@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.2

package/backend/internal/api/api.gen.go

@@ -71,6 +71,27 @@ func (e LoginResponseRole) Valid() bool {
 	}
 }
 
+// CreateIdeaForm defines model for CreateIdeaForm.
+type CreateIdeaForm struct {
+	// Category COOL_IDEA or OUTSTANDING_IMPACT
+	Category string `json:"category"`
+
+	// Direction One of the five ESG directions (PRD 6.6)
+	Direction string `json:"direction"`
+
+	// Name 1-75 code points after clean-up; no / \ : * ? " < > |
+	Name string `json:"name"`
+
+	// Org AAID, BSID, ICSD, TSID, PLED or DEID
+	Org string `json:"org"`
+
+	// Slides One PDF or PPTX, at most 5 MiB, named {I|O}_{org}_{leaderName}_{leaderEmpNo}_{name}.{pdf|pptx}
+	Slides openapi_types.File `json:"slides"`
+
+	// Summary 1-300 code points after clean-up
+	Summary string `json:"summary"`
+}
+
 // CsrfTokenResponse defines model for CsrfTokenResponse.
 type CsrfTokenResponse struct {
 	Token string `json:"token"`
@@ -93,6 +114,9 @@ type FieldError struct {
 	Code     string  `json:"code"`
 	Expected *string `json:"expected,omitempty"`
 	Field    string  `json:"field"`
+
+	// Rule PASSWORD_POLICY only, the violated rule id (PRD 6.4)
+	Rule *string `json:"rule,omitempty"`
 }
 
 // IdeaDetail defines model for IdeaDetail.
@@ -245,6 +269,33 @@ type RegisterParams struct {
 type ListIdeasParams struct {
 	Page *int `form:"page,omitempty" json:"page,omitempty"`
 	Size *int `form:"size,omitempty" json:"size,omitempty"`
+
+	// Org Closed set; an invalid value is 422 INVALID_ENUM (never ignored). Validated in the handler.
+	Org         *string `form:"org,omitempty" json:"org,omitempty"`
+	Category    *string `form:"category,omitempty" json:"category,omitempty"`
+	Direction   *string `form:"direction,omitempty" json:"direction,omitempty"`
+	LeaderEmpNo *string `form:"leaderEmpNo,omitempty" json:"leaderEmpNo,omitempty"`
+
+	// CreatedFrom ISO 8601 instant with offset or Z; inclusive. Validated in the handler.
+	CreatedFrom *string `form:"createdFrom,omitempty" json:"createdFrom,omitempty"`
+
+	// CreatedTo ISO 8601 instant with offset or Z; exclusive. Validated in the handler.
+	CreatedTo *string `form:"createdTo,omitempty" json:"createdTo,omitempty"`
+
+	// Q Case-insensitive "name contains"; `%` and `_` are literal.
+	Q *string `form:"q,omitempty" json:"q,omitempty"`
+
+	// Sort createdAt (default) or name; anything else is 422 INVALID_ENUM. Validated in the handler.
+	Sort *string `form:"sort,omitempty" json:"sort,omitempty"`
+
+	// Order asc or desc (default desc for createdAt, asc for name); anything else is 422 INVALID_ENUM. Validated in the handler.
+	Order *string `form:"order,omitempty" json:"order,omitempty"`
+}
+
+// CreateIdeaParams defines parameters for CreateIdea.
+type CreateIdeaParams struct {
+	// XCSRFToken Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400).
+	XCSRFToken *CsrfToken `json:"X-CSRF-Token,omitempty"`
 }
 
 // LoginJSONRequestBody defines body for Login for application/json ContentType.
@@ -253,6 +304,9 @@ type LoginJSONRequestBody = LoginRequest
 // RegisterJSONRequestBody defines body for Register for application/json ContentType.
 type RegisterJSONRequestBody = RegisterRequest
 
