refactor: 拆分 middleware/router 为单一职责文件，新增站点设置管理页面

middleware:
- 拆分 auth.go → auth.go + auth_token.go + auth_parser.go + auth_admin.go
- 拆分 csrf.go → csrf.go + csrf_token.go
- 拆分 ratelimit.go → ratelimit.go + ratelimit_core.go + ratelimit_cleanup.go
- 修复 import 未使用/缺失问题

router:
- 拆分 router.go → admin.go + api.go + frontend.go + deps_core.go + deps_extra.go

feat(admin): 站点设置管理页面
- 新增 SSR 页面 /admin/site-settings（仅 Owner）
- 审核开关 Toggle 即时保存
- 通用设置展示
- 侧边栏新增站点设置入口
- 注册 UpdateBoolSetting/GetBoolSetting API 路由

internal/middleware/auth.go

@@ -1,16 +1,10 @@
 package middleware
 
 import (
-	"log"
-	"net/http"
-	"strings"
-	"time"
-
 	"metazone.cc/metalab/internal/common"
 	"metazone.cc/metalab/internal/config"
 
 	"github.com/gin-gonic/gin"
-	"github.com/golang-jwt/jwt/v5"
 )
 
 // AuthMiddleware 认证中间件（结构体模式，持有 DB 依赖用于实时令牌吊销校验）
@@ -25,7 +19,6 @@ func NewAuthMiddleware(cfg *config.Config, userRepo tokenVersionStore) *AuthMidd
 }
 
 // Required 登录认证中间件：校验 JWT → 检查 token_version → 注入用户信息
-// 令牌版本与 DB 不匹配时即时拒绝，实现实时吊销
 func (am *AuthMiddleware) Required() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		claims, err := am.authenticateToken(c)
@@ -36,122 +29,20 @@ func (am *AuthMiddleware) Required() gin.HandlerFunc {
 			})
 			return
 		}
-
 		injectUserContext(c, claims)
 		c.Next()
 	}
 }
 
