fix

Signed-off-by: Hayim.Shaul@ibm.com <hayimsha@fhe03.vpc.cloud9.ibm.com>

Author: Hayim.Shaul@ibm.com

docs/configuration.md

@@ -1007,7 +1007,7 @@ Default values:
 - **burst**: Token bucket capacity, absorbing short spikes without raising the sustained rate; values below `rate` are raised to `rate`
 - **window**: Period over which the error and invalid-signature ratios are evaluated
 - **minSamples**: Minimum number of observations in a window before a ratio can escalate a principal
-- **errorRateThreshold**: Fraction of failing operations in a window that escalates a principal; `1` or more disables this trigger
+- **errorRateThreshold**: Fraction of failing operations in a window that escalates a principal; a value greater than `1` disables this trigger
 - **invalidSignatureRateThreshold**: Fraction of rejected verifications in a window that escalates a principal
 - **quotaReductionFactor**: Multiplier applied to `rate` and `burst` while a principal is soft-limited; must be in `(0,1]`
 - **softDuration**: Minimum time a principal stays on the reduced quota

docs/security/signature_observability.md

@@ -209,7 +209,7 @@ token:
 | `burst` | `400` | Bucket capacity, absorbing short spikes without raising the sustained rate. Values below `rate` are raised to `rate`. |
 | `window` | `1m` | Evaluation period for the ratio thresholds. |
 | `minSamples` | `50` | Minimum observations in a window before a ratio can escalate a principal. |
-| `errorRateThreshold` | `0.5` | Failing-operation fraction that escalates. `1` or more disables this trigger. |
+| `errorRateThreshold` | `0.5` | Failing-operation fraction that escalates. A value greater than `1` disables this trigger. |
 | `invalidSignatureRateThreshold` | `0.2` | Rejected-verification fraction that escalates. Stricter than the error threshold: a healthy caller does not present bad signatures. |
 | `quotaReductionFactor` | `0.25` | Multiplier applied to `rate` and `burst` at level `soft`. Must be in `(0,1]`. |
 | `softDuration` | `5m` | Minimum time on a reduced quota. |

token/services/identity/throttle/config.go

@@ -96,10 +96,11 @@ type Config struct {
 	// escalate a principal. Zero selects DefaultMinSamples.
 	MinSamples int `yaml:"minSamples,omitempty"`
 	// ErrorRateThreshold is the failing-operation fraction that escalates. Zero selects
-	// DefaultErrorRateThreshold; a value of 1 or more effectively disables this trigger.
+	// DefaultErrorRateThreshold; a value greater than 1 disables this trigger.
 	ErrorRateThreshold float64 `yaml:"errorRateThreshold,omitempty"`
 	// InvalidSignatureRateThreshold is the rejected-verification fraction that escalates.
-	// Zero selects DefaultInvalidSignatureRateThreshold.
+	// Zero selects DefaultInvalidSignatureRateThreshold; a value greater than 1 disables
+	// this trigger.
 	InvalidSignatureRateThreshold float64 `yaml:"invalidSignatureRateThreshold,omitempty"`
 	// QuotaReductionFactor multiplies Rate for a soft-limited principal. Zero selects
 	// DefaultQuotaReductionFactor. Must be in (0,1].
@@ -181,10 +182,10 @@ func (c *Config) Defaults() error {
 	}
 
 	if c.ErrorRateThreshold < 0 {
-		return errors.Errorf("invalid errorRateThreshold [%g], expected a fraction in [0,1]", c.ErrorRateThreshold)
+		return errors.Errorf("invalid errorRateThreshold [%g], expected a non-negative value (use > 1 to disable)", c.ErrorRateThreshold)
 	}
 	if c.InvalidSignatureRateThreshold < 0 {
-		return errors.Errorf("invalid invalidSignatureRateThreshold [%g], expected a fraction in [0,1]", c.InvalidSignatureRateThreshold)
+		return errors.Errorf("invalid invalidSignatureRateThreshold [%g], expected a non-negative value (use > 1 to disable)", c.InvalidSignatureRateThreshold)
 	}
 	if c.QuotaReductionFactor <= 0 || c.QuotaReductionFactor > 1 {
 		return errors.Errorf("invalid quotaReductionFactor [%g], expected a fraction in (0,1]", c.QuotaReductionFactor)