@consilioweb/payload-support 3.0.0 → 5.0.0

package/dist/index.d.cts

@@ -11,9 +11,29 @@ interface RateLimitStore {
 /**
  * Process-local fallback store. Applications running more than one process
  * should provide a persistent RateLimitStore through the plugin options.
+ *
+ * BOUNDED, because the keys come from anonymous HTTP traffic: `/support/login`
+ * and `/support/chatbot` key their limiter on the client IP, and the IP is read
+ * from `x-forwarded-for`. A caller rotating that header wrote one PERMANENT
+ * entry per value into a map that had no ceiling, no expiry sweep and no
+ * eviction — only `reset()` ever removed anything, and the login path never
+ * calls it. Worse, every fresh key opened a fresh window, so the limiter did
+ * not even slow down the flood that was exhausting it.
+ *
+ * Two independent bounds, the same pair `endpoints/typing.ts` already applies
+ * to its own module-level map: `clientIpRateKey` caps the SIZE of a key, the
+ * ceiling below caps their NUMBER.
  */
 declare class MemoryRateLimitStore implements RateLimitStore {
+    private readonly maxKeys;
     private readonly entries;
+    constructor(maxKeys?: number);
+    /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+    get size(): number;
+    /** Reclaims every window that has already closed. */
+    private sweepExpired;
+    /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+    private evictOldest;
     increment(key: string, windowMs: number): Promise<RateLimitEntry>;
     reset(key: string): Promise<void>;
 }
@@ -28,7 +48,19 @@ declare class RateLimiter {
     private readonly windowMs;
     private readonly maxRequests;
     private readonly store;
-    constructor(windowMs: number, maxRequests: number, store?: RateLimitStore);
+    private readonly prefix;
+    /**
+     * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
+     *   The store is SHARED (`rateLimitStore: 'payload'` builds one instance for
+     *   all endpoints), and the raw keys collide across endpoints: `ip` was used
+     *   by both the login and the chatbot limiter — 10 forged chatbot requests
+     *   locked a victim out of the portal for 15 minutes — and `String(user.id)`
+     *   by five different endpoints. Always pass one; it is optional only because
+     *   `RateLimiter` is part of the published API surface.
+     */
+    constructor(windowMs: number, maxRequests: number, store?: RateLimitStore, namespace?: string);
+    /** The key actually written to the store. Exposed for assertions in tests. */
+    scopedKey(key: string): string;
     check(key: string, context?: unknown): Promise<boolean>;
     reset(key: string, context?: unknown): Promise<void>;
 }
@@ -505,14 +537,17 @@ interface SupportSettingsState {
      */
     featuresConfigured: boolean;
 }
-declare function readSupportSettingsState(payload: Payload): Promise<SupportSettingsState>;
-declare function readSupportSettings(payload: Payload): Promise<SupportSettings>;
-declare function readUserPrefs(payload: Payload, userId: string | number): Promise<UserPrefs>;
+declare function readSupportSettingsState(payload: Payload, staffSlug?: string): Promise<SupportSettingsState>;
+declare function readSupportSettings(payload: Payload, staffSlug?: string): Promise<SupportSettings>;
+declare function readUserPrefs(payload: Payload, userId: string | number, staffSlug?: string): Promise<UserPrefs>;
 
 /**
  * POST /api/support/oauth/google
  * Google OAuth — handles both login redirect and callback.
- * Body: { action: 'login' } or { code: string, state: string, cookieState: string }
+ * Body: { action: 'login' } or { code: string, state: string }
+ *
+ * The CSRF state is NOT taken from the body: `action: 'login'` issues it as an
+ * HttpOnly cookie and the callback reads it back from the `Cookie` header.
  */
 interface OAuthGoogleOptions {
     allowedEmailDomains?: string[];

package/dist/index.d.ts

@@ -11,9 +11,29 @@ interface RateLimitStore {
 /**
  * Process-local fallback store. Applications running more than one process
  * should provide a persistent RateLimitStore through the plugin options.
+ *
+ * BOUNDED, because the keys come from anonymous HTTP traffic: `/support/login`
+ * and `/support/chatbot` key their limiter on the client IP, and the IP is read
+ * from `x-forwarded-for`. A caller rotating that header wrote one PERMANENT
+ * entry per value into a map that had no ceiling, no expiry sweep and no
+ * eviction — only `reset()` ever removed anything, and the login path never
+ * calls it. Worse, every fresh key opened a fresh window, so the limiter did
+ * not even slow down the flood that was exhausting it.
+ *
+ * Two independent bounds, the same pair `endpoints/typing.ts` already applies
+ * to its own module-level map: `clientIpRateKey` caps the SIZE of a key, the
+ * ceiling below caps their NUMBER.
  */
 declare class MemoryRateLimitStore implements RateLimitStore {
+    private readonly maxKeys;
     private readonly entries;
+    constructor(maxKeys?: number);
+    /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+    get size(): number;
+    /** Reclaims every window that has already closed. */
+    private sweepExpired;
+    /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+    private evictOldest;
     increment(key: string, windowMs: number): Promise<RateLimitEntry>;
     reset(key: string): Promise<void>;
 }
@@ -28,7 +48,19 @@ declare class RateLimiter {
     private readonly windowMs;
     private readonly maxRequests;
     private readonly store;
-    constructor(windowMs: number, maxRequests: number, store?: RateLimitStore);
+    private readonly prefix;
+    /**
+     * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
+     *   The store is SHARED (`rateLimitStore: 'payload'` builds one instance for
+     *   all endpoints), and the raw keys collide across endpoints: `ip` was used
+     *   by both the login and the chatbot limiter — 10 forged chatbot requests
+     *   locked a victim out of the portal for 15 minutes — and `String(user.id)`
+     *   by five different endpoints. Always pass one; it is optional only because
+     *   `RateLimiter` is part of the published API surface.
+     */
+    constructor(windowMs: number, maxRequests: number, store?: RateLimitStore, namespace?: string);
+    /** The key actually written to the store. Exposed for assertions in tests. */
+    scopedKey(key: string): string;
     check(key: string, context?: unknown): Promise<boolean>;
     reset(key: string, context?: unknown): Promise<void>;
 }
@@ -505,14 +537,17 @@ interface SupportSettingsState {
      */
     featuresConfigured: boolean;
 }
-declare function readSupportSettingsState(payload: Payload): Promise<SupportSettingsState>;
-declare function readSupportSettings(payload: Payload): Promise<SupportSettings>;
-declare function readUserPrefs(payload: Payload, userId: string | number): Promise<UserPrefs>;
+declare function readSupportSettingsState(payload: Payload, staffSlug?: string): Promise<SupportSettingsState>;
+declare function readSupportSettings(payload: Payload, staffSlug?: string): Promise<SupportSettings>;
+declare function readUserPrefs(payload: Payload, userId: string | number, staffSlug?: string): Promise<UserPrefs>;
 
 /**
  * POST /api/support/oauth/google
  * Google OAuth — handles both login redirect and callback.
- * Body: { action: 'login' } or { code: string, state: string, cookieState: string }
+ * Body: { action: 'login' } or { code: string, state: string }
+ *
+ * The CSRF state is NOT taken from the body: `action: 'login'` issues it as an
+ * HttpOnly cookie and the callback reads it back from the `Cookie` header.
  */
 interface OAuthGoogleOptions {
     allowedEmailDomains?: string[];