@digitraffic/common 2026.8.6-1 → 2026.8.31-1

package/dist/__test__/infra/acl-builder.test.js

@@ -51,6 +51,24 @@ describe("acl-builder tests", () => {
             expect(throttleRule.action.block).toBeDefined();
         }
     });
+    test("anonymous uri-path throttle can exclude a path", () => {
+        const acl = createBuilder()
+            .withThrottleAnonymousUserIpAndUriPath(100, /^\/roadnetwork\//)
+            .build();
+        const rule = acl.rules[0];
+        const statement = rule?.statement;
+        const rateBased = statement.rateBasedStatement;
+        const scopeDown = rateBased.scopeDownStatement;
+        const scopeDownStatement = scopeDown;
+        const andStatement = scopeDownStatement.andStatement;
+        const scopeDownStatements = (andStatement.statements ??
+            []);
+        const excludedStatement = scopeDownStatements[1];
+        const excludedPathStatement = excludedStatement.notStatement;
+        const regexMatchStatement = excludedPathStatement.statement.regexMatchStatement;
+        expect(scopeDownStatements).toHaveLength(2);
+        expect(regexMatchStatement.regexString).toBe("^\\/roadnetwork\\/");
+    });
     test("Cannot define two rules with the same name", () => {
         expect(() => createBuilder()
             .withThrottleAnonymousUserIp(10)

package/dist/aws/infra/acl-builder.d.ts

@@ -32,13 +32,32 @@ export declare class AclBuilder {
      * Allow access only from the given addresses
      */
     withIpWhitelistRule(addresses: string[]): this;
-    withThrottleRule(name: string, limit: number, isHeaderRequired: boolean, isBasedOnIpAndUriPath: boolean, customResponseBodyKey?: string, path?: RegExp): this;
+    /**
+     * Adds a rate-based WAF rule for either blocking or counting requests.
+     *
+     * @param name WAF rule name and CloudWatch metric name.
+     * @param limit Maximum requests allowed in the WAF evaluation window.
+     * @param isHeaderRequired Whether the rule applies when the digitraffic-user header is present.
+     * @param isBasedOnIpAndUriPath Whether requests are aggregated by IP address and URI path.
+     * @param customResponseBodyKey Custom response body key; when provided, matching requests are blocked instead of counted.
+     * @param path Optional URI path pattern that limits which requests are included.
+     * @param excludedPath Optional URI path pattern that excludes matching requests from the rule.
+     */
+    withThrottleRule(name: string, limit: number, isHeaderRequired: boolean, isBasedOnIpAndUriPath: boolean, customResponseBodyKey?: string, path?: RegExp, excludedPath?: RegExp): this;
     withCustomResponseBody(key: string, customResponseBody: CfnWebACL.CustomResponseBodyProperty): this;
     withThrottleDigitrafficUserIp(limit: number | undefined): this;
     withThrottleDigitrafficUserIpAndUriPath(limit: number | undefined): this;
     withThrottleAnonymousUserIp(limit: number | undefined): AclBuilder;
     withThrottleAnonymousUserIpByUriPath(limit: number | undefined, path: RegExp | undefined): AclBuilder;
-    withThrottleAnonymousUserIpAndUriPath(limit: number | undefined): this;
+    /**
+     * Throttles anonymous requests by IP address and URI path.
+     *
+     * Existing callers that omit `excludedPath` retain the previous behavior.
+     *
+     * @param limit Maximum requests allowed for each IP and URI path combination.
+     * @param excludedPath Optional URI path pattern excluded from this throttle rule.
+     */
+    withThrottleAnonymousUserIpAndUriPath(limit: number | undefined, excludedPath?: RegExp): this;
     withCountDigitrafficUserIp(limit: number | undefined): this;
     withCountDigitrafficUserIpAndUriPath(limit: number | undefined): this;
     withCountAnonymousUserIp(limit: number | undefined): this;

