@x47base/pocketbase-addon 0.1.0

package/mail/register_test.go

@@ -0,0 +1,49 @@
+package mail
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/spink-dev/pocketbase-extension/settings"
+	"strings"
+	"testing"
+)
+
+func TestLocaleFallbackAndRequestIsolation(t *testing.T) {
+	a, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer a.Cleanup()
+	Register(a)
+	r, err := a.FindFirstRecordByData("users", "email", "test@example.com")
+	if err != nil {
+		rs, e := a.FindRecordsByFilter("users", "", "", 1, 0)
+		if e != nil || len(rs) == 0 {
+			t.Fatal(err)
+		}
+		r = rs[0]
+	}
+	c, _ := settings.Load(a)
+	c.EmailLocales = map[string]map[string]map[string]settings.Template{r.Collection().Id: {"otp": {"fr": {Subject: "Bonjour {RECORD:email}", Body: "Code {OTP}"}}}}
+	if err = settings.Save(a, c); err != nil {
+		t.Fatal(err)
+	}
+	subjects := []string{}
+	a.OnMailerRecordOTPSend().BindFunc(func(e *core.MailerRecordEvent) error {
+		subjects = append(subjects, e.Message.Subject)
+		if len(subjects) == 1 && !strings.Contains(e.Message.HTML, "Code 123456") {
+			t.Fatal("OTP placeholder missing")
+		}
+		return nil
+	})
+	if err = mails.SendRecordOTP(WithLocale(a, "fr-ch"), r, "fixture", "123456"); err != nil {
+		t.Fatal(err)
+	}
+	if err = mails.SendRecordOTP(a, r, "fixture", "123456"); err != nil {
+		t.Fatal(err)
+	}
+	if len(subjects) != 2 || !strings.HasPrefix(subjects[0], "Bonjour") || strings.HasPrefix(subjects[1], "Bonjour") {
+		t.Fatalf("locale leaked: %v", subjects)
+	}
+}

package/mail/resolve.go

@@ -0,0 +1,91 @@
+package mail
+
+import (
+	"bytes"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails/templates"
+	"html"
+	"html/template"
+	"slices"
+	texttemplate "text/template"
+)
+
+var nonescapeTypes = []string{core.FieldTypeNumber, core.FieldTypeBool, core.FieldTypeDate, core.FieldTypeAutodate}
+
+func resolveTemplateContent(data any, content ...string) (string, error) {
+	if len(content) == 0 {
+		return "", nil
+	}
+
+	t := texttemplate.New("inline_template")
+
+	var parseErr error
+	for _, v := range content {
+		t, parseErr = t.Parse(v)
+		if parseErr != nil {
+			return "", parseErr
+		}
+	}
+
+	var wr bytes.Buffer
+
+	if executeErr := t.Execute(&wr, data); executeErr != nil {
+		return "", executeErr
+	}
+
+	return wr.String(), nil
+}
+
+func resolveEmailTemplate(
+	app core.App,
+	authRecord *core.Record,
+	emailTemplate core.EmailTemplate,
+	placeholders map[string]any,
+) (subject string, body string, err error) {
+	if placeholders == nil {
+		placeholders = map[string]any{}
+	}
+
+	// register default system placeholders
+	if _, ok := placeholders[core.EmailPlaceholderAppName]; !ok {
+		placeholders[core.EmailPlaceholderAppName] = app.Settings().Meta.AppName
+	}
+	if _, ok := placeholders[core.EmailPlaceholderAppURL]; !ok {
+		placeholders[core.EmailPlaceholderAppURL] = app.Settings().Meta.AppURL
+	}
+
+	// register default auth record placeholders
+	for _, field := range authRecord.Collection().Fields {
+		if field.GetHidden() {
+			continue
+		}
+
+		fieldPlacehodler := "{RECORD:" + field.GetName() + "}"
+		if _, ok := placeholders[fieldPlacehodler]; !ok {
+			val := authRecord.GetString(field.GetName())
+
+			// note: the escaping is not strictly necessary but for just in case
+			// the user decide to store and render the email as plain html
+			if !slices.Contains(nonescapeTypes, field.Type()) {
+				val = html.EscapeString(val)
+			}
+
+			placeholders[fieldPlacehodler] = val
+		}
+	}
+
+	subject, rawBody := emailTemplate.Resolve(placeholders)
+
+	params := struct {
+		HTMLContent template.HTML
+	}{
+		HTMLContent: template.HTML(rawBody),
+	}
+
+	body, err = resolveTemplateContent(params, templates.Layout, templates.HTMLBody)
+	if err != nil {
+		return "", "", err
+	}
+
+	return subject, body, nil
+}

