Struct LoginLimiter 

pub struct LoginLimiter { /* private fields */ }

Fixed-window failed-login counter, keyed by client address.

In-process on purpose: it protects a listener that defaults to loopback and holds a handful of accounts, and a database-backed counter would add a write to the very path being flooded.

Implementations

impl LoginLimiter

pub fn new(max_attempts: u32, window_seconds: u64) -> Self

pub fn rebuilt(&self, max_attempts: u32, window_seconds: u64) -> Self

The same counters under new limits.

A configuration reload rebuilds the admin router, and with it every value AdminState derives from [admin] — which for this type would mean starting from an empty map. That is a security regression, not a cosmetic one: a reload in the middle of a brute-force attempt would clear the attacker’s backoff, and admin.login_* is exactly the sort of key an operator edits because they are being flooded.

Carrying the whole limiter across instead would be the other error, leaving login_max_attempts and login_window_seconds silently stale. So the counters move and the limits do not.

pub fn check(&self, client: Option<IpAddr>) -> Result<(), u64>

Whether this address may attempt a login now. Err carries the seconds left in the window.

Called before the password hash runs: 600 000 iterations is a denial-of-service lever, so a limited caller must not pay it — nor make the server pay it.

pub fn record_failure(&self, client: Option<IpAddr>)

Records a failed attempt.

pub fn record_success(&self, client: Option<IpAddr>)

Clears an address’s counter after a successful login, so one operator fumbling their password does not spend the window for the next.

Trait Implementations

impl Debug for LoginLimiter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.