LoginGuard — Brute-force Protection

effective_key automatically determines the right key based on whether a username was submitted:

• Username submitted → key by account (targeted protection)
• Empty username → "anonym:{ip}" (per-IP protection, independent counters)

use axum::Extension;
use runique::middleware::security::trusted_proxies::ClientIp;
use runique::prelude::*;
use std::sync::LazyLock;

static GUARD: LazyLock<LoginGuard> = LazyLock::new(|| {
    LoginGuard::new()
        .max_attempts(5)
        .lockout_secs(300)
});

pub async fn sign_in(
    client_ip: Option<Extension<ClientIp>>,
    mut request: Request,
) -> AppResult<Response> {
    let form: LoginForm = request.form("login");
    let validated = match ValidationForm::try_form(form, &request).await {
        Ok(validated) => validated,
        Err(form) => {
            context_update!(request => { "login_form" => &form });
            return request.render("login.html");
        }
    };
    let username = validated.cleaned::<String>("username").unwrap_or_default();
    let password = validated.cleaned::<String>("password").unwrap_or_default();
    // The real client IP, resolved by the trusted proxies middleware
    let ip = client_ip.map(|Extension(ClientIp(ip))| ip.to_string()).unwrap_or_default();

    // username submitted → "alice"  |  empty username → "anonym:1.2.3.4"
    let key = LoginGuard::effective_key(&username, &ip);

    if GUARD.is_locked(&key) {
        let remaining = GUARD.remaining_lockout_secs(&key).unwrap_or(0);
        return Ok((StatusCode::TOO_MANY_REQUESTS, format!("Try again in {remaining}s")).into_response());
    }

    if let Some(user) = authenticate_user(&request.engine.db, &username, &password).await
        && login(&request.session, &user, None, false).await.is_ok()
    {
        GUARD.record_success(&key);
        return Ok(Redirect::to("/dashboard").into_response());
    }

    GUARD.record_failure(&key);
    context_update!(request => {
        "login_form" => &*validated,
        "messages" => flash_now!(error => "Invalid credentials"),
    });
    request.render("login.html")
}

LoginGuard::new().max_attempts(5).lockout_secs(300)    // 5 failures → 5 minute lockout
LoginGuard::new().max_attempts(3).lockout_secs(900)    // 3 failures → 15 minute lockout
LoginGuard::new().max_attempts(10).lockout_secs(3600)  // 10 failures → 1 hour lockout

Both mechanisms cover different attack vectors and are complementary:

static IP_LIMITER: LazyLock<RateLimiter> = LazyLock::new(|| RateLimiter::new().max_requests(10).retry_after(60));
static GUARD:      LazyLock<LoginGuard>  = LazyLock::new(|| LoginGuard::new().max_attempts(5).lockout_secs(300));

// In the sign-in handler above, before authenticating:

// 1. Volume per IP → RateLimiter (as middleware on the route, or by hand)
if !IP_LIMITER.is_allowed(&ip) { /* 429 */ }

// 2. Brute force per account or anonymous IP → LoginGuard
let key = LoginGuard::effective_key(&username, &ip);
if GUARD.is_locked(&key) { /* 429 */ }

// 3. Authentication: authenticate_user, then record_success / record_failure