pub type Policy {
  Policy(
    session_seconds: Int,
    session_renew_seconds: Int,
    session_max_seconds: Int,
    session_idle_seconds: Int,
    fresh_session_seconds: Int,
    challenge_seconds: Int,
    live_challenges: Int,
    email_coalesce_margin_seconds: Int,
    email_cooldown_seconds: Int,
    email_cooldown_max_seconds: Int,
    email_quiet_seconds: Int,
    password_attempts: Int,
    password_account_attempts: Int,
    password_backoff_max_seconds: Int,
    password_quiet_seconds: Int,
    password_window_seconds: Int,
    password_min_length: Int,
  )
}

Constructors

• Policy(
    session_seconds: Int,
    session_renew_seconds: Int,
    session_max_seconds: Int,
    session_idle_seconds: Int,
    fresh_session_seconds: Int,
    challenge_seconds: Int,
    live_challenges: Int,
    email_coalesce_margin_seconds: Int,
    email_cooldown_seconds: Int,
    email_cooldown_max_seconds: Int,
    email_quiet_seconds: Int,
    password_attempts: Int,
    password_account_attempts: Int,
    password_backoff_max_seconds: Int,
    password_quiet_seconds: Int,
    password_window_seconds: Int,
    password_min_length: Int,
  )

  Arguments

  session_seconds

  Session lifetime: absolute, unless session_renew_seconds extends it.

  session_renew_seconds

  Sliding renewal. When a session is used and at least this long has passed since its expiry was last set, the expiry moves to session_seconds from now. Zero, the default, disables renewal; otherwise at least 60 and less than session_seconds. With a week-long session, 86_400 keeps anyone who returns within a week signed in, at the cost of one extra write per session per day.

  session_max_seconds

  Hard ceiling on a renewed session, measured from its creation: however active, it ends then. Zero means no ceiling; otherwise at least session_seconds. Set one whenever renewal is on unless sessions really should be able to live forever.

  session_idle_seconds

  Revoke a session unused for this long. Zero disables the idle timeout; otherwise at least 300, because last use is recorded once a minute.

  fresh_session_seconds

  How recently a session must have been created by an email-token exchange for it to set or replace a password.

  challenge_seconds

  Lifetime of an emailed token.

  live_challenges

  Unexpired emailed tokens kept per address. A new request discards only the oldest beyond this, so it cannot invalidate a token in transit.

  email_coalesce_margin_seconds

  A token request sends nothing when the address already has a live token with at least this long left; the caller still receives success, because a usable token is already in that inbox. This is what stops a third party both flooding an inbox and locking its owner out: whoever asks, the owner ends up with exactly one live token. Raising it sends more email and allows a sooner resend; challenge_seconds disables coalescing entirely.

  email_cooldown_seconds

  Wait after the first email to an address. It doubles with every further request, up to email_cooldown_max_seconds.

  email_quiet_seconds

  The doubling starts over once an address has been left alone this long after its cooldown ended. A successful exchange resets it immediately.

  password_attempts

  Initial guesses per client/address before exponential back-off.

  password_account_attempts

  High shared ceiling per address; the lower budget is per client/address.

  password_min_length

  Minimum new password length in Unicode code points.