@opengeni/api-router 4.1.0 → 4.1.2-canary.36199476632001

package/src/app.ts

@@ -1,10 +1,16 @@
 import { registerConnectCallbackReturns } from "./integrations/connect-callback-return";
 import { registerFeedbackRoutes } from "./routes/feedback";
+import {
+  CLIENT_ERRORS_PATH,
+  isClientErrorReportRequest,
+  registerClientErrorRoutes,
+} from "./routes/client-errors";
 import { codemodeSessionRequest } from "./codemode";
 import { SiteSessionPathError, OrganizationIntegrationDeniedError } from "@opengeni/contracts";
 import { registerModelConnectionAccessRoutes } from "./routes/model-connection-access";
 import {
   canonicalizeConfiguredModelId,
+  codeSearchDeploymentPolicy,
   configuredAllowedModels,
   configuredAllowedReasoningEfforts,
   configuredModels,
@@ -44,6 +50,7 @@ import {
   ConnectAttemptConflictError,
   ConnectAttemptNotFoundError,
   configureChildLifecycleNotices,
+  configureCodeSearchDeploymentPolicy,
   configureWorkspaceControlRequestLockTimeoutMs,
   dbSql,
   getManagedAuthSessionSetSnapshot,
@@ -66,7 +73,12 @@ import { cors } from "hono/cors";
 import { getCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { ApiHttpError, workspaceControlBusyHttpError } from "./http/api-error";
+import { replaceTrustedClientAddressHeader } from "./http/request-source";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
+import {
+  boundedRegisteredRouteLabel,
+  registeredHandlerRoutePath,
+} from "./http/registered-route-label";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
 import {
   CodexCompactionV2ProviderLockedError,
@@ -144,7 +156,16 @@ import {
   BrowserControlTransportError,
 } from "@opengeni/runtime/sandbox";
 import { requireAccessKey } from "./http/auth";
+import {
+  publicListenerServesMetrics,
+  registerPrometheusMetricsRoute,
+} from "./http/metrics-listener";
 import { allowedCorsOrigin } from "./http/cors";
+import {
+  createLocalBrowserBoundary,
+  localBrowserRequestHost,
+  markLocalInternalDispatch,
+} from "./http/local-browser-boundary";
 import { withAccessGrantSessionRlsContext } from "./access-grant-rls";
 import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
@@ -294,11 +315,17 @@ export function createAppComposition(deps: AppDependencies): {
   // Pause) run inside API-originated db commands; install the boot-validated
   // rollout flag once for this process.
   configureChildLifecycleNotices({ enabled: deps.settings.childLifecycleNoticesEnabled });
+  // Sessions created by this process freeze their code_search decision from
+  // the boot-parsed deployment policy.
+  configureCodeSearchDeploymentPolicy(codeSearchDeploymentPolicy(deps.settings));
   const managedEmailTransport =
     deps.managedEmailTransport ?? createManagedEmailTransport(deps.settings);
   assertManagedEmailTransportMetadata(managedEmailTransport);
+  const observability =
+    deps.observability ?? createObservability(deps.settings, { component: "api" });
   const managedAuth =
-    deps.managedAuth ?? createManagedAuth(deps.settings, deps.db, managedEmailTransport);
+    deps.managedAuth ??
+    createManagedAuth(deps.settings, deps.db, managedEmailTransport, { observability });
   const managedAuthSessionAdapter =
     deps.managedAuthSessionAdapter ??
     (managedAuth ? createBetterAuthSessionAdapter(managedAuth, deps.db) : null);
@@ -373,8 +400,6 @@ export function createAppComposition(deps: AppDependencies): {
   // concrete for routes; it throws SandboxResumeError when sandboxBackend=none.
   const sandboxClient = deps.sandboxClient ?? createApiSandboxClient(deps.settings);
   const resumeBoxById = deps.resumeBoxById ?? makeResumeBoxById(sandboxClient);
-  const observability =
-    deps.observability ?? createObservability(deps.settings, { component: "api" });
   if (
     managedAuth &&
     deps.settings.managedAuthSessionSetMode !== "legacy" &&
@@ -435,6 +460,39 @@ export function createAppComposition(deps: AppDependencies): {
     await next();
   });
 
