@beechcms/api 0.4.0 → 0.4.1

package/src/middleware.ts

@@ -1,20 +1,14 @@
 /// <reference types="@cloudflare/workers-types" />
 import type { Context, Next } from 'hono'
 import { HTTPException } from 'hono/http-exception'
-import { jwtVerify } from 'jose'
+import type { Env, Variables } from './types'
 
-/** Payload JWT decodificato (sub = userId, email opzionale, name opzionale) */
 export type JwtPayload = {
   sub: string
   email?: string
   name?: string
 }
 
-/** Variabili iniettate nel context Hono dopo auth */
-export type AuthVariables = {
-  jwtPayload: JwtPayload
-}
-
 const UNAUTHORIZED_JSON = JSON.stringify({ error: 'Unauthorized' })
 
 function unauthorizedResponse() {
@@ -24,44 +18,30 @@ function unauthorizedResponse() {
   })
 }
 
-export type JwtVerifyOptions = {
-  issuer?: string
-  audience?: string
-}
-
 /**
- * Middleware di autenticazione JWT.
- * Intercetta Authorization: Bearer <token>, verifica con jose e JWT_SECRET.
- * Se valido: imposta jwtPayload nel context e chiama next().
- * Se invalido/mancante: lancia HTTPException 401 (gestita dal framework).
+ * JWT authentication middleware. Reads the Bearer token from the Authorization
+ * header and delegates verification to the ITokenService injected in context.
+ * Returns 401 on any missing or invalid token; never exposes failure details.
  */
-export function authMiddleware(secret: string, options: JwtVerifyOptions = {}) {
-  return async (c: Context, next: Next): Promise<Response | void> => {
-    const auth = c.req.header('Authorization')
-    if (!auth?.startsWith('Bearer ')) {
+export function authMiddleware() {
+  return async (c: Context<{ Bindings: Env; Variables: Variables }>, next: Next): Promise<Response | void> => {
+    const authHeader = c.req.header('Authorization')
+    if (!authHeader?.startsWith('Bearer ')) {
       throw new HTTPException(401, { res: unauthorizedResponse() })
     }
 
-    const token = auth.slice(7)
+    const token = authHeader.slice(7)
     if (!token) {
       throw new HTTPException(401, { res: unauthorizedResponse() })
     }
 
-    try {
-      const secretBytes = new TextEncoder().encode(secret)
-      const { payload, protectedHeader } = await jwtVerify(token, secretBytes, {
-        algorithms: ['HS256'],
-        issuer: options.issuer,
-        audience: options.audience,
-      })
-      // Hardening: accetta solo token JWT standard (se presente il typ)
-      if (protectedHeader.typ && protectedHeader.typ !== 'JWT') {
-        throw new Error('Invalid typ header')
-      }
-      c.set('jwtPayload', payload as JwtPayload)
-      await next()
-    } catch {
+    const claims = await c.get('tokenService').verify(token)
+
+    if (!claims) {
       throw new HTTPException(401, { res: unauthorizedResponse() })
     }
+
+    c.set('jwtPayload', claims as JwtPayload)
+    await next()
   }
 }

package/src/public/public-add.ts

@@ -1,11 +1,10 @@
-import { isValidContentStatus, SlugConflictError } from '@beechcms/core'
+import { isValidContentStatus, SlugConflictError, sha256hex } from '@beechcms/core'
 import type { Context } from 'hono'
 import { cleanStr } from '../shared/query-utils'
 import { checkPublicOperation } from './access-policy'
 import { publicProblem } from './problem-details'
 import { generateEntrySlug, slugify } from './slug-utils'
 import { sanitizePublicPayload } from './sanitize'
-import { createNotification } from '../shared/notification-service'
 import { AppEnv } from '../types'
 
 function errorMessage(context: Context<AppEnv>, error: unknown): string {
@@ -32,15 +31,6 @@ function parseIdempotencyKey(rawValue: string | undefined): string | null {
   return key
 }
 
