2026-08-15 — Legacy rate-limit migration remediation

Context

The exact-current independent review deleg_4357d521 returned a valid five-key JSON verdict with one blocking finding: the new directory-backed rate limiter did not read or migrate the legacy DATA_DIR/ratelimit.json state. A deployment could therefore silently reset persisted brute-force counters.

Remediation

Added a lock-protected, idempotent migration from ratelimit.json into the directory-backed JsonStore.
Preserved the legacy file and write a migration sidecar only after all records are migrated successfully.
Merged existing records instead of overwriting newer counters.
Rejected malformed legacy state and invalid timestamps through the existing fail-closed rate-limit path.
Added a regression for legacy counters so an existing active attempt blocks instead of resetting.
Routed direct by_email() lookups through canonical email validation.
Added regression coverage for deactivate/reactivate auth-version revocation.

Verification

Targeted legacy/auth/rate-limit/password suites: 125 passed.
Backend full suite: 280 passed.
Frontend unit suite: 4 passed.
compileall: passed.
git diff --check: passed.
Added-line security scan: no hardcoded secrets, shell-command injection, dynamic-code, unsafe-deserialization, or formatted-SQL matches.
No commit, push, deploy, production mutation, credential access, or credential rotation.

Independent gate status

The remediation invalidated the earlier review snapshot. Three fresh exact-current, read-only review scopes were dispatched after the final source change. They remain pending; no reviewer status or incomplete output is treated as approval. The gate closes only when each scope returns valid JSON with exactly the required five keys, passed=true, and empty security_concerns and logic_errors.

Remaining operational limits

PostgreSQL runtime/parity, Docker build/smoke, Redis persistence, real-provider LLM QA, browser/mobile E2E, authenticated production smoke, deployment, public access, and credential/JWT rotation remain unperformed and require separate approval.

2.1 KiB Raw Blame History