+  // Unauthenticated local mode: admit only requests addressed to this computer
+  // and, when a browser sent them, from this stack's web app (see
+  // http/local-browser-boundary.ts). Runs before CORS so a refused preflight
+  // carries no CORS grant, and logs each distinct refused Host or Origin once
+  // because the browser shows only a generic CORS error. Null outside local
+  // development.
+  const localBrowserBoundary = createLocalBrowserBoundary(deps.settings, {
+    warn: (message, attributes) => observability.warn(message, attributes),
+  });
+  if (localBrowserBoundary) {
+    app.use("*", async (c, next) => {
+      const rejection = localBrowserBoundary.rejection(c.req.raw);
+      if (rejection) {
+        throw new ApiHttpError(rejection.status, {
+          code: "forbidden",
+          message: rejection.message,
+          retryable: false,
+          details: { code: rejection.code },
+        });
+      }
+      await next();
+    });
+  }
+
+  // Better Auth keys its rate limits and session addresses on a request
+  // header. Drop any caller-supplied copy everywhere and stamp the trusted
+  // source address on managed-auth routes before any route derives a Better
+  // Auth request from this one.
+  app.use("*", async (c, next) => {
+    replaceTrustedClientAddressHeader(c, deps.settings, c.req.path.startsWith("/v1/auth/"));
+    await next();
+  });
+
   app.use("*", async (c, next) => {
     const oauthToken = mcpOAuthBearerToken(c.req.raw);
     if (
@@ -498,8 +556,25 @@ export function createAppComposition(deps: AppDependencies): {
       allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin) ? origin : null,
   });
 
+  const localCors = localBrowserBoundary
+    ? cors({
+        ...corsHeaders,
+        credentials: true,
+        origin: (origin, c) =>
+          localBrowserBoundary.originAllowed(origin, localBrowserRequestHost(c.req.raw))
+            ? origin
+            : null,
+      })
+    : null;
+
   app.use("*", (c, next) => {
     const origin = c.req.header("origin");
+    if (localCors) {
+      // The boundary above already refused every other origin. Local mode
+      // never answers with wildcard CORS: a request without credentials acts
+      // as the local user, so any site could otherwise read its responses.
+      return origin ? localCors(c, next) : next();
+    }
     const middleware =
       origin && allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin)
         ? credentialedCors
@@ -516,7 +591,14 @@ export function createAppComposition(deps: AppDependencies): {
     // Git packfiles must stay streaming and can legitimately exceed the JSON
     // request ceiling. The exact closed broker routes apply their own method,
     // content-type, authority, and idle-deadline checks.
-    if (isPersonalGitHubGitBrokerRequest(c.req.method, new URL(c.req.url).pathname)) {
+    const pathname = new URL(c.req.url).pathname;
+    if (isPersonalGitHubGitBrokerRequest(c.req.method, pathname)) {
+      await next();
+      return;
+    }
+    // The anonymous web error beacon enforces its own 512-byte limit on the
+    // streamed body; the generic ceiling would buffer far more first.
+    if (isClientErrorReportRequest(c.req.method, pathname)) {
       await next();
       return;
     }
@@ -539,7 +621,7 @@ export function createAppComposition(deps: AppDependencies): {
 
   app.use("*", async (c, next) => {
     const url = new URL(c.req.url);
-    const route = routeLabel(url.pathname);
+    const route = routeLabel(url.pathname, registeredHandlerRoutePath(c));
     const correlationId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
     const start = performance.now();
     const span = observability.startSpan(
@@ -896,14 +978,14 @@ export function createAppComposition(deps: AppDependencies): {
     return c.json(result, result.ok ? 200 : 503);
   });
 
-  app.get("/metrics", async (c) =>
-    c.text(await observability.prometheusMetrics(), 200, {
-      "content-type": "text/plain; version=0.0.4; charset=utf-8",
-    }),
-  );
+  if (publicListenerServesMetrics(deps.settings)) {
+    registerPrometheusMetricsRoute(app, observability);
+  }
 
   registerMcpOAuthRoutes(app, routeDeps);
 
