@proteinjs/user-server 1.22.0 → 1.22.2

package/dist/src/routes/initiatePasswordReset.d.ts

@@ -2,8 +2,16 @@ import { Route } from '@proteinjs/server-api';
 /**
  * Route for initiating a password reset process.
  *
- * This route handles the process of generating a password reset token,
- * sending a reset email to the user, and storing the token and expiration of the token in the database.
+ * Mints a reset token through `PasswordResetToken` — which stores only the token's digest and
+ * its expiry on the user row — and mails the token to the account as a reset link. The token is
+ * withdrawn again when the mail fails to send.
+ *
+ * ONE ANSWER: every request with an address is answered `ONE_ANSWER` — BEFORE the address is
+ * looked up — whether it has an account, is throttled (`PasswordResetThrottle`: per client and
+ * per address), is inside the account's five-minute gap, or its mail fails; so neither the
+ * words, the status nor the timing say whether an address has an account. The work runs after
+ * the answer. Every request is one outcome line carrying the account digest and the coarse IP
+ * hash (`RequestDigests`) — never the address.
  *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *

package/dist/src/routes/initiatePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAgEnC,CAAC"}
+{"version":3,"file":"initiatePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAoB9C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAoEnC,CAAC"}

package/dist/src/routes/initiatePasswordReset.js

@@ -57,11 +57,27 @@ var logger_1 = require("@proteinjs/logger");
 var moment_1 = __importDefault(require("moment"));
 var email_server_1 = require("@proteinjs/email-server");
 var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
+var ClientAddress_1 = require("../throttle/ClientAddress");
+var RequestDigests_1 = require("../throttle/RequestDigests");
+var PasswordResetThrottle_1 = require("../throttle/PasswordResetThrottle");
+/**
+ * The door's one answer: the same words for an address with an account or without, inside or
+ * past a window, mailed or not — the page shows exactly this sentence.
+ */
+var ONE_ANSWER = { message: 'If that address has an account, a reset link is on its way.' };
 /**
  * Route for initiating a password reset process.
  *
- * This route handles the process of generating a password reset token,
- * sending a reset email to the user, and storing the token and expiration of the token in the database.
+ * Mints a reset token through `PasswordResetToken` — which stores only the token's digest and
+ * its expiry on the user row — and mails the token to the account as a reset link. The token is
+ * withdrawn again when the mail fails to send.
+ *
+ * ONE ANSWER: every request with an address is answered `ONE_ANSWER` — BEFORE the address is
+ * looked up — whether it has an account, is throttled (`PasswordResetThrottle`: per client and
+ * per address), is inside the account's five-minute gap, or its mail fails; so neither the
+ * words, the status nor the timing say whether an address has an account. The work runs after
+ * the answer. Every request is one outcome line carrying the account digest and the coarse IP
+ * hash (`RequestDigests`) — never the address.
  *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *
@@ -74,65 +90,70 @@ exports.initiatePasswordReset = {
     path: user_1.routes.initiatePasswordReset.path,
     method: user_1.routes.initiatePasswordReset.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var logger, email, db, genericResponse, user, currentTime, tokenCreationTime, timeDifference, emailSender, defaultConfigFactory, passwordResetToken, passwordResetTokenExpiration, config, _a, text, html, error_1;
+        var logger, requestedEmail, digests, fields, window, email, db, user, resetToken, mintedAt, emailSender, defaultConfigFactory, passwordResetToken, config, _a, text, html, error_1;
         var _b, _c;
         return __generator(this, function (_d) {
             switch (_d.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'initiatePasswordReset' });
-                    email = (_b = request.body.email) === null || _b === void 0 ? void 0 : _b.toLowerCase();
+                    requestedEmail = ((_b = request.body) !== null && _b !== void 0 ? _b : {}).email;
+                    if (typeof requestedEmail !== 'string' || requestedEmail.length === 0) {
+                        response.status(400).send({ error: 'Email cannot be blank' });
+                        return [2 /*return*/];
+                    }
+                    digests = new RequestDigests_1.RequestDigests();
+                    fields = { account: digests.account(requestedEmail), ip: digests.coarseIp(new ClientAddress_1.ClientAddress().of(request)) };
+                    window = PasswordResetThrottle_1.passwordResetThrottle.admit(fields.ip, fields.account);
+                    response.send(ONE_ANSWER);
+                    if (window) {
+                        logger.warn({ message: "Password reset throttled", obj: __assign(__assign({}, fields), { window: window }) });
+                        return [2 /*return*/];
+                    }
+                    email = requestedEmail.toLowerCase();
                     db = (0, db_1.getDbAsSystem)();
