@90soft/parse-server-kit 2.10.1 → 2.11.0

package/CHANGELOG.md

@@ -8,6 +8,90 @@ All notable changes to `@90soft/parse-server-kit`.
 
 ---
 
+## [2.11.0]
+
+### Security
+
+- **`rateLimit` could be bypassed completely, by anyone, without an account.**
+  The bucket key was `req.headers['x-parse-session-token'] || req.ip`. That
+  header is supplied by the caller and is **not validated at this point in the
+  pipeline** — the entity-route middleware runs before Parse Server resolves the
+  session — so sending a fresh random token on every request minted a fresh
+  bucket each time.
+
+  Measured against a limit of `max: 3`: ten requests with ten different random
+  tokens all succeeded. The limiter was decorative.
+
+  The key is now the **client address** (`req.ip`, falling back to the socket
+  address). An optional `keyBy` is available for apps that can derive a
+  trustworthy identity themselves.
+
+  ```ts
+  @CloudFunction({ rateLimit: { windowMs: 60_000, max: 5 } })          // keyed on address
+  @CloudFunction({ rateLimit: { windowMs: 60_000, max: 5, keyBy: r => r.apiKeyId } })
+  ```
+
+  **Two things to know when you adopt this:**
+
+  1. **Configure Express `trust proxy` precisely** — a hop count, or the proxy's
+     address — if you run behind nginx or a load balancer. `req.ip` honours that
+     setting, so a permissive `true` lets a caller spoof the key with
+     `X-Forwarded-For`. This is the same bypass Parse Server fixed for its own
+     limiter in 9.10.1. Unset, Express ignores the header, which is safe.
+  2. **Limits were previously per session token and are now per address**, so
+     several users behind one NAT now share a bucket. Raise `max` where that
+     matters, or supply `keyBy`.
+
+- **The bucket store is now bounded** (10,000 clients per function, oldest
+  evicted). A caller rotating addresses could previously grow the map without
+  limit, turning the rate limiter into a memory-exhaustion vector.
+
+### Added
+
+- `resetRateLimits()`, exported for tests.
+- `test/rateLimit.test.ts` — eight tests, including the bypass above as a
+  regression. Rate limiting previously had **no test coverage at all**; the
+  regression test was verified to fail against the old implementation.
+
+### Changed
+
+- **`engines.node` is now `>=20.19.0`** (was `>=18.0.0`). Parse Server 9
+  requires it, so the old floor advertised a combination that cannot work.
+- **Peer floors raised** to `parse >= 8.0.0` and `parse-server >= 9.0.0` (were
+  `>= 5.0.0` and `>= 8.3.0`). Development and tests now run against
+  `parse@8.6.2` / `parse-server@9.10.1`; previously the kit was tested against
+  Parse JS SDK **5** while every consuming app ran 8.x. That gap matters:
+  SDK 6 made `Parse.Object.set`/`setACL`/`unset` and `Role.setName` **throw**
+  instead of taking an error callback, so such a failure escapes the
+  `catchError` convention entirely.
+
+  The floors stay permissive deliberately — nothing in a consuming app breaks on
+  install. **Parse Server ≥ 9.10.1 is strongly recommended**: the 9.5→9.10 line
+  is almost entirely security fixes, including account takeover through
+  auth-adapter identity spoofing, protected-field bypasses via logical
+  operators, dot-notation, relation counts and LiveQuery, and several stored-XSS
+  routes through file upload.
+
+### Notes
+
+- Rate limiting remains **per process**: with N app instances the effective
+  limit is N × `max`. For cross-instance enforcement use Parse Server's own
+  `rateLimit` server option with `redisUrl`.
+- A unique index with a **value** predicate (e.g. "one active row per pair")
+  needs `partialFilterExpression`, not `partialFilterNulls` — the latter only
+  emits `$exists: true`. Use the `options` escape hatch, which is passed
+  straight through to MongoDB:
+
+  ```ts
+  compoundIndexes: [{
+    fields: ['trainee', 'sport'],
+    unique: true,
+    options: { partialFilterExpression: { status: 'active' } },
+  }]
+  ```
+
+---
+
 ## [2.10.1]
 