package/dist/aws/infra/acl-builder.js

@@ -91,7 +91,18 @@ export class AclBuilder {
         });
         return this;
     }
-    withThrottleRule(name, limit, isHeaderRequired, isBasedOnIpAndUriPath, customResponseBodyKey, path) {
+    /**
+     * Adds a rate-based WAF rule for either blocking or counting requests.
+     *
+     * @param name WAF rule name and CloudWatch metric name.
+     * @param limit Maximum requests allowed in the WAF evaluation window.
+     * @param isHeaderRequired Whether the rule applies when the digitraffic-user header is present.
+     * @param isBasedOnIpAndUriPath Whether requests are aggregated by IP address and URI path.
+     * @param customResponseBodyKey Custom response body key; when provided, matching requests are blocked instead of counted.
+     * @param path Optional URI path pattern that limits which requests are included.
+     * @param excludedPath Optional URI path pattern that excludes matching requests from the rule.
+     */
+    withThrottleRule(name, limit, isHeaderRequired, isBasedOnIpAndUriPath, customResponseBodyKey, path, excludedPath) {
         const isBlockRule = !!customResponseBodyKey;
         const rules = isBlockRule ? this._blockRules : this._countRules;
         const action = isBlockRule
@@ -114,7 +125,7 @@ export class AclBuilder {
                 metricName: name,
             },
             action,
-            statement: createThrottleStatement(limit, isHeaderRequired, isBasedOnIpAndUriPath, path),
+            statement: createThrottleStatement(limit, isHeaderRequired, isBasedOnIpAndUriPath, path, excludedPath),
         });
         return this;
     }
@@ -160,13 +171,21 @@ export class AclBuilder {
         this._addThrottleResponseBody(customResponseBodyKey, limit);
         return this.withThrottleRule("ThrottleRuleWithAnonymousUserByPath", limit, false, false, customResponseBodyKey, path);
     }
-    withThrottleAnonymousUserIpAndUriPath(limit) {
+    /**
+     * Throttles anonymous requests by IP address and URI path.
+     *
+     * Existing callers that omit `excludedPath` retain the previous behavior.
+     *
+     * @param limit Maximum requests allowed for each IP and URI path combination.
+     * @param excludedPath Optional URI path pattern excluded from this throttle rule.
+     */
+    withThrottleAnonymousUserIpAndUriPath(limit, excludedPath) {
         if (limit === undefined) {
             return this;
         }
         const customResponseBodyKey = `IP_PATH_THROTTLE_ANONYMOUS_USER_${limit}`;
         this._addThrottleResponseBody(customResponseBodyKey, limit);
-        return this.withThrottleRule("ThrottleRuleIPQueryWithAnonymousUser", limit, false, true, customResponseBodyKey);
+        return this.withThrottleRule("ThrottleRuleIPQueryWithAnonymousUser", limit, false, true, customResponseBodyKey, undefined, excludedPath);
     }
     withCountDigitrafficUserIp(limit) {
         if (limit === undefined) {
@@ -289,8 +308,18 @@ function notStatement(statement) {
         },
     };
 }
-function createThrottleStatement(limit, isHeaderRequired, isBasedOnIpAndUriPath, path) {
-    // this statement matches empty digitraffic-user -header
+/**
+ * Creates the scope-down and rate-based statement used by a throttle rule.
+ *
+ * @param limit Maximum requests allowed in the WAF evaluation window.
+ * @param isHeaderRequired Whether the statement matches requests with the digitraffic-user header.
+ * @param isBasedOnIpAndUriPath Whether requests are aggregated by IP address and URI path.
+ * @param path Optional URI path pattern that limits which requests are included.
+ * @param excludedPath Optional URI path pattern that is explicitly excluded from the statement.
+ */
+function createThrottleStatement(limit, isHeaderRequired, isBasedOnIpAndUriPath, path, excludedPath) {
+    // Matches requests with a non-empty digitraffic-user header. For anonymous
+    // requests, the inverted statement matches requests without the header.
     const matchStatement = {
         sizeConstraintStatement: {
             comparisonOperator: isHeaderRequired ? "GT" : "GE",
@@ -324,6 +353,25 @@ function createThrottleStatement(limit, isHeaderRequired, isBasedOnIpAndUriPath,
             },
         };
     }
+    if (excludedPath) {
+        const excludedPathMatchStatement = {
+            regexMatchStatement: {
+                fieldToMatch: {
+                    uriPath: {},
+                },
+                regexString: excludedPath.source,
+                textTransformations: [{ priority: 0, type: "NONE" }],
+            },
+        };
+        scopeDownStatement = {
+            andStatement: {
+                statements: [
+                    scopeDownStatement,
+                    notStatement(excludedPathMatchStatement),
+                ],
+            },
+        };
+    }
     if (isBasedOnIpAndUriPath) {
         return {
             rateBasedStatement: {