-                    genericResponse = { message: 'If an account with that email exists, we have sent a password reset link.' };
                     return [4 /*yield*/, db.get(user_1.tables.User, { email: email })];
                 case 1:
                     user = _d.sent();
                     if (!user) {
-                        logger.info({ message: "Password reset requested for non-existent user", obj: { email: email } });
-                        // Don't reveal that the user doesn't exist
-                        response.send(genericResponse);
+                        logger.info({ message: "Password reset requested for non-existent user", obj: fields });
                         return [2 /*return*/];
                     }
-                    // Check if there's an existing token and it's less than 5 minutes old
-                    if (user.passwordResetToken && user.passwordResetTokenExpiration) {
-                        currentTime = (0, moment_1.default)();
-                        tokenCreationTime = (0, moment_1.default)(user.passwordResetTokenExpiration).subtract(1, 'hour');
-                        timeDifference = currentTime.diff(tokenCreationTime, 'minutes');
-                        if (timeDifference < 5) {
-                            logger.info({ message: "Password reset requested too soon for user", obj: { email: email } });
-                            response.send(genericResponse);
-                            return [2 /*return*/];
-                        }
+                    resetToken = new PasswordResetToken_1.PasswordResetToken();
+                    mintedAt = resetToken.mintedAt(user);
+                    if (mintedAt && (0, moment_1.default)().diff(mintedAt, 'minutes') < 5) {
+                        logger.info({ message: "Password reset requested too soon for user", obj: fields });
+                        return [2 /*return*/];
                     }
                     emailSender = new email_server_1.EmailSender();
                     defaultConfigFactory = (0, email_server_1.getDefaultPasswordResetEmailConfigFactory)();
                     if (!defaultConfigFactory) {
                         throw new Error("Unable to find a @proteinjs/email-server/DefaultPasswordResetEmailConfigFactory implementation when initiating password reset.");
                     }
-                    passwordResetToken = new PasswordResetToken_1.PasswordResetToken().mint();
-                    passwordResetTokenExpiration = (0, moment_1.default)().add(1, 'hour');
-                    _d.label = 2;
+                    return [4 /*yield*/, resetToken.mint(user)];
                 case 2:
-                    _d.trys.push([2, 5, , 6]);
+                    passwordResetToken = _d.sent();
+                    _d.label = 3;
+                case 3:
+                    _d.trys.push([3, 5, , 7]);
                     config = defaultConfigFactory.getConfig();
                     _a = config.getEmailContent("".concat(user_1.uiRoutes.auth.passwordReset, "?token=").concat(passwordResetToken)), text = _a.text, html = _a.html;
                     // Send email containing a reset link
                     return [4 /*yield*/, emailSender.sendEmail(__assign({ to: user.email, subject: ((_c = config.options) === null || _c === void 0 ? void 0 : _c.subject) || 'Reset Password', text: text, html: html }, config.options))];
-                case 3:
-                    // Send email containing a reset link
-                    _d.sent();
-                    // If email is sent successfully, save reset token to user record
-                    return [4 /*yield*/, db.update(user_1.tables.User, { id: user.id, passwordResetToken: passwordResetToken, passwordResetTokenExpiration: passwordResetTokenExpiration })];
                 case 4:
-                    // If email is sent successfully, save reset token to user record
+                    // Send email containing a reset link
                     _d.sent();
-                    response.send(genericResponse);
-                    return [3 /*break*/, 6];
+                    logger.info({ message: "Password reset link mailed", obj: fields });
+                    return [3 /*break*/, 7];
                 case 5:
                     error_1 = _d.sent();
-                    logger.error({ message: "Failed to send password reset email", obj: { email: email }, error: error_1 });
-                    response.status(500).send({ error: 'Failed to send password reset email. Please try again later.' });
-                    return [3 /*break*/, 6];
-                case 6: return [2 /*return*/];
+                    logger.error({ message: "Failed to send password reset email", obj: fields, error: error_1 });
+                    // The link never reached the account: withdraw the token so asking again is not throttled
+                    return [4 /*yield*/, resetToken.revoke(user, passwordResetToken)];
+                case 6:
+                    // The link never reached the account: withdraw the token so asking again is not throttled
+                    _d.sent();
+                    return [3 /*break*/, 7];
+                case 7: return [2 /*return*/];
             }
         });
     }); },

