@tuturuuu/utils 0.7.0 → 0.9.0

package/src/__tests__/app-url.test.ts

@@ -110,11 +110,31 @@ describe('resolveInternalAppUrl', () => {
       kind: 'internal',
       name: 'tasks',
     });
+    expect(
+      getAppDomainByUrl(
+        'https://zalo-qr-chat-setup.tasks.tuturuuu.localhost:1355/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toMatchObject({
+      canonicalUrl:
+        'https://zalo-qr-chat-setup.tasks.tuturuuu.localhost/verify-token?nextUrl=%2Fpersonal',
+      kind: 'internal',
+      name: 'tasks',
+    });
     expect(
       getAppDomainByUrl(
         'https://tuturuuu.localhost.evil.test:1355/verify-token?nextUrl=%2F'
       )
     ).toBeNull();
+    expect(
+      getAppDomainByUrl(
+        'https://tasks.tuturuuu.localhost:4444/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toBeNull();
+    expect(
+      getAppDomainByUrl(
+        'https://attacker.tasks.tuturuuu.localhost:4444/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toBeNull();
   });
 
   it('canonicalizes production internal app URLs to their registered HTTPS origins', () => {
@@ -244,6 +264,7 @@ describe('Portless app origin registry', () => {
       'https://finance.tuturuuu.localhost',
       'https://hive.tuturuuu.localhost',
       'https://realtime.hive.tuturuuu.localhost',
+      'https://infra.tuturuuu.localhost',
       'https://inventory.tuturuuu.localhost',
       'https://learn.tuturuuu.localhost',
       'https://mail.tuturuuu.localhost',
@@ -256,6 +277,7 @@ describe('Portless app origin registry', () => {
       'https://rewise.tuturuuu.localhost',
       'https://shortener.tuturuuu.localhost',
       'https://storefront.tuturuuu.localhost',
+      'https://tanstack.tuturuuu.localhost',
       'https://tasks.tuturuuu.localhost',
       'https://teach.tuturuuu.localhost',
       'https://track.tuturuuu.localhost',

package/src/__tests__/upstash-rest.test.ts

@@ -30,12 +30,15 @@ describe('upstash-rest', () => {
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
     const client = {
+      decr: vi.fn(),
       del: vi.fn(),
       eval: vi.fn(),
       evalsha: vi.fn(),
       expire: vi.fn(),
       get: vi.fn(),
       incr: vi.fn(),
+      mget: vi.fn(),
+      scan: vi.fn(),
       set: vi.fn(),
       ttl: vi.fn(),
     };

package/src/abuse-protection/__tests__/backend-rate-limit.test.ts

@@ -2,8 +2,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 const mocks = vi.hoisted(() => ({
   blockIPEdge: vi.fn(),
-  checkUserSuspension: vi.fn(),
-  suspendUser: vi.fn(),
 }));
 
 vi.mock('../edge', () => ({
@@ -11,14 +9,6 @@ vi.mock('../edge', () => ({
     mocks.blockIPEdge(...args),
 }));
 
-vi.mock('../user-suspension', () => ({
-  checkUserSuspension: (
-    ...args: Parameters<typeof mocks.checkUserSuspension>
-  ) => mocks.checkUserSuspension(...args),
-  suspendUser: (...args: Parameters<typeof mocks.suspendUser>) =>
-    mocks.suspendUser(...args),
-}));
-
 import {
   cascadeBackendRateLimitToProxyBan,
   isBackendRateLimitError,
@@ -28,8 +18,6 @@ describe('backend-rate-limit', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mocks.blockIPEdge.mockResolvedValue(null);
-    mocks.checkUserSuspension.mockResolvedValue({ suspended: false });
-    mocks.suspendUser.mockResolvedValue(true);
   });
 
   describe('isBackendRateLimitError', () => {
@@ -51,16 +39,7 @@ describe('backend-rate-limit', () => {
   });
 
   describe('cascadeBackendRateLimitToProxyBan', () => {
-    it('blocks the IP without suspending an identified user', async () => {
-      const blockInfo = {
-        id: 'block-1',
-        blockLevel: 1,
-        reason: 'api_abuse',
-        blockedAt: new Date(),
-        expiresAt: new Date(Date.now() + 300_000),
-      };
-      mocks.blockIPEdge.mockResolvedValue(blockInfo);
-
+    it('does not hard-ban a known client IP for a backend rate-limit signal', async () => {
       const result = await cascadeBackendRateLimitToProxyBan({
         endpoint: '/api/ai/chat/new',
         ipAddress: '203.0.113.10',
@@ -68,46 +47,32 @@ describe('backend-rate-limit', () => {
         userId: 'user-1',
       });
 
