mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
fe1b12042d
The login throttle was one counter for everyone, so a stranger failing on purpose every thirty seconds kept the owner on 429s too. A browser that logs in now gets a signed diary_device cookie (__Host- over HTTPS, SameSite=Strict, 400 days), and a login carrying a valid one is slowed only by its own throttle. Everything else shares the anonymous one, as before. At most 64 known browsers are tracked; the least recently used is forgotten first. The failed-login mail says which kind of browser the failures came from.
34 lines
1.1 KiB
Rust
34 lines
1.1 KiB
Rust
use std::sync::{atomic::AtomicI64, Arc};
|
|
|
|
use sqlx::SqlitePool;
|
|
|
|
use crate::{
|
|
auth::Sessions,
|
|
backup::Backup,
|
|
config::Config,
|
|
notify::Notifier,
|
|
throttle::{LoginThrottle, LoginThrottles},
|
|
vault::Vault,
|
|
};
|
|
|
|
#[derive(Clone)]
|
|
pub struct AppState {
|
|
pub db: SqlitePool,
|
|
pub config: Arc<Config>,
|
|
pub login_throttle: Arc<LoginThrottles>,
|
|
/// The vault password gets the same slowing-down as the login, kept apart
|
|
/// so guessing at one does not slow the other.
|
|
pub vault_throttle: Arc<LoginThrottle>,
|
|
/// Sealed files. Always present; holds no key until it is unlocked.
|
|
pub vault: Arc<Vault>,
|
|
/// The Proton Drive mirror. Always present; dormant until it has a session.
|
|
pub backup: Arc<Backup>,
|
|
/// Notification mail. Always present; dormant until WORKSPACE_SMTP_URL is set.
|
|
pub notify: Arc<Notifier>,
|
|
/// Signed into every session cookie, which must carry the current value
|
|
/// to be accepted; see [`crate::auth::Epoch`].
|
|
pub epoch: Arc<AtomicI64>,
|
|
/// Every signed-in browser; a cookie is good only while its row is here.
|
|
pub sessions: Arc<Sessions>,
|
|
}
|