@cosmicdrift/kumiko-framework 0.157.2 → 0.158.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.157.2",
+  "version": "0.158.2",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -193,7 +193,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.157.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.158.2",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/redis-login-rate-limiter.integration.test.ts

@@ -0,0 +1,66 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { createTestRedis, type TestRedis } from "../../stack";
+import { createRedisLoginRateLimiter } from "../auth-routes";
+
+let testRedis: TestRedis;
+
+beforeAll(async () => {
+  testRedis = await createTestRedis();
+});
+
+afterAll(async () => {
+  await testRedis.cleanup();
+});
+
+beforeEach(async () => {
+  await testRedis.flushNamespace();
+});
+
+describe("createRedisLoginRateLimiter", () => {
+  test("allows exactly maxAttempts checks, then blocks", async () => {
+    const limiter = createRedisLoginRateLimiter(testRedis.redis, 3, 60_000);
+
+    expect(await limiter.check("1.2.3.4|user@test.local")).toBe(true);
+    expect(await limiter.check("1.2.3.4|user@test.local")).toBe(true);
+    expect(await limiter.check("1.2.3.4|user@test.local")).toBe(true);
+    expect(await limiter.check("1.2.3.4|user@test.local")).toBe(false);
+  });
+
+  test("reset clears the counter for that key", async () => {
+    const limiter = createRedisLoginRateLimiter(testRedis.redis, 1, 60_000);
+
+    expect(await limiter.check("k")).toBe(true);
+    expect(await limiter.check("k")).toBe(false);
+
+    await limiter.reset("k");
+    expect(await limiter.check("k")).toBe(true);
+  });
+
+  test("buckets are independent per key", async () => {
+    const limiter = createRedisLoginRateLimiter(testRedis.redis, 1, 60_000);
+
+    expect(await limiter.check("a")).toBe(true);
+    expect(await limiter.check("b")).toBe(true);
+    expect(await limiter.check("a")).toBe(false);
+    expect(await limiter.check("b")).toBe(false);
+  });
+
+  test("namespace keeps two limiter instances from sharing a keyspace", async () => {
+    const login = createRedisLoginRateLimiter(testRedis.redis, 1, 60_000, "login");
+    const mfa = createRedisLoginRateLimiter(testRedis.redis, 1, 60_000, "mfa-verify");
+
+    expect(await login.check("1.2.3.4")).toBe(true);
+    expect(await mfa.check("1.2.3.4")).toBe(true);
+  });
+
+  test("counter resets once windowMs elapses", async () => {
+    const limiter = createRedisLoginRateLimiter(testRedis.redis, 1, 150);
+
+    expect(await limiter.check("k")).toBe(true);
+    expect(await limiter.check("k")).toBe(false);
+
+    await Bun.sleep(200);
+
+    expect(await limiter.check("k")).toBe(true);
+  });
+});

package/src/api/auth-routes.ts

@@ -1,6 +1,7 @@
 import type { Context } from "hono";
 import { Hono } from "hono";
 import { deleteCookie, setCookie } from "hono/cookie";
+import type Redis from "ioredis";
 import { z } from "zod";
 import { buildSessionRoles } from "../engine/membership-roles";
 import { createSystemUser } from "../engine/system-user";
@@ -461,6 +462,37 @@ export function createInMemoryLoginRateLimiter(
   };
 }
 
+// Redis-backed sibling of createInMemoryLoginRateLimiter — same fixed-window
+// semantics (count <= maxAttempts allows, window anchored on first hit), but
+// shared across replicas via INCR/PEXPIRE instead of an in-process Map.
+// runProdApp defaults to this: an in-memory limiter only rate-limits within
+// a single instance, so a multi-replica prod deployment would silently give
+// each replica its own bucket. namespace separates the login-key keyspace
+// from the mfa-verify one (they share the same LoginRateLimiter shape but
+// key on different values).
+export function createRedisLoginRateLimiter(
+  redis: Redis,
+  maxAttempts = 10,
+  windowMs = 5 * 60_000,
+  namespace = "login",
+): LoginRateLimiter {
+  const prefix = `kumiko:auth:ratelimit:${namespace}:`;
+
+  return {
+    async check(key) {
+      const redisKey = `${prefix}${key}`;
+      const count = await redis.incr(redisKey);
+      if (count === 1) {
+        await redis.pexpire(redisKey, windowMs);
+      }
+      return count <= maxAttempts;
+    },
+    async reset(key) {
+      await redis.del(`${prefix}${key}`);
+    },
+  };
+}
+
 export function createAuthRoutes(
   dispatcher: Dispatcher,
   jwt: JwtHelper,

package/src/api/index.ts

@@ -19,7 +19,11 @@ export type {
   SessionMetadata,
   SessionRevoker,
 } from "./auth-routes";
-export { createAuthRoutes, createInMemoryLoginRateLimiter } from "./auth-routes";
+export {
+  createAuthRoutes,
+  createInMemoryLoginRateLimiter,
+  createRedisLoginRateLimiter,
+} from "./auth-routes";
 export type { CachedResponseInit, CachePolicy } from "./http-cache";
 export {
   cacheControlHeader,