Security values move into the Settings UI

Operator: *"proxy hops defaults to 1 and should be in the settings UI not in the
envs, we need the security values to be in the UI."* Overrules the call I made
yesterday, and rule 25 is on your side — I argued deployment-topology, but the
operator has to be able to SEE what protects them, and reading a container's
environment is not seeing.

Six new settings in a **Security** group: trusted proxy hops (default 1), the
per-account and per-address sign-in limits with their shared window, and the
sign-up limit with its own. `THOUGHTSYNC_TRUSTED_PROXY_HOPS` is gone; the rate
limits are no longer hardcoded constants.

**The hard part was keeping the throttle cheap.** It consults these BEFORE opening
a database connection — deliberately, because a refused attempt is meant to cost
nothing, and the hop count is needed to know who is even asking. A query per
attempt would undo both. So there is a small cache seeded from the registry
defaults (the app works with no database at all, which is what the DB-free unit
lane relies on), loaded at boot, and refreshed on every settings save — the same
live-update contract `session_ttl_days` already had.

`SlidingWindow` now takes its limit and window as SUPPLIERS rather than values, so
a saved number applies to the next attempt instead of the next deploy.

**Bounds are rejected, not clamped.** A hop count of 99 would trust anything a
caller sent; a sign-in limit of 0 would lock every account out permanently. Both
now fail validation with a message naming the range, and the number input carries
min/max so the browser objects first. Silently storing a different number than the
one typed is how somebody ends up believing a protection is set to something it is
not.

`MAX_BUCKETS` stays a constant on purpose: it protects the limiter from itself
rather than the app from a caller, and there is no operator judgment to apply.

Two integration tests, because the whole point is the round trip: a dangerous
value refused, a legitimate one reaching the cache the throttle reads and
persisting; and every Security row reaching the admin payload with bounds and a
description that explains itself.

tests/test_integration.py

@@ -27,7 +27,7 @@ from thoughtsync.db import dispose_engine, session_scope
 from thoughtsync.models.note import Note
 from thoughtsync.models.note_item import NoteItem
 from thoughtsync.models.user import User
-from thoughtsync.settings import get_setting, set_settings
+from thoughtsync.settings import get_setting, live, refresh_live, reset_live, set_settings
 from thoughtsync.notes.helpers import derive_display_title
 from thoughtsync.models.note_link_preview import NoteLinkPreview
 from thoughtsync.sync import _apply_note_items
@@ -337,3 +337,80 @@ async def test_registration_closes_itself_once_an_admin_exists(app_client, db):
     )
     assert third.status_code == 201
     assert (await third.get_json())["is_admin"] is False
+
+
+async def test_security_settings_are_live_and_bounded(app_client, db):
+    """The security values are settings now, not constants — so saving one has to take
+    effect without a restart, and a dangerous value has to be refused.
+
+    Real database because the whole point is the round trip: write through the admin
+    API, re-read into the cache the throttle consults, observe the new number.
+    """
+    # An admin to authenticate as. First account, so it is allowed and becomes admin.
+    reset_live()
+    created = await app_client.post(
+        "/api/auth/register",
+        json={"email": "admin@example.test", "password": "a-long-enough-password"},
+    )
+    assert created.status_code == 201
+
+    # Defaults are what the registry says.
+    async with session_scope() as fresh:
+        await refresh_live(fresh)
+    assert live("trusted_proxy_hops") == 1
+    assert live("signin_limit_per_account") == 10
+
+    # A value that would disable the protection is REFUSED, not clamped — storing a
+    # different number than the one typed is how somebody ends up believing a limit
+    # is set to something it is not.
+    bad = await app_client.patch("/api/settings", json={"signin_limit_per_account": 0})
+    assert bad.status_code == 400
+    assert "at least" in (await bad.get_json())["error"]
+
+    # …and so is a hop count that would trust anything a caller sent.
+    bad_hops = await app_client.patch("/api/settings", json={"trusted_proxy_hops": 99})
+    assert bad_hops.status_code == 400
+
+    # A legitimate change applies to the cache the throttle reads, immediately.
+    ok = await app_client.patch(
+        "/api/settings", json={"signin_limit_per_account": 3, "trusted_proxy_hops": 2}
+    )
+    assert ok.status_code == 200
+    assert live("signin_limit_per_account") == 3
+    assert live("trusted_proxy_hops") == 2
+
+    # And it is persisted, not just cached.
+    async with session_scope() as fresh:
+        assert await get_setting(fresh, "trusted_proxy_hops") == 2
+
+    reset_live()
+
+
+async def test_the_security_group_reaches_the_admin_ui(app_client, db):
+    """Every security value has to be visible and editable, which is the whole reason
+    they moved out of the environment."""
+    created = await app_client.post(
+        "/api/auth/register",
+        json={"email": "admin2@example.test", "password": "a-long-enough-password"},
+    )
+    assert created.status_code == 201
+
+    resp = await app_client.get("/api/settings")
+    assert resp.status_code == 200
+    rows = (await resp.get_json())["settings"]
+    security = {r["key"]: r for r in rows if r["group"] == "Security"}
+
+    assert set(security) == {
+        "trusted_proxy_hops",
+        "signin_limit_per_account",
+        "signin_limit_per_address",
+        "signin_window_minutes",
+        "register_limit_per_address",
+        "register_window_minutes",
+    }
+    # The UI renders a number input from these, and it cannot offer a safe range it
+    # was never told about.
+    for row in security.values():
+        assert row["type"] == "int"
+        assert row["minimum"] is not None and row["maximum"] is not None
+        assert row["description"], f"{row['key']} has no description to explain itself"

