@20syldev/api 4.3.0 → 4.5.0

package/package.json

@@ -1,5 +1,5 @@
 {
-    "version": "4.3.0",
+    "version": "4.5.0",
     "name": "@20syldev/api",
     "description": "Node.js API with multiple features. Check the documentation at https://docs.sylvain.sh",
     "main": "dist/app.js",

package/src/config/env.ts

@@ -18,11 +18,16 @@ export const env = {
     GITHUB_TOKEN: process.env.GITHUB_TOKEN ?? '',
 
     DEFAULT_LIMIT: envNumber('DEFAULT_LIMIT', 2000),
+    ADVANCED_LIMIT: envNumber('ADVANCED_LIMIT', 3500),
     PRO_LIMIT: envNumber('PRO_LIMIT', 6000),
-    ADVANCED_LIMIT: envNumber('ADVANCED_LIMIT', 4000),
     BUSINESS_LIMIT: envNumber('BUSINESS_LIMIT', 10000),
     GLOBAL_LIMIT: envNumber('GLOBAL_LIMIT', 50000),
 
+    DEFAULT_BURST: envNumber('DEFAULT_BURST', 50),
+    ADVANCED_BURST: envNumber('ADVANCED_BURST', 80),
+    PRO_BURST: envNumber('PRO_BURST', 120),
+    BUSINESS_BURST: envNumber('BUSINESS_BURST', 200),
+
     BUSINESS_TOKEN_LIST: envList('BUSINESS_TOKEN_LIST') ?? [],
     PRO_TOKEN_LIST: envList('PRO_TOKEN_LIST') ?? [],
     ADVANCED_TOKEN_LIST: envList('ADVANCED_TOKEN_LIST') ?? [],

package/src/config/plans.ts

@@ -0,0 +1,61 @@
+import { env } from './env.js';
+
+/**
+ * Rate limit plans configuration.
+ *
+ * hourly  — max requests per hour (matches pricing page)
+ * burst   — max requests per 10-second window
+ * tokens  — list of bearer tokens for this tier
+ *
+ * To adjust limits, edit the values below or override via .env:
+ *   DEFAULT_LIMIT, ADVANCED_LIMIT, PRO_LIMIT, BUSINESS_LIMIT
+ *   DEFAULT_BURST, ADVANCED_BURST, PRO_BURST, BUSINESS_BURST
+ */
+
+export interface Plan {
+    hourly: number;
+    burst: number;
+    tokens: string[];
+}
+
+export const plans: Record<string, Plan> = {
+    business: {
+        hourly: env.BUSINESS_LIMIT,
+        burst: env.BUSINESS_BURST,
+        tokens: env.BUSINESS_TOKEN_LIST,
+    },
+    pro: {
+        hourly: env.PRO_LIMIT,
+        burst: env.PRO_BURST,
+        tokens: env.PRO_TOKEN_LIST,
+    },
+    advanced: {
+        hourly: env.ADVANCED_LIMIT,
+        burst: env.ADVANCED_BURST,
+        tokens: env.ADVANCED_TOKEN_LIST,
+    },
+    default: {
+        hourly: env.DEFAULT_LIMIT,
+        burst: env.DEFAULT_BURST,
+        tokens: [],
+    },
+};
+
+export const globalLimit = env.GLOBAL_LIMIT; // 50 000/h
+
+/**
+ * Returns the plan matching a bearer token, or 'default'.
+ * Returns null if the token is provided but invalid.
+ */
+export function getPlan(token: string): { name: string; plan: Plan } | null {
+    if (!token) return { name: 'default', plan: plans.default! };
+    if (token === 'undefined') return null;
+
+    for (const [name, plan] of Object.entries(plans)) {
+        if (name === 'default') continue;
+        if (plan.tokens.includes('undefined')) continue;
+        if (plan.tokens.includes(token)) return { name, plan };
+    }
+
+    return null;
+}

