@tuturuuu/utils 0.8.0 → 0.9.0

package/src/abuse-protection/__tests__/backend-rate-limit.test.ts

@@ -2,8 +2,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 const mocks = vi.hoisted(() => ({
   blockIPEdge: vi.fn(),
-  checkUserSuspension: vi.fn(),
-  suspendUser: vi.fn(),
 }));
 
 vi.mock('../edge', () => ({
@@ -11,14 +9,6 @@ vi.mock('../edge', () => ({
     mocks.blockIPEdge(...args),
 }));
 
-vi.mock('../user-suspension', () => ({
-  checkUserSuspension: (
-    ...args: Parameters<typeof mocks.checkUserSuspension>
-  ) => mocks.checkUserSuspension(...args),
-  suspendUser: (...args: Parameters<typeof mocks.suspendUser>) =>
-    mocks.suspendUser(...args),
-}));
-
 import {
   cascadeBackendRateLimitToProxyBan,
   isBackendRateLimitError,
@@ -28,8 +18,6 @@ describe('backend-rate-limit', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mocks.blockIPEdge.mockResolvedValue(null);
-    mocks.checkUserSuspension.mockResolvedValue({ suspended: false });
-    mocks.suspendUser.mockResolvedValue(true);
   });
 
   describe('isBackendRateLimitError', () => {
@@ -51,16 +39,7 @@ describe('backend-rate-limit', () => {
   });
 
   describe('cascadeBackendRateLimitToProxyBan', () => {
-    it('blocks the IP without suspending an identified user', async () => {
-      const blockInfo = {
-        id: 'block-1',
-        blockLevel: 1,
-        reason: 'api_abuse',
-        blockedAt: new Date(),
-        expiresAt: new Date(Date.now() + 300_000),
-      };
-      mocks.blockIPEdge.mockResolvedValue(blockInfo);
-
+    it('does not hard-ban a known client IP for a backend rate-limit signal', async () => {
       const result = await cascadeBackendRateLimitToProxyBan({
         endpoint: '/api/ai/chat/new',
         ipAddress: '203.0.113.10',
@@ -68,46 +47,32 @@ describe('backend-rate-limit', () => {
         userId: 'user-1',
       });
 
-      expect(result).toBe(blockInfo);
-      expect(mocks.blockIPEdge).toHaveBeenCalledWith(
-        '203.0.113.10',
-        'api_abuse'
-      );
-      expect(mocks.checkUserSuspension).not.toHaveBeenCalled();
-      expect(mocks.suspendUser).not.toHaveBeenCalled();
+      expect(result).toBeNull();
+      expect(mocks.blockIPEdge).not.toHaveBeenCalled();
     });
 
-    it('does not inspect existing user suspensions', async () => {
-      mocks.checkUserSuspension.mockResolvedValue({
-        suspended: true,
-        reason: 'already suspended',
-      });
-
-      await cascadeBackendRateLimitToProxyBan({
+    it('does not hard-ban auth backend rate-limit signals', async () => {
+      const result = await cascadeBackendRateLimitToProxyBan({
         endpoint: '/api/ai/chat/new',
         ipAddress: '203.0.113.10',
         source: 'auth',
         userId: 'user-1',
       });
 
-      expect(mocks.suspendUser).not.toHaveBeenCalled();
-      expect(mocks.blockIPEdge).toHaveBeenCalledWith(
-        '203.0.113.10',
-        'api_abuse'
-      );
-      expect(mocks.checkUserSuspension).not.toHaveBeenCalled();
+      expect(result).toBeNull();
+      expect(mocks.blockIPEdge).not.toHaveBeenCalled();
     });
 
-    it('does not suspend the user when the client IP is unavailable', async () => {
-      await cascadeBackendRateLimitToProxyBan({
+    it('returns null when the client IP is unavailable', async () => {
+      const result = await cascadeBackendRateLimitToProxyBan({
         endpoint: '/api/ai/chat/new',
         ipAddress: 'unknown',
         source: 'database',
         userId: 'user-1',
       });
 
+      expect(result).toBeNull();
       expect(mocks.blockIPEdge).not.toHaveBeenCalled();
-      expect(mocks.suspendUser).not.toHaveBeenCalled();
     });
   });
 });

package/src/abuse-protection/__tests__/edge-trust.test.ts

@@ -80,6 +80,17 @@ describe('edge-trust cache', () => {
     expect(await getCachedTrustMultiplier(['session:aaa'])).toBe(2.5);
   });
 