+// CreateIdeaMultipartRequestBody defines body for CreateIdea for multipart/form-data ContentType.
+type CreateIdeaMultipartRequestBody = CreateIdeaForm
+
 // ServerInterface represents all server handlers.
 type ServerInterface interface {
 	// GetCsrfToken Session-bound CSRF token (anonymous before login)
@@ -276,9 +330,15 @@ type ServerInterface interface {
 	// ListIdeas List Ideas visible to the caller
 	// (GET /ideas)
 	ListIdeas(w http.ResponseWriter, r *http.Request, params ListIdeasParams)
+	// CreateIdea Create an Idea with its slides (User only)
+	// (POST /ideas)
+	CreateIdea(w http.ResponseWriter, r *http.Request, params CreateIdeaParams)
 	// GetIdea Idea detail
 	// (GET /ideas/{id})
 	GetIdea(w http.ResponseWriter, r *http.Request, id IdeaId)
+	// DownloadSlides Download the Idea's slides (Leader, Member, Admin)
+	// (GET /ideas/{id}/slides)
+	DownloadSlides(w http.ResponseWriter, r *http.Request, id IdeaId)
 }
 
 // Unimplemented server implementation that returns http.StatusNotImplemented for each endpoint.
@@ -327,12 +387,24 @@ func (_ Unimplemented) ListIdeas(w http.ResponseWriter, r *http.Request, params
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// CreateIdea Create an Idea with its slides (User only)
+// (POST /ideas)
+func (_ Unimplemented) CreateIdea(w http.ResponseWriter, r *http.Request, params CreateIdeaParams) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // GetIdea Idea detail
 // (GET /ideas/{id})
 func (_ Unimplemented) GetIdea(w http.ResponseWriter, r *http.Request, id IdeaId) {
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// DownloadSlides Download the Idea's slides (Leader, Member, Admin)
+// (GET /ideas/{id}/slides)
+func (_ Unimplemented) DownloadSlides(w http.ResponseWriter, r *http.Request, id IdeaId) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // ServerInterfaceWrapper converts contexts to parameters.
 type ServerInterfaceWrapper struct {
 	Handler            ServerInterface
@@ -542,6 +614,123 @@ func (siw *ServerInterfaceWrapper) ListIdeas(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
+	// ------------- Optional query parameter "org" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "org", r.URL.Query(), &params.Org, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "org"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "org", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "category" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "category", r.URL.Query(), &params.Category, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "category"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "category", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "direction" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "direction", r.URL.Query(), &params.Direction, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "direction"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "direction", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "leaderEmpNo" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "leaderEmpNo", r.URL.Query(), &params.LeaderEmpNo, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "leaderEmpNo"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "leaderEmpNo", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "createdFrom" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "createdFrom", r.URL.Query(), &params.CreatedFrom, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "createdFrom"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "createdFrom", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "createdTo" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "createdTo", r.URL.Query(), &params.CreatedTo, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "createdTo"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "createdTo", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "q" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "q", r.URL.Query(), &params.Q, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "q"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "q", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "sort" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "sort", r.URL.Query(), &params.Sort, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "sort"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "sort", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "order" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "order", r.URL.Query(), &params.Order, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "order"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "order", Err: err})
+		}
+		return
+	}
+
 	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		siw.Handler.ListIdeas(w, r, params)
 	}))
@@ -553,6 +742,47 @@ func (siw *ServerInterfaceWrapper) ListIdeas(w http.ResponseWriter, r *http.Requ
 	handler.ServeHTTP(w, r)
 }
 