package/src/config/versions.ts

@@ -78,10 +78,20 @@ const v3 = {
 
 const v4 = {
     get: merge(v3.get, [
+        {
+            name: 'captcha',
+            path: '/captcha(&text={text}&length={n}&width={px}&height={px}&noise={low|medium|high}&bg={hex}&color={hex})',
+        },
+        { name: 'color', path: '/color(&hex={hex})' },
+        { name: 'convert', path: '/convert?value={value}&from={unit}&to={unit}' },
         { name: 'dice', path: '/dice?roll={NdX+M}' },
         { name: 'encode', path: '/encode?method={method}&text={text}(&shift={shift})' },
         { name: 'geo', path: '/geo?lat1={lat}&lon1={lon}&lat2={lat}&lon2={lon}' },
         { name: 'palette', path: '/palette?color={#hex}&type={type}' },
+        {
+            name: 'qrcode',
+            path: '/qrcode?url={URL}(&size={px}&margin={n}&correction={L|M|Q|H}&dark={hex}&light={hex}&icon={URL}&iconSize={px}&iconPadding={px}&iconRadius={px}&format={png|base64})',
+        },
         {
             name: 'placeholder',
             path: '/placeholder?type={image|skeleton}&width={w}&height={h}(&bg={hex}&color={hex}&text={text}&rows={n}&avatar={bool})',

package/src/constants.ts

@@ -14,8 +14,6 @@ export const MAX_GCD_VALUE = 100_000;
 export const MAX_PRIME_LIST = 10_000;
 export const MAX_LEVENSHTEIN_LENGTH = 1000;
 export const MAX_STRING_LENGTH = 1000;
-export const MIN_TEMPERATURE = -273.15;
-export const MAX_TEMPERATURE = 1_000_000;
 export const DOCS_URL = 'https://docs.sylvain.sh';
 export const DEFAULT_PORT = 3000;
 
@@ -24,6 +22,7 @@ export const STATUS_MESSAGES: Record<number, string> = {
     401: 'Unauthorized',
     404: 'Not Found',
     405: 'Method Not Allowed',
+    413: 'Payload Too Large',
     429: 'Too Many Requests',
     500: 'Internal Server Error',
 };

package/src/middleware/cors.ts

@@ -9,8 +9,14 @@ const __dirname = dirname(__filename);
 export function setupCors(app: Express): void {
     app.set('trust proxy', 1);
     app.use(cors({ methods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'] }));
-    app.use(express.urlencoded({ extended: true }));
-    app.use(express.json());
+    app.use(express.urlencoded({ extended: true, limit: '10kb' }));
+    app.use(express.json({ limit: '10kb' }));
+
+    app.use((_req, res, next) => {
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('X-Frame-Options', 'DENY');
+        next();
+    });
 
     app.use('/favicon.ico', express.static(join(__dirname, '..', '..', 'src', 'favicon.ico')));
     app.use('/robots.txt', express.static(join(__dirname, '..', '..', 'robots.txt')));

package/src/middleware/error.ts

@@ -1,7 +1,15 @@
 import type { Request, Response, NextFunction } from 'express';
 import { error } from '../utils/response.js';
 
-export function errorHandler(err: Error, _req: Request, res: Response, _next: NextFunction): void {
+export function errorHandler(
+    err: Error & { status?: number },
+    _req: Request,
+    res: Response,
+    _next: NextFunction,
+): void {
     console.error(err.stack);
-    error(res, 500, err.message);
+
+    const status = err.status && err.status >= 400 && err.status < 600 ? err.status : 500;
+    const sensitive = status === 500 && /\/[a-z]|\\[a-z]|ECONNREFUSED|ENOENT|EPERM|at\s+\w/i.test(err.message);
+    error(res, status, sensitive ? 'An unexpected error occurred.' : err.message);
 }

package/src/middleware/ratelimit.ts

@@ -1,45 +1,53 @@
 import type { Request, Response, NextFunction } from 'express';
-import { env } from '../config/env.js';
 import { ipLimits } from '../storage/index.js';
-import { SESSION_TTL } from '../constants.js';
+import { RATE_LIMIT_WINDOW, SESSION_TTL } from '../constants.js';
 import { error } from '../utils/response.js';
+import { getPlan, globalLimit } from '../config/plans.js';
 
 let requests = 0;
 let resetTime = Date.now() + SESSION_TTL;
 
