@bajustone/fortress 1.0.0-rc.1

package/src/plugins/rate-limit/sveltekit.test.ts

@@ -0,0 +1,58 @@
+import type { SvelteKitRateLimitEvent } from './sveltekit';
+import { describe, expect, it } from 'vitest';
+import { FortressError } from '../../core/errors';
+import { createFortress } from '../../core/fortress';
+import { createTestAdapter } from '../../testing';
+import { rateLimit } from './index';
+import { svelteKitRateLimit } from './sveltekit';
+
+const SECRET = 'sveltekit-rate-limit-wrapper-test-32!!';
+
+function setup(maxPerIp: number) {
+  return createFortress({
+    jwt: { key: SECRET },
+    database: createTestAdapter(),
+    plugins: [rateLimit({ rules: { api: { maxPerIp, windowSeconds: 60 } } })],
+  });
+}
+
+function mockEvent(headers: Record<string, string>, userId?: string): SvelteKitRateLimitEvent {
+  return {
+    request: new Request('http://localhost/api/thing', { headers }),
+    locals: userId != null ? { fortressUserId: userId } : undefined,
+  };
+}
+
+describe('svelteKitRateLimit (framework wrapper)', () => {
+  it('resolves under the limit and throws FortressError when exceeded', async () => {
+    const fortress = setup(2);
+
+    await svelteKitRateLimit(fortress, 'api', mockEvent({ 'x-forwarded-for': '10.0.0.1' }));
+    await svelteKitRateLimit(fortress, 'api', mockEvent({ 'x-forwarded-for': '10.0.0.1' }));
+
+    await expect(
+      svelteKitRateLimit(fortress, 'api', mockEvent({ 'x-forwarded-for': '10.0.0.1' })),
+    ).rejects.toMatchObject({ code: 'RATE_LIMITED' });
+  });
+
+  it('keys by userId from event.locals when keyByUser is on (default)', async () => {
+    const fortress = setup(1);
+
+    await svelteKitRateLimit(fortress, 'api', mockEvent({ 'x-forwarded-for': '10.0.0.2' }, '42'));
+
+    // Same IP+user → second hit blocked.
+    await expect(
+      svelteKitRateLimit(fortress, 'api', mockEvent({ 'x-forwarded-for': '10.0.0.2' }, '42')),
+    ).rejects.toBeInstanceOf(FortressError);
+  });
+
+  it('throws synchronously when the plugin is not registered', async () => {
+    const fortress = createFortress({
+      jwt: { key: SECRET },
+      database: createTestAdapter(),
+    });
+    await expect(
+      svelteKitRateLimit(fortress, 'api', mockEvent({ 'x-forwarded-for': '10.0.0.3' })),
+    ).rejects.toThrow(/rate-limit plugin is not registered/);
+  });
+});

package/src/plugins/rate-limit/sveltekit.ts

@@ -0,0 +1,66 @@
+/**
+ * SvelteKit helper for the rate-limit plugin.
+ *
+ * Call from `hooks.server.ts` or inside a load/action to rate-limit a given
+ * route. Throws a `FortressError` with code `RATE_LIMITED` when the limit
+ * is exceeded — the fortress SvelteKit handle (or your own `handleError`)
+ * will render a proper 429 response via `errorToResponse`.
+ *
+ * @example
+ * ```ts
+ * // hooks.server.ts
+ * import { svelteKitRateLimit } from '@bajustone/fortress/plugins/rate-limit/sveltekit';
+ *
+ * export const handle = async ({ event, resolve }) => {
+ *   if (event.url.pathname.startsWith('/api/')) {
+ *     await svelteKitRateLimit(fortress, 'api', event);
+ *   }
+ *   return resolve(event);
+ * };
+ * ```
+ *
+ * @module
+ */
+
+import type { Fortress } from '../../core/fortress';
+
+export interface SvelteKitRateLimitEvent {
+  request: Request;
+  locals?: { fortressUserId?: string };
+}
+
+interface RateLimitCheck {
+  check: (rule: string, keys: { ip?: string; userId?: string }) => Promise<void>;
+}
+
+function ipFromRequest(request: Request): string | undefined {
+  const xff = request.headers.get('x-forwarded-for');
+  if (xff)
+    return xff.split(',')[0].trim();
+  return request.headers.get('x-real-ip') ?? undefined;
+}
+
+/**
+ * Run a rate-limit check against the named rule for the given SvelteKit
+ * request event. Returns void on pass; throws `FortressError` (RATE_LIMITED)
+ * on exceed.
+ */
+export async function svelteKitRateLimit(
+  fortress: Fortress,
+  ruleName: string,
+  event: SvelteKitRateLimitEvent,
+  options: { keyByUser?: boolean } = {},
+): Promise<void> {
+  const methods = fortress.plugins['rate-limit'] as unknown as RateLimitCheck | undefined;
+  if (!methods?.check) {
+    throw new Error(
+      'rate-limit plugin is not registered — add rateLimit({...}) to your FortressConfig.plugins',
+    );
+  }
+  const keyByUser = options.keyByUser ?? true;
+  const userId = keyByUser ? event.locals?.fortressUserId : undefined;
+  await methods.check(ruleName, {
+    ip: ipFromRequest(event.request),
+    userId,
+  });
+}