Enum StoreErrorPolicy 

#[non_exhaustive]
pub enum StoreErrorPolicy {
    Allow,
    Deny,
}

How super::RateLimitLayer treats a failure of the backing super::RateLimitStore, as distinct from a caller who is genuinely over budget.

The distinction that matters is transport vs logical, not open vs closed

The first cut of this knob was “on any store error, allow”. A security review falsified the premise it rested on — that a store failure is never caller-controlled — with a measured attack: [super::key_fn::default_key_fn] hashes an unvalidated Authorization header (this layer runs before authentication), so an unauthenticated caller mints one Redis key per request just by rotating that header. Drive that until the instance reaches maxmemory and every subsequent HSET fails with OOM — at which point a blanket fail-open serves every request unthrottled, including from buckets that were already exhausted. The bypass is reachable by anyone.

So the axis is not “open vs closed”. It is:

• A transport failure — the socket broke, the server is unreachable — is not caller-controlled and self-heals once the connection is replaced. Refusing here converts a limiter hiccup into a simultaneous outage of every rate-limited route, for a condition nobody in the request path can fix. This is what StoreErrorPolicy::Allow serves through.
• A logical failure — the store was reached and said no (OOM, a permission error, a poisoned mutex, a malformed reply) — may be caller-induced, does not self-heal, and is exactly the shape an attacker steers toward. It stays closed under every policy.

Concretely: Allow matches CratestackError::Unavailable and nothing else. Backends signal transport-class failures with that variant (cratestack-redis’s ratelimit::util::is_transport_class); anything else they return is refused even under Allow.

Key derivation remains fail-closed under both policies (cratestack#416) for the same reason the OOM case is: its inputs are caller-controlled.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Allow

Serve the request unthrottled when — and only when — the store failure is transport-class. Every other store failure is refused exactly as under StoreErrorPolicy::Deny.

Deny

Refuse on any store failure, transport-class included, with the store’s own error status and the normal typed error envelope. For deployments where the limiter is a security control (a paywall, a brute-force guard) rather than a capacity control.

Trait Implementations

impl Clone for StoreErrorPolicy

fn clone(&self) -> StoreErrorPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for StoreErrorPolicy

impl Debug for StoreErrorPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for StoreErrorPolicy

fn default() -> StoreErrorPolicy

Returns the “default value” for a type.

impl Eq for StoreErrorPolicy

impl PartialEq for StoreErrorPolicy

fn eq(&self, other: &StoreErrorPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for StoreErrorPolicy