Struct RateLimitConfig 

pub struct RateLimitConfig {

    pub enabled: bool,
    pub auth_start_max_requests: u32,
    pub auth_start_window_secs: u64,
    pub auth_callback_max_requests: u32,
    pub auth_callback_window_secs: u64,
    pub auth_refresh_max_requests: u32,
    pub auth_refresh_window_secs: u64,
    pub auth_logout_max_requests: u32,
    pub auth_logout_window_secs: u64,
    pub auth_otp_send_max_requests: u32,
    pub auth_otp_send_window_secs: u64,
    pub auth_otp_verify_max_requests: u32,
    pub auth_otp_verify_window_secs: u64,
    pub auth_password_max_requests: u32,
    pub auth_password_window_secs: u64,
    pub auth_anonymous_signup_max_requests: u32,
    pub auth_anonymous_signup_window_secs: u64,
    pub auth_rules_enabled: bool,
    pub failed_login_max_requests: u32,
    pub failed_login_window_secs: u64,
    pub requests_per_second: u32,
    pub burst_size: u32,
    pub trust_proxy_headers: bool,
    pub trusted_proxy_cidrs: Vec<String>,
    pub max_buckets: usize,
}

Rate limiting configuration

Fields

enabled: bool

Enable rate limiting

auth_start_max_requests: u32

Max requests for auth start endpoint (per IP)

auth_start_window_secs: u64

Time window for auth start in seconds

auth_callback_max_requests: u32

Max requests for auth callback endpoint (per IP)

auth_callback_window_secs: u64

Time window for auth callback in seconds

auth_refresh_max_requests: u32

Max requests for auth refresh endpoint (per user)

auth_refresh_window_secs: u64

Time window for auth refresh in seconds

auth_logout_max_requests: u32

Max requests for auth logout endpoint (per user)

auth_logout_window_secs: u64

Time window for auth logout in seconds

auth_otp_send_max_requests: u32

Max OTP send requests (/auth/v1/otp) per client per window

auth_otp_send_window_secs: u64

Time window for OTP send in seconds

auth_otp_verify_max_requests: u32

Max OTP verify requests (/auth/v1/verify) per client per window

auth_otp_verify_window_secs: u64

Time window for OTP verify in seconds

auth_password_max_requests: u32

Max requests per client per window to each local-password endpoint

auth_password_window_secs: u64

Time window for the local-password endpoints in seconds

auth_anonymous_signup_max_requests: u32

Max anonymous signups (/auth/v1/signup) per client per window

auth_anonymous_signup_window_secs: u64

Time window for anonymous signup in seconds

auth_rules_enabled: bool

Apply the per-client auth endpoint rules. On unless written false; the rules run whether or not enabled turns the global limit on.

failed_login_max_requests: u32

Max failed login attempts per IP.

Emitted as the consumer’s failed_login_max_attempts. The binary performs no first-factor login, so a value tuned away from the default is refused at boot in production (#356) — hence the default matching the consumer’s, so an untouched config signals no intent and boots.

failed_login_window_secs: u64

Time window for failed login tracking in seconds. See failed_login_max_requests.

requests_per_second: u32

Global per-IP request rate (requests/second) for the GraphQL surface.

burst_size: u32

Burst allowance above requests_per_second.

trust_proxy_headers: bool

Trust X-Real-IP / X-Forwarded-For for the client IP.

Only safe behind a proxy named in trusted_proxy_cidrs; the server refuses to boot in production if this is on and that list is empty (#618).

trusted_proxy_cidrs: Vec<String>

CIDR ranges trusted as proxies, e.g. ["10.0.0.0/8"].

max_buckets: usize

Maximum tracked rate-limit buckets per map — a memory ceiling, not a security control (#1171). ~200 bytes a bucket, so the default is about 20 MiB per map. Reaching it evicts the least-recently-used entry rather than refusing the new client, so a low value costs accuracy and never availability.

Implementations

impl RateLimitConfig

pub fn validate(&self) -> Result<()>

Validate rate limiting configuration

Errors

Returns an error if any time-window is zero or if any max_requests value is zero (which would permanently block all requests).

pub fn to_json(&self) -> Value

Convert to JSON representation for schema

Trait Implementations

impl Clone for RateLimitConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RateLimitConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RateLimitConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RateLimitConfig

where RateLimitConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for RateLimitConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.