@lacspace/lock

Account lockout & brute-force protection — "server lock".

Stop credential-stuffing and brute force at the door. Track failed attempts per key (user, email, IP), lock after N strikes with exponential backoff, auto-expire the window, and reset on success. In-memory store built in; implement LockStore for Redis/Mongo.

• 🔒 record / check / reset with a clear LockStatus
• 📈 Exponential backoff up to a cap · self-resetting window
• 🔌 Pluggable LockStore (memory included)
• ⚡ Zero dependencies · 🌍 isomorphic · fully typed

Install

npm install @lacspace/lock

Usage

import { lockout } from "@lacspace/lock";

const guard = lockout({ maxAttempts: 5, baseDelayMs: 60_000, maxDelayMs: 3_600_000 });

// before checking the password
const status = await guard.check(email);
if (status.locked) throw new Error(`Too many attempts. Try again in ${Math.ceil(status.retryAfterMs / 1000)}s`);

if (await verifyPassword(input, stored)) {
  await guard.reset(email);          // success — clear strikes
} else {
  const s = await guard.record(email); // failure — may lock
  throw new Error(s.locked ? "Account temporarily locked." : `${s.remaining} attempts left`);
}

API

| Export | Description | | --- | --- | | lockout(opts?) | maxAttempts, baseDelayMs, maxDelayMs, windowMs, store | | .check(key) | status without recording | | .record(key) | record a failure → new status | | .reset(key) | clear on success | | MemoryLockStore / LockStore | storage (bring your own for Redis) |

LockStatus → { locked, attempts, remaining, retryAfterMs }.

The Lacspace Security Kit

| Package | For | | --- | --- | | @lacspace/crypto | AES encryption & hashing | | @lacspace/password | Password hashing | | @lacspace/jwt | JWTs & tokens | | @lacspace/apikey | API keys | | @lacspace/otp | TOTP/HOTP 2FA | | @lacspace/webauthn | Passkeys / biometric | | @lacspace/mfa | 2FA/3FA orchestration | | @lacspace/lock | Account lockout (this package) | | @lacspace/headers | Secure headers / CSP | | @lacspace/redact | Log redaction |

Licensing

This package is free under the Lacspace Free Licence — MIT-equivalent freedoms. Use it in personal and commercial projects at no cost; just keep the notice.

Not every Lacspace package is free. We also offer Commercial (paid), Client-specific, and Private (proprietary) packages under separate terms. See the full Lacspace Licence Centre.

Part of the Lacspace ecosystem — 35 zero-dependency, isomorphic TypeScript packages.

All packages ↗ · npm org ↗ · Licence Centre ↗ · GitHub ↗