Repository navigation
feat(system-config): add flow_rate_limits and pin the Android origin form - #68
Merged
Merged
Conversation
…form The auth API limits how often one caller may start an OTP, magic link or OAuth flow with constants fixed in code. Those suit a web audience and refuse a mobile one, because carriers put thousands of subscribers behind one address. flow_rate_limits carries the same values as an object key whose defaults are exactly those constants, so a deployment that sets nothing behaves as it did and a partial value fills the flows it leaves out. origins gains a test and a comment for android:apk-key-hash:<base64url>, which z.url() accepts as an opaque URL and native passkeys depend on.
Merged
3 of 4 tasks
13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of the mobile track (fells-code/seamless-templates#40). Consumed by a following
seamless-auth-apiPR that reads these values into its limiters.flow_rate_limits(object, defaulted):windowSeconds(900),otp.perIp(10),otp.perIdentity(5),magicLink.perIp(20),magicLink.perIdentity(5),oauth.perIp(30),oauth.perProvider(10). The defaults are exactly the constants the API has hardcoded insrc/middleware/rateLimit.tstoday, so a deployment that sets nothing behaves as it did, and a partial value fills the flows it leaves out. The patch schema accepts the key. ExportsFlowRateLimitsSchema,FlowRateLimits,DefaultFlowRateLimits.perIpwithout touchingperIdentity.originsgains a comment and a test pinning the Android WebAuthn origin form,android:apk-key-hash:<base64url>. Zod 4'sz.url()accepts it as an opaque URL, and native passkeys depend on that; until now nothing said so, and a future tightening to a hostname check would have broken Android silently.Test plan
npm test: 243 passing (new: defaults, partial fill, rejections, Android origin)npm run typecheck,npm run lint,npm run format:check,npm run build