+  it('returns neutral verified session entries without treating plain neutral entries as active', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([{ m: 1, verified: true }, 1]);
+
+    const { getCachedTrustEntries } = await import('../edge-trust.js');
+    const entries = await getCachedTrustEntries(['session:aaa', 'session:bbb']);
+
+    expect(entries.get('session:aaa')).toEqual({ m: 1, verified: true });
+    expect(entries.has('session:bbb')).toBe(false);
+  });
+
   it('fails open to a neutral multiplier when Redis errors', async () => {
     mockRedisClient();
     mocks.mget.mockRejectedValue(new Error('redis down'));
@@ -139,6 +150,53 @@ describe('edge-trust cache', () => {
     });
   });
 
+  it('writes neutral verified session markers without writing non-session subjects', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([null]);
+    mocks.set.mockResolvedValue('OK');
+
+    const { writeVerifiedSessionCacheForSubjects } = await import(
+      '../edge-trust.js'
+    );
+    await writeVerifiedSessionCacheForSubjects(
+      ['session:aaa', 'cidr:1.2.3.0/24'],
+      600
+    );
+
+    expect(mocks.set).toHaveBeenCalledTimes(1);
+    expect(mocks.set).toHaveBeenCalledWith(
+      'trust:mult:session:aaa',
+      { m: 1, verified: true },
+      { ex: 600 }
+    );
+  });
+
+  it('does not downgrade elevated trust entries when writing verified session markers', async () => {
+    mockRedisClient();
+    mocks.mget.mockResolvedValue([3, null]);
+    mocks.set.mockResolvedValue('OK');
+
+    const { writeVerifiedSessionCacheForSubjects } = await import(
+      '../edge-trust.js'
+    );
+    await writeVerifiedSessionCacheForSubjects(
+      ['session:elevated', 'session:neutral'],
+      600
+    );
+
+    expect(mocks.set).toHaveBeenCalledTimes(1);
+    expect(mocks.set).toHaveBeenCalledWith(
+      'trust:mult:session:neutral',
+      { m: 1, verified: true },
+      { ex: 600 }
+    );
+    expect(mocks.set).not.toHaveBeenCalledWith(
+      'trust:mult:session:elevated',
+      expect.anything(),
+      expect.anything()
+    );
+  });
+
   it('parses legacy plain numbers and rich JSON entries together', async () => {
     mockRedisClient();
     mocks.mget.mockResolvedValue([

package/src/abuse-protection/__tests__/index.test.ts

@@ -3,19 +3,27 @@
  */
 
 import { afterEach, describe, expect, it, vi } from 'vitest';
+
 import {
   ABUSE_THRESHOLDS,
   BLOCK_DURATIONS,
+  checkMFAVerifyLimit,
   checkOTPSendAllowed,
+  checkOTPVerifyLimit,
   checkPasswordLoginLimit,
+  checkReauthVerifyLimit,
   classifyPotentialSpamUserAgent,
   clearPasswordLoginFailures,
   extractIPFromHeaders,
   hashEmail,
+  isSharedIpThrottleOnlyBlockReason,
   MAX_BLOCK_LEVEL,
   REDIS_KEYS,
+  recordMFAVerifyFailure,
   recordOTPSendSuccess,
+  recordOTPVerifyFailure,
   recordPasswordLoginFailure,
+  recordReauthVerifyFailure,
   resetOtpLimitsForEmail,
   WINDOW_MS,
 } from '../index';
@@ -251,6 +259,23 @@ describe('abuse-protection', () => {
     });
   });
 
