@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/rate-limit/express.cjs

@@ -0,0 +1,55 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/rate-limit/express.ts
+var express_exports = {};
+__export(express_exports, {
+  expressRateLimit: () => expressRateLimit
+});
+module.exports = __toCommonJS(express_exports);
+function defaultExtractIp(req) {
+  if (req.ip)
+    return req.ip;
+  const xff = req.headers["x-forwarded-for"];
+  if (typeof xff === "string")
+    return xff.split(",")[0].trim();
+  if (Array.isArray(xff) && xff.length > 0)
+    return xff[0].split(",")[0].trim();
+  const xri = req.headers["x-real-ip"];
+  return typeof xri === "string" ? xri : void 0;
+}
+function expressRateLimit(fortress, ruleName, options = {}) {
+  const methods = fortress.plugins["rate-limit"];
+  if (!methods?.check) {
+    throw new Error(
+      "rate-limit plugin is not registered \u2014 add rateLimit({...}) to your FortressConfig.plugins"
+    );
+  }
+  const extractIp = options.extractIp ?? defaultExtractIp;
+  const keyByUser = options.keyByUser ?? true;
+  return (req, _res, next) => {
+    const ip = extractIp(req);
+    const userId = keyByUser ? req.fortressUserId : void 0;
+    methods.check(ruleName, { ip, userId }).then(() => next()).catch(next);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  expressRateLimit
+});

package/dist/plugins/rate-limit/express.d.cts

@@ -0,0 +1,64 @@
+import { F as Fortress } from '../../fortress-BmSvFfqK.cjs';
+import '../../index-D054pcb-.cjs';
+import '../../config-GtlVt6ZD.cjs';
+import '../../index-CxEkfCA0.cjs';
+import '../../jwt.cjs';
+import '../../types-et0R8tsC.cjs';
+import '../../auth-service-BcyQ2PuZ.cjs';
+import '../api-key.cjs';
+import '../audit-log.cjs';
+import '../data-isolation.cjs';
+import '../email-verification.cjs';
+import '../magic-link.cjs';
+import '../oauth.cjs';
+import '../social-login.cjs';
+import '../tenancy.cjs';
+import '../two-factor.cjs';
+import '../webauthn.cjs';
+import '@simplewebauthn/server';
+
+/**
+ * Express middleware wrapper for the rate-limit plugin.
+ *
+ * Thin adapter that extracts the client IP (and optional authenticated
+ * userId) from an Express request and delegates to
+ * `fortress.plugins['rate-limit'].check(rule, keys)`. A `FortressError` with
+ * code `RATE_LIMITED` is passed to `next(err)` on exceed — the Express error
+ * middleware (`createErrorMiddleware` from `@bajustone/fortress/express`)
+ * renders a proper 429 with `Retry-After`.
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import { expressRateLimit } from '@bajustone/fortress/plugins/rate-limit/express';
+ *
+ * const app = express();
+ * app.use('/api', expressRateLimit(fortress, 'api'));
+ * ```
+ *
+ * @module
+ */
+
+/** Shape fortress reads from; compatible with any modern Express request. */
+interface MinimalExpressRequest {
+    ip?: string;
+    headers: Record<string, string | string[] | undefined>;
+    fortressUserId?: string;
+}
+interface ExpressRateLimitOptions {
+    /**
+     * Include the authenticated user in the key (requires fortress auth
+     * middleware to have run first, populating `req.fortressUserId`). Defaults
+     * to `true` — falls back to IP-only when no user is present.
+     */
+    keyByUser?: boolean;
+    /** Override IP extraction. Default uses `req.ip` then forwarding headers. */
+    extractIp?: (req: MinimalExpressRequest) => string | undefined;
+}
+/**
+ * Returns an Express middleware that rate-limits requests against the named
+ * rule defined in your `rateLimit({ rules: { ... } })` config.
+ */
+declare function expressRateLimit(fortress: Fortress, ruleName: string, options?: ExpressRateLimitOptions): (req: MinimalExpressRequest, _res: unknown, next: (err?: unknown) => void) => void;
+
+export { type ExpressRateLimitOptions, type MinimalExpressRequest, expressRateLimit };

