GovOPlaN/govoplan-core
1
0
Fork 0
Code Issues 44 Pull Requests Actions Packages Projects Releases Wiki Activity
Page: Repo docs THROTTLING
Pages
Codex Project Index Product govoplan split concept action plan Repo-README Repo README Repo docs ACCESS RBAC MODEL Repo docs ACTION EFFECT AUTOMATION LAYER Repo docs AUTOMATION CONTRACTS Repo docs CODEX WORKFLOW Repo docs CONFIGURATION PACKAGES Repo-docs-DEPENDENCY-AUDITS Repo docs DEPENDENCY AUDITS Repo docs DEPLOYMENT OPERATOR GUIDE Repo-docs-DOCUMENTATION-MAP Repo docs DOCUMENTATION MAP Repo docs EVENTS AND AUDIT Repo docs GITEA ISSUES Repo docs GOVERNANCE MODEL Repo docs GOVOPLAN MASTER ROADMAP Repo docs INTERFACE ETHICS AND DESIGN DOCTRINE Repo-docs-MODULE-ARCHITECTURE Repo docs MODULE ARCHITECTURE Repo docs POLICY CONTRACTS Repo docs POSTBOX E2EE ARCHITECTURE Repo docs PUBLIC SECTOR INTEGRATION STRATEGY Repo-docs-RELEASE-DEPENDENCIES Repo docs RELEASE DEPENDENCIES Repo docs REMOTE WEBUI BUNDLES Repo docs SECURITY AUDIT Repo docs SELF HOSTED INSTALLABILITY Repo docs THROTTLING Repo docs UI UX DECISION LEDGER Repo-docs-audits-2026-07-09-dependency-audit Repo docs audits 2026 07 09 dependency audit
Clone
1
Repo docs THROTTLING
Albrecht Degering edited this page 2026-07-28 15:08:25 +02:00
Table of Contents

Mirrored from /mnt/DATA/git/govoplan-core/docs/THROTTLING.md. Origin: repository. Active tasks and changing state belong in Gitea issues; this wiki page is durable project context.

Shared fixed-window throttling

Core exposes govoplan_core.core.throttling for security-sensitive endpoints that need bounded fixed-window counters. Subjects are SHA-256 hashed before they become store keys. A configured Redis instance provides atomic counters shared across API workers; development, a missing Redis configuration, and temporary Redis outages use a bounded process-local fallback. When Redis fails, local attempts are still mirrored so losing the distributed store does not reset the active worker's protection window.

Callers define one or more ThrottleDimension values with a controlled namespace, a subject and a positive limit. They must call check before an expensive verifier, record after a failed attempt, and may reset the relevant dimension after successful verification. A blocked decision includes a retry_after_seconds value suitable for an HTTP Retry-After header.

The first consumer is Scheduling's anonymous participation password challenge. Its namespace is poll-participation-password; its subject combines tenant, scheduling request and Poll's non-secret invitation-token fingerprint. Access's login throttle predates this primitive and should be migrated onto it in a separate compatibility-preserving slice.