+  describe('shared-IP hard block suppression', () => {
+    it('keeps human-auth failure reasons throttle-only', () => {
+      expect(isSharedIpThrottleOnlyBlockReason('otp_send')).toBe(true);
+      expect(isSharedIpThrottleOnlyBlockReason('otp_verify_failed')).toBe(true);
+      expect(isSharedIpThrottleOnlyBlockReason('mfa_verify_failed')).toBe(true);
+      expect(isSharedIpThrottleOnlyBlockReason('reauth_verify_failed')).toBe(
+        true
+      );
+      expect(isSharedIpThrottleOnlyBlockReason('password_login_failed')).toBe(
+        true
+      );
+      expect(isSharedIpThrottleOnlyBlockReason('api_auth_failed')).toBe(false);
+      expect(isSharedIpThrottleOnlyBlockReason('api_abuse')).toBe(false);
+      expect(isSharedIpThrottleOnlyBlockReason('manual')).toBe(false);
+    });
+  });
+
   describe('password login failure limits', () => {
     it('keeps the IP-wide failure counter after another account succeeds', async () => {
       const ipAddress = '203.0.113.41';
@@ -293,6 +318,33 @@ describe('abuse-protection', () => {
         remainingAttempts: 10,
       });
     });
+
+    it('throttles shared-IP password failures without writing a hard IP block', async () => {
+      const ipAddress = '203.0.113.42';
+
+      for (
+        let attempt = 0;
+        attempt < ABUSE_THRESHOLDS.PASSWORD_LOGIN_FAILED_MAX;
+        attempt += 1
+      ) {
+        await recordPasswordLoginFailure(
+          ipAddress,
+          `password-shared-ip-${attempt}@example.com`
+        );
+      }
+
+      const result = await checkPasswordLoginLimit(
+        ipAddress,
+        'another-user@example.com'
+      );
+
+      expect(result).toMatchObject({
+        allowed: false,
+        reason: 'Too many failed login attempts',
+        remainingAttempts: 0,
+      });
+      expect(result.blocked).not.toBe(true);
+    });
   });
 
   describe('BLOCK_DURATIONS constants', () => {
@@ -469,6 +521,90 @@ describe('abuse-protection', () => {
       expect(blockedAttempt.retryAfter).toBeGreaterThan(0);
     });
 
+    it('throttles aggressive shared-IP OTP sends without writing a hard IP block', async () => {
+      vi.stubEnv('ABUSE_OTP_SEND_IP_LIMIT_MINUTE', '1');
+      const ipAddress = '198.51.100.12';
+
+      await expect(
+        checkOTPSendAllowed(ipAddress, 'otp-shared-ip-1@example.com')
+      ).resolves.toMatchObject({ allowed: true });
+
+      const blockedAttempt = await checkOTPSendAllowed(
+        ipAddress,
+        'otp-shared-ip-2@example.com'
+      );
+
+      expect(blockedAttempt).toMatchObject({
+        allowed: false,
+        remainingAttempts: 0,
+      });
+      expect(blockedAttempt.blocked).not.toBe(true);
+    });
+
+    it('throttles shared-IP OTP verify failures without writing a hard IP block', async () => {
+      const ipAddress = '198.51.100.13';
+
+      for (
+        let attempt = 0;
+        attempt < ABUSE_THRESHOLDS.OTP_VERIFY_FAILED_MAX;
+        attempt += 1
+      ) {
+        await recordOTPVerifyFailure(
+          ipAddress,
+          `otp-verify-shared-ip-${attempt}@example.com`
+        );
+      }
+
+      const result = await checkOTPVerifyLimit(
+        ipAddress,
+        'legit-teacher@example.com'
+      );
+
+      expect(result).toMatchObject({
+        allowed: false,
+        reason: 'Too many failed verification attempts from this IP',
+        remainingAttempts: 0,
+      });
+      expect(result.blocked).not.toBe(true);
+    });
+
+    it('throttles shared-IP MFA and reauth failures without writing a hard IP block', async () => {
+      const mfaIpAddress = '198.51.100.14';
+      const reauthIpAddress = '198.51.100.15';
+
+      for (
+        let attempt = 0;
+        attempt < ABUSE_THRESHOLDS.MFA_VERIFY_FAILED_MAX;
+        attempt += 1
+      ) {
+        await recordMFAVerifyFailure(mfaIpAddress);
+      }
+
+      for (
+        let attempt = 0;
+        attempt < ABUSE_THRESHOLDS.REAUTH_VERIFY_FAILED_MAX;
+        attempt += 1
+      ) {
+        await recordReauthVerifyFailure(reauthIpAddress);
+      }
+
+      const mfaResult = await checkMFAVerifyLimit(mfaIpAddress);
+      const reauthResult = await checkReauthVerifyLimit(reauthIpAddress);
+
+      expect(mfaResult).toMatchObject({
+        allowed: false,
+        reason: 'Too many failed MFA verification attempts',
+        remainingAttempts: 0,
+      });
+      expect(reauthResult).toMatchObject({
+        allowed: false,
+        reason: 'Too many failed reauthentication attempts',
+        remainingAttempts: 0,
+      });
+      expect(mfaResult.blocked).not.toBe(true);
+      expect(reauthResult.blocked).not.toBe(true);
+    });
+
     it('caps successful sends for the same email across distributed IPs within an hour', async () => {
       vi.useFakeTimers();
       vi.setSystemTime(new Date('2026-03-12T00:00:00.000Z'));

