Ilia Denisov 2207ac6132 feat(account): throttle confirm-code sends per recipient ...

Add an in-memory SendLimiter enforcing a one-per-minute cooldown and a
five-per-rolling-hour cap per recipient address, checked before provisioning or
sending in RequestCode, RequestLoginCode and RequestLinkCode. It guards against
email bombing and protects the relay quota. The limiter is injected in main
(nil in tests, so the domain suite is unaffected); ErrTooManyRequests maps to
HTTP 429.

2026-07-03 03:02:49 +02:00

..

main.go

feat(account): throttle confirm-code sends per recipient

2026-07-03 03:02:49 +02:00