tests/test_ratelimit.py

@@ -13,10 +13,18 @@ import time
 import pytest
 
 from thoughtsync import ratelimit
+from thoughtsync.settings import live
 from thoughtsync.app import create_app
 from thoughtsync.ratelimit import SlidingWindow
 
 
+def window(limit: int, window_s: float) -> SlidingWindow:
+    """A fixed-value window. The real ones read their numbers from the settings cache
+    so an admin's change applies immediately; these tests are about the counting, not
+    about where the numbers come from."""
+    return SlidingWindow(lambda: limit, lambda: window_s)
+
+
 @pytest.fixture(autouse=True)
 def _clean_counters():
     ratelimit.reset_all()
@@ -30,7 +38,7 @@ def app():
 
 
 def test_under_the_limit_is_not_blocked():
-    w = SlidingWindow(limit=3, window_s=60)
+    w = window(3, 60)
     for i in range(3):
         assert w.retry_after("k", now=i) is None
         w.record("k", now=i)
@@ -38,7 +46,7 @@ def test_under_the_limit_is_not_blocked():
 
 
 def test_window_slides_rather_than_resetting():
-    w = SlidingWindow(limit=2, window_s=60)
+    w = window(2, 60)
     w.record("k", now=0)
     w.record("k", now=30)
     assert w.retry_after("k", now=31) is not None
@@ -50,7 +58,7 @@ def test_window_slides_rather_than_resetting():
 
 
 def test_retry_after_points_past_the_oldest_hit():
-    w = SlidingWindow(limit=1, window_s=100)
+    w = window(1, 100)
     w.record("k", now=10)
     wait = w.retry_after("k", now=40)
     # The hit at t=10 leaves the window at t=110, i.e. 70s away. Rounded up, never
@@ -62,14 +70,14 @@ def test_retry_after_points_past_the_oldest_hit():
 
 
 def test_keys_are_counted_separately():
-    w = SlidingWindow(limit=1, window_s=60)
+    w = window(1, 60)
     w.record("a", now=0)
     assert w.retry_after("a", now=1) is not None
     assert w.retry_after("b", now=1) is None
 
 
 def test_forget_clears_one_key():
-    w = SlidingWindow(limit=1, window_s=60)
+    w = window(1, 60)
     w.record("a", now=0)
     w.record("b", now=0)
     w.forget("a")
@@ -81,7 +89,7 @@ def test_bucket_count_is_bounded(monkeypatch):
     # An attacker rotating a forged X-Forwarded-For must not be able to grow this
     # dict without limit — the limiter cannot become the exhaustion it prevents.
     monkeypatch.setattr(ratelimit, "MAX_BUCKETS", 8)
-    w = SlidingWindow(limit=5, window_s=60)
+    w = window(5, 60)
     for i in range(50):
         w.record(f"addr-{i}", now=i)
     assert len(w._hits) <= 8
@@ -97,7 +105,7 @@ async def test_login_starts_refusing(app):
     # at t=0..9 are fifteen minutes stale the moment the route reads
     # `time.monotonic()` and get pruned before they can refuse anything.
     now = time.monotonic()
-    for _ in range(ratelimit.ACCOUNT_LIMIT):
+    for _ in range(live("signin_limit_per_account")):
         ratelimit.sign_in_by_account.record("someone@example.com", now=now)
     resp = await client.post("/api/auth/login", json=body)
     assert resp.status_code == 429
@@ -109,7 +117,7 @@ async def test_login_starts_refusing(app):
 async def test_device_login_shares_the_account_counter(app):
     client = app.test_client()
     now = time.monotonic()
-    for _ in range(ratelimit.ACCOUNT_LIMIT):
+    for _ in range(live("signin_limit_per_account")):
         ratelimit.sign_in_by_account.record("someone@example.com", now=now)
     resp = await client.post(
         "/api/auth/device-login",
@@ -123,7 +131,7 @@ async def test_device_login_shares_the_account_counter(app):
 async def test_register_is_throttled_by_address(app):
     client = app.test_client()
     now = time.monotonic()
-    for _ in range(ratelimit.REGISTER_LIMIT):
+    for _ in range(live("register_limit_per_address")):
         ratelimit.register_by_address.record("203.0.113.9", now=now)
     resp = await client.post(
         "/api/auth/register",