// The shared login-protection stack, ordered cheapest-rejection-first:
//
//   backoffGuard → per-IP exponential lockout on repeated failures
//   slowLogin    → progressive per-request delay within the window
//   loginLimiter → hard 10-per-15-min cap
//
// Every credential-guessing surface spreads it with `...loginGuards`: local
// login, the TOTP second step, registration, invite acceptance and the SSO TOTP
// step. It lived inline in auth.routes.js while all but one of those were in the
// same file; the domain split (docs/website/API_V2_PLAN.md § Phase 2) puts them in
// five, so it moved here rather than being copied five times. Duplicating a
// throttling stack is how the copies drift — and the copy that drifts is the one
// that stops throttling.
//
// The array is exported frozen: it is module-level shared state, and a router
// that pushed onto it would silently add middleware to every other login surface.

const { loginLimiter } = require('../../../middleware/rateLimit')
const { slowLogin, backoffGuard } = require('../../../middleware/loginProtection')

const loginGuards = Object.freeze([backoffGuard, slowLogin, loginLimiter])

module.exports = { loginGuards }
