"""
Scoped rate limits for the auth endpoints the PRD explicitly calls out as
sensitive (§34: "Rate-limit login, password reset..."). IP-based (Anon), not
per-user, since a login/password-reset attempt happens before — or in the
case of a bad password, instead of — establishing who the user is.
"""
from rest_framework.throttling import AnonRateThrottle


class LoginRateThrottle(AnonRateThrottle):
    scope = 'login'


class PasswordResetRateThrottle(AnonRateThrottle):
    scope = 'password_reset'