+const burstTracker: Record<string, number[]> = {};
+
+// Cleanup stale IPs every hour
+setInterval(() => {
+    const currentHour = String(Math.floor(Date.now() / 3600000) % 24);
+    for (const ip of Object.keys(ipLimits)) {
+        const hours = Object.keys(ipLimits[ip]!);
+        if (hours.length === 0 || (hours.length === 1 && hours[0] !== currentHour)) {
+            delete ipLimits[ip];
+        }
+    }
+
+    const now = Date.now();
+    for (const ip of Object.keys(burstTracker)) {
+        burstTracker[ip] = burstTracker[ip]!.filter((t) => now - t < RATE_LIMIT_WINDOW);
+        if (burstTracker[ip]!.length === 0) delete burstTracker[ip];
+    }
+}, SESSION_TTL);
+
 export function rateLimitMiddleware(req: Request, res: Response, next: NextFunction): void {
-    const ip = (req.headers['cf-connecting-ip'] as string) || req.socket.remoteAddress || '';
+    const ip = req.ip || req.socket.remoteAddress || '';
     const token = req.headers.authorization?.split(' ')[1] || '';
 
     const now = Date.now();
     const minute = String(Math.floor(now / 60000) % 60);
     const hour = String(Math.floor(now / 3600000) % 24);
 
-    if (
-        (token && ![...env.BUSINESS_TOKEN_LIST, ...env.PRO_TOKEN_LIST, ...env.ADVANCED_TOKEN_LIST].includes(token)) ||
-        token === 'undefined'
-    ) {
+    const match = getPlan(token);
+    if (!match) {
         error(res, 401, 'Invalid token.');
         return;
     }
 
-    let requestLimit: number;
-    if (env.BUSINESS_TOKEN_LIST.includes(token) && !env.BUSINESS_TOKEN_LIST.includes('undefined')) {
-        requestLimit = env.BUSINESS_LIMIT;
-    } else if (env.PRO_TOKEN_LIST.includes(token) && !env.PRO_TOKEN_LIST.includes('undefined')) {
-        requestLimit = env.PRO_LIMIT;
-    } else if (env.ADVANCED_TOKEN_LIST.includes(token) && !env.ADVANCED_TOKEN_LIST.includes('undefined')) {
-        requestLimit = env.ADVANCED_LIMIT;
-    } else {
-        requestLimit = env.DEFAULT_LIMIT;
-    }
+    const { plan } = match;
 
     if (now > resetTime) {
         requests = 0;
         resetTime = now + SESSION_TTL;
     }
 
-    if (++requests > Math.max(env.GLOBAL_LIMIT, requestLimit)) {
+    if (++requests > Math.max(globalLimit, plan.hourly)) {
         error(res, 429, 'Global rate limit exceeded.');
         return;
     }
@@ -49,12 +57,26 @@ export function rateLimitMiddleware(req: Request, res: Response, next: NextFunct
         return;
     }
 
+    // Burst protection per tier
+    if (process.env.NODE_ENV !== 'test') {
+        if (!burstTracker[ip]) burstTracker[ip] = [];
+        burstTracker[ip] = burstTracker[ip]!.filter((t) => now - t < RATE_LIMIT_WINDOW);
+        burstTracker[ip]!.push(now);
+
+        if (burstTracker[ip]!.length > plan.burst) {
+            error(res, 429, 'Too many requests, please slow down.');
+            return;
+        }
+    }
+
+    // Hourly rate limit per IP
     if (!ipLimits[ip]) ipLimits[ip] = {};
     if (!ipLimits[ip]![hour]) ipLimits[ip]![hour] = {};
     ipLimits[ip]![hour]![minute] = (ipLimits[ip]![hour]![minute] ?? 0) + 1;
 
