2e9e8997

Add per-email and per-IPv4 login rate limiting

Replace the global 20-attempt login rate limiter with independent
per-email (max 2) and per-IPv4 (max 4) limits within a 24-hour
sliding window. IPv6 addresses are only limited by email, not by IP.

Thread the client IP from the HTTP request through a new
LoginEmailRequest struct so the rate limiter can enforce IP-based
limits. Extract the client IP from r.RemoteAddr, handling both
"host:port" and bare IP formats. Normalize IPv4-mapped IPv6
addresses (::ffff:x.x.x.x) to their native IPv4 form for
consistent rate limiting.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Agent Instructions

Each run corresponds to one flake attribute. Click a run for its logs and status.

Example: https://nix-ci.com/cb:mtlynch:little-moments/ratelimit-ip-intermediate/2e9e899747fbdabcba7b85a509cc7f6e82cfe50c/c9948197-d2d1-4d5b-87fc-2b5453a9dd73

Wait for suite to complete:

curl --netrc -N https://nix-ci.com/cb:mtlynch:little-moments/ratelimit-ip-intermediate/2e9e899747fbdabcba7b85a509cc7f6e82cfe50c/wait

This page is also available in machine-friendly formats. Request one with the Accept header:

• curl --netrc -H 'Accept: application/json' https://nix-ci.com/cb:mtlynch:little-moments/ratelimit-ip-intermediate/2e9e899747fbdabcba7b85a509cc7f6e82cfe50c
• curl --netrc -H 'Accept: text/markdown' https://nix-ci.com/cb:mtlynch:little-moments/ratelimit-ip-intermediate/2e9e899747fbdabcba7b85a509cc7f6e82cfe50c

For more instructions, fetch https://nix-ci.com/instructions .