-function toHex(buffer: ArrayBuffer): string {
-  return [...new Uint8Array(buffer)].map((v) => v.toString(16).padStart(2, '0')).join('')
-}
-
-async function sha256Hex(input: string): Promise<string> {
-  const data = new TextEncoder().encode(input)
-  const digest = await crypto.subtle.digest('SHA-256', data)
-  return toHex(digest)
-}
 
 export async function publicAddHandler(context: Context<AppEnv>) {
   const seedSlug = context.req.param('seed') ?? ''
@@ -98,14 +88,14 @@ export async function publicAddHandler(context: Context<AppEnv>) {
 
   const idempotencyKey = parseIdempotencyKey(context.req.header('Idempotency-Key'))
   const entrySlug = pickSlugFromBody(body, sanitized.data)
-  const finalSlug = entrySlug || crypto.randomUUID().slice(0, 8)
+  const finalSlug = entrySlug || context.get('idGenerator').uuid().slice(0, 8)
   const repository = context.get('repository')
   const idempotencyRepository = context.get('idempotencyRepository')
 
   try {
     const now = Math.floor(Date.now() / 1000)
     const fingerprintPayload = JSON.stringify({ seedSlug, statusValue, slug: cleanStr(body.slug) ?? null, data: sanitized.data })
-    const fingerprint = await sha256Hex(fingerprintPayload)
+    const fingerprint = await sha256hex(fingerprintPayload)
     const idempotencyTtlSeconds = Math.max(60, Number.parseInt(context.env.PUBLIC_IDEMPOTENCY_TTL_SECONDS ?? '86400', 10) || 86400)
 
     if (idempotencyKey) {
@@ -120,7 +110,7 @@ export async function publicAddHandler(context: Context<AppEnv>) {
       }
     }
 
-    const id = crypto.randomUUID()
+    const id = context.get('idGenerator').uuid()
     
     try {
       await repository.create(seed, id, finalSlug, statusValue as any, sanitized.data)
@@ -147,7 +137,7 @@ export async function publicAddHandler(context: Context<AppEnv>) {
       })
     }
 
-    await createNotification(context, {
+    context.get('notificationService').notify({
       title: `${seed.label}: New entry`,
       message: `A new entry ("${sanitized.data.title || sanitized.data.name || finalSlug}") has been added via the public API.`,
       type: 'success',

package/src/public/public-edit.ts

@@ -6,7 +6,6 @@ import { checkPublicOperation } from './access-policy'
 import { publicProblem } from './problem-details'
 import { slugify } from './slug-utils'
 import { sanitizePublicPayload } from './sanitize'
-import { createNotification } from '../shared/notification-service'
 import { AppEnv } from '../types'
 
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
@@ -77,7 +76,9 @@ function resolveData(
 
   const sensitiveAliases = Object.keys(rawData).filter((alias) => {
     const branch = seed.branches.find((b) => b.alias === alias)
-    return branch != null && resolvePolicies(branch).privacy !== 'plain'
+    if (!branch) return false
+    const policies = resolvePolicies(branch)
+    return policies.privacy !== 'plain' || policies.public === false
   })
   if (sensitiveAliases.length > 0) {
     return { ok: false, response: publicProblem(context, { type: 'sensitive-field-edit', title: 'Unprocessable Entity', status: 422, detail: `Cannot edit sensitive fields: ${sensitiveAliases.join(', ')}` }) }
@@ -141,7 +142,7 @@ export async function publicEditHandler(context: PublicCtx) {
 
     await repository.update(seed, id, updateData, statusResult.value)
 
-    await createNotification(context, {
+    context.get('notificationService').notify({
       title: `${seed.label}: Update`,
       message: `The entry "${slugResult.value.nextSlug}" has been modified via the public API.`,
       type: 'info',

package/src/public/public-read.ts

@@ -1,5 +1,5 @@
 import { resolvePolicies, EntryNotFoundError } from '@beechcms/core'
-import type { Seed } from '@beechcms/core'
+import type { Seed, ISeedRegistry } from '@beechcms/core'
 import type { Context } from 'hono'
 import { cleanStr } from '../shared/query-utils'
 import { checkPublicOperation } from './access-policy'
@@ -13,8 +13,8 @@ import {
 } from './query-builder'
 import { AppEnv } from '../types'
 
