Authly::AttemptLimiter
Counts events per key inside a window, to throttle guessing (device user codes) and abuse
(dynamic client registration). Pluggable like StateStore: with more than one node the limiter has to be shared,
otherwise every node counts for itself.
The handlers count with increment, which counts and reads in ONE step: asking exceeded? and then recording
lets a burst of parallel requests all pass the check before any of them is counted. A shared limiter must make
increment atomic (Redis: INCR key, then EXPIRE key window when the answer is 1; or one Lua script) and
exceeded? a plain read of the same counter. record is increment without the answer.
Instance methods
true when key has been counted limit times or more within its window
Count one event for key and answer how many events the key has now within its window. The window starts with
the first event and the count is forgotten window later. A limiter that cannot count (it is full of live keys)
answers a count no limit reaches, so the caller refuses: it fails closed.