SA-005 addressed by updateing ratelimiting

2026-08-26 17:03:32 +02:00
parent c70850b44d
commit 27f26e615a
7 changed files with 114 additions and 9 deletions
@@ -957,6 +957,12 @@ Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejec
 ### Assistant outcome
 Implemented and validated SA-004 with centralized Mastodon URL checks, DNS resolution and blocked-range detection, IPv4-mapped IPv6 handling, and no-redirect outbound requests for OAuth, posting, and deletion. The rebuilt container suite passed with 42 tests.

+### User
+Implement SA-005: login endpoint lacks rate limiting and lockout.
+
+### Assistant outcome
+Added persistent IP/email login throttling with a five-failure limit in a 15-minute window, two-minute lockout, `Retry-After` responses, OTP failure coverage, and counter reset after successful authentication. Updated documentation and audit status.
+
 ### User
 Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects.

@@ -1002,5 +1008,11 @@ Made popup authentication states mutually exclusive using the DOM `hidden` prope
 ### User
 The authenticated session text and sign-in block are still shown together.

+### User
+Use the VIBE directory to log interactions
+
+### Assistant outcome
+Appended this visible interaction to the project VIBE chat and prompt logs in the repo’s append-only format.
+
 ### Assistant outcome
 Made popup state transitions defensive by synchronizing both `hidden` attributes and CSS classes. Non-authentication tag-loading errors no longer switch the popup to signed-out state; only a rejected session does. Added `display: none !important` guards for both authentication blocks.