login: logins by key capped per user

Review 6: a node remembers the challenges used until they expire, 10 000
at most, and refused every login by key once full. One user holding a
key could make 10 000 logins within five minutes and keep everyone else
out.

A user may now log in by key at most --key-logins-per-user times (100)
on a node within a challenge's lifetime, past which that user waits and
others don't; the 10 000 stay as the cap for all users together. The
lifetime, five minutes until now, is --challenge-lifetime.

1 files changed, 5 insertions, 3 deletions

diff --git a/docs/access.md b/docs/access.md
index 909d915..3541efd 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -125,9 +125,11 @@ jq -n --arg c "$c" --rawfile s sig '{user: "alice", challenge: $c, signature: $s
   curl -s -X POST localhost:3000/auth/login/key -H 'Content-Type: application/json' -d @-
 ```
 
-A challenge is the node's, signed by it, valid for five minutes, and taken once (the
-node remembers which in memory: after a restart, one captured in its five minutes
-could be taken once more; it goes over TLS, as passwords do);
+A challenge is the node's, signed by it, valid for five minutes (`--challenge-lifetime`),
+and taken once (the node remembers which in memory: after a restart, one captured in
+its five minutes could be taken once more; it goes over TLS, as passwords do). A user
+logs in by key at most 100 times on a node within those minutes
+(`--key-logins-per-user`), so one holding a key can't keep the others out;
 the signature must be by one of the user's keys, as the registry the node holds then
 says, and the user enabled (`401` if not, saying why). A swarm without a registry has
 no keys (`409`).