package/dist/aws/infra/stack/dt-function.js

@@ -3,7 +3,7 @@ import { Duration } from "aws-cdk-lib";
 import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { ApplicationLogLevel, Architecture, AssetCode, Function as AwsFunction, Code, LoggingFormat, Runtime, SystemLogLevel, } from "aws-cdk-lib/aws-lambda";
-import { camelCase, startCase } from "es-toolkit";
+import { camelCase, kebabCase, startCase } from "es-toolkit";
 import { DatabaseEnvironmentKeys } from "../../../database/database.js";
 import { EnvKeys } from "../../runtime/environment.js";
 import { DtFunctionAlarms } from "./dt-function-alarms.js";
@@ -260,14 +260,16 @@ export class FunctionBuilder {
         }
     }
     getEnvironment() {
-        let environment = {};
-        if (this._features.secretAccess) {
+        let environment = {
+            [EnvKeys.APP_NAME]: `${this._stack.configuration.trafficType.toLowerCase()}-${kebabCase(this._stack.configuration.shortName)}`,
+        };
+        if (this._features.secretAccess && this._stack.configuration.secretId) {
             environment = {
                 ...environment,
                 [EnvKeys.SECRET_ID]: this._stack.configuration.secretId,
             };
         }
-        if (this._features.databaseAccess) {
+        if (this._features.databaseAccess && this._stack.configuration.shortName) {
             environment = {
                 ...environment,
                 [DatabaseEnvironmentKeys.DB_APPLICATION]: this._stack.configuration.shortName,

package/dist/aws/runtime/dt-logger.d.ts

@@ -61,6 +61,7 @@ export interface LoggableType extends CustomParams {
  * * the actual message (as json or as string)
  */
 export declare class DtLogger {
+    readonly appName?: string;
     readonly lambdaName?: string;
     readonly runtime?: string;
     readonly writeStream: Writable;

package/dist/aws/runtime/dt-logger.js

@@ -1,5 +1,6 @@
 import { lowerFirst, mapKeys } from "es-toolkit";
 import { getEnvVariableOrElse } from "../../utils/utils.js";
+import { EnvKeys } from "./environment.js";
 /**
  * Helper class for json-logging.
  *
@@ -10,6 +11,7 @@ import { getEnvVariableOrElse } from "../../utils/utils.js";
  * * the actual message (as json or as string)
  */
 export class DtLogger {
+    appName;
     lambdaName;
     runtime;
     writeStream;
@@ -19,6 +21,7 @@ export class DtLogger {
      * @param {LoggerConfiguration?} [config] - Accepts configuration options @see {@link LoggerConfiguration}
      */
     constructor(config) {
+        this.appName = getEnvVariableOrElse(EnvKeys.APP_NAME, undefined);
         this.lambdaName =
             config?.lambdaName ??
                 getEnvVariableOrElse("AWS_LAMBDA_FUNCTION_NAME", "unknown lambda name");
@@ -38,6 +41,7 @@ export class DtLogger {
         const logMessage = {
             message,
             level: "DEBUG",
+            app: this.appName,
             lambdaName: this.lambdaName,
             runtime: this.runtime,
         };
@@ -112,6 +116,7 @@ export class DtLogger {
             ...messageFields,
             error,
             stack,
+            app: this.appName,
             lambdaName: this.lambdaName,
             runtime: this.runtime,
         };

package/dist/aws/runtime/environment.d.ts

@@ -1,4 +1,5 @@
 export declare enum EnvKeys {
+    APP_NAME = "APP_NAME",
     AWS_REGION = "AWS_REGION",
     SECRET_ID = "SECRET_ID",
     SECRET_OVERRIDE_AWS_REGION = "SECRET_OVERRIDE_AWS_REGION"

package/dist/aws/runtime/environment.js

@@ -1,5 +1,6 @@
 export var EnvKeys;
 (function (EnvKeys) {
+    EnvKeys["APP_NAME"] = "APP_NAME";
     EnvKeys["AWS_REGION"] = "AWS_REGION";
     EnvKeys["SECRET_ID"] = "SECRET_ID";
     EnvKeys["SECRET_OVERRIDE_AWS_REGION"] = "SECRET_OVERRIDE_AWS_REGION";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digitraffic/common",
-  "version": "2026.8.6-1",
+  "version": "2026.8.31-1",
   "private": false,
   "description": "",
   "repository": {