package/dist/src/routes/initiatePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,2EAA0E;AAE1E;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBACvD,KAAK,GAAG,MAAA,OAAO,CAAC,IAAI,CAAC,KAAK,0CAAE,WAAW,EAAE,CAAC;oBAC1C,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAErB,eAAe,GAAG,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;oBAEpG,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBAC3F,2CAA2C;wBAC3C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAED,sEAAsE;oBACtE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,4BAA4B,EAAE;wBAC1D,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;wBACvB,iBAAiB,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClF,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;wBACtE,IAAI,cAAc,GAAG,CAAC,EAAE;4BACtB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;4BACvF,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;4BAC/B,sBAAO;yBACR;qBACF;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAGK,kBAAkB,GAAG,IAAI,uCAAkB,EAAE,CAAC,IAAI,EAAE,CAAC;oBACrD,4BAA4B,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;;;;oBAGrD,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,iEAAiE;oBACjE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,oBAAA,EAAE,4BAA4B,8BAAA,EAAE,CAAC,EAAA;;oBAD/F,iEAAiE;oBACjE,SAA+F,CAAC;oBAChG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;;;;oBAE/B,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACxF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;;;;;SAExG;CACF,CAAC"}
+{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,2EAA0E;AAC1E,2DAA0D;AAC1D,6DAA4D;AAC5D,2EAA0E;AAE1E;;;GAGG;AACH,IAAM,UAAU,GAAG,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;GAoBG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAC9C,cAAc,GAAK,CAAA,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAA,MAAvB,CAAwB;oBACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;wBAC9D,sBAAO;qBACR;oBAEK,OAAO,GAAG,IAAI,+BAAc,EAAE,CAAC;oBAC/B,MAAM,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC7G,MAAM,GAAG,6CAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;oBACtE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC1B,IAAI,MAAM,EAAE;wBACV,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,wBAAO,MAAM,KAAE,MAAM,QAAA,GAAE,EAAE,CAAC,CAAC;wBACjF,sBAAO;qBACR;oBAEK,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;oBACrC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;wBACxF,sBAAO;qBACR;oBAGK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACtC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,QAAQ,IAAI,IAAA,gBAAM,GAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;wBACtD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;wBACpF,sBAAO;qBACR;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAG0B,qBAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAA;;oBAAhD,kBAAkB,GAAG,SAA2B;;;;oBAG9C,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;;;;oBAEpE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACrF,0FAA0F;oBAC1F,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAA;;oBADjD,0FAA0F;oBAC1F,SAAiD,CAAC;;;;;SAErD;CACF,CAAC"}

package/dist/src/routes/login.d.ts

@@ -1,3 +1,11 @@
 import { Route } from '@proteinjs/server-api';
+/**
+ * `POST /user/login`. Throttled per client and per account (`SignInThrottle`): a throttled try
+ * is told "Too many attempts. Try again in a few minutes." whether or not the address has an
+ * account, after the same password check a refusal runs (verdict discarded), so neither the
+ * words nor the timing tell. Every refusal is a "Sign-in refused" line and every throttled try
+ * its own "Sign-in throttled" line, carrying the account digest and the coarse IP hash
+ * (`RequestDigests`) — never the address.
+ */
 export declare const login: Route;
 //# sourceMappingURL=login.d.ts.map

package/dist/src/routes/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C,eAAO,MAAM,KAAK,EAAE,KA4CnB,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAU9C;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,EAAE,KA+DnB,CAAC"}