-      expect(result).toBe(blockInfo);
-      expect(mocks.blockIPEdge).toHaveBeenCalledWith(
-        '203.0.113.10',
-        'api_abuse'
-      );
-      expect(mocks.checkUserSuspension).not.toHaveBeenCalled();
-      expect(mocks.suspendUser).not.toHaveBeenCalled();
+      expect(result).toBeNull();
+      expect(mocks.blockIPEdge).not.toHaveBeenCalled();
     });
 
-    it('does not inspect existing user suspensions', async () => {
-      mocks.checkUserSuspension.mockResolvedValue({
-        suspended: true,
-        reason: 'already suspended',
-      });
-
-      await cascadeBackendRateLimitToProxyBan({
+    it('does not hard-ban auth backend rate-limit signals', async () => {
+      const result = await cascadeBackendRateLimitToProxyBan({
         endpoint: '/api/ai/chat/new',
         ipAddress: '203.0.113.10',
         source: 'auth',
         userId: 'user-1',
       });
 
-      expect(mocks.suspendUser).not.toHaveBeenCalled();
-      expect(mocks.blockIPEdge).toHaveBeenCalledWith(
-        '203.0.113.10',
-        'api_abuse'
-      );
-      expect(mocks.checkUserSuspension).not.toHaveBeenCalled();
+      expect(result).toBeNull();
+      expect(mocks.blockIPEdge).not.toHaveBeenCalled();
     });
 
-    it('does not suspend the user when the client IP is unavailable', async () => {
-      await cascadeBackendRateLimitToProxyBan({
+    it('returns null when the client IP is unavailable', async () => {
+      const result = await cascadeBackendRateLimitToProxyBan({
         endpoint: '/api/ai/chat/new',
         ipAddress: 'unknown',
         source: 'database',
         userId: 'user-1',
       });
 
+      expect(result).toBeNull();
       expect(mocks.blockIPEdge).not.toHaveBeenCalled();
-      expect(mocks.suspendUser).not.toHaveBeenCalled();
     });
   });
 });