 Twelve fixes found by a full read of the source, each verified against a running

package/CLAUDE.md

@@ -187,7 +187,7 @@ Static-method decorator. Registers the function and wraps it with role checking.
 interface RouteConfig {
   methods: HttpMethod[];                      // 'GET'|'POST'|'PUT'|'DELETE'|'PATCH'
   requiresAuth?: boolean;
-  rateLimit?: {windowMs: number; max: number};
+  rateLimit?: {windowMs: number; max: number; keyBy?: (req) => string};  // keyed on client ADDRESS
   validation?: Parse.Cloud.Validator;
   description?: string;
   requireRoles?: string[];
@@ -454,11 +454,35 @@ parent's final ACL and **before** saving. For status-derived visibility set in a
 | `removeResultMiddleware` | Unwraps Parse's `{result: …}` response |
 | `conditionalJsonMiddleware` | `express.json({limit:'10mb', type:['text/plain']})`, skipping `{mountPath}/files` |
 | `validateFunctionRoutes` | Legacy `/functions/*` validation |
-| `checkRateLimit(req,res,name,cfg)` | In-process token bucket; returns `false` after sending 429 |
+| `checkRateLimit(req,res,name,cfg)` | In-process token bucket keyed on client address; returns `false` after sending 429 |
 
 **Master key** is read from the `X-Parse-Master-Key` header (preferred) or the
-request body (deprecated, warns once). Rate limiting is **per process** — no
-enforcement across instances.
+request body (deprecated, warns once).
+
+### Rate limiting — read before relying on it
+
+The bucket key is the **client address** (`req.ip`, falling back to the socket
+address). Pass `keyBy` only if the app can derive an identity it actually trusts.
+
+> Before 2.11.0 the key was `x-parse-session-token || req.ip`. That header is
+> caller-supplied and unvalidated here — this middleware runs **before** Parse
+> resolves the session — so a rotating random token minted a fresh bucket per
+> request and the limit did nothing. Ten requests passed a limit of three.
+
+Three constraints:
+
+1. **`trust proxy` must be exact** — a hop count or the proxy's address — when
+   behind nginx or a load balancer. `req.ip` honours it, so a permissive `true`
+   lets a caller spoof the key via `X-Forwarded-For` (the bypass Parse Server
+   fixed for its own limiter in 9.10.1). Unset is safe: Express ignores the
+   header.
+2. **Per process.** With N instances the effective limit is N × `max`. For
+   cross-instance enforcement use Parse Server's `rateLimit` option with
+   `redisUrl`.
+3. **Per address, not per user.** Users behind one NAT share a bucket.
+
+The store is bounded at 10,000 clients per function, oldest evicted, so a caller
+rotating addresses cannot grow it without limit.
 
 ---
 
@@ -488,7 +512,9 @@ interface CompoundIndex {
   unique?: boolean;
   name?: string;
   sparse?: boolean;
-  partialFilterNulls?: boolean;                       // only index docs where all fields exist
+  partialFilterNulls?: boolean;                       // only index docs where all fields EXIST
+  // For a VALUE predicate (e.g. one active row per pair) use the options escape hatch:
+  //   options: {partialFilterExpression: {status: 'active'}}   -> passed straight to MongoDB
   fieldTypes?: Record<string, 1|-1|'text'|'2dsphere'|'hashed'>;
   options?: Record<string, unknown>;                  // e.g. default_language
 }
@@ -688,11 +714,21 @@ output for `[Versioning]`.
 
