Account unlock flow

[xtrandom]

What's the flow to unlock (or how long before it auto-unlocks) an account when it gets locked due to too many attempts:

I think there should be an option to see locked users and be able to unlock them

[cerede2000]

It unlocks itself. Five failed attempts on an address lock it for fifteen minutes, and both numbers are settings — AUTH_MAX_FAILED and AUTH_LOCK_MINUTES. A successful sign-in also clears the counter, so once the fifteen minutes are up the next correct password puts things back to normal; there is nothing left over.

The screen does not say any of that, which is most of why the question comes up. It says the account is locked and stops.

Your suggestion is a real gap, though, and I would not argue against it. There is no list of locked accounts and no way for an administrator to release one early — if somebody locks themselves out five minutes before they need to be in, the only options today are to wait or to delete the row from auth_locks in the SQLite database.

One thing that makes the case stronger than "somebody mistyped their password": the lock is keyed on the email address alone, not on a session or an IP. Anyone who knows a colleague's address can lock it for fifteen minutes by guessing wrong five times. The login rate limit bounds how fast that can be done, but it does not stop it, and an administrator who can see it and clear it is the answer to that rather than a longer lockout.

I maintain a fork and I have the same gap; I have written it down there as well.

[xtrandom]

Thanks for the info, and for adding it to the roadmap!

[cerede2000]

@xtrandom Following up: this is now built in my fork. It is not in a release yet, but it is in the test image (linux/amd64):

• ghcr.io/cerede2000/explorer:test
• ghcr.io/cerede2000/explorer:test-lean

What changed

• Settings → User Management marks a locked account as Locked, with the time it frees itself.
• In that account's Security tab, an administrator can click Unlock now. The lock and the failed-attempt count are both cleared, so the next typo does not lock the account straight back. The release is logged with the name of the administrator who did it.
• The sign-in screen now says how long to wait ("Try again in 10 minutes"), instead of only saying that the account is locked.
• A lock that has already run out is not shown, since it no longer blocks anything.

As before, a lock still frees itself after AUTH_LOCK_MINUTES (15 by default), and a successful sign-in clears the count.

To try it

1. Sign in with the wrong password five times on a test account.
2. The sign-in screen should say how many minutes are left.
3. As an administrator, open Settings → User Management: the account shows Locked and the time it frees itself.
4. Open the account, go to Security, and click Unlock now. The badge goes away, and the correct password works straight away.

If you try it, I would like to hear what worked and what did not.