@20syldev/api 4.4.0 → 4.5.0

package/src/middleware/ratelimit.ts

@@ -1,45 +1,53 @@
 import type { Request, Response, NextFunction } from 'express';
-import { env } from '../config/env.js';
 import { ipLimits } from '../storage/index.js';
-import { SESSION_TTL } from '../constants.js';
+import { RATE_LIMIT_WINDOW, SESSION_TTL } from '../constants.js';
 import { error } from '../utils/response.js';
+import { getPlan, globalLimit } from '../config/plans.js';
 
 let requests = 0;
 let resetTime = Date.now() + SESSION_TTL;
 
+const burstTracker: Record<string, number[]> = {};
+
+// Cleanup stale IPs every hour
+setInterval(() => {
+    const currentHour = String(Math.floor(Date.now() / 3600000) % 24);
+    for (const ip of Object.keys(ipLimits)) {
+        const hours = Object.keys(ipLimits[ip]!);
+        if (hours.length === 0 || (hours.length === 1 && hours[0] !== currentHour)) {
+            delete ipLimits[ip];
+        }
+    }
+
+    const now = Date.now();
+    for (const ip of Object.keys(burstTracker)) {
+        burstTracker[ip] = burstTracker[ip]!.filter((t) => now - t < RATE_LIMIT_WINDOW);
+        if (burstTracker[ip]!.length === 0) delete burstTracker[ip];
+    }
+}, SESSION_TTL);
+
 export function rateLimitMiddleware(req: Request, res: Response, next: NextFunction): void {
-    const ip = (req.headers['cf-connecting-ip'] as string) || req.socket.remoteAddress || '';
+    const ip = req.ip || req.socket.remoteAddress || '';
     const token = req.headers.authorization?.split(' ')[1] || '';
 
     const now = Date.now();
     const minute = String(Math.floor(now / 60000) % 60);
     const hour = String(Math.floor(now / 3600000) % 24);
 
-    if (
-        (token && ![...env.BUSINESS_TOKEN_LIST, ...env.PRO_TOKEN_LIST, ...env.ADVANCED_TOKEN_LIST].includes(token)) ||
-        token === 'undefined'
-    ) {
+    const match = getPlan(token);
+    if (!match) {
         error(res, 401, 'Invalid token.');
         return;
     }
 
-    let requestLimit: number;
-    if (env.BUSINESS_TOKEN_LIST.includes(token) && !env.BUSINESS_TOKEN_LIST.includes('undefined')) {
-        requestLimit = env.BUSINESS_LIMIT;
-    } else if (env.PRO_TOKEN_LIST.includes(token) && !env.PRO_TOKEN_LIST.includes('undefined')) {
-        requestLimit = env.PRO_LIMIT;
-    } else if (env.ADVANCED_TOKEN_LIST.includes(token) && !env.ADVANCED_TOKEN_LIST.includes('undefined')) {
-        requestLimit = env.ADVANCED_LIMIT;
-    } else {
-        requestLimit = env.DEFAULT_LIMIT;
-    }
+    const { plan } = match;
 
     if (now > resetTime) {
         requests = 0;
         resetTime = now + SESSION_TTL;
     }
 
-    if (++requests > Math.max(env.GLOBAL_LIMIT, requestLimit)) {
+    if (++requests > Math.max(globalLimit, plan.hourly)) {
         error(res, 429, 'Global rate limit exceeded.');
         return;
     }
@@ -49,12 +57,26 @@ export function rateLimitMiddleware(req: Request, res: Response, next: NextFunct
         return;
     }
 