package/dist/src/routes/login.js

@@ -1,4 +1,15 @@
 "use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -38,41 +49,71 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.login = void 0;
 var user_1 = require("@proteinjs/user");
+var logger_1 = require("@proteinjs/logger");
 var authenticate_1 = require("../authentication/authenticate");
 var establishSession_1 = require("../authentication/establishSession");
 var AccountDeletion_1 = require("../services/AccountDeletion");
+var ClientAddress_1 = require("../throttle/ClientAddress");
+var RequestDigests_1 = require("../throttle/RequestDigests");
+var SignInThrottle_1 = require("../throttle/SignInThrottle");
+/**
+ * `POST /user/login`. Throttled per client and per account (`SignInThrottle`): a throttled try
+ * is told "Too many attempts. Try again in a few minutes." whether or not the address has an
+ * account, after the same password check a refusal runs (verdict discarded), so neither the
+ * words nor the timing tell. Every refusal is a "Sign-in refused" line and every throttled try
+ * its own "Sign-in throttled" line, carrying the account digest and the coarse IP hash
+ * (`RequestDigests`) — never the address.
+ */
 exports.login = {
     path: user_1.routes.login.path,
     method: user_1.routes.login.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var credentials, error, result, outcome, error_1, error;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        var logger, credentials, email, password, digests, ip, account, fields, window, error, result, outcome, error_1, error;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    credentials = request.body;
-                    if (!credentials.email || !credentials.password) {
+                    logger = new logger_1.Logger({ name: 'login' });
+                    credentials = (_a = request.body) !== null && _a !== void 0 ? _a : {};
+                    email = typeof credentials.email === 'string' ? credentials.email : '';
+                    password = typeof credentials.password === 'string' ? credentials.password : '';
+                    digests = new RequestDigests_1.RequestDigests();
+                    ip = digests.coarseIp(new ClientAddress_1.ClientAddress().of(request));
+                    account = email ? digests.account(email) : undefined;
+                    fields = account ? { account: account, ip: ip } : { ip: ip };
+                    window = SignInThrottle_1.signInThrottle.admit(ip, password ? account : undefined);
+                    if (!window) return [3 /*break*/, 2];
+                    return [4 /*yield*/, (0, authenticate_1.checkPassword)(email, password)];
+                case 1:
+                    _b.sent();
+                    logger.warn({ message: 'Sign-in throttled', obj: __assign(__assign({}, fields), { window: window }) });
+                    response.send({ error: SignInThrottle_1.SignInThrottle.ANSWER });
+                    return [2 /*return*/];
+                case 2:
+                    if (!email || !password || !account) {
                         error = "Email and password cannot be blank";
-                        console.error(error);
+                        logger.info({ message: 'Sign-in refused', obj: __assign(__assign({}, fields), { reason: error }) });
                         response.send({ error: error });
                         return [2 /*return*/];
                     }
-                    return [4 /*yield*/, (0, authenticate_1.authenticate)(credentials.email, credentials.password)];
-                case 1:
-                    result = _a.sent();
+                    return [4 /*yield*/, (0, authenticate_1.authenticate)(email, password)];
+                case 3:
+                    result = _b.sent();
                     if (result !== true) {
-                        console.error(result);
+                        logger.info({ message: 'Sign-in refused', obj: __assign(__assign({}, fields), { reason: result }) });
                         response.send({ error: result });
                         return [2 /*return*/];
                     }
-                    _a.label = 2;
-                case 2:
-                    _a.trys.push([2, 4, , 5]);
-                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(credentials.email)];
-                case 3:
-                    outcome = _a.sent();
-                    return [3 /*break*/, 5];
+                    SignInThrottle_1.signInThrottle.recordSuccess(account, ip);
+                    _b.label = 4;
                 case 4:
-                    error_1 = _a.sent();
+                    _b.trys.push([4, 6, , 7]);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(email)];
+                case 5:
+                    outcome = _b.sent();
+                    return [3 /*break*/, 7];
+                case 6:
+                    error_1 = _b.sent();
                     // Security boundary: the login response never carries internal error detail — an
                     // attacker probing emails must learn nothing from failure shapes (founder ruling
                     // 2026-08-18 after a watcher error surfaced verbatim in the login form). The real
@@ -80,16 +121,16 @@ exports.login = {
                     console.error('cancelPendingDeletion failed during login', error_1);
                     response.send({ error: 'Unable to log in right now. Please try again.' });
                     return [2 /*return*/];
-                case 5:
+                case 7:
                     if (outcome === 'purging') {
                         error = 'This account is being deleted and can no longer be restored.';
                         console.error(error);
                         response.send({ error: error });
                         return [2 /*return*/];
                     }
-                    return [4 /*yield*/, (0, establishSession_1.establishSession)(request, credentials.email)];
-                case 6:
-                    _a.sent();
+                    return [4 /*yield*/, (0, establishSession_1.establishSession)(request, email)];
+                case 8:
+                    _b.sent();
                     response.send({});
                     return [2 /*return*/];
             }