-// Optional 可选认证：已登录且版本通过则注入，未登录或版本不匹配也放行（仅清除过期 Cookie）
+// Optional 可选认证：已登录且版本通过则注入，未登录或版本不匹配也放行
 func (am *AuthMiddleware) Optional() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		claims, err := am.authenticateToken(c)
 		if err != nil {
-			log.Printf("[AuthOptional] token invalid for %s: %v", c.Request.URL.Path, err)
 			c.Next()
 			return
 		}
-
-		log.Printf("[AuthOptional] OK: uid=%v username=%v path=%s", claims["uid"], claims["username"], c.Request.URL.Path)
 		injectUserContext(c, claims)
 		c.Next()
 	}
 }
-
-// AdminAuth 管理后台页面认证：失败时 302 跳首页而非返回 JSON
-func (am *AuthMiddleware) AdminAuth() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		claims, err := am.authenticateToken(c)
-		if err != nil {
-			log.Printf("[AdminAuth] auth failed path=%s err=%v → 302", c.Request.URL.Path, err)
-			common.ClearAuthCookies(c, am.cfg)
-			c.Redirect(http.StatusFound, "/")
-			c.Abort()
-			return
-		}
-
-		log.Printf("[AdminAuth] OK: uid=%v role=%v path=%s", claims["uid"], claims["role"], c.Request.URL.Path)
-		injectUserContext(c, claims)
-		c.Next()
-	}
-}
-
-// authenticateToken 统一的认证核心流程：读 Cookie → 解析 JWT → 检查 token_version
-// 成功返回 claims，失败返回 error（调用方自行决定如何响应）
-func (am *AuthMiddleware) authenticateToken(c *gin.Context) (jwt.MapClaims, error) {
-	tokenStr, err := c.Cookie(common.CookieName)
-	if err != nil {
-		return nil, err
-	}
-
-	claims, err := parseToken(tokenStr, am.cfg.JWT.Secret)
-	if err != nil {
-		return nil, err
-	}
-
-	uid := uint(claims["uid"].(float64))
-	tokenVer := int(claims["ver"].(float64))
-
-	currentVer, err := am.userRepo.FindTokenVersion(uid)
-	if err != nil {
-		return nil, err
-	}
-	if tokenVer != currentVer {
-		log.Printf("[authenticateToken] REVOKED: uid=%d tokenVer=%d dbVer=%d", uid, tokenVer, currentVer)
-		return nil, common.ErrTokenRevoked
-	}
-
-	return claims, nil
-}
-
-// injectUserContext 将 JWT claims 中的用户信息注入 gin context
-func injectUserContext(c *gin.Context, claims jwt.MapClaims) {
-	if claims == nil {
-		return
-	}
-	uid, ok := claims["uid"].(float64)
-	if !ok {
-		return
-	}
-	c.Set("uid", uint(uid))
-	c.Set("email", claims["email"])
-	c.Set("username", claims["username"])
-	c.Set("role", claims["role"])
-}
-
-// parseToken 解析并验证 JWT
-func parseToken(tokenStr, secret string) (jwt.MapClaims, error) {
-	now := time.Now()
-	token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
-		return []byte(secret), nil
-	})
-	if err != nil || !token.Valid {
-		log.Printf("[parseToken] FAIL: now=%v err=%v (secret_len=%d token_len=%d)",
-			now, err, len(secret), len(tokenStr))
-		return nil, err
-	}
-	claims, ok := token.Claims.(jwt.MapClaims)
-	if !ok {
-		return nil, jwt.ErrSignatureInvalid
-	}
-	// Debug: 打印 exp/iat 对比当前时间
-	if exp, exists := claims["exp"]; exists {
-		var expTime time.Time
-		switch v := exp.(type) {
-		case float64:
-			expTime = time.Unix(int64(v), 0)
-		case *jwt.NumericDate:
-			expTime = v.Time
-		}
-		if !expTime.IsZero() {
-			log.Printf("[parseToken] OK: exp=%v (%d) now=%v isExpired=%v",
-				expTime, expTime.Unix(), now, now.After(expTime))
-		}
-	}
-	return claims, nil
-}
-
-// IsLoginPage 检查是否已在登录状态，已登录用户跳过登录/注册页
-func IsLoginPage(c *gin.Context) bool {
-	return strings.HasPrefix(c.Request.URL.Path, "/auth/")
-}

internal/middleware/auth_admin.go

@@ -0,0 +1,27 @@
+package middleware
+
+import (
+	"log"
+	"net/http"
+
+	"metazone.cc/metalab/internal/common"
+
+	"github.com/gin-gonic/gin"
+)
+
+// AdminAuth 管理后台页面认证：失败时 302 跳首页而非返回 JSON
+func (am *AuthMiddleware) AdminAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		claims, err := am.authenticateToken(c)
+		if err != nil {
+			log.Printf("[AdminAuth] auth failed path=%s err=%v → 302", c.Request.URL.Path, err)
+			common.ClearAuthCookies(c, am.cfg)
+			c.Redirect(http.StatusFound, "/")
+			c.Abort()
+			return
+		}
+		log.Printf("[AdminAuth] OK: uid=%v role=%v path=%s", claims["uid"], claims["role"], c.Request.URL.Path)
+		injectUserContext(c, claims)
+		c.Next()
+	}
+}

internal/middleware/auth_parser.go

@@ -0,0 +1,46 @@
+package middleware
+
+import (
+	"log"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// parseToken 解析并验证 JWT
+func parseToken(tokenStr, secret string) (jwt.MapClaims, error) {
+	now := time.Now()
+	token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
+		return []byte(secret), nil
+	})
+	if err != nil || !token.Valid {
+		log.Printf("[parseToken] FAIL: now=%v err=%v (secret_len=%d token_len=%d)",
+			now, err, len(secret), len(tokenStr))
+		return nil, err
+	}
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok {
+		return nil, jwt.ErrSignatureInvalid
+	}
+	if exp, exists := claims["exp"]; exists {
+		var expTime time.Time
+		switch v := exp.(type) {
+		case float64:
+			expTime = time.Unix(int64(v), 0)
+		case *jwt.NumericDate:
+			expTime = v.Time
+		}
+		if !expTime.IsZero() {
+			log.Printf("[parseToken] OK: exp=%v (%d) now=%v isExpired=%v",
+				expTime, expTime.Unix(), now, now.After(expTime))
+		}
+	}
+	return claims, nil
+}
+
+// IsLoginPage 检查是否已在登录状态，已登录用户跳过登录/注册页
+func IsLoginPage(c *gin.Context) bool {
+	return strings.HasPrefix(c.Request.URL.Path, "/auth/")
+}