+  registerClientErrorRoutes(app, { observability, settings: deps.settings });
+
   app.get("/v1/config/client", async (c) => {
     c.header("cache-control", "no-store");
     const resolvedCatalog = await resolveCatalogSettings(deps.db, deps.settings);
@@ -934,6 +1016,7 @@ export function createAppComposition(deps: AppDependencies): {
           name: server.name ?? server.id,
         })),
         firstPartyMcpTools: resolveFirstPartyMcpToolPolicy(deps.settings),
+        codeSearch: codeSearchDeploymentPolicy(deps.settings),
         fileUploads: {
           enabled: objectStorage !== null,
           maxSizeBytes: objectStorage?.maxSinglePutSizeBytes ?? 5_000_000_000,
@@ -969,6 +1052,7 @@ export function createAppComposition(deps: AppDependencies): {
         billingMode: deps.settings.billingMode,
         managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
         auth: clientAuthConfig(deps.settings),
+        documentationUrl: deps.settings.documentationUrl,
         analytics: clientAnalyticsConfig(deps.settings),
         // Channel-A structured services (P4.4) ride exec/readFile/createEditor,
         // available on every real backend; `none` has no box so they are all off.
@@ -1232,7 +1316,9 @@ export function createAppComposition(deps: AppDependencies): {
     } catch (error) {
       throw codemodeHttpError(error);
     }
-    return app.fetch(forwarded);
+    // The forwarded request drops the caller's Host and names a non-sandbox
+    // path; the request it was built from already passed the local boundary.
+    return app.fetch(markLocalInternalDispatch(forwarded));
   });
 
   app.get("/v1/workspaces/:workspaceId/codemode/catalog", async (c) => {
@@ -1816,6 +1902,21 @@ const routeLabelPatterns: Array<{
   },
   { pattern: /^\/healthz$/, label: "/healthz" },
   { pattern: /^\/readyz$/, label: "/readyz" },
+  // Better Auth answers these behind one `/v1/auth/*` registration, so the
+  // provider endpoints need an explicit closed set to stay distinguishable.
+  {
+    pattern:
+      /^\/v1\/auth\/(sign-up\/email|sign-in\/email|sign-in\/social|sign-out|send-verification-email|verify-email|request-password-reset|reset-password|error|ok)$/,
+    label: (match) => `/v1/auth/${match[1]}`,
+  },
+  { pattern: /^\/v1\/auth\/reset-password\/[^/]+$/, label: "/v1/auth/reset-password/:token" },
+  {
+    pattern: /^\/v1\/auth\/callback\/([^/]+)$/,
+    label: (match) =>
+      match[1] === "google" || match[1] === "github"
+        ? `/v1/auth/callback/${match[1]}`
+        : "/v1/auth/callback/:providerId",
+  },
   { pattern: /^\/traffic-readyz$/, label: "/traffic-readyz" },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/connect\/start$/,
@@ -1871,6 +1972,7 @@ const routeLabelPatterns: Array<{
   },
   { pattern: /^\/metrics$/, label: "/metrics" },
   { pattern: /^\/v1\/config\/client$/, label: "/v1/config/client" },
+  { pattern: /^\/v1\/client-errors$/, label: "/v1/client-errors" },
   { pattern: /^\/v1\/billing$/, label: "/v1/billing" },
   { pattern: /^\/v1\/billing\/checkout$/, label: "/v1/billing/checkout" },
   { pattern: /^\/v1\/billing\/usage$/, label: "/v1/billing/usage" },
@@ -2629,7 +2731,13 @@ const routeLabelPatterns: Array<{
   },
 ];
 
-export function routeLabel(pathname: string): string {
+/**
+ * Bounded route label for metrics, spans, and request logs. Explicit patterns
+ * keep established label spellings stable; any other request answered by a
+ * registered handler uses that handler's code-owned path template (see
+ * `registeredHandlerRoutePath`). Only unregistered paths fall into `unknown`.
+ */
+export function routeLabel(pathname: string, registeredRoutePath?: string | null): string {
   if (/^\/v1\/workspaces\/[^/]+\/transcriptions$/.test(pathname))
     return "/v1/workspaces/:workspaceId/transcriptions";
   const transcription = pathname.match(
@@ -2650,6 +2758,8 @@ export function routeLabel(pathname: string): string {
       return typeof candidate.label === "string" ? candidate.label : candidate.label(match);
     }
   }
+  const registered = boundedRegisteredRouteLabel(registeredRoutePath);
+  if (registered) return registered;
   return pathname.startsWith("/v1/") ? "/v1/unknown" : "/unknown";
 }
 