package/dist/plugins/rate-limit/express.d.ts

@@ -0,0 +1,64 @@
+import { F as Fortress } from '../../fortress-uA-_cheR.js';
+import '../../index-jAMbbUAY.js';
+import '../../config-B2366s_G.js';
+import '../../index-CxEkfCA0.js';
+import '../../jwt.js';
+import '../../types-et0R8tsC.js';
+import '../../auth-service-BkzZkWfH.js';
+import '../api-key.js';
+import '../audit-log.js';
+import '../data-isolation.js';
+import '../email-verification.js';
+import '../magic-link.js';
+import '../oauth.js';
+import '../social-login.js';
+import '../tenancy.js';
+import '../two-factor.js';
+import '../webauthn.js';
+import '@simplewebauthn/server';
+
+/**
+ * Express middleware wrapper for the rate-limit plugin.
+ *
+ * Thin adapter that extracts the client IP (and optional authenticated
+ * userId) from an Express request and delegates to
+ * `fortress.plugins['rate-limit'].check(rule, keys)`. A `FortressError` with
+ * code `RATE_LIMITED` is passed to `next(err)` on exceed — the Express error
+ * middleware (`createErrorMiddleware` from `@bajustone/fortress/express`)
+ * renders a proper 429 with `Retry-After`.
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import { expressRateLimit } from '@bajustone/fortress/plugins/rate-limit/express';
+ *
+ * const app = express();
+ * app.use('/api', expressRateLimit(fortress, 'api'));
+ * ```
+ *
+ * @module
+ */
+
+/** Shape fortress reads from; compatible with any modern Express request. */
+interface MinimalExpressRequest {
+    ip?: string;
+    headers: Record<string, string | string[] | undefined>;
+    fortressUserId?: string;
+}
+interface ExpressRateLimitOptions {
+    /**
+     * Include the authenticated user in the key (requires fortress auth
+     * middleware to have run first, populating `req.fortressUserId`). Defaults
+     * to `true` — falls back to IP-only when no user is present.
+     */
+    keyByUser?: boolean;
+    /** Override IP extraction. Default uses `req.ip` then forwarding headers. */
+    extractIp?: (req: MinimalExpressRequest) => string | undefined;
+}
+/**
+ * Returns an Express middleware that rate-limits requests against the named
+ * rule defined in your `rateLimit({ rules: { ... } })` config.
+ */
+declare function expressRateLimit(fortress: Fortress, ruleName: string, options?: ExpressRateLimitOptions): (req: MinimalExpressRequest, _res: unknown, next: (err?: unknown) => void) => void;
+
+export { type ExpressRateLimitOptions, type MinimalExpressRequest, expressRateLimit };

package/dist/plugins/rate-limit/express.js

@@ -0,0 +1,30 @@
+// src/plugins/rate-limit/express.ts
+function defaultExtractIp(req) {
+  if (req.ip)
+    return req.ip;
+  const xff = req.headers["x-forwarded-for"];
+  if (typeof xff === "string")
+    return xff.split(",")[0].trim();
+  if (Array.isArray(xff) && xff.length > 0)
+    return xff[0].split(",")[0].trim();
+  const xri = req.headers["x-real-ip"];
+  return typeof xri === "string" ? xri : void 0;
+}
+function expressRateLimit(fortress, ruleName, options = {}) {
+  const methods = fortress.plugins["rate-limit"];
+  if (!methods?.check) {
+    throw new Error(
+      "rate-limit plugin is not registered \u2014 add rateLimit({...}) to your FortressConfig.plugins"
+    );
+  }
+  const extractIp = options.extractIp ?? defaultExtractIp;
+  const keyByUser = options.keyByUser ?? true;
+  return (req, _res, next) => {
+    const ip = extractIp(req);
+    const userId = keyByUser ? req.fortressUserId : void 0;
+    methods.check(ruleName, { ip, userId }).then(() => next()).catch(next);
+  };
+}
+export {
+  expressRateLimit
+};

package/dist/plugins/rate-limit/hono.cjs

@@ -0,0 +1,51 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/rate-limit/hono.ts
+var hono_exports = {};
+__export(hono_exports, {
+  honoRateLimit: () => honoRateLimit
+});
+module.exports = __toCommonJS(hono_exports);
+function defaultExtractIp(c) {
+  const xff = c.req.header("x-forwarded-for");
+  if (xff)
+    return xff.split(",")[0].trim();
+  return c.req.header("x-real-ip");
+}
+function honoRateLimit(fortress, ruleName, options = {}) {
+  const methods = fortress.plugins["rate-limit"];
+  if (!methods?.check) {
+    throw new Error(
+      "rate-limit plugin is not registered \u2014 add rateLimit({...}) to your FortressConfig.plugins"
+    );
+  }
+  const extractIp = options.extractIp ?? defaultExtractIp;
+  const keyByUser = options.keyByUser ?? true;
+  return async (c, next) => {
+    const ip = extractIp(c);
+    const userId = keyByUser ? c.get("fortressUserId") : void 0;
+    await methods.check(ruleName, { ip, userId });
+    await next();
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  honoRateLimit
+});