 | | Requirement |
 |---|---|
-| Node | ≥ 18 for this package; **≥ 20.19** with parse-server 9 |
-| parse-server | ≥ 8.3 (optional peer) — `keepUnknownIndexes`, adapter internals |
+| Node | **≥ 20.19** |
+| parse-server | ≥ 9.0 (optional peer); **≥ 9.10.1 strongly recommended** — see below. ≥ 9.10.0 is required on MongoDB 8.3+ (GeoPoint distance queries 500 otherwise) |
 | MongoDB | ≥ 7.0.16 for parse-server 9; **replica set** for transactions |
-| Parse SDK | ≥ 5; verified on 5.3.0 and 8.6.0 |
+| Parse SDK | ≥ 8; developed and tested on 8.6.2 |
 | TypeScript | any, with `experimentalDecorators: true` |
 
+**Why ≥ 9.10.1 rather than merely 9.x:** the 9.5→9.10 releases are almost
+entirely security fixes — account takeover through auth-adapter identity
+spoofing, protected-field bypasses via logical operators, dot-notation, relation
+counts and LiveQuery, multiple rate-limit bypasses, and several stored-XSS routes
+through file upload. An older 9.x is not "stable", it is unpatched.
+
+**`@types/parse` is far behind the runtime** (3.0.x against an 8.x SDK), which is
+why reaching newer Parse APIs sometimes needs an `as unknown as` cast. That is
+the types package, not this kit.
+
 **Transactions and `@ParseVersionField` are MongoDB-only.** On Postgres the
 version field is declared but never enforced.

package/dist/decorators/types/cloudTypes.d.ts

@@ -12,9 +12,21 @@ export interface SwaggerDocConfig {
 export interface RouteConfig {
     methods: HttpMethod[];
     requiresAuth?: boolean;
+    /**
+     * Per-function rate limit, keyed on the CLIENT ADDRESS.
+     *
+     * Enforced per process: with N app instances the effective limit is N x `max`.
+     * For cross-instance enforcement use Parse Server's own `rateLimit` server
+     * option with `redisUrl`.
+     *
+     * Requires Express `trust proxy` to be configured precisely (a hop count or
+     * the proxy's address) when running behind a reverse proxy. A permissive
+     * value lets a caller spoof the key with `X-Forwarded-For`.
+     */
     rateLimit?: {
         windowMs: number;
         max: number;
+        keyBy?: (req: any) => string;
     };
     validation?: Parse.Cloud.Validator;
     description?: string;

package/dist/decorators/types/cloudTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudTypes.d.ts","sourceRoot":"","sources":["../../../src/decorators/types/cloudTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,UAAU,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACtE,2EAA2E;IAC3E,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"cloudTypes.d.ts","sourceRoot":"","sources":["../../../src/decorators/types/cloudTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAA;KAAE,CAAC;IAC5E,UAAU,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACtE,2EAA2E;IAC3E,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/middleware/rateLimit.d.ts

@@ -1,10 +1,29 @@
 import { Request, Response } from 'express';
-/**
- * Check rate limit for a function + client.
- * Returns null if allowed, or an error response object if exceeded.
- */
-export declare function checkRateLimit(req: Request, res: Response, functionName: string, config: {
+/** Per-function configuration, as declared on `@CloudFunction({rateLimit})`. */
+export interface RateLimitConfig {
     windowMs: number;
     max: number;
-}): boolean;
+    /**
+     * Optional custom bucket key.
+     *
+     * This middleware runs BEFORE Parse Server validates the session, so there is
+     * no authenticated user here. Supply this only if the app can derive a
+     * trustworthy identity on its own (e.g. a validated API key). Returning
+     * anything the caller controls freely re-opens the bypass described below.
+     */
+    keyBy?: (req: Request) => string;
+}
+/**
+ * Check the rate limit for a function + client.
+ *
+ * Returns true when the request may proceed. Returns false after sending a 429,
+ * in which case the caller must not continue the chain.
+ *
+ * NOTE — the store is in-memory and therefore PER PROCESS. With N app instances
+ * the effective limit is N x `max`. For cross-instance enforcement use Parse
+ * Server's own `rateLimit` server option with `redisUrl`.
+ */
+export declare function checkRateLimit(req: Request, res: Response, functionName: string, config: RateLimitConfig): boolean;
+/** Clear all buckets. Intended for tests. */
+export declare function resetRateLimits(): void;
 //# sourceMappingURL=rateLimit.d.ts.map

package/dist/middleware/rateLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAuC1C;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAiCT"}
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAO1C,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CAClC;AA8DD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,eAAe,GACtB,OAAO,CAwCT;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/middleware/rateLimit.js