+    // Burst protection per tier
+    if (process.env.NODE_ENV !== 'test') {
+        if (!burstTracker[ip]) burstTracker[ip] = [];
+        burstTracker[ip] = burstTracker[ip]!.filter((t) => now - t < RATE_LIMIT_WINDOW);
+        burstTracker[ip]!.push(now);
+
+        if (burstTracker[ip]!.length > plan.burst) {
+            error(res, 429, 'Too many requests, please slow down.');
+            return;
+        }
+    }
+
+    // Hourly rate limit per IP
     if (!ipLimits[ip]) ipLimits[ip] = {};
     if (!ipLimits[ip]![hour]) ipLimits[ip]![hour] = {};
     ipLimits[ip]![hour]![minute] = (ipLimits[ip]![hour]![minute] ?? 0) + 1;
 
-    if (ipLimits[ip]![hour]![minute]! > requestLimit) {
-        error(res, 429, `You have exceeded the limit of ${requestLimit} requests per hour.`);
+    const hourTotal = Object.values(ipLimits[ip]![hour]!).reduce((sum, count) => sum + count, 0);
+    if (hourTotal > plan.hourly) {
+        error(res, 429, `You have exceeded the limit of ${plan.hourly} requests per hour.`);
         return;
     }
 

package/src/modules/v4/hyperplanning.ts

@@ -11,8 +11,34 @@ interface CalendarEvent {
     end: string;
 }
 
+function blocked(hostname: string): boolean {
+    const list = ['localhost', '127.0.0.1', '0.0.0.0', '[::1]', 'metadata.google.internal'];
+    if (list.includes(hostname)) return true;
+
+    const parts = hostname.split('.').map(Number);
+    if (parts.length === 4 && parts.every((n) => !isNaN(n))) {
+        if (parts[0] === 10) return true;
+        if (parts[0] === 172 && parts[1]! >= 16 && parts[1]! <= 31) return true;
+        if (parts[0] === 192 && parts[1] === 168) return true;
+        if (parts[0] === 169 && parts[1] === 254) return true;
+        if (parts[0] === 0) return true;
+    }
+
+    return false;
+}
+
 export default async function hyperplanning(url: string, detail?: string): Promise<CalendarEvent[]> {
-    const response = await fetch(url);
+    let parsed: URL;
+    try {
+        parsed = new URL(url);
+    } catch {
+        throw new Error('Invalid URL.');
+    }
+
+    if (parsed.protocol !== 'https:') throw new Error('Only HTTPS URLs are allowed.');
+    if (blocked(parsed.hostname)) throw new Error('Access to private/internal hosts is not allowed.');
+
+    const response = await fetch(url, { signal: AbortSignal.timeout(10_000) });
 
     if (!response.ok || !(response.headers.get('content-type') || '').includes('text/calendar')) {
         throw new Error('Invalid ICS file format.');

package/src/routes/get.ts

@@ -61,7 +61,7 @@ router.get('/:version/algorithms', (req: Request, res: Response) => {
     const { version } = req.params;
 
     const algorithms = req.module.algorithms as Record<string, (v: string, v2?: string) => unknown>;
-    if (!algorithms || !algorithms[method as string]) {
+    if (!algorithms || !method || !Object.hasOwn(algorithms, method as string)) {
         error(res, 400, 'Please provide a valid algorithm (?method={algorithm})', `${version}/algorithms`);
         return;
     }
@@ -217,7 +217,7 @@ router.get('/:version/encode', (req: Request, res: Response) => {
         error(res, 404, `Endpoint not available in ${version}.`, `${version}/encode`);
         return;
     }
-    if (!method || !encode[method as string]) {
+    if (!method || !Object.hasOwn(encode, method as string)) {
         error(res, 400, 'Please provide a valid method (?method={method})', `${version}/encode`);
         return;
     }
@@ -434,7 +434,7 @@ router.get('/:version/text', (req: Request, res: Response) => {
         error(res, 404, `Endpoint not available in ${version}.`, `${version}/text`);
         return;
     }
-    if (!method || !textMod[method as string]) {
+    if (!method || !Object.hasOwn(textMod, method as string)) {
         error(res, 400, 'Please provide a valid method (?method={slug|stats|lorem|number})', `${version}/text`);
         return;
     }
@@ -471,7 +471,7 @@ router.get('/:version/validate', (req: Request, res: Response) => {
         error(res, 404, `Endpoint not available in ${version}.`, `${version}/validate`);
         return;
     }
-    if (!type || !validate[type as string]) {
+    if (!type || !Object.hasOwn(validate, type as string)) {
         error(res, 400, 'Please provide a valid type (?type={luhn|iban|email})', `${version}/validate`);
         return;
     }

