Is it possible to expose the match_discriminator for blocklists?

[monfresh]

Hi. For notifications, I'm logging the following text:

"#{req.env['rack.attack.matched']} throttle occurred for " \
"#{req.env['rack.attack.match_discriminator']}"

For throttles, it works great. For example:

req/ip throttle occurred for 127.0.0.1

However, for blocklists, it doesn't specify the user_id:

allow2ban otp delivery throttle occurred for

Here is my blocklist:

blocklist('allow2ban otp delivery') do |req|
  user_id = req.env['warden'].user&.id

  Allow2Ban.filter(
    user_id,
    maxretry: 5,
    findtime: 5.minutes,
    bantime: 5.minutes
  ) do
    req.get? && req.path == '/otp/new'
  end
end

Is there a way to expose the Allow2Ban key as the match_discriminator?

Thanks!

[ktheory]

@monfresh Neat question! I don't see an easy way to expose the Allow2Ban discriminator at the moment. I'd welcome a PR adding more instrumentation or events to Allow2Ban/Fail2Ban to enable your use case.

[Nowaker]

The fact it's not possible to expose the discriminator for blocklists without resorting to thread-local hacks suggests the data structure used for blocklists is lacking.

I've come across RackAttackAdmin library and it monkey-patches RackAttack and modified how blocklists work. I'm not sure if the modifications are enough for this feature, but it's worth checking out: https://github.com/TylerRick/rack_attack_admin#fail2banallow2ban