package/src/abuse-protection/__tests__/edge-trust.test.ts

@@ -0,0 +1,258 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  getClient: vi.fn(),
+  mget: vi.fn(),
+  set: vi.fn(),
+}));
+
+vi.mock('../../upstash-rest', () => ({
+  getUpstashRestRedisClient: () => mocks.getClient(),
+}));
+
+function mockRedisClient() {
+  mocks.getClient.mockResolvedValue({
+    mget: (...keys: string[]) => mocks.mget(...keys),
+    set: (key: string, value: unknown, options?: unknown) =>
+      mocks.set(key, value, options),
+  });
+}
+
+describe('edge-trust cache', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    mocks.getClient.mockReset();
+    mocks.mget.mockReset();
+    mocks.set.mockReset();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it('returns only elevated subjects from getCachedTrustMultipliers', async () => {
+    mockRedisClient();
+    // Order of values matches the order of keys requested.
+    mocks.mget.mockResolvedValue([3, null, 1, 2]);
+
+    const { getCachedTrustMultipliers } = await import('../edge-trust.js');
+    const result = await getCachedTrustMultipliers([
+      'session:aaa',
+      'cidr:1.2.3.0/24',
+      'ip:1.2.3.4',
+      'user:abc',
+    ]);
+
+    expect(result.get('session:aaa')).toBe(3);
+    expect(result.has('cidr:1.2.3.0/24')).toBe(false); // null
+    expect(result.has('ip:1.2.3.4')).toBe(false); // neutral (1)
+    expect(result.get('user:abc')).toBe(2);
+  });
+
+  it('clamps cached multipliers to the DB ceiling', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([5000]);
+
+    const { getCachedTrustMultipliers } = await import('../edge-trust.js');
+    const result = await getCachedTrustMultipliers(['session:aaa']);
+
+    expect(result.get('session:aaa')).toBe(1000);
+  });
+
+  it('takes the most-trusting multiplier in getCachedTrustMultiplier', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([2, 3]);
+
+    const { getCachedTrustMultiplier } = await import('../edge-trust.js');
+    const best = await getCachedTrustMultiplier([
+      'cidr:1.2.3.0/24',
+      'session:aaa',
+    ]);
+
+    expect(best).toBe(3);
+  });
+
+  it('parses string multipliers from Redis', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue(['2.5']);
+
+    const { getCachedTrustMultiplier } = await import('../edge-trust.js');
+    expect(await getCachedTrustMultiplier(['session:aaa'])).toBe(2.5);
+  });
+
+  it('returns neutral verified session entries without treating plain neutral entries as active', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([{ m: 1, verified: true }, 1]);
+
+    const { getCachedTrustEntries } = await import('../edge-trust.js');
+    const entries = await getCachedTrustEntries(['session:aaa', 'session:bbb']);
+
+    expect(entries.get('session:aaa')).toEqual({ m: 1, verified: true });
+    expect(entries.has('session:bbb')).toBe(false);
+  });
+
+  it('fails open to a neutral multiplier when Redis errors', async () => {
+    mockRedisClient();
+    mocks.mget.mockRejectedValue(new Error('redis down'));
+
+    const { getCachedTrustMultiplier, getCachedTrustMultipliers } =
+      await import('../edge-trust.js');
+
+    expect(await getCachedTrustMultiplier(['session:aaa'])).toBe(1);
+    expect((await getCachedTrustMultipliers(['session:aaa'])).size).toBe(0);
+  });
+
+  it('fails open when no Redis client is configured', async () => {
+    mocks.getClient.mockResolvedValue(null);
+
+    const { getCachedTrustMultiplier } = await import('../edge-trust.js');
+    expect(await getCachedTrustMultiplier(['session:aaa'])).toBe(1);
+  });
+
+  it('writes a clamped multiplier with a TTL', async () => {
+    mockRedisClient();
+    mocks.set.mockResolvedValue('OK');
+
+    const { setCachedTrustMultiplier } = await import('../edge-trust.js');
+    await setCachedTrustMultiplier('cidr:1.2.3.0/24', 5000, 7200);
+
+    expect(mocks.set).toHaveBeenCalledWith('trust:mult:cidr:1.2.3.0/24', 1000, {
+      ex: 7200,
+    });
+  });
+
+  it('skips neutral multipliers in writeTrustCacheForSubjects', async () => {
