[schmitch]

Fixes #803

What changed

• Separate network budget. Wrong user codes on /device were counted per client network in the same throttle as the per-session ones, ten per five minutes. That meant one user's typos, or a page opening /device?code=… ten times for a signed-in victim, locked every user behind that NAT out. Without auth.trusted_proxy_cidrs, it locked out every user of the install. The network now has its own throttle, AppState::device_network_throttle, allowing DEVICE_CODES_PER_NETWORK = 100 wrong codes per five minutes. That is still far too few to guess a code out of 20^8. The per-session budget (device_code_throttle) stays at ten per five minutes. A 429's Retry-After comes from whichever throttle refused.
• A linked code is looked up only after a click. /device?code=… (web/src/routes/Device.tsx) now only fills the code in. The page says "Check that this is the code your terminal shows, then continue." and runs the lookup when the user clicks Continue. So a page opened by someone else spends neither the session's budget nor the network's. Approval still needs the click on Approve, as before.
• Docs. docs/deployment.md (Device login, Guessing and The /device page) states both limits and the click.

Tests

• crates/server/tests/device_auth.rs:
  • New wrong_codes_in_one_session_leave_the_network_its_other_sessions: two sessions from one address. Ten wrong codes in one cut that session off with 429, and the other session still looks the code up (200) and approves it (204).
  • New a_network_is_cut_off_after_a_hundred_wrong_codes: ten sessions × ten wrong codes from one address. A fresh session of that network then gets 429 with Retry-After, and another network still finds the code.
  • guessing_a_code_is_cut_off_by_the_rate_limit now expects the network's other session to find the code instead of being refused.
  • Without the server fix (the three source files reset to origin/main), all three fail: left: 429, right: 200 for the colleague's session, and 429 instead of 404 before the hundredth code. With the fix, all 13 tests in the file pass.
• web/src/routes/Device.test.tsx:
  • New test: a linked code is filled in but sends no lookup until Continue is clicked.
  • The existing linked-code tests (deny, sign-in redirect, 404, expired before the click) now click Continue first.
• Checks run: cargo fmt --all --check, cargo clippy -p forge-server --all-targets -- -D warnings, cargo test -p forge-server --lib and --test device_auth (Postgres pulled through mirror.gcr.io), pnpm run tsc, pnpm run test (622 passed), cargo xtask changelog --check.

Changelog

docs/changes/2.2.0/803.fixed.md

---

Generated by Claude Code

[schmitch]

CI test failed in crates/db/tests/encryption.rs: dek_revocation_is_checked_at_commit_time_against_writers (unwrap_err() on Ok). This PR didn't cause it. The PR doesn't touch forge-db, and the same test failed the same way on main at 5812f2b (run 41734827738). The race in that test is #883, and #885 fixed it on main.

I merged main into this branch (512d0b3) to bring in #885. Locally, that test file (13 tests) and device_auth (13 tests) pass, and cargo xtask changelog --check passes.

---

Generated by Claude Code