package/dist/src/routes/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,+DAA8D;AAC9D,uEAAsE;AACtE,+DAA8D;AAEjD,QAAA,KAAK,GAAU;IAC1B,IAAI,EAAE,aAAM,CAAC,KAAK,CAAC,IAAI;IACvB,MAAM,EAAE,aAAM,CAAC,KAAK,CAAC,MAAM;IAC3B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;oBAChC,WAAW,GAAwC,OAAO,CAAC,IAAI,CAAC;oBACtE,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;wBACzC,KAAK,GAAG,oCAAoC,CAAC;wBACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAEc,qBAAM,IAAA,2BAAY,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAA;;oBAApE,MAAM,GAAG,SAA2D;oBAC1E,IAAI,MAAM,KAAK,IAAI,EAAE;wBACnB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;wBACjC,sBAAO;qBACR;;;;oBAOW,qBAAM,IAAI,iCAAe,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAA;;oBAA9E,OAAO,GAAG,SAAoE,CAAC;;;;oBAE/E,iFAAiF;oBACjF,iFAAiF;oBACjF,kFAAkF;oBAClF,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,OAAK,CAAC,CAAC;oBAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;oBAC1E,sBAAO;;oBAET,IAAI,OAAO,KAAK,SAAS,EAAE;wBACnB,KAAK,GAAG,8DAA8D,CAAC;wBAC7E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAED,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAA;;oBAAlD,SAAkD,CAAC;oBACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,+DAA6E;AAC7E,uEAAsE;AACtE,+DAA8D;AAC9D,2DAA0D;AAC1D,6DAA4D;AAC5D,6DAA4E;AAE5E;;;;;;;GAOG;AACU,QAAA,KAAK,GAAU;IAC1B,IAAI,EAAE,aAAM,CAAC,KAAK,CAAC,IAAI;IACvB,MAAM,EAAE,aAAM,CAAC,KAAK,CAAC,MAAM;IAC3B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;oBACvC,WAAW,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC;oBAEjC,KAAK,GAAW,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/E,QAAQ,GAAW,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxF,OAAO,GAAG,IAAI,+BAAc,EAAE,CAAC;oBAC/B,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;oBACvD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACrD,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,SAAA,EAAE,EAAE,IAAA,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAA,EAAE,CAAC;oBAG5C,MAAM,GAAG,+BAAc,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;yBACpE,MAAM,EAAN,wBAAM;oBACR,qBAAM,IAAA,4BAAa,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAApC,SAAoC,CAAC;oBACrC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,wBAAO,MAAM,KAAE,MAAM,QAAA,GAAE,EAAE,CAAC,CAAC;oBAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAAc,CAAC,MAAM,EAAE,CAAC,CAAC;oBAChD,sBAAO;;oBAGT,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE;wBAC7B,KAAK,GAAG,oCAAoC,CAAC;wBACnD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,wBAAO,MAAM,KAAE,MAAM,EAAE,KAAK,GAAE,EAAE,CAAC,CAAC;wBAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAEc,qBAAM,IAAA,2BAAY,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAA5C,MAAM,GAAG,SAAmC;oBAClD,IAAI,MAAM,KAAK,IAAI,EAAE;wBACnB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,wBAAO,MAAM,KAAE,MAAM,EAAE,MAAM,GAAE,EAAE,CAAC,CAAC;wBAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;wBACjC,sBAAO;qBACR;oBACD,+BAAc,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;;;;oBAO9B,qBAAM,IAAI,iCAAe,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAA;;oBAAlE,OAAO,GAAG,SAAwD,CAAC;;;;oBAEnE,iFAAiF;oBACjF,iFAAiF;oBACjF,kFAAkF;oBAClF,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,OAAK,CAAC,CAAC;oBAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;oBAC1E,sBAAO;;oBAET,IAAI,OAAO,KAAK,SAAS,EAAE;wBACnB,KAAK,GAAG,8DAA8D,CAAC;wBAC7E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAED,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}

package/dist/src/throttle/ClientAddress.d.ts

@@ -0,0 +1,35 @@
+/** The request fields the read needs — an express request has all of them. */
+type ClientRequest = {
+    app?: {
+        get?: (setting: string) => unknown;
+    };
+    headers?: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    };
+};
+/**
+ * The client's address, as a throttle should key on it.
+ *
+ * Behind Google's external Application Load Balancer the `X-Forwarded-For` header ENDS with the
+ * two entries the balancer appends — `<client-ip>,<load-balancer-ip>` — and everything before
+ * them is whatever the client itself sent. So the client is the second entry from the right:
+ * - never the LAST entry: that is the balancer's own forwarding-rule address, the same for every
+ *   visitor. It is what express's `request.ip` resolves to under the server's `trust proxy 1`
+ *   (one trusted hop: the Google front end that opened the connection), so a throttle keyed on
+ *   `request.ip` there is one bucket for the whole world;
+ * - never the FIRST entry: a client can send its own header, and the balancer keeps it.
+ *
+ * Only when the server trusts a proxy (the deployed shape; `trust proxy` is unset in
+ * development) is the header read at all. A request that did not come through the balancer —
+ * no appended pair: an in-cluster call, a probe — and every request in development key on the
+ * connection's own address.
+ */
+export declare class ClientAddress {
+    /** How many entries the load balancer appends to the header: the client, then itself. */
+    private static readonly BALANCER_APPENDED_ENTRIES;
+    of(request: ClientRequest): string;
+    private forwardedFor;
+}
+export {};
+//# sourceMappingURL=ClientAddress.d.ts.map

