Current state: authkit.Config.SessionTTL, ratelimit.Config, server.Config.MaxStreamLifetime and server.Config.MaxStreamsPerUser all exist as configuration fields and run.go sets none of them, so every install takes the library default of thirty day sessions, ten failed logins a minute per client IP, five minute streams and five concurrent streams per user. None can be changed without a rebuild.
Proposal: read all four in loadRunConfig and assign them, following the pattern ALPHONE_TENANT_MACHINE_GRACE already sets, with today's values as defaults.
Trigger: each answers to an environment variable, and an install setting none behaves exactly as it does today.
Current state: authkit.Config.SessionTTL, ratelimit.Config, server.Config.MaxStreamLifetime and server.Config.MaxStreamsPerUser all exist as configuration fields and run.go sets none of them, so every install takes the library default of thirty day sessions, ten failed logins a minute per client IP, five minute streams and five concurrent streams per user. None can be changed without a rebuild.
Proposal: read all four in loadRunConfig and assign them, following the pattern ALPHONE_TENANT_MACHINE_GRACE already sets, with today's values as defaults.
Trigger: each answers to an environment variable, and an install setting none behaves exactly as it does today.