+    mockRedisClient();
+    mocks.set.mockResolvedValue('OK');
+
+    const { writeTrustCacheForSubjects } = await import('../edge-trust.js');
+    await writeTrustCacheForSubjects(['session:aaa', 'cidr:1.2.3.0/24'], 1);
+
+    expect(mocks.set).not.toHaveBeenCalled();
+  });
+
+  it('writes every subject key for an elevated multiplier', async () => {
+    mockRedisClient();
+    mocks.set.mockResolvedValue('OK');
+
+    const { writeTrustCacheForSubjects } = await import('../edge-trust.js');
+    await writeTrustCacheForSubjects(
+      ['session:aaa', 'cidr:1.2.3.0/24'],
+      3,
+      600
+    );
+
+    expect(mocks.set).toHaveBeenCalledWith('trust:mult:session:aaa', 3, {
+      ex: 600,
+    });
+    expect(mocks.set).toHaveBeenCalledWith('trust:mult:cidr:1.2.3.0/24', 3, {
+      ex: 600,
+    });
+  });
+
+  it('writes neutral verified session markers without writing non-session subjects', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([null]);
+    mocks.set.mockResolvedValue('OK');
+
+    const { writeVerifiedSessionCacheForSubjects } = await import(
+      '../edge-trust.js'
+    );
+    await writeVerifiedSessionCacheForSubjects(
+      ['session:aaa', 'cidr:1.2.3.0/24'],
+      600
+    );
+
+    expect(mocks.set).toHaveBeenCalledTimes(1);
+    expect(mocks.set).toHaveBeenCalledWith(
+      'trust:mult:session:aaa',
+      { m: 1, verified: true },
+      { ex: 600 }
+    );
+  });
+
+  it('does not downgrade elevated trust entries when writing verified session markers', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([3, null]);
+    mocks.set.mockResolvedValue('OK');
+
+    const { writeVerifiedSessionCacheForSubjects } = await import(
+      '../edge-trust.js'
+    );
+    await writeVerifiedSessionCacheForSubjects(
+      ['session:elevated', 'session:neutral'],
+      600
+    );
+
+    expect(mocks.set).toHaveBeenCalledTimes(1);
+    expect(mocks.set).toHaveBeenCalledWith(
+      'trust:mult:session:neutral',
+      { m: 1, verified: true },
+      { ex: 600 }
+    );
+    expect(mocks.set).not.toHaveBeenCalledWith(
+      'trust:mult:session:elevated',
+      expect.anything(),
+      expect.anything()
+    );
+  });
+
+  it('parses legacy plain numbers and rich JSON entries together', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([
+      3, // legacy plain number
+      { m: 1, mode: 'unlimited' }, // rich object (auto-deserialized by upstash)
+      { m: 1, mode: 'absolute', abs: { minute: 500 } },
+    ]);
+
+    const { getCachedTrustEntries } = await import('../edge-trust.js');
+    const entries = await getCachedTrustEntries([
+      'session:legacy',
+      'cidr:unl',
+      'ip:abs',
+    ]);
+
+    expect(entries.get('session:legacy')).toEqual({ m: 3 });
+    expect(entries.get('cidr:unl')).toEqual({ m: 1, mode: 'unlimited' });
+    expect(entries.get('ip:abs')).toEqual({
+      abs: { minute: 500 },
+      m: 1,
+      mode: 'absolute',
+    });
+  });
+
+  it('writes rich entries as JSON and multiplier-only as a plain number', async () => {
+    mockRedisClient();
+    mocks.set.mockResolvedValue('OK');
+
+    const { setCachedTrustEntry } = await import('../edge-trust.js');
+    await setCachedTrustEntry('session:a', { m: 3 }, 600);
+    await setCachedTrustEntry(
+      'cidr:b',
+      { abs: { minute: 500 }, m: 1, mode: 'absolute' },
+      600
+    );
+
+    expect(mocks.set).toHaveBeenCalledWith('trust:mult:session:a', 3, {
+      ex: 600,
+    });
+    expect(mocks.set).toHaveBeenCalledWith(
+      'trust:mult:cidr:b',
+      { abs: { minute: 500 }, m: 1, mode: 'absolute' },
+      { ex: 600 }
+    );
+  });
+
+  it('honors the configurable cache TTL', async () => {
+    vi.stubEnv('EDGE_TRUST_CACHE_TTL_SECONDS', '900');
+    mockRedisClient();
+    mocks.set.mockResolvedValue('OK');
+
+    const { setCachedTrustMultiplier } = await import('../edge-trust.js');
+    await setCachedTrustMultiplier('session:aaa', 3);
+
+    expect(mocks.set).toHaveBeenCalledWith('trust:mult:session:aaa', 3, {
+      ex: 900,
+    });
+  });
+});