+// CreateIdea operation middleware
+func (siw *ServerInterfaceWrapper) CreateIdea(w http.ResponseWriter, r *http.Request) {
+
+	var err error
+	_ = err
+
+	// Parameter object where we will unmarshal all parameters from the context
+	var params CreateIdeaParams
+
+	headers := r.Header
+
+	// ------------- Optional header parameter "X-CSRF-Token" -------------
+	if valueList, found := headers[http.CanonicalHeaderKey("X-CSRF-Token")]; found {
+		var XCSRFToken CsrfToken
+		n := len(valueList)
+		if n != 1 {
+			siw.ErrorHandlerFunc(w, r, &TooManyValuesForParamError{ParamName: "X-CSRF-Token", Count: n})
+			return
+		}
+
+		err = runtime.BindStyledParameterWithOptions("simple", "X-CSRF-Token", valueList[0], &XCSRFToken, runtime.BindStyledParameterOptions{ParamLocation: runtime.ParamLocationHeader, Explode: false, Required: false, Type: "string", Format: ""})
+		if err != nil {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "X-CSRF-Token", Err: err})
+			return
+		}
+
+		params.XCSRFToken = &XCSRFToken
+
+	}
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.CreateIdea(w, r, params)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 // GetIdea operation middleware
 func (siw *ServerInterfaceWrapper) GetIdea(w http.ResponseWriter, r *http.Request) {
 
@@ -579,6 +809,32 @@ func (siw *ServerInterfaceWrapper) GetIdea(w http.ResponseWriter, r *http.Reques
 	handler.ServeHTTP(w, r)
 }
 
+// DownloadSlides operation middleware
+func (siw *ServerInterfaceWrapper) DownloadSlides(w http.ResponseWriter, r *http.Request) {
+
+	var err error
+	_ = err
+
+	// ------------- Path parameter "id" -------------
+	var id IdeaId
+
+	err = runtime.BindStyledParameterWithOptions("simple", "id", chi.URLParam(r, "id"), &id, runtime.BindStyledParameterOptions{ParamLocation: runtime.ParamLocationPath, Explode: false, Required: true, Type: "string", Format: "uuid", ValueIsUnescaped: r.URL.RawPath == ""})
+	if err != nil {
+		siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "id", Err: err})
+		return
+	}
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.DownloadSlides(w, r, id)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 type UnescapedCookieParamError struct {
 	ParamName string
 	Err       error
@@ -713,9 +969,15 @@ func HandlerWithOptions(si ServerInterface, options ChiServerOptions) http.Handl
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/ideas", wrapper.ListIdeas)
 	})
+	r.Group(func(r chi.Router) {
+		r.Post(options.BaseURL+"/ideas", wrapper.CreateIdea)
+	})
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/ideas/{id}", wrapper.GetIdea)
 	})
+	r.Group(func(r chi.Router) {
+		r.Get(options.BaseURL+"/ideas/{id}/slides", wrapper.DownloadSlides)
+	})
 
 	return r
 }

package/backend/internal/auth/internal/store/login_attempt.go

@@ -0,0 +1,53 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// IPPolicy is the per-IP sliding-window rule (PRD §6.5).
+type IPPolicy struct {
+	MaxFailures   int
+	WindowSeconds int
+}
+
+// RecordIPFailure stores one failed attempt of ip at database time.
+func RecordIPFailure(ctx context.Context, db *sql.DB, ip string) error {
+	if _, err := db.ExecContext(ctx,
+		`INSERT INTO login_attempt (ip, attempted_at) VALUES (?, NOW(6))`, ip); err != nil {
+		return fmt.Errorf("record login attempt: %w", err)
+	}
+	return nil
+}
+
+// IPRetryAfter returns how long ip stays over the limit, 0 when it is not.
+// The address is over the limit while at least MaxFailures failures lie inside
+// the window; it is free again when the MaxFailures-th newest one leaves it,
+// so that row's age decides (with exactly MaxFailures rows this is the oldest).
+func IPRetryAfter(ctx context.Context, db *sql.DB, ip string, p IPPolicy) (time.Duration, error) {
+	var us int64
+	err := db.QueryRowContext(ctx,
+		`SELECT TIMESTAMPDIFF(MICROSECOND, NOW(6), attempted_at + INTERVAL ? SECOND)
+		   FROM login_attempt
+		  WHERE ip = ? AND attempted_at > NOW(6) - INTERVAL ? SECOND
+		  ORDER BY attempted_at DESC
+		  LIMIT 1 OFFSET ?`, p.WindowSeconds, ip, p.WindowSeconds, p.MaxFailures-1).Scan(&us)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, fmt.Errorf("read login attempts: %w", err)
+	}
+	return time.Duration(us) * time.Microsecond, nil
+}
+
+// DeleteOldAttempts removes at most limit login_attempt rows outside the
+// window; IPRetryAfter only reads rows inside it.
+func DeleteOldAttempts(ctx context.Context, db *sql.DB, p IPPolicy, limit int) (int64, error) {
+	return deleteRows(ctx, db, "purge login attempts",
+		`DELETE FROM login_attempt WHERE attempted_at <= NOW(6) - INTERVAL ? SECOND LIMIT ?`,
+		p.WindowSeconds, limit)
+}