package/src/abuse-protection/backend-rate-limit.ts

@@ -1,4 +1,3 @@
-import { blockIPEdge } from './edge';
 import type { BlockInfo } from './types';
 
 type BackendRateLimitSource = 'auth' | 'database';
@@ -37,8 +36,10 @@ export function isBackendRateLimitError(
 }
 
 export async function cascadeBackendRateLimitToProxyBan({
-  ipAddress,
+  ipAddress: _ipAddress,
 }: BackendRateLimitEscalationOptions): Promise<BlockInfo | null> {
-  const shouldBlockIp = ipAddress && ipAddress !== 'unknown';
-  return shouldBlockIp ? blockIPEdge(ipAddress, 'api_abuse') : null;
+  // A backend 429 is an availability/backpressure signal. It is not enough
+  // evidence to hard-ban a public NAT IP that may represent a classroom,
+  // university, or enterprise office.
+  return null;
 }

package/src/abuse-protection/edge-trust.ts

@@ -39,6 +39,8 @@ export interface CachedTrustEntry {
   mode?: 'absolute' | 'unlimited';
   /** For mode=absolute: explicit per-window READ limits. */
   abs?: { minute?: number; hour?: number; day?: number };
+  /** Server-verified session marker. Does not increase limits by itself. */
+  verified?: boolean;
 }
 
 const DEFAULT_TRUST_CACHE_TTL_SECONDS = 3600; // 1 hour
@@ -156,14 +158,25 @@ function parseEntry(value: unknown): CachedTrustEntry | null {
       ? record.mode
       : undefined;
   const abs = parseAbsLimits(record.abs);
+  const verified = record.verified === true;
 
-  return { abs, m, mode };
+  const entry: CachedTrustEntry = { m };
+  if (mode) {
+    entry.mode = mode;
+  }
+  if (abs) {
+    entry.abs = abs;
+  }
+  if (verified) {
+    entry.verified = true;
+  }
+  return entry;
 }
 
 /** Serializes an entry for storage: plain number when multiplier-only. */
 function serializeEntry(entry: CachedTrustEntry): number | CachedTrustEntry {
   const m = clampMultiplier(entry.m);
-  if (!entry.mode && !entry.abs) {
+  if (!entry.mode && !entry.abs && !entry.verified) {
     return m;
   }
 
@@ -182,20 +195,28 @@ function serializeEntry(entry: CachedTrustEntry): number | CachedTrustEntry {
       serialized.abs = abs;
     }
   }
+  if (entry.verified) {
+    serialized.verified = true;
+  }
   return serialized;
 }
 
 function isActiveEntry(entry: CachedTrustEntry): boolean {
-  return entry.mode != null || entry.m > NEUTRAL_TRUST_MULTIPLIER;
+  return (
+    entry.mode != null ||
+    entry.verified === true ||
+    entry.m > NEUTRAL_TRUST_MULTIPLIER
+  );
 }
 