@@ -1,8 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkRateLimit = checkRateLimit;
+exports.resetRateLimits = resetRateLimits;
 // Map<functionName, Map<clientKey, RateLimitEntry>>
 const store = new Map();
+/**
+ * Hard ceiling on tracked clients per function. A caller rotating addresses
+ * would otherwise grow this map without bound — turning the rate limiter into
+ * a memory-exhaustion vector. When the ceiling is hit we drop the oldest
+ * entries rather than stop limiting.
+ */
+const MAX_CLIENTS_PER_FUNCTION = 10000;
 // Cleanup old entries every 5 minutes
 const cleanupTimer = setInterval(() => {
     const now = Date.now();
@@ -24,34 +32,68 @@ const cleanupTimer = setInterval(() => {
 // which is the only time it has anything to do.
 cleanupTimer.unref();
 /**
- * Get client key — session token if available, fallback to IP.
+ * Resolve the bucket key for a request.
+ *
+ * SECURITY — why this is the client address and NOT the session token:
+ *
+ * Until v2.11.0 the key was `req.headers['x-parse-session-token'] || req.ip`.
+ * That header is supplied by the caller and is NOT validated at this point in
+ * the pipeline, so sending a fresh random token on every request minted a fresh
+ * bucket each time and the limit did nothing at all. No account was needed.
+ *
+ * The address is the only identifier available here that the caller cannot
+ * multiply at will.
+ *
+ * `req.ip` honours Express's `trust proxy` setting. The app MUST configure that
+ * precisely — a hop count, or the proxy's address. With a permissive value
+ * (`true`) a caller sets `X-Forwarded-For: 127.0.0.1` and spoofs the key, which
+ * is the same bypass Parse Server fixed in 9.10.1 for its own limiter. When
+ * `trust proxy` is unset, Express already ignores the header and `req.ip` is
+ * the socket address, which is what we want.
  */
-function getClientKey(req) {
-    return req.headers['x-parse-session-token'] || req.ip || 'unknown';
+function getClientKey(req, config) {
+    if (config.keyBy) {
+        return config.keyBy(req);
+    }
+    return req.ip || req.socket?.remoteAddress || 'unknown';
 }
 /**
- * Check rate limit for a function + client.
- * Returns null if allowed, or an error response object if exceeded.
+ * Check the rate limit for a function + client.
+ *
+ * Returns true when the request may proceed. Returns false after sending a 429,
+ * in which case the caller must not continue the chain.
+ *
+ * NOTE — the store is in-memory and therefore PER PROCESS. With N app instances
+ * the effective limit is N x `max`. For cross-instance enforcement use Parse
+ * Server's own `rateLimit` server option with `redisUrl`.
  */
 function checkRateLimit(req, res, functionName, config) {
-    const clientKey = getClientKey(req);
+    const clientKey = getClientKey(req, config);
     const now = Date.now();
-    // Get or create function map
     if (!store.has(functionName)) {
         store.set(functionName, new Map());
     }
     const clients = store.get(functionName);
-    // Get or create client entry
     const entry = clients.get(clientKey);
     if (!entry || now > entry.resetAt) {
-        // First request or window expired — start fresh
+        // First request in this window — start fresh.
+        if (!entry && clients.size >= MAX_CLIENTS_PER_FUNCTION) {
+            // Evict the oldest-expiring entries to make room. Map preserves insertion
+            // order, so the head is the least recently added.
+            const toEvict = Math.ceil(MAX_CLIENTS_PER_FUNCTION * 0.1);
+            let evicted = 0;
+            for (const key of clients.keys()) {
+                clients.delete(key);
+                if (++evicted >= toEvict)
+                    break;
+            }
+        }
         clients.set(clientKey, { count: 1, resetAt: now + config.windowMs });
-        return true; // allowed
+        return true;
     }
     if (entry.count < config.max) {
-        // Under limit
         entry.count++;
-        return true; // allowed
+        return true;
     }
     // Exceeded — send 429
     const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
@@ -60,6 +102,10 @@ function checkRateLimit(req, res, functionName, config) {
         message: `Too many requests. Try again in ${retryAfter} seconds.`,
         retryAfter,
     });
-    return false; // blocked
+    return false;
+}
+/** Clear all buckets. Intended for tests. */
+function resetRateLimits() {
+    store.clear();
 }
 //# sourceMappingURL=rateLimit.js.map

