Exempt admins and super viewers from auth rate limits

src/lib/server/auth/index.ts

@@ -106,8 +106,23 @@ export function listAuthAudit() {
         .all();
 }
 
-/** Persistent fixed windows are consumed before hashing, including failed setup. */
-export function consumeAuthAttempt(clientAddress: string, account: string, kind = 'login'): void {
+/** Persistent fixed windows are consumed before hashing, except for enabled admin roles. */
+export function consumeAuthAttempt(
+    clientAddress: string,
+    account: string,
+    kind: 'login' | 'setup' | 'password' = 'login'
+): void {
+    // Resolve the current role from storage; setup never has an existing account exemption.
+    if (
+        kind !== 'setup' &&
+        database()
+            .prepare(
+                `SELECT 1 FROM auth_users WHERE ${kind === 'login' ? 'username' : 'id'}=?
+                AND disabled=0 AND role IN ('admin','super_viewer')`
+            )
+            .get(kind === 'login' ? account.toLowerCase() : account)
+    )
+        return;
     const now = Date.now();
     const windowMs = 15 * 60_000;
     const ipKey = digest(`${kind}:ip:${clientAddress}`);