Struct FailureTracker 

pub struct FailureTracker { /* private fields */ }

Tracks authentication failures and enforces FIA_AFL.1 lockout.

Implementations

impl FailureTracker

pub fn new(policy: LockoutPolicy) -> Self

Create a tracker with the given policy.

pub fn policy(&self) -> &LockoutPolicy

The active policy.

pub fn check(&self, identity: &str) -> LockoutStatus

Check whether identity is currently locked out, without recording an attempt. Call this before validating a credential.

pub fn record_failure(&self, identity: &str) -> LockoutStatus

Record a failed authentication attempt for identity and return the resulting status. A return of LockoutStatus::LockedOut means this failure reached (or was already past) the threshold — the caller should emit the FIA_AFL security-violation audit event.

pub fn record_success(&self, identity: &str)

Record a successful authentication for identity, clearing its failure state. A success does not lift an active lockout — the credential is still refused until the lockout expires — so we only drop the record when it is not currently locked.