package/dist/src/throttle/ClientAddress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAddress.d.ts","sourceRoot":"","sources":["../../../src/throttle/ClientAddress.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,KAAK,aAAa,GAAG;IACnB,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,CAAC;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACxD,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,aAAa;IACxB,yFAAyF;IACzF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IAEtD,EAAE,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM;IAUlC,OAAO,CAAC,YAAY;CAQrB"}

package/dist/src/throttle/ClientAddress.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientAddress = void 0;
+/**
+ * The client's address, as a throttle should key on it.
+ *
+ * Behind Google's external Application Load Balancer the `X-Forwarded-For` header ENDS with the
+ * two entries the balancer appends — `<client-ip>,<load-balancer-ip>` — and everything before
+ * them is whatever the client itself sent. So the client is the second entry from the right:
+ * - never the LAST entry: that is the balancer's own forwarding-rule address, the same for every
+ *   visitor. It is what express's `request.ip` resolves to under the server's `trust proxy 1`
+ *   (one trusted hop: the Google front end that opened the connection), so a throttle keyed on
+ *   `request.ip` there is one bucket for the whole world;
+ * - never the FIRST entry: a client can send its own header, and the balancer keeps it.
+ *
+ * Only when the server trusts a proxy (the deployed shape; `trust proxy` is unset in
+ * development) is the header read at all. A request that did not come through the balancer —
+ * no appended pair: an in-cluster call, a probe — and every request in development key on the
+ * connection's own address.
+ */
+var ClientAddress = /** @class */ (function () {
+    function ClientAddress() {
+    }
+    ClientAddress.prototype.of = function (request) {
+        var _a, _b, _c, _d;
+        if ((_b = (_a = request.app) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'trust proxy')) {
+            var entries = this.forwardedFor(request);
+            if (entries.length >= ClientAddress.BALANCER_APPENDED_ENTRIES) {
+                return entries[entries.length - ClientAddress.BALANCER_APPENDED_ENTRIES];
+            }
+        }
+        return (_d = (_c = request.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) !== null && _d !== void 0 ? _d : '';
+    };
+    ClientAddress.prototype.forwardedFor = function (request) {
+        var _a;
+        var header = (_a = request.headers) === null || _a === void 0 ? void 0 : _a['x-forwarded-for'];
+        var value = Array.isArray(header) ? header.join(',') : header !== null && header !== void 0 ? header : '';
+        return value
+            .split(',')
+            .map(function (entry) { return entry.trim(); })
+            .filter(function (entry) { return entry.length > 0; });
+    };
+    /** How many entries the load balancer appends to the header: the client, then itself. */
+    ClientAddress.BALANCER_APPENDED_ENTRIES = 2;
+    return ClientAddress;
+}());
+exports.ClientAddress = ClientAddress;
+//# sourceMappingURL=ClientAddress.js.map

package/dist/src/throttle/ClientAddress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAddress.js","sourceRoot":"","sources":["../../../src/throttle/ClientAddress.ts"],"names":[],"mappings":";;;AAOA;;;;;;;;;;;;;;;;GAgBG;AACH;IAAA;IAsBA,CAAC;IAlBC,0BAAE,GAAF,UAAG,OAAsB;;QACvB,IAAI,MAAA,MAAA,OAAO,CAAC,GAAG,0CAAE,GAAG,mDAAG,aAAa,CAAC,EAAE;YACrC,IAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE;gBAC7D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,yBAAyB,CAAC,CAAC;aAC1E;SACF;QACD,OAAO,MAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,aAAa,mCAAI,EAAE,CAAC;IAC7C,CAAC;IAEO,oCAAY,GAApB,UAAqB,OAAsB;;QACzC,IAAM,MAAM,GAAG,MAAA,OAAO,CAAC,OAAO,0CAAG,iBAAiB,CAAC,CAAC;QACpD,IAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC;QACtE,OAAO,KAAK;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,IAAI,EAAE,EAAZ,CAAY,CAAC;aAC5B,MAAM,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,MAAM,GAAG,CAAC,EAAhB,CAAgB,CAAC,CAAC;IACzC,CAAC;IApBD,yFAAyF;IACjE,uCAAyB,GAAG,CAAC,CAAC;IAoBxD,oBAAC;CAAA,AAtBD,IAsBC;AAtBY,sCAAa"}