internal/middleware/auth_token.go

@@ -0,0 +1,48 @@
+package middleware
+
+import (
+	"log"
+
+	"metazone.cc/metalab/internal/common"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// authenticateToken 统一的认证核心流程：读 Cookie → 解析 JWT → 检查 token_version
+func (am *AuthMiddleware) authenticateToken(c *gin.Context) (jwt.MapClaims, error) {
+	tokenStr, err := c.Cookie(common.CookieName)
+	if err != nil {
+		return nil, err
+	}
+	claims, err := parseToken(tokenStr, am.cfg.JWT.Secret)
+	if err != nil {
+		return nil, err
+	}
+	uid := uint(claims["uid"].(float64))
+	tokenVer := int(claims["ver"].(float64))
+	currentVer, err := am.userRepo.FindTokenVersion(uid)
+	if err != nil {
+		return nil, err
+	}
+	if tokenVer != currentVer {
+		log.Printf("[authenticateToken] REVOKED: uid=%d tokenVer=%d dbVer=%d", uid, tokenVer, currentVer)
+		return nil, common.ErrTokenRevoked
+	}
+	return claims, nil
+}
+
+// injectUserContext 将 JWT claims 中的用户信息注入 gin context
+func injectUserContext(c *gin.Context, claims jwt.MapClaims) {
+	if claims == nil {
+		return
+	}
+	uid, ok := claims["uid"].(float64)
+	if !ok {
+		return
+	}
+	c.Set("uid", uint(uid))
+	c.Set("email", claims["email"])
+	c.Set("username", claims["username"])
+	c.Set("role", claims["role"])
+}

internal/middleware/csrf.go

@@ -1,8 +1,6 @@
 package middleware
 
 import (
-	"crypto/rand"
-	"encoding/hex"
 	"net/http"
 
 	"metazone.cc/metalab/internal/config"
@@ -14,15 +12,11 @@ const (
 	csrfCookieName = "mlb_csrf"
 	csrfHeaderName = "X-CSRF-Token"
 	csrfMetaName   = "csrf_token"
-	csrfTokenLen   = 32 // 字节
 )
 
 // CSRF 中间件：Double Submit Cookie 模式
-// 前端 JS 从 Cookie 中读取 token 并放入 X-CSRF-Token 请求头，后端验证两者一致
-// GET / HEAD / OPTIONS 请求自动放行
 func CSRF(cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		// 安全读取豁免
 		if c.Request.Method == http.MethodGet ||
 			c.Request.Method == http.MethodHead ||
 			c.Request.Method == http.MethodOptions {
@@ -39,7 +33,6 @@ func CSRF(cfg *config.Config) gin.HandlerFunc {
 		}
 