package/src/abuse-protection/__tests__/index.test.ts

@@ -3,16 +3,27 @@
  */
 
 import { afterEach, describe, expect, it, vi } from 'vitest';
+
 import {
   ABUSE_THRESHOLDS,
   BLOCK_DURATIONS,
+  checkMFAVerifyLimit,
   checkOTPSendAllowed,
+  checkOTPVerifyLimit,
+  checkPasswordLoginLimit,
+  checkReauthVerifyLimit,
   classifyPotentialSpamUserAgent,
+  clearPasswordLoginFailures,
   extractIPFromHeaders,
   hashEmail,
+  isSharedIpThrottleOnlyBlockReason,
   MAX_BLOCK_LEVEL,
   REDIS_KEYS,
+  recordMFAVerifyFailure,
   recordOTPSendSuccess,
+  recordOTPVerifyFailure,
+  recordPasswordLoginFailure,
+  recordReauthVerifyFailure,
   resetOtpLimitsForEmail,
   WINDOW_MS,
 } from '../index';
@@ -241,6 +252,98 @@ describe('abuse-protection', () => {
         5 * 60 * 1000
       );
       expect(ABUSE_THRESHOLDS.PASSWORD_LOGIN_FAILED_MAX).toBe(10);
+      expect(ABUSE_THRESHOLDS.PASSWORD_LOGIN_FAILED_EMAIL_WINDOW_MS).toBe(
+        15 * 60 * 1000
+      );
+      expect(ABUSE_THRESHOLDS.PASSWORD_LOGIN_FAILED_EMAIL_MAX).toBe(10);
+    });
+  });
+
+  describe('shared-IP hard block suppression', () => {
+    it('keeps human-auth failure reasons throttle-only', () => {
+      expect(isSharedIpThrottleOnlyBlockReason('otp_send')).toBe(true);
+      expect(isSharedIpThrottleOnlyBlockReason('otp_verify_failed')).toBe(true);
+      expect(isSharedIpThrottleOnlyBlockReason('mfa_verify_failed')).toBe(true);
+      expect(isSharedIpThrottleOnlyBlockReason('reauth_verify_failed')).toBe(
+        true
+      );
+      expect(isSharedIpThrottleOnlyBlockReason('password_login_failed')).toBe(
+        true
+      );
+      expect(isSharedIpThrottleOnlyBlockReason('api_auth_failed')).toBe(false);
+      expect(isSharedIpThrottleOnlyBlockReason('api_abuse')).toBe(false);
+      expect(isSharedIpThrottleOnlyBlockReason('manual')).toBe(false);
+    });
+  });
+
+  describe('password login failure limits', () => {
+    it('keeps the IP-wide failure counter after another account succeeds', async () => {
+      const ipAddress = '203.0.113.41';
+
+      for (let attempt = 0; attempt < 9; attempt += 1) {
+        await recordPasswordLoginFailure(ipAddress, 'victim@example.com');
+      }
+
+      await clearPasswordLoginFailures(ipAddress, 'attacker@example.com');
+
+      await expect(
+        checkPasswordLoginLimit(ipAddress, 'victim@example.com')
+      ).resolves.toMatchObject({
+        allowed: true,
+        remainingAttempts: 1,
+      });
+    });
+
+    it('clears only the successful account email failure counter', async () => {
+      const email = 'targeted-user@example.com';
+
+      for (let attempt = 0; attempt < 10; attempt += 1) {
+        await recordPasswordLoginFailure(`198.51.100.${attempt + 1}`, email);
+      }
+
+      await expect(
+        checkPasswordLoginLimit('198.51.100.200', email)
+      ).resolves.toMatchObject({
+        allowed: false,
+        reason: 'Too many failed login attempts for this email',
+        remainingAttempts: 0,
+      });
+
+      await clearPasswordLoginFailures('198.51.100.200', email);
+
+      await expect(
+        checkPasswordLoginLimit('198.51.100.200', email)
+      ).resolves.toMatchObject({
+        allowed: true,
+        remainingAttempts: 10,
+      });
+    });
+
+    it('throttles shared-IP password failures without writing a hard IP block', async () => {
+      const ipAddress = '203.0.113.42';
+
+      for (
+        let attempt = 0;
+        attempt < ABUSE_THRESHOLDS.PASSWORD_LOGIN_FAILED_MAX;
+        attempt += 1
+      ) {
+        await recordPasswordLoginFailure(
+          ipAddress,
+          `password-shared-ip-${attempt}@example.com`
+        );
+      }
+
+      const result = await checkPasswordLoginLimit(
+        ipAddress,
+        'another-user@example.com'
+      );
+
+      expect(result).toMatchObject({
+        allowed: false,
+        reason: 'Too many failed login attempts',
+        remainingAttempts: 0,
+      });
+      expect(result.blocked).not.toBe(true);
     });
   });
 
@@ -350,14 +453,19 @@ describe('abuse-protection', () => {
   });
 
   describe('checkOTPSendAllowed', () => {
-    it('does not consume quota during preflight checks', async () => {
-      const email = `preflight-${Date.now()}@example.com`;
+    it('reserves same-email cooldown before provider success', async () => {
+      const email = `reserved-cooldown-${Date.now()}@example.com`;
 
-      const firstAttempt = await checkOTPSendAllowed('198.51.100.1', email);
-      const secondAttempt = await checkOTPSendAllowed('198.51.100.2', email);
+      const attempts = await Promise.all([
+        checkOTPSendAllowed('198.51.100.1', email),
+        checkOTPSendAllowed('198.51.100.2', email),
+      ]);
+      const allowedAttempts = attempts.filter((attempt) => attempt.allowed);
+      const blockedAttempts = attempts.filter((attempt) => !attempt.allowed);
 
-      expect(firstAttempt.allowed).toBe(true);
-      expect(secondAttempt.allowed).toBe(true);
+      expect(allowedAttempts).toHaveLength(1);
+      expect(blockedAttempts).toHaveLength(1);
+      expect(blockedAttempts[0]?.retryAfter).toBeGreaterThan(0);
     });
 
     it('blocks repeated sends to the same email across different IPs during cooldown', async () => {
@@ -413,6 +521,90 @@ describe('abuse-protection', () => {
       expect(blockedAttempt.retryAfter).toBeGreaterThan(0);
     });
 