package/dist/src/throttle/PasswordResetThrottle.d.ts

@@ -0,0 +1,39 @@
+import { ThrottleWindow } from './SignInThrottle';
+/**
+ * The password-reset door's two windows (`POST /user/initiate-password-reset`), keyed by digests
+ * (`RequestDigests`), never by an address. Both count every request, whether or not the address
+ * has an account — a window that only counted real accounts would itself say which addresses
+ * have one. Past either window nothing is looked up, minted or mailed; the door's answer is the
+ * same sentence as always (see the route).
+ *
+ * These sit on top of the account row's own five-minute gap between links, which spans replicas
+ * (it is stored); the windows are in process memory (`SlidingWindow`): per replica. A
+ * deployment of three replicas behind a load balancer (up to ten under load) keeps three sets
+ * of windows, so its effective ceiling is ~3× the numbers below (up to ~10×) — for one address
+ * still at most one mail per five minutes. Friction, not the wall — a shared store is a
+ * separate step.
+ */
+export declare class PasswordResetThrottle {
+    /**
+     * Per client: 10 requests an hour. Someone asking for their own address again, or a household
+     * asking for a few addresses, passes; a script sweeping addresses stops at ten.
+     */
+    private static readonly CLIENT_LIMIT;
+    private static readonly CLIENT_WINDOW_MS;
+    /**
+     * Per address: 3 requests an hour. A person whose mail is slow asks once or twice more; beyond
+     * that it is mail aimed at somebody's inbox.
+     */
+    private static readonly ACCOUNT_LIMIT;
+    private static readonly ACCOUNT_WINDOW_MS;
+    private readonly clients;
+    private readonly accounts;
+    constructor(options?: {
+        now?: () => number;
+    });
+    /** Count this request and answer which window refuses it, if any. */
+    admit(client: string, account: string): ThrottleWindow | undefined;
+}
+/** The process-wide windows the reset door shares — they must span requests. */
+export declare const passwordResetThrottle: PasswordResetThrottle;
+//# sourceMappingURL=PasswordResetThrottle.d.ts.map

package/dist/src/throttle/PasswordResetThrottle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetThrottle.d.ts","sourceRoot":"","sources":["../../../src/throttle/PasswordResetThrottle.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAqB;IAChC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAM;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IAE1D;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAK;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAkB;IAE3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;gBAE7B,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAa5C,qEAAqE;IACrE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;CASnE;AAED,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}

package/dist/src/throttle/PasswordResetThrottle.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passwordResetThrottle = exports.PasswordResetThrottle = void 0;
+var SlidingWindow_1 = require("./SlidingWindow");
+/**
+ * The password-reset door's two windows (`POST /user/initiate-password-reset`), keyed by digests
+ * (`RequestDigests`), never by an address. Both count every request, whether or not the address
+ * has an account — a window that only counted real accounts would itself say which addresses
+ * have one. Past either window nothing is looked up, minted or mailed; the door's answer is the
+ * same sentence as always (see the route).
+ *
+ * These sit on top of the account row's own five-minute gap between links, which spans replicas
+ * (it is stored); the windows are in process memory (`SlidingWindow`): per replica. A
+ * deployment of three replicas behind a load balancer (up to ten under load) keeps three sets
+ * of windows, so its effective ceiling is ~3× the numbers below (up to ~10×) — for one address
+ * still at most one mail per five minutes. Friction, not the wall — a shared store is a
+ * separate step.
+ */
+var PasswordResetThrottle = /** @class */ (function () {
+    function PasswordResetThrottle(options) {
+        this.clients = new SlidingWindow_1.SlidingWindow({
+            windowMs: PasswordResetThrottle.CLIENT_WINDOW_MS,
+            limit: PasswordResetThrottle.CLIENT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+        this.accounts = new SlidingWindow_1.SlidingWindow({
+            windowMs: PasswordResetThrottle.ACCOUNT_WINDOW_MS,
+            limit: PasswordResetThrottle.ACCOUNT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+    }
+    /** Count this request and answer which window refuses it, if any. */
+    PasswordResetThrottle.prototype.admit = function (client, account) {
+        if (this.clients.hit(client)) {
+            return 'client';
+        }
+        if (this.accounts.hit(account)) {
+            return 'account';
+        }
+        return undefined;
+    };
+    /**
+     * Per client: 10 requests an hour. Someone asking for their own address again, or a household
+     * asking for a few addresses, passes; a script sweeping addresses stops at ten.
+     */
+    PasswordResetThrottle.CLIENT_LIMIT = 10;
+    PasswordResetThrottle.CLIENT_WINDOW_MS = 60 * 60 * 1000;
+    /**
+     * Per address: 3 requests an hour. A person whose mail is slow asks once or twice more; beyond
+     * that it is mail aimed at somebody's inbox.
+     */
+    PasswordResetThrottle.ACCOUNT_LIMIT = 3;
+    PasswordResetThrottle.ACCOUNT_WINDOW_MS = 60 * 60 * 1000;
+    return PasswordResetThrottle;
+}());
+exports.PasswordResetThrottle = PasswordResetThrottle;
+/** The process-wide windows the reset door shares — they must span requests. */
+exports.passwordResetThrottle = new PasswordResetThrottle();
+//# sourceMappingURL=PasswordResetThrottle.js.map