 		headerToken := c.GetHeader(csrfHeaderName)
-		// Fallback：如果请求头没有，尝试从表单字段读取（纯 HTML form 提交通道）
 		if headerToken == "" {
 			headerToken = c.PostForm(csrfMetaName)
 		}
@@ -50,7 +43,6 @@ func CSRF(cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
-		// 恒定时间比较防时序攻击
 		if !constantTimeEq(cookieToken, headerToken) {
 			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
 				"success": false, "message": "CSRF 验证失败",
@@ -58,55 +50,7 @@ func CSRF(cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
-		// 注入到上下文，供前端 <meta> 使用
 		c.Set(csrfMetaName, cookieToken)
 		c.Next()
 	}
 }
-
-// SetCSRFToken 在首次页面访问时下发 CSRF Cookie（由页面路由中间件调用）
-// 注意：此 Cookie HttpOnly=false，JS 可读——这是 Double Submit 模式的必要条件
-func SetCSRFToken(c *gin.Context, cfg *config.Config) string {
-	secure := cfg.Server.Mode != "debug"
-
-	// 如果已有 token 且未过期，复用（但必须注入 context，供模板 meta 标签使用）
-	if existing, err := c.Cookie(csrfCookieName); err == nil && existing != "" {
-		c.Set(csrfMetaName, existing)
-		return existing
-	}
-
-	token, err := generateCSRFToken()
-	if err != nil {
-		// 极端情况：随机数生成失败，使用短 token
-		token = "fallback-" + hex.EncodeToString([]byte("metazone"))
-	}
-
-	c.SetSameSite(http.SameSiteStrictMode)
-	// 30 天有效期，与 refresh token 对齐
-	maxAge := int(cfg.JWT.RememberExpire * 3600)
-	c.SetCookie(csrfCookieName, token, maxAge, "/", "", secure, false)
-
-	c.Set(csrfMetaName, token)
-	return token
-}
-
-// generateCSRFToken 生成 64 字符十六进制随机 CSRF token
-func generateCSRFToken() (string, error) {
-	b := make([]byte, csrfTokenLen)
-	if _, err := rand.Read(b); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(b), nil
-}
-
-// constantTimeEq 恒定时间字符串比较（防时序攻击）
-func constantTimeEq(a, b string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	var result byte
-	for i := 0; i < len(a); i++ {
-		result |= a[i] ^ b[i]
-	}
-	return result == 0
-}

internal/middleware/csrf_token.go

@@ -0,0 +1,54 @@
+package middleware
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"net/http"
+
+	"metazone.cc/metalab/internal/config"
+
+	"github.com/gin-gonic/gin"
+)
+
+const csrfTokenLen = 32
+
+// SetCSRFToken 在首次页面访问时下发 CSRF Cookie（由页面路由中间件调用）
+func SetCSRFToken(c *gin.Context, cfg *config.Config) string {
+	secure := cfg.Server.Mode != "debug"
+	if existing, err := c.Cookie(csrfCookieName); err == nil && existing != "" {
+		c.Set(csrfMetaName, existing)
+		return existing
+	}
+
+	token, err := generateCSRFToken()
+	if err != nil {
+		token = "fallback-" + hex.EncodeToString([]byte("metazone"))
+	}
+
+	c.SetSameSite(http.SameSiteStrictMode)
+	maxAge := int(cfg.JWT.RememberExpire * 3600)
+	c.SetCookie(csrfCookieName, token, maxAge, "/", "", secure, false)
+	c.Set(csrfMetaName, token)
+	return token
+}
+
+// generateCSRFToken 生成 64 字符十六进制随机 CSRF token
+func generateCSRFToken() (string, error) {
+	b := make([]byte, csrfTokenLen)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+// constantTimeEq 恒定时间字符串比较（防时序攻击）
+func constantTimeEq(a, b string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	var result byte
+	for i := 0; i < len(a); i++ {
+		result |= a[i] ^ b[i]
+	}
+	return result == 0
+}

internal/middleware/ratelimit.go

@@ -1,47 +1,16 @@
 package middleware
 
-import (
-	"fmt"
-	"sync"
-	"time"
-)
+import "sync"
 
 // RateLimiter 双维度滑动窗口登录限流
 // 维度一（账户）：同邮箱 1 分钟内失败 3 次 → 锁定 1 分钟
 // 维度二（IP）：同 IP 1 分钟内失败 10 次 → 锁定 1 分钟
 type RateLimiter struct {
-	mu sync.RWMutex
-	// accountFailures key = 邮箱（小写）
+	mu              sync.RWMutex
 	accountFailures map[string]*windowState
-	// ipFailures key = IP
-	ipFailures map[string]*windowState
+	ipFailures      map[string]*windowState
 }
 