package/dist/plugins/rate-limit/hono.d.cts

@@ -0,0 +1,59 @@
+import { Context, MiddlewareHandler } from 'hono';
+import { F as Fortress } from '../../fortress-BmSvFfqK.cjs';
+import '../../index-D054pcb-.cjs';
+import '../../config-GtlVt6ZD.cjs';
+import '../../index-CxEkfCA0.cjs';
+import '../../jwt.cjs';
+import '../../types-et0R8tsC.cjs';
+import '../../auth-service-BcyQ2PuZ.cjs';
+import '../api-key.cjs';
+import '../audit-log.cjs';
+import '../data-isolation.cjs';
+import '../email-verification.cjs';
+import '../magic-link.cjs';
+import '../oauth.cjs';
+import '../social-login.cjs';
+import '../tenancy.cjs';
+import '../two-factor.cjs';
+import '../webauthn.cjs';
+import '@simplewebauthn/server';
+
+/**
+ * Hono middleware wrapper for the rate-limit plugin.
+ *
+ * Thin adapter that extracts the client IP (and optional authenticated
+ * userId) from a Hono context and delegates to
+ * `fortress.plugins['rate-limit'].check(rule, keys)`. A `FortressError` with
+ * code `RATE_LIMITED` is thrown when the limit is exceeded — pair this with
+ * `createHonoMiddleware(fortress).errorHandler` (or any handler that calls
+ * `errorToResponse`) to render a proper 429 with `Retry-After`.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono';
+ * import { honoRateLimit } from '@bajustone/fortress/plugins/rate-limit/hono';
+ *
+ * const app = new Hono();
+ * app.use('/api/*', honoRateLimit(fortress, 'api'));
+ * ```
+ *
+ * @module
+ */
+
+interface HonoRateLimitOptions {
+    /**
+     * Include the authenticated user in the key (requires fortress auth
+     * middleware to have run first, populating `fortressUserId`). Defaults to
+     * `true` — falls back to IP-only when no user is present.
+     */
+    keyByUser?: boolean;
+    /** Override IP extraction. Default reads `X-Forwarded-For` then `X-Real-IP`. */
+    extractIp?: (c: Context) => string | undefined;
+}
+/**
+ * Returns a Hono middleware that rate-limits requests against the named rule
+ * defined in your `rateLimit({ rules: { ... } })` config.
+ */
+declare function honoRateLimit(fortress: Fortress, ruleName: string, options?: HonoRateLimitOptions): MiddlewareHandler;
+
+export { type HonoRateLimitOptions, honoRateLimit };

package/dist/plugins/rate-limit/hono.d.ts

@@ -0,0 +1,59 @@
+import { Context, MiddlewareHandler } from 'hono';
+import { F as Fortress } from '../../fortress-uA-_cheR.js';
+import '../../index-jAMbbUAY.js';
+import '../../config-B2366s_G.js';
+import '../../index-CxEkfCA0.js';
+import '../../jwt.js';
+import '../../types-et0R8tsC.js';
+import '../../auth-service-BkzZkWfH.js';
+import '../api-key.js';
+import '../audit-log.js';
+import '../data-isolation.js';
+import '../email-verification.js';
+import '../magic-link.js';
+import '../oauth.js';
+import '../social-login.js';
+import '../tenancy.js';
+import '../two-factor.js';
+import '../webauthn.js';
+import '@simplewebauthn/server';
+
+/**
+ * Hono middleware wrapper for the rate-limit plugin.
+ *
+ * Thin adapter that extracts the client IP (and optional authenticated
+ * userId) from a Hono context and delegates to
+ * `fortress.plugins['rate-limit'].check(rule, keys)`. A `FortressError` with
+ * code `RATE_LIMITED` is thrown when the limit is exceeded — pair this with
+ * `createHonoMiddleware(fortress).errorHandler` (or any handler that calls
+ * `errorToResponse`) to render a proper 429 with `Retry-After`.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono';
+ * import { honoRateLimit } from '@bajustone/fortress/plugins/rate-limit/hono';
+ *
+ * const app = new Hono();
+ * app.use('/api/*', honoRateLimit(fortress, 'api'));
+ * ```
+ *
+ * @module
+ */
+
+interface HonoRateLimitOptions {
+    /**
+     * Include the authenticated user in the key (requires fortress auth
+     * middleware to have run first, populating `fortressUserId`). Defaults to
+     * `true` — falls back to IP-only when no user is present.
+     */
+    keyByUser?: boolean;
+    /** Override IP extraction. Default reads `X-Forwarded-For` then `X-Real-IP`. */
+    extractIp?: (c: Context) => string | undefined;
+}
+/**
+ * Returns a Hono middleware that rate-limits requests against the named rule
+ * defined in your `rateLimit({ rules: { ... } })` config.
+ */
+declare function honoRateLimit(fortress: Fortress, ruleName: string, options?: HonoRateLimitOptions): MiddlewareHandler;
+
+export { type HonoRateLimitOptions, honoRateLimit };