package/dist/src/throttle/PasswordResetThrottle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetThrottle.js","sourceRoot":"","sources":["../../../src/throttle/PasswordResetThrottle.ts"],"names":[],"mappings":";;;AAAA,iDAAgD;AAGhD;;;;;;;;;;;;;GAaG;AACH;IAkBE,+BAAY,OAAgC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,6BAAa,CAAC;YAC/B,QAAQ,EAAE,qBAAqB,CAAC,gBAAgB;YAChD,KAAK,EAAE,qBAAqB,CAAC,YAAY;YACzC,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,6BAAa,CAAC;YAChC,QAAQ,EAAE,qBAAqB,CAAC,iBAAiB;YACjD,KAAK,EAAE,qBAAqB,CAAC,aAAa;YAC1C,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,qCAAK,GAAL,UAAM,MAAc,EAAE,OAAe;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC5B,OAAO,QAAQ,CAAC;SACjB;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAC9B,OAAO,SAAS,CAAC;SAClB;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAvCD;;;OAGG;IACqB,kCAAY,GAAG,EAAE,CAAC;IAClB,sCAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1D;;;OAGG;IACqB,mCAAa,GAAG,CAAC,CAAC;IAClB,uCAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IA4B7D,4BAAC;CAAA,AAzCD,IAyCC;AAzCY,sDAAqB;AA2ClC,gFAAgF;AACnE,QAAA,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAC"}

package/dist/src/throttle/RequestDigests.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The two keyed digests the throttled doors key their windows on and write on their log lines,
+ * in place of what they stand for:
+ * - `account(email)` — the ACCOUNT DIGEST: a keyed hash of the trimmed, lowercased address.
+ *   One address gives one digest however it was typed, on every replica and across restarts, so
+ *   an operator can say "one account" across lines without the address.
+ * - `coarseIp(address)` — the COARSE IP HASH: a keyed hash of the client address at the grain
+ *   one device holds (an IPv4 address; an IPv6 /64, inside which a device rotates freely), so
+ *   an operator can say "one device" and a throttle cannot be dodged by rotating inside a /64.
+ *
+ * Keyed with HMAC-SHA256 under a key DERIVED from the session secret — the one secret every
+ * replica already shares, the same keying the invite-request door's IP hash uses; derived per
+ * purpose, never used raw, so neither digest weakens the session's own use of it, and the two
+ * digests never collide in meaning. Truncated to 64 bits: enough to tell accounts and devices
+ * apart, useless to anyone without the key — never the address, never a plain hash a list of
+ * addresses could reverse.
+ *
+ * The key is the deployment's `SESSION_SECRET` unless the constructor is given one (the tests).
+ * Without either the digests refuse to run: a server with no `SESSION_SECRET` has no sessions
+ * either (the session middleware refuses to start), so nothing ever runs unkeyed — never a plain
+ * hash a list of addresses could reverse, never a per-process key that quietly stops matching
+ * across replicas.
+ */
+export declare class RequestDigests {
+    private readonly options?;
+    /** Hex characters kept from the HMAC: 64 bits. */
+    private static readonly DIGEST_HEX_LENGTH;
+    constructor(options?: {
+        secret?: string | undefined;
+    } | undefined);
+    /** The account digest of an address, however it was typed. */
+    account(email: string): string;
+    /** The coarse IP hash of a client address (see `ClientAddress`). */
+    coarseIp(address: string): string;
+    private digest;
+    private secret;
+    /** An IPv4 address as itself (an IPv4-mapped IPv6 address as its IPv4); an IPv6 address as its /64. */
+    private coarsen;
+    /** The first four groups (the /64) of an IPv6 address, each without leading zeros; undefined when it does not parse. */
+    private ipv6Groups;
+}
+//# sourceMappingURL=RequestDigests.d.ts.map

package/dist/src/throttle/RequestDigests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestDigests.d.ts","sourceRoot":"","sources":["../../../src/throttle/RequestDigests.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,cAAc;IAIb,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAHrC,kDAAkD;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAM;gBAElB,OAAO,CAAC;;iBAAqB;IAE1D,8DAA8D;IAC9D,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI9B,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIjC,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,MAAM;IAUd,uGAAuG;IACvG,OAAO,CAAC,OAAO;IAYf,wHAAwH;IACxH,OAAO,CAAC,UAAU;CAwBnB"}