src/ratelimit.h

#ifndef GT_RATELIMIT_H
#define GT_RATELIMIT_H

/*
 * Per-IP authentication throttling.  Failures are remembered for a
 * sliding window; each failure doubles the required delay, and past
 * a hard ceiling the source is refused outright for a cooldown.
 *
 * rl_check:  0  = proceed
 *           >0  = proceed after sleeping this many ms
 *           -1  = banned for now (caller should respond 429)
 */
int  rl_check(const char *ip);
void rl_fail(const char *ip);
void rl_ok(const char *ip);

#endif