package/dist/plugins/rate-limit/hono.js

@@ -0,0 +1,26 @@
+// src/plugins/rate-limit/hono.ts
+function defaultExtractIp(c) {
+  const xff = c.req.header("x-forwarded-for");
+  if (xff)
+    return xff.split(",")[0].trim();
+  return c.req.header("x-real-ip");
+}
+function honoRateLimit(fortress, ruleName, options = {}) {
+  const methods = fortress.plugins["rate-limit"];
+  if (!methods?.check) {
+    throw new Error(
+      "rate-limit plugin is not registered \u2014 add rateLimit({...}) to your FortressConfig.plugins"
+    );
+  }
+  const extractIp = options.extractIp ?? defaultExtractIp;
+  const keyByUser = options.keyByUser ?? true;
+  return async (c, next) => {
+    const ip = extractIp(c);
+    const userId = keyByUser ? c.get("fortressUserId") : void 0;
+    await methods.check(ruleName, { ip, userId });
+    await next();
+  };
+}
+export {
+  honoRateLimit
+};

package/dist/plugins/rate-limit/sveltekit.cjs

@@ -0,0 +1,49 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/rate-limit/sveltekit.ts
+var sveltekit_exports = {};
+__export(sveltekit_exports, {
+  svelteKitRateLimit: () => svelteKitRateLimit
+});
+module.exports = __toCommonJS(sveltekit_exports);
+function ipFromRequest(request) {
+  const xff = request.headers.get("x-forwarded-for");
+  if (xff)
+    return xff.split(",")[0].trim();
+  return request.headers.get("x-real-ip") ?? void 0;
+}
+async function svelteKitRateLimit(fortress, ruleName, event, options = {}) {
+  const methods = fortress.plugins["rate-limit"];
+  if (!methods?.check) {
+    throw new Error(
+      "rate-limit plugin is not registered \u2014 add rateLimit({...}) to your FortressConfig.plugins"
+    );
+  }
+  const keyByUser = options.keyByUser ?? true;
+  const userId = keyByUser ? event.locals?.fortressUserId : void 0;
+  await methods.check(ruleName, {
+    ip: ipFromRequest(event.request),
+    userId
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  svelteKitRateLimit
+});

package/dist/plugins/rate-limit/sveltekit.d.cts

@@ -0,0 +1,59 @@
+import { F as Fortress } from '../../fortress-BmSvFfqK.cjs';
+import '../../index-D054pcb-.cjs';
+import '../../config-GtlVt6ZD.cjs';
+import '../../index-CxEkfCA0.cjs';
+import '../../jwt.cjs';
+import '../../types-et0R8tsC.cjs';
+import '../../auth-service-BcyQ2PuZ.cjs';
+import '../api-key.cjs';
+import '../audit-log.cjs';
+import '../data-isolation.cjs';
+import '../email-verification.cjs';
+import '../magic-link.cjs';
+import '../oauth.cjs';
+import '../social-login.cjs';
+import '../tenancy.cjs';
+import '../two-factor.cjs';
+import '../webauthn.cjs';
+import '@simplewebauthn/server';
+
+/**
+ * SvelteKit helper for the rate-limit plugin.
+ *
+ * Call from `hooks.server.ts` or inside a load/action to rate-limit a given
+ * route. Throws a `FortressError` with code `RATE_LIMITED` when the limit
+ * is exceeded — the fortress SvelteKit handle (or your own `handleError`)
+ * will render a proper 429 response via `errorToResponse`.
+ *
+ * @example
+ * ```ts
+ * // hooks.server.ts
+ * import { svelteKitRateLimit } from '@bajustone/fortress/plugins/rate-limit/sveltekit';
+ *
+ * export const handle = async ({ event, resolve }) => {
+ *   if (event.url.pathname.startsWith('/api/')) {
+ *     await svelteKitRateLimit(fortress, 'api', event);
+ *   }
+ *   return resolve(event);
+ * };
+ * ```
+ *
+ * @module
+ */
+
+interface SvelteKitRateLimitEvent {
+    request: Request;
+    locals?: {
+        fortressUserId?: string;
+    };
+}
+/**
+ * Run a rate-limit check against the named rule for the given SvelteKit
+ * request event. Returns void on pass; throws `FortressError` (RATE_LIMITED)
+ * on exceed.
+ */
+declare function svelteKitRateLimit(fortress: Fortress, ruleName: string, event: SvelteKitRateLimitEvent, options?: {
+    keyByUser?: boolean;
+}): Promise<void>;
+
+export { type SvelteKitRateLimitEvent, svelteKitRateLimit };