+    it('throttles aggressive shared-IP OTP sends without writing a hard IP block', async () => {
+      vi.stubEnv('ABUSE_OTP_SEND_IP_LIMIT_MINUTE', '1');
+      const ipAddress = '198.51.100.12';
+
+      await expect(
+        checkOTPSendAllowed(ipAddress, 'otp-shared-ip-1@example.com')
+      ).resolves.toMatchObject({ allowed: true });
+
+      const blockedAttempt = await checkOTPSendAllowed(
+        ipAddress,
+        'otp-shared-ip-2@example.com'
+      );
+
+      expect(blockedAttempt).toMatchObject({
+        allowed: false,
+        remainingAttempts: 0,
+      });
+      expect(blockedAttempt.blocked).not.toBe(true);
+    });
+
+    it('throttles shared-IP OTP verify failures without writing a hard IP block', async () => {
+      const ipAddress = '198.51.100.13';
+
+      for (
+        let attempt = 0;
+        attempt < ABUSE_THRESHOLDS.OTP_VERIFY_FAILED_MAX;
+        attempt += 1
+      ) {
+        await recordOTPVerifyFailure(
+          ipAddress,
+          `otp-verify-shared-ip-${attempt}@example.com`
+        );
+      }
+
+      const result = await checkOTPVerifyLimit(
+        ipAddress,
+        'legit-teacher@example.com'
+      );
+
+      expect(result).toMatchObject({
+        allowed: false,
+        reason: 'Too many failed verification attempts from this IP',
+        remainingAttempts: 0,
+      });
+      expect(result.blocked).not.toBe(true);
+    });
+
+    it('throttles shared-IP MFA and reauth failures without writing a hard IP block', async () => {
+      const mfaIpAddress = '198.51.100.14';
+      const reauthIpAddress = '198.51.100.15';
+
+      for (
+        let attempt = 0;
+        attempt < ABUSE_THRESHOLDS.MFA_VERIFY_FAILED_MAX;
+        attempt += 1
+      ) {
+        await recordMFAVerifyFailure(mfaIpAddress);
+      }
+
+      for (
+        let attempt = 0;
+        attempt < ABUSE_THRESHOLDS.REAUTH_VERIFY_FAILED_MAX;
+        attempt += 1
+      ) {
+        await recordReauthVerifyFailure(reauthIpAddress);
+      }
+
+      const mfaResult = await checkMFAVerifyLimit(mfaIpAddress);
+      const reauthResult = await checkReauthVerifyLimit(reauthIpAddress);
+
+      expect(mfaResult).toMatchObject({
+        allowed: false,
+        reason: 'Too many failed MFA verification attempts',
+        remainingAttempts: 0,
+      });
+      expect(reauthResult).toMatchObject({
+        allowed: false,
+        reason: 'Too many failed reauthentication attempts',
+        remainingAttempts: 0,
+      });
+      expect(mfaResult.blocked).not.toBe(true);
+      expect(reauthResult.blocked).not.toBe(true);
+    });
+
     it('caps successful sends for the same email across distributed IPs within an hour', async () => {
       vi.useFakeTimers();
       vi.setSystemTime(new Date('2026-03-12T00:00:00.000Z'));

package/src/abuse-protection/backend-rate-limit.ts

@@ -1,4 +1,3 @@
-import { blockIPEdge } from './edge';
 import type { BlockInfo } from './types';
 
 type BackendRateLimitSource = 'auth' | 'database';
@@ -37,8 +36,10 @@ export function isBackendRateLimitError(
 }
 
 export async function cascadeBackendRateLimitToProxyBan({
-  ipAddress,
+  ipAddress: _ipAddress,
 }: BackendRateLimitEscalationOptions): Promise<BlockInfo | null> {
-  const shouldBlockIp = ipAddress && ipAddress !== 'unknown';
-  return shouldBlockIp ? blockIPEdge(ipAddress, 'api_abuse') : null;
+  // A backend 429 is an availability/backpressure signal. It is not enough
+  // evidence to hard-ban a public NAT IP that may represent a classroom,
+  // university, or enterprise office.
+  return null;
 }