package/backend/internal/auth/internal/store/login_lock.go

@@ -0,0 +1,77 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// LockPolicy is the key-lock rule (PRD §6.5), in seconds and failures.
+type LockPolicy struct {
+	MaxFailures   int
+	WindowSeconds int // a failure older than this no longer counts as consecutive
+	LockSeconds   int // fixed lock length
+}
+
+// RecordFailure counts one failed attempt for key in ONE statement on database
+// time. The assignments run left to right in MariaDB, so later columns see the
+// new fail_count. A lock that is still active is never extended or re-counted
+// (a concurrent attempt that passed Check before the lock was set); an expired
+// lock or a stale window starts again at 1.
+func RecordFailure(ctx context.Context, db *sql.DB, key string, p LockPolicy) error {
+	_, err := db.ExecContext(ctx,
+		`INSERT INTO login_lock (lock_key, fail_count, last_fail_at, locked_until)
+		 VALUES (?, 1, NOW(6), NULL)
+		 ON DUPLICATE KEY UPDATE
+		   fail_count = IF(locked_until > NOW(6), fail_count,
+		                   IF(locked_until IS NOT NULL OR last_fail_at <= NOW(6) - INTERVAL ? SECOND, 1, fail_count + 1)),
+		   locked_until = CASE WHEN locked_until > NOW(6) THEN locked_until
+		                       WHEN fail_count >= ? THEN NOW(6) + INTERVAL ? SECOND
+		                       ELSE NULL END,
+		   last_fail_at = NOW(6)`,
+		key, p.WindowSeconds, p.MaxFailures, p.LockSeconds)
+	if err != nil {
+		return fmt.Errorf("record login failure: %w", err)
+	}
+	return nil
+}
+
+// LockRemaining returns how long key stays locked, 0 when it is not locked.
+func LockRemaining(ctx context.Context, db *sql.DB, key string) (time.Duration, error) {
+	var us sql.NullInt64
+	err := db.QueryRowContext(ctx,
+		`SELECT TIMESTAMPDIFF(MICROSECOND, NOW(6), locked_until)
+		   FROM login_lock WHERE lock_key = ? AND locked_until > NOW(6)`, key).Scan(&us)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, fmt.Errorf("read login lock: %w", err)
+	}
+	return time.Duration(us.Int64) * time.Microsecond, nil
+}
+
+// ClearFailures resets the counter after a successful login. An active lock is
+// left alone (a success cannot shorten it).
+func ClearFailures(ctx context.Context, db *sql.DB, key string) error {
+	_, err := db.ExecContext(ctx,
+		`DELETE FROM login_lock WHERE lock_key = ? AND (locked_until IS NULL OR locked_until <= NOW(6))`, key)
+	if err != nil {
+		return fmt.Errorf("clear login failures: %w", err)
+	}
+	return nil
+}
+
+// DeleteStaleLocks removes at most limit login_lock rows that no longer
+// matter: no active lock and the last failure outside the window. For such a
+// row RecordFailure would start again at 1, exactly as for a missing row.
+func DeleteStaleLocks(ctx context.Context, db *sql.DB, p LockPolicy, limit int) (int64, error) {
+	return deleteRows(ctx, db, "purge login locks",
+		`DELETE FROM login_lock
+		  WHERE last_fail_at <= NOW(6) - INTERVAL ? SECOND
+		    AND (locked_until IS NULL OR locked_until <= NOW(6))
+		  LIMIT ?`,
+		p.WindowSeconds, limit)
+}