-function buildSeedNotFoundMessage(seed: string, seedRegistry: Record<string, Seed>): string {
-  const available = Object.keys(seedRegistry).join(', ')
+function buildSeedNotFoundMessage(seed: string, seedRegistry: ISeedRegistry): string {
+  const available = seedRegistry.all().map(s => s.slug).join(', ')
   return `The content type '${seed}' does not exist. Available types: ${available}.`
 }
 

package/src/public/public-routes.ts

@@ -13,7 +13,7 @@ publicApp.get('/health', (c) => {
 /** Returns the public-facing schema: only seeds with public read or post enabled. */
 publicApp.get('/schema', (c) => {
   const registry = c.get('seedRegistry')
-  const publicSeeds = Object.values(registry)
+  const publicSeeds = registry.all()
     .filter(seed => seed.allowPublicRead === true || seed.allowPublicPost === true || seed.allowPublicEdit === true)
     .map(seed => ({
       slug: seed.slug,
@@ -39,7 +39,7 @@ publicApp.get('/schema', (c) => {
 /** HTML render of the public schema for quick browser inspection. */
 publicApp.get('/schema.html', (c) => {
   const registry = c.get('seedRegistry')
-  const publicSeeds = Object.values(registry)
+  const publicSeeds = registry.all()
     .filter(seed => seed.allowPublicRead === true || seed.allowPublicPost === true || seed.allowPublicEdit === true)
 