-    if (ipLimits[ip]![hour]![minute]! > requestLimit) {
-        error(res, 429, `You have exceeded the limit of ${requestLimit} requests per hour.`);
+    const hourTotal = Object.values(ipLimits[ip]![hour]!).reduce((sum, count) => sum + count, 0);
+    if (hourTotal > plan.hourly) {
+        error(res, 429, `You have exceeded the limit of ${plan.hourly} requests per hour.`);
         return;
     }
 

package/src/modules/v4/captcha.ts

@@ -1,49 +1,106 @@
 import { createCanvas } from 'canvas';
+import { normalizeColor } from '../../utils/colors.js';
 
-export default function captcha(text: string): Buffer {
-    if (!text) throw new Error('Text is required to generate a captcha.');
+export interface CaptchaOptions {
+    text?: string;
+    length?: number;
+    width?: number;
+    height?: number;
+    noise?: 'low' | 'medium' | 'high';
+    bg?: string;
+    color?: string;
+}
+
+export interface CaptchaResult {
+    contentType: string;
+    body: Buffer;
+    text: string;
+}
+
+const NOISE_LEVELS = new Set(['low', 'medium', 'high']);
+const NOISE_CONFIG = { low: { lines: 8, dots: 80 }, medium: { lines: 25, dots: 300 }, high: { lines: 50, dots: 600 } };
+const CHARSET = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789';
+
+function generateText(length: number): string {
+    let result = '';
+    for (let i = 0; i < length; i++) {
+        result += CHARSET[Math.floor(Math.random() * CHARSET.length)];
+    }
+    return result;
+}
+
+function clamp(value: number | undefined, name: string, def: number, min: number, max: number): number {
+    if (value === undefined) return def;
+    if (isNaN(value)) throw new Error(`${name} must be a number`);
+    if (value < min || value > max) throw new Error(`${name} must be between ${min} and ${max}`);
+    return Math.floor(value);
+}
+
+export default function captcha(options: CaptchaOptions): CaptchaResult {
+    const text = options.text || generateText(clamp(options.length, 'length', 6, 1, 20));
+    const height = clamp(options.height, 'height', 120, 50, 400);
+    const width = clamp(options.width, 'width', text.length * 60, 100, 800);
+
+    const noise = options.noise ?? 'medium';
+    if (!NOISE_LEVELS.has(noise)) throw new Error('noise must be one of: low, medium, high');
+    const { lines, dots } = NOISE_CONFIG[noise];
+
+    const bg = normalizeColor(options.bg, '#ffffff');
+    const baseColor = options.color ? normalizeColor(options.color, '#000000') : undefined;
 
-    const size = 60,
-        font = '60px Comic Sans Ms',
-        width = text.length * size,
-        height = 120;
-    const canvas = createCanvas(width, height),
-        ctx = canvas.getContext('2d');
+    const canvas = createCanvas(width, height);
+    const ctx = canvas.getContext('2d');
 
-    ctx.fillStyle = 'white';
+    ctx.fillStyle = bg;
     ctx.fillRect(0, 0, width, height);
 
-    for (let i = 0; i < 20; i++) {
-        ctx.strokeStyle = 'rgba(0, 0, 0, 0.3)';
+    for (let i = 0; i < lines; i++) {
+        ctx.strokeStyle = `rgba(${Math.floor(Math.random() * 180)}, ${Math.floor(Math.random() * 180)}, ${Math.floor(Math.random() * 180)}, ${0.3 + Math.random() * 0.4})`;
         ctx.beginPath();
-        ctx.moveTo(Math.random() * width, Math.random() * height);
-        ctx.lineTo(Math.random() * width, Math.random() * height);
-        ctx.lineWidth = Math.random() * 2;
+        const x0 = Math.random() * width,
+            y0 = Math.random() * height;
+        ctx.moveTo(x0, y0);
+        ctx.bezierCurveTo(
+            Math.random() * width,
+            Math.random() * height,
+            Math.random() * width,
+            Math.random() * height,
+            Math.random() * width,
+            Math.random() * height,
+        );
+        ctx.lineWidth = 1 + Math.random() * 2;
         ctx.stroke();
     }
 
