{
  "name": "session.pair \u2014 the sixth failed attempt in a minute is locked out",
  "description": "Rate limiting is what stops another local process brute-forcing its way to a token.",
  "transport": "ws",
  "request": {
    "jsonrpc": "2.0",
    "id": 102,
    "method": "session.pair",
    "params": {
      "clientName": "Velox for Firefox",
      "extensionId": "11111111-2222-3333-4444-555555555555",
      "code": "0000"
    }
  },
  "response": {
    "jsonrpc": "2.0",
    "id": 102,
    "error": {
      "code": -32014,
      "message": "too many pairing attempts; try again later",
      "data": {
        "retryAfterSec": 60
      }
    }
  },
  "assertions": [
    "five failures per minute, then a 60 s lockout",
    "the lockout is per-origin and survives a reconnect, or it is not a lockout",
    "no user prompt is shown while locked out \u2014 the prompt itself is the thing being flooded",
    "the runner does not brute-force a live daemon; mockd reproduces it under --lockout"
  ],
  "requires": "six failed pairing attempts inside one minute"
}