Security Operations

Security operations are the stable identifiers passed to AuthRateLimit.require. They select attempt-limiting policy; they are not routes, endpoint names, audit events, or authorization permissions. Standard HTTP Operations invoke the appropriate identifier once before authentication work. See Security Policies for default limits and deployment guidance, and HTTP Operations for the transport services that invoke them.

Operation catalog

AuthRateLimitOperation is the key union of AuthRateLimitStandardRules. Every standard rule is fixed-window unless overridden. The key column identifies the subject supplied by the operation; operations with ip, email apply both rules as one policy.

The rule id defaults to the operation ID plus .ip, .email, or .user. It identifies the persisted counter independently of the operation selector. Consult AuthRateLimitStandardRules for the authoritative limits, windows, and exact rule IDs; the summarized defaults are in Security Policies.

Overrides

Pass an AuthRateLimitConfig to AuthRateLimitStandardLive(config). An omitted property preserves that operation's defaults. A rule array replaces the complete default array rather than merging with it; an empty array therefore performs no checks. null explicitly disables the operation. AuthRateLimitNoopLive disables all operations and should be reserved for tests or a deliberate replacement boundary.

import { AuthRateLimitStandardLive } from "@effect-auth/core/AuthRateLimit";
import { Duration } from "effect";

const SecurityLive = AuthRateLimitStandardLive({
  "auth.password.sign_in": [
    {
      id: "app.password.sign_in.ip",
      key: "ip",
      limit: 8,
      window: Duration.minutes(15),
      algorithm: "fixed-window",
    },
  ],
  "auth.magic_link.verify": null,
});

Rules accept key: "ip" | "email" | "user", limit, window, optional algorithm: "fixed-window" | "token-bucket", and optional tokens. Missing email or user context fails closed with RateLimitStoreError; missing IP uses a stable missing-IP bucket. Do not wrap a standard HTTP Operation in a second AuthRateLimit.require, because that consumes the budget twice.

Supporting boundaries

LoginNotificationHttpOperations is unrelated to the operation-ID catalog despite its name. It is the HTTP service imported from @effect-auth/core/HttpApi; its sole reportLogin: LoginNotificationReportOperation method belongs to LoginNotificationHttpApiGroup and reports a login notification. Its exact public exports are LoginNotificationHttpOperationsService, LoginNotificationHttpOperations, LoginNotificationReportOperation, and LoginNotificationHttpOperationsLive. Calling reportLogin neither selects an AuthRateLimitOperation nor grants access to an application resource.

Assurance observability

Assurance transitions have dedicated audit, webhook, and security-timeline summaries. They contain transition type, session/user correlation, previous and derived AAL/AMR, and safe timestamps/status fields. They deliberately omit raw authentication events, credential/factor IDs, accepted TOTP counters, passkey authenticator facts, custom-evidence properties, codes, and session tokens. Build webhooks with the assurance summary helpers rather than serializing a session row or evidence object.

Public exports