login: drop the unused per-username failure counter

The counter was incremented on every failed login and read but never
acted on; the per-IP limits do the throttling. Its keys never expired
and had grown to most of the keyspace.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01UjHzoBmW1iPpEe5qC2LDYB

1 files changed, 0 insertions, 7 deletions

diff --git a/routes/users.ts b/routes/users.ts
index 711ad07f..aa4e4b11 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -425,8 +425,6 @@ export default {
       username = username.toLowerCase().replace(/\s/g, "");
       username = username.split("@")[0];
 
-      const fk = `${username}:failures`;
-      const failures = await g(fk);
       const ipFailKey = `ip:${ip}:login:fail`;
       const ipFailures = await g(ipFailKey);
       if (!isAdmin && ipFailures > 20) return res.code(429).send({});
@@ -443,8 +441,6 @@ export default {
         if (!user || !verified) {
           await db.incrBy(ipFailKey, 1);
           if ((await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600);
-          await db.incrBy(fk, 1);
-          setTimeout(() => db.decrBy(fk, 1), 120000);
           return res.code(401).send({});
         }
 
@@ -869,9 +865,6 @@ export default {
       await s(`user:${id}`, user);
       await db.del(`reset:${code}`);
 
-      const un = username.toLowerCase().replace(/\s/g, "");
-      await db.del(`${un}:failures`);
-
       res.send(pick(user, whitelist));
 
       for await (const k of db.scanIterator({ MATCH: "ip:*:login:fail" })) {