-    let x = (canvas.width + 20 - width) / 2;
+    const baseFontSize = Math.floor(height * 0.5);
+    const charWidth = width / (text.length + 0.5);
+    let x = charWidth * 0.25;
 
     for (let i = 0; i < text.length; i++) {
-        const offsetX = Math.cos(i * 0.3) * 10,
-            y = height / 2.5 + Math.floor(Math.random() * (height / 2));
+        const size = Math.floor(baseFontSize * (0.8 + Math.random() * 0.4));
+        const y = height / 2 + (Math.random() - 0.5) * height * 0.3;
 
-        ctx.font = font;
-        ctx.fillStyle = `rgb(${Math.floor(Math.random() * 192)}, ${Math.floor(Math.random() * 192)}, ${Math.floor(Math.random() * 192)})`;
+        ctx.font = `${size}px Comic Sans Ms`;
+        if (baseColor) {
+            ctx.fillStyle = baseColor;
+        } else {
+            ctx.fillStyle = `rgb(${Math.floor(Math.random() * 180)}, ${Math.floor(Math.random() * 180)}, ${Math.floor(Math.random() * 180)})`;
+        }
 
         ctx.save();
-        ctx.translate(x + size / 2, y);
-        ctx.rotate((Math.random() - 0.5) * 0.5);
-        ctx.fillText(text[i]!, -size / 2 + offsetX, 0);
+        ctx.translate(x + charWidth / 2, y);
+        ctx.rotate((Math.random() - 0.5) * 1.2);
+        ctx.fillText(text[i]!, -charWidth / 2, 0);
         ctx.restore();
 
-        x += size;
+        x += charWidth;
     }
 
-    for (let i = 0; i < 200; i++) {
-        ctx.fillStyle = 'black';
-        ctx.fillRect(Math.floor(Math.random() * width), Math.floor(Math.random() * height), 1.2, 1.2);
+    for (let i = 0; i < dots; i++) {
+        ctx.fillStyle = `rgba(${Math.floor(Math.random() * 180)}, ${Math.floor(Math.random() * 180)}, ${Math.floor(Math.random() * 180)}, ${0.4 + Math.random() * 0.5})`;
+        const dotSize = 1 + Math.random() * 2;
+        ctx.fillRect(Math.floor(Math.random() * width), Math.floor(Math.random() * height), dotSize, dotSize);
     }
 
-    return canvas.toBuffer('image/png');
+    return { contentType: 'image/png', body: canvas.toBuffer('image/png'), text };
 }

package/src/modules/v4/chat.ts

@@ -1,4 +1,4 @@
-import { checkRateLimit } from './utils.js';
+import { checkRateLimit } from '../../utils/helpers.js';
 import { SESSION_TTL } from '../../constants.js';
 import type { ChatStorage, ChatMessage } from '../../types/storage.js';
 

package/src/modules/v4/color.ts

@@ -1,62 +1,66 @@
-export default function color(): Record<string, string> {
-    const r = Math.floor(Math.random() * 256),
-        g = Math.floor(Math.random() * 256),
-        b = Math.floor(Math.random() * 256);
+import { hexToRgb, rgbToHsl, rgbToHex } from '../../utils/colors.js';
+
+export interface ColorResult {
+    hex: string;
+    rgb: string;
+    hsl: string;
+    hsv: string;
+    hwb: string;
+    cmyk: string;
+}
+
+function rgbToHsv(r: number, g: number, b: number): [number, number, number] {
+    const max = Math.max(r, g, b),
+        min = Math.min(r, g, b),
+        v = max / 255,
+        s = max ? (max - min) / max : 0;
+
+    if (max === min) return [0, s * 100, v * 100];
+
+    let h = 0;
+    const d = max - min;
+    if (max === r) h = (g - b) / d + (g < b ? 6 : 0);
+    else if (max === g) h = (b - r) / d + 2;
+    else h = (r - g) / d + 4;
 
