Struct SeenNonces 

pub struct SeenNonces { /* private fields */ }

The nonces already spent, so a ticket is single use.

A ring and not a set: the thing that writes to it is a verified ticket with a bounded life, so what has to be remembered is one life’s worth of them and never the whole history. MAX_LIFE_MS is ten minutes; a box selling a renewal a second for ten minutes fills six hundred slots.

In memory, and that is a stated limit rather than an oversight. A monetize that restarts forgets, and a ticket replayed across that restart would be admitted — within its ten-minute life, by somebody who had already captured it, to buy the tenant it already names another period of the same subscription. The exposure is one duplicate renewal of the attacker’s own account, and Purchase.Start is idempotent on its reference anyway (<product>/<tenant>/<date>), so the second one is the same order. Making it durable would mean a table, and a table is worth its cost when the thing it prevents is worth more than a repeated no-op.

Implementations

impl SeenNonces

pub fn with_capacity(cap: usize) -> SeenNonces

pub fn admit(&self, nonce: &str) -> bool

Record this nonce and say whether it was new. false means it has been spent and the ticket must be refused.

Trait Implementations

impl Debug for SeenNonces

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SeenNonces

fn default() -> SeenNonces

Returns the “default value” for a type.