   const seedHtml = publicSeeds.map(seed => {

package/src/public/query-builder.test.ts

@@ -0,0 +1,220 @@
+import { describe, it, expect } from 'vitest'
+import {
+  parsePublicFilter,
+  toEngineFilters,
+  parsePublicPagination,
+  parseLatestCount,
+} from './query-builder'
+import type { Seed } from '@beechcms/core'
+
+const SEED = {
+  slug: 'posts',
+  displayNameAlias: 'title',
+  branches: [
+    { id: 'br_01', alias: 'title', type: 'text' },
+    { id: 'br_02', alias: 'count', type: 'number' },
+    { id: 'br_03', alias: 'active', type: 'boolean' },
+    { id: 'br_04', alias: 'published_at', type: 'date' },
+    { id: 'br_05', alias: 'tags', type: 'tags' },
+    { id: 'br_06', alias: 'body', type: 'richtext' },
+    { id: 'br_07', alias: 'attachment', type: 'file' },
+    { id: 'br_08', alias: 'meta', type: 'json' },
+  ],
+} as unknown as Seed
+
+// ─── parsePublicFilter ────────────────────────────────────────────────────────
+
+describe('parsePublicFilter', () => {
+  it('returns null for undefined input', () => {
+    expect(parsePublicFilter(undefined)).toBeNull()
+  })
+
+  it('returns null for empty string', () => {
+    expect(parsePublicFilter('')).toBeNull()
+  })
+
+  it('parses a valid filter with explicit AND logic', () => {
+    const raw = JSON.stringify({ logic: 'AND', where: [{ field: 'title', op: 'eq', value: 'Hello' }] })
+    const result = parsePublicFilter(raw)!
+    expect(result.logic).toBe('AND')
+    expect(result.where).toHaveLength(1)
+    expect(result.where[0]).toEqual({ field: 'title', op: 'eq', value: 'Hello' })
+  })
+
+  it('defaults logic to AND when omitted', () => {
+    const raw = JSON.stringify({ where: [{ field: 'title', op: 'contains', value: 'x' }] })
+    expect(parsePublicFilter(raw)!.logic).toBe('AND')
+  })
+
+  it('accepts case-insensitive logic value', () => {
+    const raw = JSON.stringify({ logic: 'or', where: [] })
+    expect(parsePublicFilter(raw)!.logic).toBe('OR')
+  })
+
+  it('throws for malformed JSON', () => {
+    expect(() => parsePublicFilter('{not-json')).toThrow('malformed JSON')
+  })
+
+  it('throws when parsed value is not an object', () => {
+    expect(() => parsePublicFilter('"a string"')).toThrow('object expected')
+  })
+
+  it('throws for an invalid logic value', () => {
+    const raw = JSON.stringify({ logic: 'BOTH', where: [] })
+    expect(() => parsePublicFilter(raw)).toThrow("'AND' or 'OR'")
+  })
+
+  it('throws for an unknown operator in a where condition', () => {
+    const raw = JSON.stringify({ where: [{ field: 'title', op: 'like', value: 'x' }] })
+    expect(() => parsePublicFilter(raw)).toThrow("unknown operator 'like'")
+  })
+
+  it('throws when where is not an array', () => {
+    const raw = JSON.stringify({ where: { field: 'title', op: 'eq' } })
+    expect(() => parsePublicFilter(raw)).toThrow("'where' must be an array")
+  })
+
+  it('filters out null conditions from where (missing field/op)', () => {
+    const raw = JSON.stringify({ where: [null, { field: 'title', op: 'eq', value: 'x' }] })
+    const result = parsePublicFilter(raw)!
+    expect(result.where).toHaveLength(1)
+  })
+
+  it('accepts all valid operators without throwing', () => {
+    const operators = ['eq', 'neq', 'gt', 'gte', 'lt', 'lte', 'contains', 'not_contains',
+      'starts_with', 'ends_with', 'is_empty', 'is_not_empty', 'in', 'not_in',
+      'has_tag', 'has_any_tag', 'has_all_tags']
+    for (const op of operators) {
+      const raw = JSON.stringify({ where: [{ field: 'title', op, value: 'x' }] })
+      expect(() => parsePublicFilter(raw)).not.toThrow()
+    }
+  })
+})
+
+// ─── toEngineFilters ──────────────────────────────────────────────────────────
+
+describe('toEngineFilters', () => {
+  it('returns [] for null filter', () => {
+    expect(toEngineFilters(SEED, null)).toEqual([])
+  })
+
+  it('returns [] when where array is empty', () => {
+    expect(toEngineFilters(SEED, { where: [], logic: 'AND' })).toEqual([])
+  })
+
+  it('maps text branch to FilterType "text"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'title', op: 'eq', value: 'Hi' }], logic: 'AND' })
+    expect(result[0].type).toBe('text')
+  })
+
+  it('maps number branch to FilterType "number"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'count', op: 'gt', value: 5 }], logic: 'AND' })
+    expect(result[0].type).toBe('number')
+  })
+
+  it('maps boolean branch to FilterType "boolean"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'active', op: 'eq', value: true }], logic: 'AND' })
+    expect(result[0].type).toBe('boolean')
+  })
+
+  it('maps date branch to FilterType "date"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'published_at', op: 'gt', value: '2024-01-01' }], logic: 'AND' })
+    expect(result[0].type).toBe('date')
+  })
+
+  it('maps tags branch to FilterType "tags"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'tags', op: 'has_tag', value: 'news' }], logic: 'AND' })
+    expect(result[0].type).toBe('tags')
+  })
+
+  it('maps richtext branch to FilterType "text"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'body', op: 'contains', value: 'x' }], logic: 'AND' })
+    expect(result[0].type).toBe('text')
+  })
+
+  it('maps file branch to FilterType "text"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'attachment', op: 'contains', value: 'url' }], logic: 'AND' })
+    expect(result[0].type).toBe('text')
+  })
+
+  it('maps json branch to FilterType "json"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'meta', op: 'eq', value: '{}' }], logic: 'AND' })
+    expect(result[0].type).toBe('json')
+  })
+
+  it('maps system columns (id, slug, status) to FilterType "system"', () => {
+    for (const field of ['id', 'slug', 'status', 'created_at', 'updated_at']) {
+      const result = toEngineFilters(SEED, { where: [{ field, op: 'eq', value: 'x' }], logic: 'AND' })
+      expect(result[0].type).toBe('system')
+    }
+  })
+
+  it('maps unknown fields to FilterType "text"', () => {
+    const result = toEngineFilters(SEED, { where: [{ field: 'ghost_field', op: 'eq', value: 'x' }], logic: 'AND' })
+    expect(result[0].type).toBe('text')
+  })
+
+  it('produces one FilterGroup per condition', () => {
+    const filter = {
+      where: [
+        { field: 'title', op: 'eq' as const, value: 'A' },
+        { field: 'count', op: 'gt' as const, value: 5 },
+      ],
+      logic: 'AND' as const,
+    }
+    expect(toEngineFilters(SEED, filter)).toHaveLength(2)
+  })
+
+  it('includes column and conditions in each FilterGroup', () => {
+    const filter = { where: [{ field: 'title', op: 'contains' as const, value: 'hi' }], logic: 'AND' as const }
+    const [group] = toEngineFilters(SEED, filter)
+    expect(group.column).toBe('title')
+    expect(group.conditions[0].op).toBe('contains')
+    expect(group.conditions[0].value).toBe('hi')
+  })
+})
+
+// ─── parsePublicPagination ────────────────────────────────────────────────────
+
+describe('parsePublicPagination', () => {
+  it('defaults to page=1 and limit=25 when input is empty', () => {
+    expect(parsePublicPagination({})).toEqual({ page: 1, limit: 25 })
+  })
+
+  it('parses valid page and limit values', () => {
+    expect(parsePublicPagination({ page: '3', limit: '10' })).toEqual({ page: 3, limit: 10 })
+  })
+
+  it('clamps limit to a maximum of 100', () => {
+    expect(parsePublicPagination({ limit: '500' }).limit).toBe(100)
+  })
+
+  it('uses default for invalid (non-numeric) input', () => {
+    expect(parsePublicPagination({ page: 'abc', limit: 'xyz' })).toEqual({ page: 1, limit: 25 })
+  })
+})
+
+// ─── parseLatestCount ─────────────────────────────────────────────────────────
+
+describe('parseLatestCount', () => {
+  it('returns 10 for undefined', () => {
+    expect(parseLatestCount(undefined)).toBe(10)
+  })
+
+  it('parses a valid integer string', () => {
+    expect(parseLatestCount('5')).toBe(5)
+  })
+
+  it('clamps to 1 for values below minimum', () => {
+    expect(parseLatestCount('0')).toBe(1)
+    expect(parseLatestCount('-5')).toBe(1)
+  })
+
+  it('clamps to 100 for values above maximum', () => {
+    expect(parseLatestCount('200')).toBe(100)
+  })
+
+  it('returns 10 for non-numeric input', () => {
+    expect(parseLatestCount('abc')).toBe(10)
+  })
+})

