From d56f237177a7dbd1d6bdb3b4ece42a11e92888a4 Mon Sep 17 00:00:00 2001 From: Raghu Betina Date: Mon, 12 Oct 2026 12:31:21 -0500 Subject: [PATCH] Say sign-in is limited when lockout is left out The service release this plugin ships with gives an Account without lockout Rails' own sign-in rate limit (firstdraft/firstdraft#1147), so the Skill's Accounts text no longer says failed sign-ins are unlimited. It points at DEPLOY.md's Failed sign-ins section, because a classroom on one network shares the per-IP limit. --- CHANGELOG.md | 4 ++++ .../references/foundation-plan-023.md | 4 ++-- skills/create-full-stack-app/references/interview.md | 7 ++++--- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 37474fa..a494a76 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -61,6 +61,10 @@ their emails are not delivered until you add a mail provider, as the Account ema Apps compiled earlier keep their `AGENTS.md`. To adopt the new rules, ask your agent to compare its spec bullet with this entry and update it. +An Account that leaves out `lockout` now gets Rails' own sign-in limit in the generated `RodauthController`: 10 +attempts per IP address every three minutes. People on one network, such as a classroom, share it; `DEPLOY.md` +describes the limit and how to key it by email as well. The Skill's Accounts text says so instead of "not limited". + ## 2026-10-12: State Machine events First Draft cannot generate are stubs **Skills — released in plugin 0.8.15.** Plugin 0.8.14 carried the same text but was never published: its tag was pushed while a GitHub Actions incident had dropped its main CI run, so the publish workflow refused it. Once the First Draft service deploys the matching Compiler, a required, diff --git a/skills/create-full-stack-app/references/foundation-plan-023.md b/skills/create-full-stack-app/references/foundation-plan-023.md index 7ec61cc..f36e520 100644 --- a/skills/create-full-stack-app/references/foundation-plan-023.md +++ b/skills/create-full-stack-app/references/foundation-plan-023.md @@ -692,8 +692,8 @@ a signed-in session. Without `registration`, nobody can sign themselves up: the generated README shows the owner how to create each Account, in development seeds and with `bin/rails runner` against the production database, because Render Free has no Shell. With `verification` but no `registration`, verification covers email changes only. Without `recovery`, there is no password reset, and the README shows how the owner sets a -new password. Without `lockout`, failed sign-ins are not limited: nothing throttles `/login`, and `DEPLOY.md` says so -in its Failed sign-ins section. Keep `recovery` and `lockout` unless the user asks to leave them out. +new password. Without `lockout`, the generated `RodauthController` carries Rails' own sign-in limit, 10 attempts per IP +address every three minutes, and `DEPLOY.md` describes it in its Failed sign-ins section. Keep `recovery` and `lockout` unless the user asks to leave them out. A realized Account derives one Web `/account` destination without requiring an authored profile. With `registration`, sign-up shows a control for each required registration input that names a stored Account Field, diff --git a/skills/create-full-stack-app/references/interview.md b/skills/create-full-stack-app/references/interview.md index ed27b5e..daf36c5 100644 --- a/skills/create-full-stack-app/references/interview.md +++ b/skills/create-full-stack-app/references/interview.md @@ -176,7 +176,8 @@ proposal in the read-back. confirmation: leave `verification` out unless the user asks for it, so sign-up signs people in at once and they can share the app with friends right away. "No sign-up" is supported: without `registration`, sign-in and Policies still generate, and the generated README shows the owner how to create each Account. Keep - `recovery` and `lockout`; without `lockout`, failed sign-ins are not limited, and `DEPLOY.md` says so. + `recovery` and `lockout`; without `lockout`, sign-in allows 10 attempts per IP address every three minutes, and + `DEPLOY.md` describes the limit. - [ ] Lists: what each main list shows, starting with the record's name, and its order. - [ ] Sample data: the proposed sample records and demo sign-in, and any CSV the user wants imported; import itself goes in the implementation notes. @@ -201,8 +202,8 @@ These steps are outside the Plan and do not block local development. They come a it, Change email and sign-up with `registration` need one too, because their links travel by email. Follow the Account email section of `DEPLOY.md` to add one before inviting real users. - [ ] Accounts without sign-up or lockout: without `registration`, create each Account as the README's Accounts - section shows; without `lockout`, limit sign-in attempts as the Failed sign-ins section of `DEPLOY.md` says - before inviting real users. + section shows; without `lockout`, read the Failed sign-ins section of `DEPLOY.md`, because people on one network, + such as a classroom, share the per-IP sign-in limit. - [ ] Photos and files (apps with image or attachment Fields): sign up for Cloudinary and set `CLOUDINARY_URL` as the [upload setup](foundation-plan-023.md#photos-and-files) describes. - [ ] Deploy: before the first deploy, the user creates a separate Render workspace for this app in the Render