package/src/utils/response.ts

@@ -10,10 +10,18 @@ import { DOCS_URL, STATUS_MESSAGES } from '../constants.js';
  * @param docPath - Optional documentation path appended to the base URL
  */
 export function error(res: Response, status: number, message: string, docPath?: string): void {
-    res.status(status).jsonResponse({
+    const body = {
         message: STATUS_MESSAGES[status] ?? 'Error',
         error: message,
         documentation: docPath ? `${DOCS_URL}/${docPath}` : DOCS_URL,
         status: String(status),
-    });
+    };
+
+    if (typeof res.jsonResponse === 'function') {
+        res.status(status).jsonResponse(body);
+    } else {
+        res.status(status)
+            .setHeader('Content-Type', 'application/json')
+            .send(JSON.stringify(body, null, 2));
+    }
 }

package/tests/integration/api.test.ts

@@ -536,3 +536,41 @@ describe('POST /v4/token', () => {
         assert.equal(status, 400);
     });
 });
+
+// --- Security ---
+
+describe('Security headers', () => {
+    test('returns X-Content-Type-Options and X-Frame-Options', async () => {
+        const res = await fetch(`${baseUrl}/v4/color`);
+        assert.equal(res.headers.get('x-content-type-options'), 'nosniff');
+        assert.equal(res.headers.get('x-frame-options'), 'DENY');
+    });
+});
+
+describe('Payload size limit', () => {
+    test('body > 10kb returns 413', async () => {
+        const res = await fetch(`${baseUrl}/v4/hash`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ text: 'A'.repeat(20000), method: 'sha256' }),
+        });
+        assert.equal(res.status, 413);
+    });
+});
+
+describe('Prototype access on dynamic endpoints', () => {
+    test('algorithms?method=toString returns 400', async () => {
+        const { status } = await getJson('/v4/algorithms?method=toString');
+        assert.equal(status, 400);
+    });
+
+    test('encode?method=constructor returns 400', async () => {
+        const { status } = await getJson('/v4/encode?method=constructor&text=hello');
+        assert.equal(status, 400);
+    });
+
+    test('validate?type=hasOwnProperty returns 400', async () => {
+        const { status } = await getJson('/v4/validate?type=hasOwnProperty&value=test');
+        assert.equal(status, 400);
+    });
+});

package/tests/unit/hyperplanning.test.ts

@@ -70,6 +70,25 @@ describe('hyperplanning', () => {
         const events = await hyperplanning('https://fake.test/cal.ics');
         assert.equal(events.length, 0);
     });
+
+    test('throws on HTTP URL', async () => {
+        await assert.rejects(() => hyperplanning('http://fake.test/cal.ics'), /Only HTTPS/);
+    });
+
+    test('throws on private IP', async () => {
+        await assert.rejects(() => hyperplanning('https://127.0.0.1/cal.ics'), /private/);
+        await assert.rejects(() => hyperplanning('https://192.168.1.1/cal.ics'), /private/);
+        await assert.rejects(() => hyperplanning('https://10.0.0.1/cal.ics'), /private/);
+        await assert.rejects(() => hyperplanning('https://169.254.169.254/latest'), /private/);
+    });
+
+    test('throws on localhost', async () => {
+        await assert.rejects(() => hyperplanning('https://localhost/cal.ics'), /private/);
+    });
+
+    test('throws on invalid URL', async () => {
+        await assert.rejects(() => hyperplanning('not-a-url'), /Invalid URL/);
+    });
 });
 
 before(() => {