package/src/public/rate-limit-middleware.ts

@@ -1,34 +1,22 @@
 import type { Context, Next } from 'hono'
+import type { AppEnv } from '../types'
 import { publicProblem } from './problem-details'
-
-type PublicBindings = {
-  PUBLIC_READ_RATE_LIMITER?: RateLimit
-  PUBLIC_WRITE_RATE_LIMITER?: RateLimit
-}
+import { getClientIp } from '../shared/request-utils'
 
 function isReadMethod(method: string): boolean {
   return method === 'GET' || method === 'HEAD' || method === 'OPTIONS'
 }
 
-function getClientIp(headers: Headers): string {
-  return headers.get('cf-connecting-ip') ?? 'unknown'
-}
-
 export function publicRateLimitMiddleware() {
-  return async (c: Context, next: Next): Promise<Response | void> => {
-    const env = c.env as PublicBindings
+  return async (c: Context<AppEnv>, next: Next): Promise<Response | void> => {
     const readMethod = isReadMethod(c.req.method)
-    const limiter = readMethod ? env.PUBLIC_READ_RATE_LIMITER : env.PUBLIC_WRITE_RATE_LIMITER
-    if (!limiter) {
-      await next()
-      return
-    }
+    const limiterName = readMethod ? ('publicApiRead' as const) : ('publicApiWrite' as const)
 
     const seed = c.req.param('seed') ?? 'no-seed'
-    const key = `${getClientIp(c.req.raw.headers)}:${seed}:${readMethod ? 'read' : 'write'}`
-    const { success } = await limiter.limit({ key })
+    const key = `${getClientIp(c.req)}:${seed}:${limiterName}`
+    const result = await c.get('rateLimiters').getLimiter(limiterName).checkLimit(key)
 
