Module refusal 

Refused OAuth and XRPC requests, as the journal says them.

A refusal is one line at info or warn: the endpoint, the client, the account when the refusing code knows it, the error the caller was sent, and the reason. A token, a code or an assertion is never one of those fields.

Refusals are volume a caller drives, so repeats collapse the way didbot_pds::evaluation_log collapses denials. The first refusal of a kind is written at once. The rest within WINDOW are counted, and the count is written as one the same refusal repeated line when the window closes. A kind is the endpoint, client, account, error and reason together.

A caller who varies the kind on every request meets two more bounds: MAX_OPEN kinds are tracked at once, the least recent closing first, and at most FRESH_PER_MINUTE new kinds of each class are written each minute. A class is the severity, the endpoint and the error together. Past that, refusals are counted, and the count is written when the minute ends.

Each class has its own budget, so a flood fills only its own. A caller with no grant can send /oauth/par a new client_id on every request, and fill the warn budget for invalid_client there. The warn lines for a reused refresh token or a mismatched DPoP key come from /oauth/token as invalid_grant and invalid_dpop_proof, which only a real grant reaches, so they are still written.

Macros

at 🔒

Structs

Budget 🔒

One class’s share of a minute.

Class 🔒

What shares one budget: the severity, the endpoint and the error. error is None for the errors at an endpoint past MAX_CLASSES.

Kind 🔒

Refusal 🔒

One refused request, as the code that refused it describes it.

RefusalLog 🔒

The collapsing state behind refused. Its own type so a test can run one against a clock it controls.

State 🔒

Window 🔒

Enums

Line 🔒

A line to write once the lock is released.

Recorded 🔒

What RefusalLog::record did with one refusal.

Severity 🔒

How loudly a refusal is written.

Constants

FRESH_PER_MINUTE 🔒

How many refusals of a kind not already open are written in a minute, for each class.

MAX_CLASSES 🔒

How many classes get a budget of their own in a minute. Error names come from this server’s code, so this is far more than are ever met. Past it, the rest at an endpoint share one budget.

MAX_FIELD_CHARS 🔒

The longest a client id, account or reason is written. Each comes from the caller in some part, and a line is not the place to store a megabyte of it.

MAX_OPEN 🔒

How many kinds are tracked at once.

MINUTE 🔒

WINDOW 🔒

How long repeats of one kind collapse into the line that opened it.

Statics

REFUSALS 🔒

Functions

clipped 🔒

flush 🔒

Writes the count of every window that has closed, and of a minute’s unwritten refusals once it has ended. The health tick calls this, so a burst that stops is still counted in the journal.

refused 🔒

Writes refusal to the journal, or counts it against a line already written.

write 🔒