package/migration/import.go

@@ -0,0 +1,96 @@
+// Package migration explicitly imports fork-only settings into extension-owned storage.
+package migration
+
+import (
+	"encoding/json"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spink-dev/pocketbase-extension/settings"
+	"os"
+	"reflect"
+)
+
+func Import(app core.App) (bool, error) {
+	c, err := settings.Load(app)
+	if err != nil {
+		return false, err
+	}
+	before, _ := json.Marshal(c)
+	p := new(core.Param)
+	if err = app.ModelQuery(p).Model("settings", p); err != nil {
+		return false, err
+	}
+	raw := []byte(p.Value)
+	var old struct {
+		Backups struct {
+			Encrypted     bool
+			EncryptionEnv string
+		}
+	}
+	if err = json.Unmarshal(raw, &old); err != nil {
+		raw, err = security.Decrypt(string(p.Value), os.Getenv(app.EncryptionEnv()))
+		if err != nil {
+			return false, err
+		}
+		if err = json.Unmarshal(raw, &old); err != nil {
+			return false, err
+		}
+	}
+	if c.Revision == 1 {
+		c.Backups.Encrypted = old.Backups.Encrypted
+		c.Backups.EncryptionEnv = old.Backups.EncryptionEnv
+	}
+	var rows []struct {
+		Id      string `db:"id"`
+		Options string `db:"options"`
+	}
+	if err = app.DB().NewQuery("SELECT id, options FROM _collections WHERE type='auth'").All(&rows); err != nil {
+		return false, err
+	}
+	for _, row := range rows {
+		var opts map[string]json.RawMessage
+		if err = json.Unmarshal([]byte(row.Options), &opts); err != nil {
+			return false, err
+		}
+		for key, kind := range map[string]string{"otp": "otp", "authAlert": "authAlert", "verificationTemplate": "verification", "resetPasswordTemplate": "passwordReset", "confirmEmailChangeTemplate": "emailChange"} {
+			data := opts[key]
+			if len(data) == 0 {
+				continue
+			}
+			if key == "otp" || key == "authAlert" {
+				var nested map[string]json.RawMessage
+				if err = json.Unmarshal(data, &nested); err != nil {
+					return false, err
+				}
+				data = nested["emailTemplate"]
+			}
+			if len(data) == 0 {
+				continue
+			}
+			var t struct{ Locales map[string]settings.Template }
+			if err = json.Unmarshal(data, &t); err != nil {
+				return false, err
+			}
+			if len(t.Locales) == 0 {
+				continue
+			}
+			if c.EmailLocales == nil {
+				c.EmailLocales = map[string]map[string]map[string]settings.Template{}
+			}
+			if c.EmailLocales[row.Id] == nil {
+				c.EmailLocales[row.Id] = map[string]map[string]settings.Template{}
+			}
+			if c.EmailLocales[row.Id][kind] == nil {
+				c.EmailLocales[row.Id][kind] = t.Locales
+			}
+		}
+	}
+	after, _ := json.Marshal(c)
+	if reflect.DeepEqual(before, after) {
+		return false, nil
+	}
+	if err = settings.Save(app, c); err != nil {
+		return false, err
+	}
+	return true, nil
+}

