Repository navigation
[Security]: Use a distributed rate limiter for portal login attempts #24
Description
Problem
The portal login limiter is process-local, so counters reset across serverless instances and cold starts.
Scope
- Move login throttling to shared production storage with atomic updates.
- Use a privacy-safe bounded key and expiry.
- Keep deterministic in-memory behavior for local/test environments where appropriate.
- Define explicit fail-safe behavior when shared storage is unavailable.
- Do not change the accepted Device-ID configuration delivery model.
Acceptance
- Concurrent attempts across simulated instances share one limit.
- Expiry, successful-login reset and storage failure behavior are tested.
- No raw password, session token or unnecessary full IP address is stored.
- Portal tests, typecheck and production build pass.
- Production deployment and unauthenticated smoke check succeed after merge.
Activity
awatchar commentedon Aug 24, 2026
Implementation started on branch fix/lab-correctness-batch. The design is being checked against the current Vercel/Cloudflare storage architecture so the limiter is genuinely shared across serverless instances, not another process-local counter.
awatchar commentedon Aug 24, 2026
Implementation update: a dedicated production D1 database has been created and migration 0001 applied. The exact atomic UPSERT/RETURNING contract was exercised in Cloudflare D1 Console against a temporary HMAC-shaped bucket and the probe row was deleted afterward. Local web tests (120/120), TypeScript, and production build pass. Independent review identified two hardening items now being addressed before PR/deploy: do not advance the account bucket after a client is already blocked, and bound expired bucket-row retention. Production token/HMAC environment provisioning and concurrent REST acceptance remain pending the required action-time secret authorization.
awatchar commentedon Aug 24, 2026
Implementation is ready in PR #26, but must not be merged/deployed yet because production intentionally fails closed until its three Vercel variables are installed.
What changed:
The production D1 schema, index, trigger and exact UPSERT/RETURNING behavior have been created and live-probed. Portal verification passes 124 tests, TypeScript and production build.
Remaining operational gate: provision
CLOUDFLARE_D1_DATABASE_ID, a least-privilegeCLOUDFLARE_D1_API_TOKEN, andLOGIN_RATE_LIMIT_KEY_SECRETin Vercel, deploy, then smoke-test 429/503/login behavior.awatchar commentedon Aug 24, 2026
Production activation completed after PR #26 merge.
Closing because implementation, deployment, and smoke acceptance are complete.