@@ -2680,6 +2790,8 @@ export function isApiContractProtectedMutation(method: string, pathname: string)
     pathname === "/v1/integrations/slack/commands" ||
     pathname === "/v1/integrations/slack/interactions" ||
     pathname.startsWith("/v1/github/") ||
+    // A stale tab must still report the error that follows a rollout.
+    pathname === CLIENT_ERRORS_PATH ||
     pathname === "/v1/enrollments/device/start" ||
     pathname === "/v1/enrollments/device/poll" ||
     pathname === "/v1/enrollments/token/exchange"

package/src/auth/managed-auth-rate-limits.ts

@@ -0,0 +1,252 @@
+import { createHmac } from "node:crypto";
+import { isIP } from "node:net";
+import type { Database } from "@opengeni/db";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { sql } from "drizzle-orm";
+
+import {
+  requestSourceRateLimitKey,
+  TRUSTED_CLIENT_ADDRESS_HEADER,
+  UNKNOWN_REQUEST_SOURCE_ADDRESS,
+} from "../http/request-source";
+
+export type ManagedAuthClientRateLimitRule = { window: number; max: number };
+
+/**
+ * Better Auth's per-client-address limits, keyed by endpoint path relative to
+ * `/v1/auth`. The client address is the trusted source address stamped by the
+ * API (see `TRUSTED_CLIENT_ADDRESS_HEADER`), never a caller-supplied header.
+ *
+ * Better Auth keys each counter on `(client address, path)` and resets it only
+ * after `window` seconds pass without an admitted request. Its database store
+ * prunes rows idle for longer than 60 s, so no window here exceeds 60 s; a
+ * longer window would silently shrink to that pruning horizon. The limits are
+ * sized for launch traffic that shares one address (office and carrier NAT)
+ * while bounding scripted credential guessing and mail sending from one
+ * source. Per-email throttles below cap the same abuse across many addresses.
+ *
+ * Email sign-in and sign-up allow 20 per minute, at least Better Auth's
+ * previous default (3 per 10 s, about 18 per minute). Until the edge forwards
+ * real client addresses (for example ingress-nginx behind a cloud load
+ * balancer with `externalTrafficPolicy: Cluster`), every user shares a few
+ * node addresses, and these two limits then bound the whole deployment's
+ * email sign-in and sign-up rate; they must not fall below that default.
+ */
+export const MANAGED_AUTH_CLIENT_RATE_LIMIT_RULES = {
+  "/sign-in/email": { window: 60, max: 20 },
+  "/sign-up/email": { window: 60, max: 20 },
+  "/sign-in/social": { window: 60, max: 20 },
+  "/callback/*": { window: 60, max: 30 },
+  "/request-password-reset": { window: 60, max: 5 },
+  "/send-verification-email": { window: 60, max: 5 },
+  "/verify-email": { window: 60, max: 20 },
+  "/reset-password": { window: 60, max: 10 },
+  "/reset-password/*": { window: 60, max: 20 },
+} as const satisfies Record<string, ManagedAuthClientRateLimitRule>;
+
+export type ManagedAuthEmailThrottle = {
+  purpose: "sign_in" | "sign_up" | "password_reset" | "verification_email";
+  windowSeconds: number;
+  /** Attempts one client address (an IPv6 /64) may make against one email. */
+  perSourceMax: number;
+  /** Attempts all client addresses together may make against one email. */
+  perEmailMax: number;
+};
+
+/**
+ * Per-email throttles for the endpoints that verify a password or send mail
+ * to an address. They bound password guessing against one account and mail
+ * bombing of one inbox regardless of how many client addresses an attacker
+ * rotates through. Every attempt counts, including successful sign-ins.
+ *
+ * Each email has two fixed windows. The tight one is per (email, client
+ * address); an attempt it refuses never reaches the looser per-email window.
+ * One source can therefore spend only its own share of an email's budget:
+ * locking a person out of email/password sign-in, sign-up, password reset, or
+ * verification mail takes at least `perEmailMax / perSourceMax` (5) distinct
+ * client addresses (IPv6: /64 blocks) inside the window, while one address
+ * can exhaust that email's budget only for requests from the same address.
+ * Social sign-in is never throttled per email. The accepted cost is that a
+ * distributed attacker may make up to `perEmailMax` attempts per window
+ * against one email, and can deny that email's password sign-in for the rest
+ * of the window once it spends them.
+ */
+export const MANAGED_AUTH_EMAIL_THROTTLES = {
+  "/sign-in/email": {
+    purpose: "sign_in",
+    windowSeconds: 15 * 60,
+    perSourceMax: 10,
+    perEmailMax: 50,
+  },
+  "/sign-up/email": {
+    purpose: "sign_up",
+    windowSeconds: 60 * 60,
+    perSourceMax: 5,
+    perEmailMax: 25,
+  },
+  "/request-password-reset": {
+    purpose: "password_reset",
+    windowSeconds: 60 * 60,
+    perSourceMax: 5,
+    perEmailMax: 25,
+  },
+  "/send-verification-email": {
+    purpose: "verification_email",
+    windowSeconds: 60 * 60,
+    perSourceMax: 5,
+    perEmailMax: 25,
+  },
+} as const satisfies Record<string, ManagedAuthEmailThrottle>;
+
+export const MANAGED_AUTH_EMAIL_THROTTLE_KEY_PREFIX = "opengeni:email-throttle:v1:";
+
+/** A per-email throttle refusal; an ordinary Better Auth 429 on the wire. */
+export class ManagedAuthEmailThrottleError extends APIError {
+  readonly retryAfterSeconds: number;
+
+  constructor(retryAfterSeconds: number) {
+    super(
+      "TOO_MANY_REQUESTS",
+      { code: "TOO_MANY_REQUESTS", message: "Too many requests. Please try again later." },
+      { "X-Retry-After": String(retryAfterSeconds) },
+    );
+    this.retryAfterSeconds = retryAfterSeconds;
+  }
+}
+
+export function managedAuthEmailThrottleFor(path: string): ManagedAuthEmailThrottle | null {
+  return Object.hasOwn(MANAGED_AUTH_EMAIL_THROTTLES, path)
+    ? MANAGED_AUTH_EMAIL_THROTTLES[path as keyof typeof MANAGED_AUTH_EMAIL_THROTTLES]
+    : null;
+}
+
+/**
+ * Content-free counter key for one email. The address is normalized the way
+ * Better Auth stores it and keyed-hashed so the rate-limit table never holds
+ * an email.
+ */
+export function managedAuthEmailThrottleKey(
+  secret: string,
+  purpose: ManagedAuthEmailThrottle["purpose"],
+  email: string,
+): string {
+  const digest = createHmac("sha256", secret)
+    .update(`opengeni:managed-auth:email-throttle:v1\n${purpose}\n${normalizedEmail(email)}`)
+    .digest("hex");
+  return `${MANAGED_AUTH_EMAIL_THROTTLE_KEY_PREFIX}${purpose}:${digest}`;
+}
+
+/**
+ * Content-free counter key for one (email, client address) pair; `source` is
+ * a {@link requestSourceRateLimitKey}. Neither value is stored.
+ */
+export function managedAuthEmailSourceThrottleKey(
+  secret: string,
+  purpose: ManagedAuthEmailThrottle["purpose"],
+  email: string,
+  source: string,
+): string {
+  const digest = createHmac("sha256", secret)
+    .update(
+      `opengeni:managed-auth:email-source-throttle:v1\n${purpose}\n${normalizedEmail(email)}\n${source}`,
+    )
+    .digest("hex");
+  return `${MANAGED_AUTH_EMAIL_THROTTLE_KEY_PREFIX}${purpose}:source:${digest}`;
+}
+
+/**
+ * The limiter source for a Better Auth request: the trusted address the API
+ * stamped on it, as a rate-limit key. The API strips caller-supplied copies,
+ * so a request without one (an in-process call without a transport peer)
+ * shares the unknown-source bucket.
+ */
+export function managedAuthThrottleSource(headers: Headers | null | undefined): string {
+  const stamped = headers?.get(TRUSTED_CLIENT_ADDRESS_HEADER)?.trim();
+  return stamped && isIP(stamped) !== 0
+    ? requestSourceRateLimitKey(stamped.toLowerCase())