package/migration/import_test.go

@@ -0,0 +1,58 @@
+package migration
+
+import (
+	"encoding/json"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/spink-dev/pocketbase-extension/settings"
+	"strings"
+	"testing"
+)
+
+func TestImportForkSettingsIsExplicitAndIdempotent(t *testing.T) {
+	a, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer a.Cleanup()
+	t.Setenv("SPINK_IMPORT_KEY", strings.Repeat("k", 32))
+	p := new(core.Param)
+	if err = a.ModelQuery(p).Model("settings", p); err != nil {
+		t.Fatal(err)
+	}
+	var data map[string]any
+	if err = json.Unmarshal(p.Value, &data); err != nil {
+		t.Fatal(err)
+	}
+	data["backups"].(map[string]any)["encrypted"] = true
+	data["backups"].(map[string]any)["encryptionEnv"] = "SPINK_IMPORT_KEY"
+	raw, _ := json.Marshal(data)
+	if _, err = a.DB().NewQuery("UPDATE _params SET value={:v} WHERE id='settings'").Bind(dbx.Params{"v": string(raw)}).Execute(); err != nil {
+		t.Fatal(err)
+	}
+	c, _ := a.FindCollectionByNameOrId("users")
+	var options string
+	if err = a.DB().NewQuery("SELECT options FROM _collections WHERE id={:id}").Bind(dbx.Params{"id": c.Id}).Row(&options); err != nil {
+		t.Fatal(err)
+	}
+	var opts map[string]any
+	json.Unmarshal([]byte(options), &opts)
+	opts["verificationTemplate"].(map[string]any)["locales"] = map[string]any{"fr": map[string]any{"subject": "Bonjour", "body": "Bienvenue"}}
+	raw, _ = json.Marshal(opts)
+	if _, err = a.DB().NewQuery("UPDATE _collections SET options={:v} WHERE id={:id}").Bind(dbx.Params{"v": string(raw), "id": c.Id}).Execute(); err != nil {
+		t.Fatal(err)
+	}
+	changed, err := Import(a)
+	if err != nil || !changed {
+		t.Fatalf("import: %v %v", changed, err)
+	}
+	got, err := settings.Load(a)
+	if err != nil || !got.Backups.Encrypted || got.EmailLocales[c.Id]["verification"]["fr"].Subject != "Bonjour" {
+		t.Fatal("lost imported configuration")
+	}
+	changed, err = Import(a)
+	if err != nil || changed {
+		t.Fatal("import is not idempotent")
+	}
+}

package/otp/otp.go

@@ -0,0 +1,56 @@
+// Package otp exposes a pre-validation password callback while leaving stock OTP
+// expiry, single-use, MFA and token issuance authoritative.
+package otp
+
+import (
+	"bytes"
+	"encoding/json"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"io"
+	"strings"
+)
+
+type Request struct {
+	Event    *core.RequestEvent
+	OTPID    string
+	Password string
+}
+
+func Register(app core.App, callback func(*Request) error) {
+	app.OnServe().BindFunc(func(e *core.ServeEvent) error {
+		e.Router.BindFunc(func(r *core.RequestEvent) error {
+			if r.Request.Method != "POST" || !strings.HasSuffix(r.Request.URL.Path, "/auth-with-otp") {
+				return r.Next()
+			}
+			data, err := io.ReadAll(io.LimitReader(r.Request.Body, (1<<20)+1))
+			if err != nil {
+				return err
+			}
+			if len(data) > 1<<20 {
+				return r.BadRequestError("OTP request too large", nil)
+			}
+			var body map[string]any
+			if err = json.Unmarshal(data, &body); err != nil {
+				return r.BadRequestError("OTP extension requires JSON", err)
+			}
+			req := &Request{Event: r}
+			req.OTPID, _ = body["otpId"].(string)
+			req.Password, _ = body["password"].(string)
+			if err = callback(req); err != nil {
+				return err
+			}
+			body["password"] = req.Password
+			data, err = json.Marshal(body)
+			if err != nil {
+				return err
+			}
+			bodyReader := &router.RereadableReadCloser{ReadCloser: io.NopCloser(bytes.NewReader(data))}
+			defer bodyReader.Close()
+			r.Request.Body = bodyReader
+			r.Request.ContentLength = int64(len(data))
+			return r.Next()
+		})
+		return e.Next()
+	})
+}