package/dist/plugins/rate-limit/sveltekit.d.ts

@@ -0,0 +1,59 @@
+import { F as Fortress } from '../../fortress-uA-_cheR.js';
+import '../../index-jAMbbUAY.js';
+import '../../config-B2366s_G.js';
+import '../../index-CxEkfCA0.js';
+import '../../jwt.js';
+import '../../types-et0R8tsC.js';
+import '../../auth-service-BkzZkWfH.js';
+import '../api-key.js';
+import '../audit-log.js';
+import '../data-isolation.js';
+import '../email-verification.js';
+import '../magic-link.js';
+import '../oauth.js';
+import '../social-login.js';
+import '../tenancy.js';
+import '../two-factor.js';
+import '../webauthn.js';
+import '@simplewebauthn/server';
+
+/**
+ * SvelteKit helper for the rate-limit plugin.
+ *
+ * Call from `hooks.server.ts` or inside a load/action to rate-limit a given
+ * route. Throws a `FortressError` with code `RATE_LIMITED` when the limit
+ * is exceeded — the fortress SvelteKit handle (or your own `handleError`)
+ * will render a proper 429 response via `errorToResponse`.
+ *
+ * @example
+ * ```ts
+ * // hooks.server.ts
+ * import { svelteKitRateLimit } from '@bajustone/fortress/plugins/rate-limit/sveltekit';
+ *
+ * export const handle = async ({ event, resolve }) => {
+ *   if (event.url.pathname.startsWith('/api/')) {
+ *     await svelteKitRateLimit(fortress, 'api', event);
+ *   }
+ *   return resolve(event);
+ * };
+ * ```
+ *
+ * @module
+ */
+
+interface SvelteKitRateLimitEvent {
+    request: Request;
+    locals?: {
+        fortressUserId?: string;
+    };
+}
+/**
+ * Run a rate-limit check against the named rule for the given SvelteKit
+ * request event. Returns void on pass; throws `FortressError` (RATE_LIMITED)
+ * on exceed.
+ */
+declare function svelteKitRateLimit(fortress: Fortress, ruleName: string, event: SvelteKitRateLimitEvent, options?: {
+    keyByUser?: boolean;
+}): Promise<void>;
+
+export { type SvelteKitRateLimitEvent, svelteKitRateLimit };

package/dist/plugins/rate-limit/sveltekit.js

@@ -0,0 +1,24 @@
+// src/plugins/rate-limit/sveltekit.ts
+function ipFromRequest(request) {
+  const xff = request.headers.get("x-forwarded-for");
+  if (xff)
+    return xff.split(",")[0].trim();
+  return request.headers.get("x-real-ip") ?? void 0;
+}
+async function svelteKitRateLimit(fortress, ruleName, event, options = {}) {
+  const methods = fortress.plugins["rate-limit"];
+  if (!methods?.check) {
+    throw new Error(
+      "rate-limit plugin is not registered \u2014 add rateLimit({...}) to your FortressConfig.plugins"
+    );
+  }
+  const keyByUser = options.keyByUser ?? true;
+  const userId = keyByUser ? event.locals?.fortressUserId : void 0;
+  await methods.check(ruleName, {
+    ip: ipFromRequest(event.request),
+    userId
+  });
+}
+export {
+  svelteKitRateLimit
+};