Make key_getter mandatory for RateLimiter

Author: RobertoPrevato

CHANGELOG.md

@@ -14,9 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   can raise `InvalidCredentialsError` when invalid credentials are provided, to
   enable automatic logging and, if enabled, brute-force protection.
 - Add `RateLimiter` class that can block authentication attempts after a configurable
-  threshold is exceeded. By default stores failed attempts in-memory. This feature is
-  disabled unless a `key_getter` function is provided (a function to obtain a context
-  key from the user-defined authentication context, like a client IP).
+  threshold is exceeded. By default stores failed attempts in-memory.
 - Integrate `RateLimiter` into `AuthenticationStrategy` with automatic tracking of
   failed authentication attempts and support for blocking excessive requests.
 - Add Python `3.14` and remove `3.9` from the build matrix.

guardpost/protection.py

@@ -137,7 +137,7 @@ class RateLimiter:
 
     def __init__(
         self,
-        key_getter: Optional[Callable[[Any], str]] = None,
+        key_getter: Callable[[Any], str],
         threshold: int = 20,
         block_time: int = 60,
         store: Optional[AuthenticationAttemptsStore] = None,
@@ -148,10 +148,8 @@ def __init__(
         Initialize a RateLimiter instance for brute-force protection.
 
         Args:
-            key_getter: Optional callable that extracts a unique key from the
+            key_getter: Callable that extracts a unique key from the
                 authentication context (e.g., client IP address, username).
-                If None, brute-force protection is disabled and a deprecation
-                warning is issued.
             threshold: Maximum number of failed authentication attempts allowed
                 before blocking. Must be a positive integer. Defaults to 20.
             block_time: Duration in seconds to block further attempts after
@@ -173,6 +171,8 @@ def __init__(
         self._store = store or SelfCleaningInMemoryAuthenticationAttemptsStore(
             max_entry_age=self._block_time + 5
         )
+        if not key_getter:
+            raise TypeError("Missing key_getter")
         self._key_getter = key_getter
         self._logger = logger or logging.getLogger("guardpost")
 
@@ -182,8 +182,6 @@ def get_context_key(self, context: Any) -> str:
         If a key_getter is not configured, rate limiting is disabled and
         returns an empty string.
         """
-        if not self._key_getter:
-            return ""
         return self._key_getter(context)
 
     async def validate_authentication_attempt(self, context: Any) -> None:

tests/test_protection.py

@@ -149,17 +149,6 @@ def test_get_context_key(self, basic_limiter):
         key = basic_limiter.get_context_key(context)
         assert key == "192.168.1.1"
 
-    def test_get_context_key_no_extractor(self):
-        limiter = RateLimiter(key_getter=None)
-        key = limiter.get_context_key({"ip": "192.168.1.1"})
-        assert key == ""
-
-    @pytest.mark.asyncio
-    async def test_allow_authentication_attempt_no_key(self):
-        limiter = RateLimiter(key_getter=None)
-        result = await limiter.allow_authentication_attempt({})
-        assert result is True
-
     @pytest.mark.asyncio
     async def test_allow_authentication_attempt_trusted_key(self):
         limiter = RateLimiter(key_getter=self.key_getter, trusted_keys=["192.168.1.1"])