package/otp/otp_test.go

@@ -0,0 +1,56 @@
+package otp
+
+import (
+	"fmt"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestPasswordCallbackKeepsNativeSingleUse(t *testing.T) {
+	a, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer a.Cleanup()
+	c, _ := a.FindCollectionByNameOrId("users")
+	c.OTP.Enabled = true
+	c.MFA.Enabled = false
+	if err = a.Save(c); err != nil {
+		t.Fatal(err)
+	}
+	rs, err := a.FindRecordsByFilter(c.Id, "", "", 1, 0)
+	if err != nil || len(rs) == 0 {
+		t.Fatal(err)
+	}
+	o := core.NewOTP(a)
+	o.SetCollectionRef(c.Id)
+	o.SetRecordRef(rs[0].Id)
+	o.SetPassword("123456")
+	if err = a.Save(o); err != nil {
+		t.Fatal(err)
+	}
+	Register(a, func(r *Request) error {
+		if r.Password == "mapped" {
+			r.Password = "123456"
+		}
+		return nil
+	})
+	router, _ := apis.NewRouter(a)
+	if err = a.OnServe().Trigger(&core.ServeEvent{App: a, Router: router}); err != nil {
+		t.Fatal(err)
+	}
+	h, _ := router.BuildMux()
+	for i, want := range []int{200, 400} {
+		r := httptest.NewRequest("POST", "/api/collections/"+c.Id+"/auth-with-otp", strings.NewReader(fmt.Sprintf(`{"otpId":%q,"password":"mapped"}`, o.Id)))
+		r.Header.Set("Content-Type", "application/json")
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, r)
+		if w.Code != want {
+			t.Fatalf("attempt %d got %d: %s", i, w.Code, w.Body.String())
+		}
+	}
+}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@x47base/pocketbase-addon",
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test security/ui/*.test.mjs",
+    "check": "./scripts/check.sh"
+  },
+  "files": [
+    "*.go",
+    "go.mod",
+    "go.sum",
+    "admin",
+    "backups",
+    "cmd",
+    "features",
+    "internal",
+    "jsvm",
+    "loadtest",
+    "localization",
+    "mail",
+    "migration",
+    "otp",
+    "security",
+    "settings",
+    "watcher",
+    "web",
+    "bin",
+    "scripts",
+    "README.md",
+    "MIGRATION.md",
+    "FEATURES.md",
+    "LICENSE.md",
+    "NOTICE.md",
+    "edge",
+    "Dockerfile",
+    ".dockerignore",
+    "deploy"
+  ],
+  "license": "MIT",
+  "description": "PocketBase add-on: security dashboard, encrypted backups and development extensions",
+  "bin": {
+    "pocketbase-extension": "bin/pocketbase-extension.mjs"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/check-edge.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""Finite loopback-only rejection smoke; no database writes or credentials."""
+import argparse
+import concurrent.futures
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+
+parser = argparse.ArgumentParser()
+parser.add_argument('--public', default='http://127.0.0.1:8080')
+parser.add_argument('--operator', default='http://127.0.0.1:8081')
+args = parser.parse_args()
+for origin in (args.public, args.operator):
+    url = urllib.parse.urlsplit(origin)
+    if url.scheme != 'http' or url.hostname not in ('127.0.0.1', '::1') or url.username or url.password or url.path not in ('', '/') or url.query or url.fragment:
+        parser.error('Use a plain loopback HTTP origin')
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None
+opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), NoRedirect())
+def get(url):
+    try:
+        with opener.open(url, timeout=5) as response:
+            return response.status, response.read(65536)
+    except urllib.error.HTTPError as error:
+        return error.code, error.read(65536)
+code, body = get(args.operator + '/edge/status')
+assert code == 200, 'operator status unavailable'
+before = json.loads(body)
+assert before['policyReady'] and before['upstreamHealthy'], 'gateway not ready'
+with concurrent.futures.ThreadPoolExecutor(max_workers=8) as pool:
+    codes = list(pool.map(lambda _: get(args.public + '/_/')[0], range(200)))
+assert all(code == 403 for code in codes), set(codes)
+assert get(args.operator + '/edge/healthz')[0] == 204
+assert get(args.operator + '/edge/readyz')[0] == 204
+code, body = get(args.operator + '/edge/status')
+after = json.loads(body)
+assert after['rejected'] - before['rejected'] >= 200
+print(json.dumps({'blockedRequests': len(codes), 'healthCanary': 'passed',
+                  'publicAcceptedDelta': after['accepted'] - before['accepted'],
+                  'note': 'Zero accepted delta expected on an otherwise idle instance.'}))

