Replace database phone one-time password rate limiter with Redis

[mitchellhenke]

changelog: Internal, Rate Limiting, Replace database phone one-time password rate limiter with Redis

[mitchellhenke]

There is a very slight difference in calculating the number of max attempts where Throttle uses greater than or equal to and OtpRateLimiter uses greater than

I think we'll want to rename the config and update it to not use the + 1 once we've switched over.

[zachmargolis]

LGTM. Since the limits for these are relatively low, we don't need to worry about like a transition/rollover case right? we'll just give everybody a quick rate limit reset at deploy time?

[mitchellhenke]

LGTM. Since the limits for these are relatively low, we don't need to worry about like a transition/rollover case right? we'll just give everybody a quick rate limit reset at deploy time?

I think the risk is relatively low, but opted to include the redis_throttle_otp_rate_limiter_read_enabled config (defaulting to false for production) to avoid the reset. It allows us to write to both for a bit while continuing to read from the current implementation. We can switch pretty quickly though, yeah.

[aduth]

Curious: What's the reason/context for refactoring this constant?

[mitchellhenke]

I think I was having trouble with the tests and having multiple avenues to stub since it can be accessed through the constant and the Throttle.attempt_window_in_minutes/1 method. It was a change I'd been considering for a bit and I swear there was a good reason to bring it into this PR in particular, but I'm struggling to remember the specifics 😓

Definitely open to improvements/reversion.