 /**
  * Resolves the cached trust multiplier for each provided subject key.
  *
  * Returns a map of subject key -> clamped multiplier for keys that have a cache
- * entry above the neutral baseline. Missing keys are omitted. Returns an empty
- * map on any Redis error (fail-open). Lets callers distinguish account trust
- * (session key) from location trust (cidr/ip keys).
+ * entry above the neutral baseline, admin-mode entries, or neutral verified
+ * session entries. Missing keys are omitted. Returns an empty map on any Redis
+ * error (fail-open). Lets callers distinguish account trust (session key) from
+ * location trust (cidr/ip keys).
  */
 export async function getCachedTrustEntries(
   subjectKeys: string[]
@@ -342,3 +363,50 @@ export async function writeTrustCacheForSubjects(
     // Cache writes must never block the protected request path.
   }
 }
+
+/**
+ * Write-through a neutral marker for server-verified browser/app sessions.
+ * This only proves the session cookie was successfully validated downstream; it
+ * does not grant a read-limit multiplier or admin override.
+ */
+export async function writeVerifiedSessionCacheForSubjects(
+  subjectKeys: string[],
+  ttlSeconds: number = getTrustCacheTtlSeconds()
+): Promise<void> {
+  const sessionKeys = subjectKeys.filter((subjectKey) =>
+    subjectKey.startsWith('session:')
+  );
+  if (sessionKeys.length === 0) {
+    return;
+  }
+
+  try {
+    const redis = await getTrustRedisClient();
+    if (!redis) {
+      return;
+    }
+
+    const existingEntries = await getCachedTrustEntries(sessionKeys);
+    const verifiedEntry = serializeEntry({
+      m: NEUTRAL_TRUST_MULTIPLIER,
+      verified: true,
+    });
+    await Promise.all(
+      sessionKeys.map((subjectKey) => {
+        const existing = existingEntries.get(subjectKey);
+        if (
+          existing &&
+          (existing.mode != null || existing.abs != null || existing.m > 1)
+        ) {
+          return Promise.resolve();
+        }
+
+        return redis.set(buildTrustCacheKey(subjectKey), verifiedEntry, {
+          ex: ttlSeconds,
+        });
+      })
+    );
+  } catch {
+    // Cache writes must never block the protected request path.
+  }
+}

package/src/abuse-protection/index.ts

@@ -34,6 +34,18 @@ export * from './user-agent';
 // In-memory fallback store
 const memoryStore = new Map<string, { count: number; expiresAt: number }>();
 
+const SHARED_IP_THROTTLE_ONLY_BLOCK_REASONS = new Set<AbuseEventType>([
+  'otp_send',
+  'otp_verify_failed',
+  'mfa_verify_failed',
+  'reauth_verify_failed',
+  'password_login_failed',
+]);
+
+export function isSharedIpThrottleOnlyBlockReason(reason: AbuseEventType) {
+  return SHARED_IP_THROTTLE_ONLY_BLOCK_REASONS.has(reason);
+}
+
 // Redis client singleton (lazy initialized)
 let redisClient: RedisClient | null = null;
 let redisInitialized = false;
@@ -396,6 +408,10 @@ export async function blockIP(
   reason: AbuseEventType,
   metadata?: Record<string, unknown>
 ): Promise<void> {
+  if (isSharedIpThrottleOnlyBlockReason(reason)) {
+    return;
+  }
+
   try {
     const sbAdmin = await getSupabaseAdmin();
     if (!sbAdmin) return;
@@ -900,18 +916,15 @@ export async function checkOTPSendAllowed(
   const ipLimits = getOTPSendIpLimits();
 
   if (minuteState.count > ipLimits.perMinute) {
-    // Log and potentially block
     void logAbuseEvent(ipAddress, 'otp_send', {
       email,
       success: false,
-      metadata: { trigger: 'minute_limit' },
+      metadata: {
+        trigger: 'minute_limit',
+        hard_block_suppressed: minuteState.count >= ipLimits.perMinute * 2,
+      },
     });
 
-    if (minuteState.count >= ipLimits.perMinute * 2) {
-      // Aggressive abuse - block IP
-      void blockIP(ipAddress, 'otp_send', { trigger: 'rate_limit_exceeded' });
-    }
-
     return {
       allowed: false,
       reason: 'Too many OTP requests. Please try again later.',
@@ -924,11 +937,12 @@ export async function checkOTPSendAllowed(
     void logAbuseEvent(ipAddress, 'otp_send', {
       email,
       success: false,
-      metadata: { trigger: 'hourly_rate_limit' },
+      metadata: {
+        trigger: 'hourly_rate_limit',
+        hard_block_suppressed: true,
+      },
     });
 