package/scripts/check.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+export GOWORK=off
+module=$(go list -m -f '{{.Version}} {{if .Replace}}REPLACED{{end}}' github.com/pocketbase/pocketbase)
+case "$module" in *REPLACED*) echo 'Compatibility checks must use unmodified upstream PocketBase' >&2; exit 1;; esac
+go test ./...
+go test -race ./edge ./security ./features ./localization ./loadtest ./backups ./settings ./mail ./admin ./otp ./watcher
+go vet ./...
+node --test security/ui/*.test.mjs
+go build -o /tmp/spink-pocketbase-check ./cmd/pocketbase
+go build -o /tmp/spink-edge-check ./cmd/edge

package/scripts/sync-jsvm-types.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+export GOWORK=off
+upstream_dir=$(go list -m -f '{{.Dir}}' github.com/pocketbase/pocketbase)
+python3 - "$upstream_dir/plugins/jsvm/internal/types/generated/types.d.ts" <<'PY'
+from pathlib import Path
+import sys
+source = Path(sys.argv[1])
+Path('jsvm/internal/types/generated/types.d.ts').write_text('\n'.join(line.rstrip() for line in source.read_text().splitlines()) + '\n')
+PY

package/security/README.md

@@ -0,0 +1,94 @@
+# Request protection for custom PocketBase binaries
+
+Register once before serving:
+
+```go
+config := security.DefaultConfig()
+config.Mode = "observe" // disabled, observe, enforce
+statePath, err := filepath.Abs(filepath.Join(app.DataDir(), "security", "state.json"))
+if err != nil { return err }
+config.StatePath = statePath
+if err := security.Register(app, config); err != nil { return err }
+```
+
+The standard binary is unchanged. `cmd/pocketbase` registers this plugin and
+accepts `PB_SECURITY_MODE`. `observe` reports decisions without rejecting requests;
+`enforce` applies global and verified-identity token buckets, concurrent request
+limits, separate write/file/realtime lanes, weighted batch size and per-client plus
+aggregate subscription limits. Batch weights and subscription reservations release
+on completion/failure/disconnect. Realtime messages receive a ten-second write
+deadline where supported. Authenticated users behind the same NAT have independent
+identity budgets; a global pre-authentication budget bounds total admission.
+Unauthenticated clients share a source budget. Identity storage is capped and uses
+process-local HMAC fingerprints; excess identities share an overflow bucket.
+Forwarded addresses are considered only for configured immediate proxy peers.
+
+Detection evaluates ten-second windows. Three consecutive high-rejection,
+authentication-failure or combined slow/failing windows open a suspected incident.
+Six clear windows resolve it. Legitimate load or client errors can trigger these
+patterns. The detector never installs blocking actions automatically. History is
+capped at 256 incidents. Missing traffic is not independent evidence of recovery;
+these are heuristic state transitions, not validated attack classification.
+
+## Management
+
+Open `/_/#/security` through the Security tab after signing into the admin dashboard. It reuses the dashboard SDK session without copying tokens. Extension assets are public; APIs still require a superuser and an immediate peer in `ManagementPeers` (loopback by default). Logout/unmount cancels polling and discards old-session responses.
+Four concurrent management requests have a separate admission lane.
+
+| Route | Behavior |
+| --- | --- |
+| GET `/api/security/status` | Mode, counters, active lanes, actions, subscriptions and checkpoint health |
+| GET `/api/security/incidents?limit=50&after=0` | Ascending ID cursor, maximum 100 items, `nextCursor: 0` at end |