package/dist/middleware/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":";;AA2CA,wCAsCC;AA1ED,oDAAoD;AACpD,MAAM,KAAK,GAA6C,IAAI,GAAG,EAAE,CAAC;AAElE,sCAAsC;AACtC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAElB,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAChF,gDAAgD;AAChD,YAAY,CAAC,KAAK,EAAE,CAAC;AAErB;;GAEG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,OAAQ,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAY,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC5B,GAAY,EACZ,GAAa,EACb,YAAoB,EACpB,MAAyC;IAEzC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,6BAA6B;IAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAE,CAAC;IAEzC,6BAA6B;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAErC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,gDAAgD;QAChD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,CAAC,UAAU;IACzB,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,cAAc;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,CAAC,UAAU;IACzB,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,mCAAmC,UAAU,WAAW;QACjE,UAAU;KACX,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,UAAU;AAC1B,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":";;AA4FA,wCA6CC;AAGD,0CAEC;AAxHD,oDAAoD;AACpD,MAAM,KAAK,GAA6C,IAAI,GAAG,EAAE,CAAC;AAElE;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,KAAM,CAAC;AAExC,sCAAsC;AACtC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAElB,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAChF,gDAAgD;AAChD,YAAY,CAAC,KAAK,EAAE,CAAC;AAErB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,YAAY,CAAC,GAAY,EAAE,MAAuB;IACzD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAC5B,GAAY,EACZ,GAAa,EACb,YAAoB,EACpB,MAAuB;IAEvB,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAE,CAAC;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAErC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,8CAA8C;QAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;YACvD,0EAA0E;YAC1E,kDAAkD;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;YAC1D,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpB,IAAI,EAAE,OAAO,IAAI,OAAO;oBAAE,MAAM;YAClC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAC,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,mCAAmC,UAAU,WAAW;QACjE,UAAU;KACX,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6CAA6C;AAC7C,SAAgB,eAAe;IAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@90soft/parse-server-kit",
-  "version": "2.10.1",
+  "version": "2.11.0",
   "description": "Complete decorator-driven development kit for Parse Server — models, cloud functions, triggers, cron, routing, ACL, Swagger, and more.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -34,14 +34,14 @@
     "url": "https://git.90-soft.com/90_soft/parse-server-kit.git"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "peerDependencies": {
     "@types/parse": ">=3.0.0",
     "express": ">=4.0.0",
     "node-cron": ">=3.0.0",
-    "parse": ">=5.0.0",
-    "parse-server": ">=8.3.0",
+    "parse": ">=8.0.0",
+    "parse-server": ">=9.0.0",
     "reflect-metadata": ">=0.1.13",
     "swagger-ui-express": ">=4.0.0"
   },
@@ -67,8 +67,8 @@
     "jest": "^29.7.0",
     "mongodb-memory-server": "^11.2.0",
     "node-cron": "^4.0.0",
-    "parse": "^5.3.0",
-    "parse-server": "^9.10.0",
+    "parse": "^8.6.2",
+    "parse-server": "^9.10.1",
     "reflect-metadata": "^0.2.2",
     "swagger-ui-express": "^5.0.1",
     "ts-jest": "^29.2.0",