+    : UNKNOWN_REQUEST_SOURCE_ADDRESS;
+}
+
+function normalizedEmail(email: string): string {
+  return email.trim().toLowerCase();
+}
+
+/**
+ * Atomically count one attempt in a fixed window shared by every API replica.
+ *
+ * Rows live in Better Auth's `auth_rate_limits` table. For these keys
+ * `last_request` holds the window deadline (epoch milliseconds) rather than
+ * the last request time: Better Auth prunes rows whose `last_request` is more
+ * than 60 s in the past, so storing the deadline keeps an active window alive
+ * and lets pruning reclaim it 60 s after it expires. Database time is the only
+ * clock, so replicas with skewed clocks agree.
+ */
+export async function consumeManagedAuthEmailThrottle(
+  db: Pick<Database, "execute">,
+  input: { key: string; windowSeconds: number; max: number },
+): Promise<{ allowed: boolean; retryAfterSeconds: number }> {
+  const windowMs = input.windowSeconds * 1_000;
+  const result = await db.execute(sql`
+    insert into auth_rate_limits as bucket (id, key, count, last_request)
+    values (
+      ${input.key},
+      ${input.key},
+      1,
+      floor(extract(epoch from clock_timestamp()) * 1000)::bigint + ${windowMs}::bigint
+    )
+    on conflict (key) do update set
+      count = case
+        when bucket.last_request <= excluded.last_request - ${windowMs}::bigint then 1
+        else least(bucket.count + 1, ${input.max + 1}::integer)
+      end,
+      last_request = case
+        when bucket.last_request <= excluded.last_request - ${windowMs}::bigint
+          then excluded.last_request
+        else bucket.last_request
+      end
+    returning
+      bucket.count as count,
+      greatest(
+        1,
+        ceil((bucket.last_request - extract(epoch from clock_timestamp()) * 1000) / 1000.0)
+      )::integer as retry_after_seconds
+  `);
+  const rows = (Array.isArray(result) ? result : (result as { rows?: unknown[] }).rows) as
+    | Array<{ count: number | string; retry_after_seconds: number | string }>
+    | undefined;
+  const row = rows?.[0];
+  if (!row) throw new Error("managed auth email throttle returned no row");
+  return {
+    allowed: Number(row.count) <= input.max,
+    retryAfterSeconds: Number(row.retry_after_seconds),
+  };
+}
+
+/**
+ * Better Auth `hooks.before` middleware. It runs after Better Auth's own
+ * per-client-address limiter and for both HTTP requests and server-side
+ * `auth.api.*` calls, so the product session-set sign-in is covered too. The
+ * per-(email, address) window is consumed first; only an attempt it admits
+ * counts toward the email's shared window.
+ */
+export function createManagedAuthEmailThrottleHook(db: Pick<Database, "execute">, secret: string) {
+  return createAuthMiddleware(async (ctx) => {
+    const throttle = managedAuthEmailThrottleFor(ctx.path);
+    if (!throttle) return;
+    const email = (ctx.body as { email?: unknown } | undefined)?.email;
+    if (typeof email !== "string" || !email.trim()) return;
+    const source = managedAuthThrottleSource(ctx.headers);
+    const perSource = await consumeManagedAuthEmailThrottle(db, {
+      key: managedAuthEmailSourceThrottleKey(secret, throttle.purpose, email, source),
+      windowSeconds: throttle.windowSeconds,
+      max: throttle.perSourceMax,
+    });
+    if (!perSource.allowed) throw new ManagedAuthEmailThrottleError(perSource.retryAfterSeconds);
+    const perEmail = await consumeManagedAuthEmailThrottle(db, {
+      key: managedAuthEmailThrottleKey(secret, throttle.purpose, email),
+      windowSeconds: throttle.windowSeconds,
+      max: throttle.perEmailMax,
+    });
+    if (!perEmail.allowed) throw new ManagedAuthEmailThrottleError(perEmail.retryAfterSeconds);
+  });
+}