-// windowState 单个维度的限流状态
-type windowState struct {
-	count      int
-	windowStart time.Time
-	blockedUntil time.Time // 零值为未封锁
-}
-
-// RateLimitResult 限流检查结果
-type RateLimitResult struct {
-	Blocked    bool
-	RetryAfter int // 剩余封锁秒数
-	Message    string
-}
-
-const (
-	accountWindow     = 1 * time.Minute
-	accountMaxFails   = 3
-	accountBlockDur   = 1 * time.Minute
-	ipWindow          = 1 * time.Minute
-	ipMaxFails        = 10
-	ipBlockDur        = 1 * time.Minute
-	cleanupInterval   = 2 * time.Minute
-	maxEntries        = 10000 // 单维度最大条目数（防内存耗尽）
-)
-
 // NewRateLimiter 创建限流器并启动后台清理
 func NewRateLimiter() *RateLimiter {
 	rl := &RateLimiter{
@@ -53,7 +22,6 @@ func NewRateLimiter() *RateLimiter {
 }
 
 // AllowAccount 检查账户维度是否允许登录尝试
-// 返回 (result, 登录失败时应调用的记录函数)
 func (rl *RateLimiter) AllowAccount(email string) (RateLimitResult, func()) {
 	return rl.check(rl.accountFailures, email, accountWindow, accountBlockDur, accountMaxFails, true)
 }
@@ -62,88 +30,3 @@ func (rl *RateLimiter) AllowAccount(email string) (RateLimitResult, func()) {
 func (rl *RateLimiter) AllowIP(ip string) (RateLimitResult, func()) {
 	return rl.check(rl.ipFailures, ip, ipWindow, ipBlockDur, ipMaxFails, false)
 }
-
-// check 核心检查逻辑
-// lowKey: 是否需要脱敏日志（true = 暗示账户存在，仅泄漏给已知该邮箱的人）
-func (rl *RateLimiter) check(m map[string]*windowState, key string, window, blockDur time.Duration, maxFails int, lowKey bool) (RateLimitResult, func()) {
-	rl.mu.Lock()
-	defer rl.mu.Unlock()
-
-	now := time.Now()
-	state, exists := m[key]
-
-	if !exists {
-		state = &windowState{}
-		if len(m) < maxEntries {
-			m[key] = state
-		}
-	}
-
-	// 检查是否处于封锁期
-	if !state.blockedUntil.IsZero() && now.Before(state.blockedUntil) {
-		retry := int(state.blockedUntil.Sub(now).Seconds()) + 1
-		msg := "请求过于频繁，请稍后重试"
-		if lowKey {
-			msg = fmt.Sprintf("该账号登录尝试过于频繁，请 %d 秒后重试", retry)
-		}
-		return RateLimitResult{Blocked: true, RetryAfter: retry, Message: msg}, nil
-	}
-
-	// 窗口过期 → 重置
-	if now.Sub(state.windowStart) > window {
-		state.count = 0
-		state.windowStart = now
-		state.blockedUntil = time.Time{}
-	}
-
-	// 记录失败（由调用方在登录失败时调用）的闭包
-	recordFail := func() {
-		rl.mu.Lock()
-		defer rl.mu.Unlock()
-		s := m[key]
-		if s == nil {
-			return
-		}
-		if now.Sub(s.windowStart) > window {
-			s.count = 1
-			s.windowStart = now
-			return
-		}
-		s.count++
-		if s.count >= maxFails {
-			s.blockedUntil = now.Add(blockDur)
-		}
-	}
-
-	return RateLimitResult{Blocked: false}, recordFail
-}
-
-// Clear 登录成功后清除该 email 和 IP 的失败计数
-func (rl *RateLimiter) Clear(email, ip string) {
-	rl.mu.Lock()
-	defer rl.mu.Unlock()
-	delete(rl.accountFailures, email)
-	delete(rl.ipFailures, ip)
-}
-
-// cleanupLoop 定期清理过期条目
-func (rl *RateLimiter) cleanupLoop() {
-	ticker := time.NewTicker(cleanupInterval)
-	defer ticker.Stop()
-	for range ticker.C {
-		rl.mu.Lock()
-		now := time.Now()
-		clean := func(m map[string]*windowState) {
-			for k, v := range m {
-				// 封锁期已过且窗口已过期 → 删除
-				if (v.blockedUntil.IsZero() || now.After(v.blockedUntil)) &&
-					now.Sub(v.windowStart) > accountWindow+ipBlockDur {
-					delete(m, k)
-				}
-			}
-		}
-		clean(rl.accountFailures)
-		clean(rl.ipFailures)
-		rl.mu.Unlock()
-	}
-}

