mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
ecbffddf19
Create Server/api/constants.go (26 constants) and Server/auth/constants.go (6 constants) for rate limits, timeouts, size limits, and token generation. Replace all inline magic numbers with descriptive names across 9 source files. No behavior changes — same values, just named for contributor readability.
31 lines
1.2 KiB
Go
31 lines
1.2 KiB
Go
package auth
|
|
|
|
import "time"
|
|
|
|
const (
|
|
// ─── Username validation ────────────────────────────────────────────────
|
|
|
|
// minUsernameLength is the minimum number of runes in a username.
|
|
minUsernameLength = 2
|
|
|
|
// maxUsernameLength is the maximum number of runes in a username.
|
|
maxUsernameLength = 32
|
|
|
|
// ─── Token generation ───────────────────────────────────────────────────
|
|
|
|
// sessionTokenBytes is the number of random bytes in a session token (256 bits).
|
|
sessionTokenBytes = 32
|
|
|
|
// opaqueTokenBytes is the number of random bytes in an opaque token (256 bits).
|
|
opaqueTokenBytes = 32
|
|
|
|
// totpSecretBytes is the number of random bytes used to generate a TOTP secret.
|
|
totpSecretBytes = 20
|
|
|
|
// ─── TOTP replay prevention ─────────────────────────────────────────────
|
|
|
|
// usedTOTPCodeTTL is how long a verified TOTP code is remembered to prevent
|
|
// replay attacks (covers the current period +/- 1, ~90 seconds).
|
|
usedTOTPCodeTTL = 90 * time.Second
|
|
)
|