mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-10-29 08:11:32 +00:00
TT
666a5c6f87
The redeem failure counter used INCR followed by Expire(24h) on every attempt, so each failed attempt refreshed the key TTL and the window never actually closed for a user who kept retrying within 24h. - Count attempts in a fixed 10-minute window via a small Lua script (INCR, then PEXPIRE only when the key is created or has no TTL), which is atomic and also repairs keys that lost their TTL. - Move the counter to the redeem:ratelimit:v2: key space so pre-existing 24h counters do not seed the new window. - Rename the service threshold to redeemMaxFailedAttempts (30) to reflect that it bounds attempts per window, not per hour. Public redeem behavior is unchanged apart from the window semantics: the check fails open when the counter read fails, and a failed increment never masks the underlying domain error.