ip).count >= limit * INBOX_PER_IP)
@@ -40,7 +40,7 @@ module Masks
         def crowded?(actor:, channel:)
           where(actor_id: actor.id, created_at: WINDOW.ago..)
             .where("payload->>'channel' = ?", channel)
-            .count >= ::Rails.configuration.masks.recovery_limit
+            .count >= Throttle.limit(:recovery)
         end
 
         def inbox

data/app/models/masks/server/declared.rb

@@ -21,7 +21,7 @@ module Masks
       def initialize(document)
         raise Invalid, "the declared configuration must be a mapping" unless document.is_a?(Hash)
 
-        @document = document
+        @document = document.except("limits")
       end
 
       def apply!
@@ -33,6 +33,8 @@ module Masks
       private
 
         def tenants
+          return [] if @document.empty?
+
           if @document.key?("tenants")
             @document.fetch("tenants").map do |subdomain, declared|
               [ Tenant.active.find_by(subdomain: subdomain) || raise(Invalid, "no tenant called #{subdomain}"), declared || {} ]

data/app/models/masks/server/event.rb

@@ -14,7 +14,7 @@ module Masks
       SESSION_EXPIRED = "session.expired".freeze
       LOGOUT_UNDELIVERED = "logout.undelivered".freeze
       LOGIN_REFUSED = "login.refused".freeze
-      LOGIN_THROTTLED = "login.throttled".freeze
+      LIMIT_REACHED = "limit.reached".freeze
 
       ACCOUNT_CREATED = "account.created".freeze
       ACCOUNT_EXPORTED = "account.exported".freeze
@@ -181,7 +181,7 @@ module Masks
       RELEASE_AVAILABLE = "release.available".freeze
 
       GRAVE = [
-        LOGIN_REFUSED, LOGIN_THROTTLED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
+        LOGIN_REFUSED, LIMIT_REACHED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
         DEVICE_BLOCKED, ACTOR_DELETED, AUTHENTICATOR_DISABLED, CONNECTION_REFUSED, DELEGATION_REFUSED,
         EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, TEXT_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT,
         ORGANIZATION_OWNERLESS, JOB_FAILED, HEALTH_FAILING