Authly::InMemoryAttemptLimiter

What increment answers for a new key while the limiter is full of live keys.

Keys kept at most. A flood of distinct keys (spoofed sources, random user codes) cannot grow the hash without bound: when it is full, expired keys are swept first; if every key is still live, a NEW key is not counted and increment answers FULL, so callers refuse (fail closed). A live counter is never dropped to make room: that would let an attacker reset their own count by flooding the limiter with other keys.

Every this many writes, once at least SWEEP_THRESHOLD keys exist, expired ones are removed.

true when key has been counted limit times or more within its window

Count one event for key and answer how many events the key has now within its window. The window starts with the first event and the count is forgotten window later. A limiter that cannot count (it is full of live keys) answers a count no limit reaches, so the caller refuses: it fails closed.