package/backend/internal/auth/internal/store/login_throttle_audit.go

@@ -0,0 +1,42 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"time"
+)
+
+// ClaimThrottleAudit reports whether the caller may write the THROTTLED audit
+// row of (scope, subject): true for the first throttled attempt of a window,
+// false while an earlier claim is still running. A winning claim holds until
+// database now + hold. The claim is atomic, so concurrent attempts on several
+// replicas produce exactly one winner.
+func ClaimThrottleAudit(ctx context.Context, db *sql.DB, scope, subject string, hold time.Duration) (bool, error) {
+	us := hold.Microseconds()
+	res, err := db.ExecContext(ctx,
+		`UPDATE login_throttle_audit SET audited_until = NOW(6) + INTERVAL ? MICROSECOND
+		  WHERE scope = ? AND subject = ? AND audited_until <= NOW(6)`, us, scope, subject)
+	if err != nil {
+		return false, fmt.Errorf("claim throttle audit: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n > 0 {
+		return true, nil
+	}
+	res, err = db.ExecContext(ctx,
+		`INSERT IGNORE INTO login_throttle_audit (scope, subject, audited_until)
+		 VALUES (?, ?, NOW(6) + INTERVAL ? MICROSECOND)`, scope, subject, us)
+	if err != nil {
+		return false, fmt.Errorf("claim throttle audit: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	return n > 0, nil
+}
+
+// DeleteExpiredThrottleAudits removes at most limit claims that have run out.
+// ClaimThrottleAudit treats a missing row like an expired one (the next
+// throttled attempt wins), so deleting it changes no outcome.
+func DeleteExpiredThrottleAudits(ctx context.Context, db *sql.DB, limit int) (int64, error) {
+	return deleteRows(ctx, db, "purge throttle audits",
+		`DELETE FROM login_throttle_audit WHERE audited_until <= NOW(6) LIMIT ?`, limit)
+}

package/backend/internal/auth/internal/store/session.go

@@ -99,19 +99,27 @@ func DeleteByUser(ctx context.Context, db *sql.DB, userID uuid.UUID) error {
 	return nil
 }
 
-// DeleteExpired removes sessions past either timeout and returns how many.
-func DeleteExpired(ctx context.Context, db *sql.DB, l Limits) (int64, error) {
-	res, err := db.ExecContext(ctx,
+// DeleteExpired removes at most limit sessions past either timeout and
+// returns how many. The condition is the exact complement of Touch's, so a row
+// it deletes could no longer be validated anyway.
+func DeleteExpired(ctx context.Context, db *sql.DB, l Limits, limit int) (int64, error) {
+	return deleteRows(ctx, db, "purge sessions",
 		`DELETE FROM session
 		  WHERE last_access_at <= NOW(6) - INTERVAL ? SECOND
-		     OR created_at     <= NOW(6) - INTERVAL ? SECOND`,
-		l.IdleSeconds, l.AbsoluteSeconds)
+		     OR created_at     <= NOW(6) - INTERVAL ? SECOND
+		  LIMIT ?`,
+		l.IdleSeconds, l.AbsoluteSeconds, limit)
+}
+
+// deleteRows runs one DELETE and returns the affected row count.
+func deleteRows(ctx context.Context, db *sql.DB, what, query string, args ...any) (int64, error) {
+	res, err := db.ExecContext(ctx, query, args...)
 	if err != nil {
-		return 0, fmt.Errorf("purge sessions: %w", err)
+		return 0, fmt.Errorf("%s: %w", what, err)
 	}
 	n, err := res.RowsAffected()
 	if err != nil {
-		return 0, fmt.Errorf("purge sessions rows: %w", err)
+		return 0, fmt.Errorf("%s rows: %w", what, err)
 	}
 	return n, nil
 }

package/backend/internal/auth/login.go

@@ -33,15 +33,20 @@ const (
 
 var empNoFormat = regexp.MustCompile(`^[0-9]{6}$`)
 