-    if (!success) {
+    if (!result.isAllowed) {
       return publicProblem(c, {
         type: 'rate-limit-exceeded',
         title: 'Too Many Requests',

package/src/rate-limit/cloudflare-rate-limiter.test.ts

@@ -0,0 +1,26 @@
+import { describe, it, expect, vi } from 'vitest'
+import { CloudflareRateLimiter } from './cloudflare-rate-limiter'
+
+describe('CloudflareRateLimiter', () => {
+  it('returns isAllowed: true when the Cloudflare binding grants the request', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: true }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const result = await limiter.checkLimit('192.168.1.1:login')
+    expect(result.isAllowed).toBe(true)
+  })
+
+  it('returns isAllowed: false when the Cloudflare binding blocks the request', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: false }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const result = await limiter.checkLimit('192.168.1.1:login')
+    expect(result.isAllowed).toBe(false)
+  })
+
+  it('forwards the exact key to the binding so per-key accounting is correct', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: true }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const key = '10.0.0.1:some-seed:publicApiRead'
+    await limiter.checkLimit(key)
+    expect(mockBinding.limit).toHaveBeenCalledWith({ key })
+  })
+})

package/src/rate-limit/cloudflare-rate-limiter.ts

@@ -0,0 +1,11 @@
+/// <reference types="@cloudflare/workers-types" />
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class CloudflareRateLimiter implements IRateLimiter {
+  constructor(private readonly binding: RateLimit) {}
+
+  async checkLimit(key: string): Promise<RateLimitResult> {
+    const { success } = await this.binding.limit({ key })
+    return { isAllowed: success }
+  }
+}

package/src/rate-limit/in-memory-rate-limiter.test.ts

@@ -0,0 +1,33 @@
+import { describe, it, expect } from 'vitest'
+import { InMemoryRateLimiter } from './in-memory-rate-limiter'
+
+describe('InMemoryRateLimiter', () => {
+  it('allows requests up to the configured maximum hit count', async () => {
+    const limiter = new InMemoryRateLimiter(3)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+  })
+
+  it('blocks the very next request after maxAllowedHits is reached', async () => {
+    const limiter = new InMemoryRateLimiter(2)
+    await limiter.checkLimit('key')
+    await limiter.checkLimit('key')
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(false)
+  })
+
+  it('tracks hit counts independently for each key', async () => {
+    const limiter = new InMemoryRateLimiter(1)
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(true)
+    // Both keys exhausted independently
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(false)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(false)
+  })
+
+  it('maxAllowedHits = 1 allows exactly one request before blocking', async () => {
+    const limiter = new InMemoryRateLimiter(1)
+    expect((await limiter.checkLimit('k')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('k')).isAllowed).toBe(false)
+  })
+})

package/src/rate-limit/in-memory-rate-limiter.ts

@@ -0,0 +1,13 @@
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class InMemoryRateLimiter implements IRateLimiter {
+  private readonly hitCounts = new Map<string, number>()
+
+  constructor(private readonly maxAllowedHits: number) {}
+
+  async checkLimit(key: string): Promise<RateLimitResult> {
+    const currentHits = (this.hitCounts.get(key) ?? 0) + 1
+    this.hitCounts.set(key, currentHits)
+    return { isAllowed: currentHits <= this.maxAllowedHits }
+  }
+}

package/src/rate-limit/no-op-rate-limiter.test.ts

@@ -0,0 +1,18 @@
+import { describe, it, expect } from 'vitest'
+import { NoOpRateLimiter } from './no-op-rate-limiter'
+
+describe('NoOpRateLimiter', () => {
+  it('always returns isAllowed: true regardless of the key', async () => {
+    const limiter = new NoOpRateLimiter()
+    for (let i = 0; i < 100; i++) {
+      expect((await limiter.checkLimit('any-key')).isAllowed).toBe(true)
+    }
+  })
+
+  it('allows all keys without accumulating state', async () => {
+    const limiter = new NoOpRateLimiter()
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+  })
+})

package/src/rate-limit/no-op-rate-limiter.ts

@@ -0,0 +1,7 @@
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class NoOpRateLimiter implements IRateLimiter {
+  async checkLimit(_key: string): Promise<RateLimitResult> {
+    return { isAllowed: true }
+  }
+}