-    void blockIP(ipAddress, 'otp_send', { trigger: 'hourly_rate_limit' });
-
     return {
       allowed: false,
       reason: 'Hourly OTP limit reached. Please try again later.',
@@ -941,9 +955,11 @@ export async function checkOTPSendAllowed(
     void logAbuseEvent(ipAddress, 'otp_send', {
       email,
       success: false,
-      metadata: { trigger: 'ip_daily_limit' },
+      metadata: {
+        trigger: 'ip_daily_limit',
+        hard_block_suppressed: true,
+      },
     });
-    void blockIP(ipAddress, 'otp_send', { trigger: 'ip_daily_limit' });
 
     return {
       allowed: false,
@@ -1114,16 +1130,35 @@ export async function recordOTPVerifyFailure(
     ),
   ]);
 
-  // Log the failure
-  void logAbuseEvent(ipAddress, 'otp_verify_failed', { email, success: false });
+  void logAbuseEvent(ipAddress, 'otp_verify_failed', {
+    email,
+    success: false,
+    metadata: createHumanAuthRateLimitMetadata(
+      ipCount,
+      ABUSE_THRESHOLDS.OTP_VERIFY_FAILED_MAX
+    ),
+  });
+}
 
-  // Block if threshold exceeded
-  if (ipCount >= ABUSE_THRESHOLDS.OTP_VERIFY_FAILED_MAX) {
-    void blockIP(ipAddress, 'otp_verify_failed', {
-      trigger: 'max_failures_exceeded',
-      failedCount: ipCount,
-    });
+/**
+ * Shared NATs can represent a whole classroom, university, or enterprise.
+ * Human-auth counters still throttle the noisy flow, but they must not write a
+ * global IP block that prevents unrelated people on the same public address
+ * from signing in.
+ */
+function createHumanAuthRateLimitMetadata(
+  failedCount: number,
+  maxFailures: number
+): Record<string, unknown> | undefined {
+  if (failedCount < maxFailures) {
+    return undefined;
   }
+
+  return {
+    trigger: 'max_failures_exceeded',
+    failedCount,
+    hard_block_suppressed: true,
+  };
 }
 
 /**
@@ -1221,14 +1256,13 @@ export async function recordMFAVerifyFailure(ipAddress: string): Promise<void> {
     ABUSE_THRESHOLDS.MFA_VERIFY_FAILED_WINDOW_MS
   );
 
-  void logAbuseEvent(ipAddress, 'mfa_verify_failed', { success: false });
-
-  if (count >= ABUSE_THRESHOLDS.MFA_VERIFY_FAILED_MAX) {
-    void blockIP(ipAddress, 'mfa_verify_failed', {
-      trigger: 'max_failures_exceeded',
-      failedCount: count,
-    });
-  }
+  void logAbuseEvent(ipAddress, 'mfa_verify_failed', {
+    success: false,
+    metadata: createHumanAuthRateLimitMetadata(
+      count,
+      ABUSE_THRESHOLDS.MFA_VERIFY_FAILED_MAX
+    ),
+  });
 }
 
 /**
@@ -1322,11 +1356,13 @@ export async function recordReauthVerifyFailure(
     ABUSE_THRESHOLDS.REAUTH_VERIFY_FAILED_WINDOW_MS
   );
 
-  void logAbuseEvent(ipAddress, 'reauth_verify_failed', { success: false });
-
-  if (count >= ABUSE_THRESHOLDS.REAUTH_VERIFY_FAILED_MAX) {
-    void blockIP(ipAddress, 'reauth_verify_failed');
-  }
+  void logAbuseEvent(ipAddress, 'reauth_verify_failed', {
+    success: false,
+    metadata: createHumanAuthRateLimitMetadata(
+      count,
+      ABUSE_THRESHOLDS.REAUTH_VERIFY_FAILED_MAX
+    ),
+  });
 }
 
 /**
@@ -1431,14 +1467,11 @@ export async function recordPasswordLoginFailure(
   void logAbuseEvent(ipAddress, 'password_login_failed', {
     email: normalizedEmail ?? undefined,
     success: false,
+    metadata: createHumanAuthRateLimitMetadata(
+      count,
+      ABUSE_THRESHOLDS.PASSWORD_LOGIN_FAILED_MAX
+    ),
   });
-
-  if (count >= ABUSE_THRESHOLDS.PASSWORD_LOGIN_FAILED_MAX) {
-    void blockIP(ipAddress, 'password_login_failed', {
-      trigger: 'max_failures_exceeded',
-      failedCount: count,
-    });
-  }
 }
 
 /**