-// Throttle is the login throttling hook (PRD §6.5). B1b-04 implements it on
-// login_lock / login_attempt; until then NoThrottle is wired. Errors fail the
-// login closed (500): an unreachable counter must not disable the limit.
+// Throttle is the login throttling hook (PRD §6.5); DBThrottle implements it on
+// login_lock. Errors fail the login closed (500): an unreachable counter must
+// not disable the limit.
 type Throttle interface {
 	// Check runs before any password work. A positive retryAfter means the
 	// attempt is throttled: it answers 429, runs no bcrypt and is not counted.
 	// key is the submitted employee-ID string as typed; implementations strip
 	// control characters and cut it to 32 characters.
 	Check(ctx context.Context, key string, ip netip.Addr) (retryAfter time.Duration, err error)
+	// AuditOnce is asked after Check reported a wait. It returns true for the
+	// first throttled attempt of a window and false for the rest, so a throttled
+	// key or address is audited once per window (PRD §6.11). Its error is not
+	// fatal: the attempt is audited anyway.
+	AuditOnce(ctx context.Context, key string, ip netip.Addr) (bool, error)
 	// Fail counts one failed attempt (also for unknown accounts).
 	Fail(ctx context.Context, key string, ip netip.Addr) error
 	// Succeed clears the key's counter.
@@ -54,6 +59,9 @@ type NoThrottle struct{}
 // Check implements Throttle.
 func (NoThrottle) Check(context.Context, string, netip.Addr) (time.Duration, error) { return 0, nil }
 
+// AuditOnce implements Throttle.
+func (NoThrottle) AuditOnce(context.Context, string, netip.Addr) (bool, error) { return true, nil }
+
 // Fail implements Throttle.
 func (NoThrottle) Fail(context.Context, string, netip.Addr) error { return nil }
 
@@ -122,7 +130,11 @@ func (l *Logins) Login(ctx context.Context, cmd LoginCommand, req Request) (Logg
 	if retry > 0 {
 		e := web.NewError(web.CodeLoginThrottled, "too many login attempts")
 		e.RetryAfter = retry
-		return LoggedIn{}, loginRefused(e, audit.Throttled, "throttled", cmd.EmpNo)
+		if first, err := l.Throttle.AuditOnce(ctx, cmd.EmpNo, req.IP); err != nil || first {
+			// An error audits anyway: a duplicate row beats a missing one.
+			return LoggedIn{}, loginRefused(e, audit.Throttled, "throttled", cmd.EmpNo)
+		}
+		return LoggedIn{}, e
 	}
 
 	var (

package/backend/internal/auth/login_integration_test.go

@@ -42,6 +42,9 @@ func (f *fakeThrottle) Check(_ context.Context, key string, _ netip.Addr) (time.
 	f.lastKey = key
 	return f.retry, f.err
 }
+func (f *fakeThrottle) AuditOnce(context.Context, string, netip.Addr) (bool, error) {
+	return true, nil
+}
 func (f *fakeThrottle) Fail(context.Context, string, netip.Addr) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
@@ -67,13 +70,23 @@ func newLoginEnv(t *testing.T) loginEnv {
 }
 
 func newLoginEnvLog(t *testing.T, log *slog.Logger) loginEnv {
+	t.Helper()
+	return newLoginEnvWith(t, log, nil)
+}
+
+// newLoginEnvWith wires mk(db) as the throttle; nil keeps the fake.
+func newLoginEnvWith(t *testing.T, log *slog.Logger, mk func(*sql.DB) auth.Throttle) loginEnv {
 	t.Helper()
 	db := dbtest.New(t)
 	auditSvc := audit.New(db, nil)
 	errs := server.ErrorAdapter{Audit: auditSvc}
 	sessions := auth.New(db)
 	th := &fakeThrottle{}
-	logins, err := auth.NewLogins(sessions, auditSvc, th)
+	var thr auth.Throttle = th
+	if mk != nil {
+		thr = mk(db)
+	}
+	logins, err := auth.NewLogins(sessions, auditSvc, thr)
 	if err != nil {
 		t.Fatal(err)
 	}