-    const hsl = ((): [number, number, number] => {
-        const r1 = r / 255,
-            g1 = g / 255,
-            b1 = b / 255,
-            max = Math.max(r1, g1, b1),
-            min = Math.min(r1, g1, b1),
-            l = (max + min) / 2;
-        if (max === min) return [0, 0, l * 100];
-        const d = max - min,
-            s = l > 0.5 ? d / (2 - max - min) : d / (max + min);
-        const h =
-            {
-                [r1]: (g1 - b1) / d + (g1 < b1 ? 6 : 0),
-                [g1]: (b1 - r1) / d + 2,
-                [b1]: (r1 - g1) / d + 4,
-            }[max] ?? 0;
-        return [(h * 60) % 360, s * 100, l * 100];
-    })();
+    return [(h * 60) % 360, s * 100, v * 100];
+}
+
+function rgbToHwb(r: number, g: number, b: number): [number, number, number] {
+    const [h] = rgbToHsv(r, g, b);
+    const whiteness = Math.min(r, g, b) / 255;
+    const blackness = 1 - Math.max(r, g, b) / 255;
+    return [h, whiteness * 100, blackness * 100];
+}
 
-    const hsv = ((): [number, number, number] => {
-        const max = Math.max(r, g, b),
-            min = Math.min(r, g, b),
-            v = max / 255,
-            s = max ? (max - min) / max : 0;
-        const h =
-            max === min
-                ? 0
-                : ({
-                      [r]: (g - b) / (max - min),
-                      [g]: 2 + (b - r) / (max - min),
-                      [b]: 4 + (r - g) / (max - min),
-                  }[max] ?? 0);
-        return [(h * 60) % 360, s * 100, v * 100];
-    })();
+function rgbToCmyk(r: number, g: number, b: number): [number, number, number, number] {
+    const k = 1 - Math.max(r, g, b) / 255;
+    const c = (1 - r / 255 - k) / (1 - k) || 0;
+    const m = (1 - g / 255 - k) / (1 - k) || 0;
+    const y = (1 - b / 255 - k) / (1 - k) || 0;
+    return [c * 100, m * 100, y * 100, k * 100];
+}
+
+export default function color(hex?: string): ColorResult {
+    let r: number, g: number, b: number;
 
-    const hwb = ((): [number, number, number] => {
-        const [h] = hsv,
-            whiteness = Math.min(r, g, b) / 255,
-            blackness = 1 - Math.max(r, g, b) / 255;
-        return [h, whiteness * 100, blackness * 100];
-    })();
+    if (hex) {
+        [r, g, b] = hexToRgb(hex);
+    } else {
+        r = Math.floor(Math.random() * 256);
+        g = Math.floor(Math.random() * 256);
+        b = Math.floor(Math.random() * 256);
+    }
 
-    const cmyk = ((): [number, number, number, number] => {
-        const k = 1 - Math.max(r, g, b) / 255,
-            c = (1 - r / 255 - k) / (1 - k) || 0,
-            m = (1 - g / 255 - k) / (1 - k) || 0,
-            y = (1 - b / 255 - k) / (1 - k) || 0;
-        return [c * 100, m * 100, y * 100, k * 100];
-    })();
+    const [h, s, l] = rgbToHsl(r, g, b);
+    const hsv = rgbToHsv(r, g, b);
+    const hwb = rgbToHwb(r, g, b);
+    const cmyk = rgbToCmyk(r, g, b);
 
     return {
-        hex: `#${[r, g, b].map((x) => x.toString(16).padStart(2, '0')).join('')}`,
+        hex: rgbToHex(r, g, b),
         rgb: `rgb(${r}, ${g}, ${b})`,
-        hsl: `hsl(${hsl[0].toFixed(1)}, ${hsl[1].toFixed(1)}%, ${hsl[2].toFixed(1)}%)`,
+        hsl: `hsl(${h.toFixed(1)}, ${(s * 100).toFixed(1)}%, ${(l * 100).toFixed(1)}%)`,
         hsv: `hsv(${hsv[0].toFixed(1)}, ${hsv[1].toFixed(1)}%, ${hsv[2].toFixed(1)}%)`,
         hwb: `hwb(${hwb[0].toFixed(1)}, ${hwb[1].toFixed(1)}%, ${hwb[2].toFixed(1)}%)`,
         cmyk: `cmyk(${cmyk.map((x) => x.toFixed(1)).join('%, ')}%)`,