internal/middleware/ratelimit_cleanup.go

@@ -0,0 +1,32 @@
+package middleware
+
+import "time"
+
+// Clear 登录成功后清除该 email 和 IP 的失败计数
+func (rl *RateLimiter) Clear(email, ip string) {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+	delete(rl.accountFailures, email)
+	delete(rl.ipFailures, ip)
+}
+
+// cleanupLoop 定期清理过期条目
+func (rl *RateLimiter) cleanupLoop() {
+	ticker := time.NewTicker(cleanupInterval)
+	defer ticker.Stop()
+	for range ticker.C {
+		rl.mu.Lock()
+		now := time.Now()
+		clean := func(m map[string]*windowState) {
+			for k, v := range m {
+				if (v.blockedUntil.IsZero() || now.After(v.blockedUntil)) &&
+					now.Sub(v.windowStart) > accountWindow+ipBlockDur {
+					delete(m, k)
+				}
+			}
+		}
+		clean(rl.accountFailures)
+		clean(rl.ipFailures)
+		rl.mu.Unlock()
+	}
+}

internal/middleware/ratelimit_core.go

@@ -0,0 +1,81 @@
+package middleware
+
+import (
+	"fmt"
+	"time"
+)
+
+// RateLimitResult 限流检查结果
+type RateLimitResult struct {
+	Blocked    bool
+	RetryAfter int
+	Message    string
+}
+
+const (
+	accountWindow   = 1 * time.Minute
+	accountMaxFails = 3
+	accountBlockDur = 1 * time.Minute
+	ipWindow        = 1 * time.Minute
+	ipMaxFails      = 10
+	ipBlockDur      = 1 * time.Minute
+	cleanupInterval = 2 * time.Minute
+	maxEntries      = 10000
+)
+
+// windowState 单个维度的限流状态
+type windowState struct {
+	count        int
+	windowStart  time.Time
+	blockedUntil time.Time
+}
+
+// check 核心检查逻辑
+func (rl *RateLimiter) check(m map[string]*windowState, key string, window, blockDur time.Duration, maxFails int, lowKey bool) (RateLimitResult, func()) {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	now := time.Now()
+	state, exists := m[key]
+	if !exists {
+		state = &windowState{}
+		if len(m) < maxEntries {
+			m[key] = state
+		}
+	}
+
+	if !state.blockedUntil.IsZero() && now.Before(state.blockedUntil) {
+		retry := int(state.blockedUntil.Sub(now).Seconds()) + 1
+		msg := "请求过于频繁，请稍后重试"
+		if lowKey {
+			msg = fmt.Sprintf("该账号登录尝试过于频繁，请 %d 秒后重试", retry)
+		}
+		return RateLimitResult{Blocked: true, RetryAfter: retry, Message: msg}, nil
+	}
+
+	if now.Sub(state.windowStart) > window {
+		state.count = 0
+		state.windowStart = now
+		state.blockedUntil = time.Time{}
+	}
+
+	recordFail := func() {
+		rl.mu.Lock()
+		defer rl.mu.Unlock()
+		s := m[key]
+		if s == nil {
+			return
+		}
+		if now.Sub(s.windowStart) > window {
+			s.count = 1
+			s.windowStart = now
+			return
+		}
+		s.count++
+		if s.count >= maxFails {
+			s.blockedUntil = now.Add(blockDur)
+		}
+	}
+
+	return RateLimitResult{Blocked: false}, recordFail
+}