+| GET `/api/security/policy/snapshot` | Atomic policy and revision pair for the dashboard |
+| GET `/api/security/policy` | Current configuration; numeric revision in ETag |
+| PUT `/api/security/policy` | Validated replacement with matching numeric If-Match; stale updates return 409 |
+| POST `/api/security/incidents/{id}/acknowledge` | Idempotent acknowledgement |
+| POST `/api/security/actions` | Replace temporary block for one family |
+| DELETE `/api/security/actions/{family}` | Cancel an existing block; missing action returns 404 |
+
+Action body: `family`, `reason` (1–200 bytes), RFC3339 `expiresAt` in the next
+15 minutes. Families: auth, reads, writes, files, realtime, other. Actions apply only
+in enforce mode. Policy changes, acknowledgements, action changes/cancellation log
+operator identity. No endpoint exports a raw request body, token or query.
+
+Optional `StatePath` writes atomic private checkpoints every ten seconds, after
+management mutations and on shutdown. Validated policy, revision, incidents and
+unexpired actions survive restart; startup mode always wins. Corrupt/missing state
+falls back to startup configuration, with corruption reported as `storageDegraded`.
+Writes are best effort; an active policy can precede a failed disk write. This is
+not a transactional audit journal. Request counters/identities are process-local.
+
+## Boundaries
+
+See [deployment and recovery guidance](../deploy/README.md). Edge
+bandwidth exhaustion requires provider/network protection. No production capacity
+profile, distributed DDoS proof, automatic incident-driven blocking, external
+telemetry exporter or calibrated detector is supplied. Observe mode deliberately
+permits traffic beyond configured limits; it does not claim an enforcement ceiling.
+The original larger acceptance plan remains in the root repository’s `specs/001-security-expansion` with
+unfulfilled release evidence explicitly open.
+
+## Disposable database simulation
+
+```sh
+go run ./cmd/loadtest -sandbox -dry-run -rate 200 -clients 8 -duration 3s -requests 400 -normal-every 10
+go run ./cmd/loadtest -sandbox -mode enforce -rate 200 -clients 8 -duration 3s -requests 400 -normal-every 10
+```
+
+The sandbox creates 5,000 records in a temporary SQLite database, serves read-only
+`pb_sim_records` on an ephemeral loopback port, then stops and removes the fixture.
+Every tenth scheduled request above is a health canary in the same total budget.
+Canaries share the unauthenticated source budget; a rejected canary is a measured
+availability failure, not counted as success. The sandbox binds admission middleware;
+it does not exercise batch hooks or subscription operations.
+
+Without `-sandbox`, accepted literal-loopback HTTP paths are `/api/health`,
+`/api/realtime`, and `/api/collections/pb_sim_records/records`. No credentials,
+writes, retries, redirects, proxies, external hosts or query parameters. Maximums:
+512 clients, 10,000 requests/s, 10 minutes, one million sent requests. Interrupt
+cancels in-flight requests. Successful JSON bodies and SSE connection data are
+validated; bodies are bounded. JSON reports response classes, 429/503, errors,
+dropped scheduling slots, offered/sent counts, canary success and latency buckets.
+`offered = sent + dropped`; dropped slots indicate generator saturation. Duration
+includes request drain/cancellation; normal duration expiry is not an interruption.
+This is a finite local capacity tool, not a distributed attack engine.