framework:
    rate_limiter:
        # OTP send-code: max 5 requests per hour per IP (prevents SMS flood)
        send_code:
            policy: 'sliding_window'
            limit: 5
            interval: '60 minutes'

        # Login: max 10 attempts per minute per IP (brute force protection)
        login:
            policy: 'fixed_window'
            limit: 10
            interval: '1 minute'

        # OTP verify: max 10 attempts per 15 minutes per IP
        verify_code:
            policy: 'sliding_window'
            limit: 10
            interval: '15 minutes'

        # Token issuance (oauth/token, otp-login): max 10 per 5 minutes per IP
        token_issue:
            policy: 'sliding_window'
            limit: 10
            interval: '5 minutes'

        # Password reset: max 5 per hour per IP
        password_reset:
            policy: 'sliding_window'
            limit: 5
            interval: '60 minutes'

        # Doctor profile claim: max 5 attempts per hour per (user, doctor) — ضد brute-force هویت
        doctor_claim:
            policy: 'sliding_window'
            limit: 5
            interval: '60 minutes'