Auth Rate Limits

Auth endpoints are common brute-force and email-flooding targets. The default 100 requests per minute is often too permissive for sign-in and password-reset flows.

AuthTableRateLimits#

Extend AuthTableRateLimits<S, R> in the auth table's rate limits file. Pass the schema ref to super():

import 'package:my_app/src/schemas/users.dart';
import 'package:zonai_schema/zonai_schema.dart';

final class UserRateLimits extends AuthTableRateLimits<UserTable, User> {
  UserRateLimits() : super(users);

  @override
  Future<RateLimitPolicy?> authenticatePolicy() async =>
      const RateLimitPolicy(maxRequests: 10, window: Duration(minutes: 15));

  @override
  Future<RateLimitPolicy?> signInPolicy() async =>
      const RateLimitPolicy(maxRequests: 10, window: Duration(minutes: 15));

  @override
  Future<RateLimitPolicy?> signUpPolicy() async =>
      const RateLimitPolicy(maxRequests: 5, window: Duration(hours: 1));

  @override
  Future<RateLimitPolicy?> sendResetPasswordPolicy() async =>
      const RateLimitPolicy(maxRequests: 5, window: Duration(hours: 1));
}

UserRateLimits main() => UserRateLimits();

AuthTableRateLimits only covers the auth routes. /db reads and writes on the same table are limited by a TableRateLimits for that table (a separate class, in its own file), or by the default if there is none.

Methods That Apply Per Table#

These are looked up on the auth table the request names, so your override takes effect:

All methods are async and return Future<RateLimitPolicy?>. Return null to disable rate limiting for that endpoint.

OTP and magic-link sends go through authenticatePolicy(). POST /auth handles password sign-in and sign-up as well as sending OTP codes and magic links, and every request to it counts against one policy. Tightening it for OTP tightens it for password sign-in on that route too.

Methods That Are Never Consulted#

AuthTableRateLimits also declares these methods, but overriding them has no effect. Either no route checks them, or the route's counter is not tied to a table (see below):

Endpoints That Carry No Table#

Some endpoints are counted per IP under a shared, synthetic key instead of per auth table, because the request does not name a trustworthy table:

A per-table override does not apply to any of these. There is no table to match it against, so the framework limit is what runs.

One Email Per Address Per Minute#

Separately from the per-IP policies, the endpoints that send a code or link refuse a second send to the same address within one minute. This applies to OTP codes, magic links, password resets, verification emails and admin invites. The refusal is a 429 with the body {"error": "Must wait 60 seconds before sending a new code"} and no Retry-After or X-RateLimit-* headers. It cannot be configured.