mirror of
https://github.com/nestriness/nestri.git
synced 2026-11-08 16:32:27 +02:00
Wanjohi
7c200ff092
The send budget was keyed by every submitted form field, so adding a field with a new value each time made a fresh budget, and one mailbox could be sent codes without limit. A claim is now built only from the claim fields (email, phone by default); anything else is dropped before it is counted and before it reaches sendCode. A budget per mailbox does nothing against a caller holding a list of addresses: each send goes to a different stranger, and the deployment's whole sending allowance goes with them. Add a second budget per requesting address, 10 codes per 24 hours by default. The window is a day rather than an hour because a caller that paces itself stays under any hourly figure a person would also fit under. The address lookup the device flow used is moved into util so both read the caller the same way.