@effectstream/runtime 0.104.0 → 0.104.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@effectstream/runtime",
-  "version": "0.104.0",
+  "version": "0.104.3",
   "license": "(MIT OR Apache-2.0)",
   "homepage": "https://effectstream.github.io/docs/",
   "repository": {
@@ -13,17 +13,17 @@
   },
   "exports": "./src/mod.ts",
   "dependencies": {
-    "@effectstream/concise": "0.104.0",
-    "@effectstream/config": "0.104.0",
-    "@effectstream/coroutine": "0.104.0",
-    "@effectstream/crypto": "0.104.0",
-    "@effectstream/db": "0.104.0",
-    "@effectstream/event-client": "0.104.0",
-    "@effectstream/event-server": "0.104.0",
-    "@effectstream/log": "0.104.0",
-    "@effectstream/sm": "0.104.0",
-    "@effectstream/sync": "0.104.0",
-    "@effectstream/utils": "0.104.0",
+    "@effectstream/concise": "0.104.3",
+    "@effectstream/config": "0.104.3",
+    "@effectstream/coroutine": "0.104.3",
+    "@effectstream/crypto": "0.104.3",
+    "@effectstream/db": "0.104.3",
+    "@effectstream/event-client": "0.104.3",
+    "@effectstream/event-server": "0.104.3",
+    "@effectstream/log": "0.104.3",
+    "@effectstream/sm": "0.104.3",
+    "@effectstream/sync": "0.104.3",
+    "@effectstream/utils": "0.104.3",
     "@fastify/cors": "^11.0.1",
     "@metamask/json-rpc-engine": "^10.0.3",
     "pg": "8.21.0",

package/src/api/http-server.ts

@@ -1,4 +1,9 @@
-import fastify, { type FastifyInstance, type FastifyReply, type FastifyRequest } from "fastify";
+import fastify, {
+  type FastifyInstance,
+  type FastifyReply,
+  type FastifyRequest,
+  type FastifyServerOptions,
+} from "fastify";
 import { evmRpcEngine } from "./rpc-evm/eip1193.ts";
 import { appliedBlockStatus } from "./apply-status.ts";
 import { finalizedStreamStatus } from "./stream-status.ts";
@@ -53,6 +58,23 @@ import {
 import { PrimitiveRegistry } from "@effectstream/sm";
 import { ConfigNetworkType, getWriteNamespace, usePaimaStaticConfig } from "@effectstream/config";
 
+/**
+ * Parse `EFFECTSTREAM_TRUST_PROXY` into Fastify's `trustProxy` option.
+ *
+ * - `true` / `1` / empty → `true` (trust every hop; the default)
+ * - `false` / `0`        → `false`
+ * - anything else        → comma-separated proxy IPs / CIDRs
+ */
+export function parseTrustProxy(raw: string | undefined): boolean | string[] {
+  const value = (raw ?? "").trim();
+  if (value === "" || value.toLowerCase() === "true" || value === "1") return true;
+  if (value.toLowerCase() === "false" || value === "0") return false;
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0);
+}
+
 function tableListContains(
   list: Array<{ table_name: string | null }>,
   name: string,
@@ -168,7 +190,15 @@ export const startHttpServer = function* (
   // Use dbConn directly; queries are executed via pgtyped PreparedQuery.run
   // Allow any webpage to access the server.
   // This node is not specific for a specific website.
-  const server = fastify({ routerOptions: { maxParamLength: 300 } });
+  // trustProxy decides what `request.ip` means. Deployments front this server
+  // with nginx/Caddy, and without it Fastify reports the proxy's address for
+  // every client — so anything keyed per IP (the rate limiter above all)
+  // shares ONE bucket across every user behind the proxy.
+  const serverOptions: FastifyServerOptions = {
+    routerOptions: { maxParamLength: 300 },
+    trustProxy: parseTrustProxy(ENV.EFFECTSTREAM_TRUST_PROXY),
+  };
+  const server = fastify(serverOptions);
   // OpenAPI Docs
   yield* registerOpenApiDocumentation(server, ENV.EFFECTSTREAM_API_PORT);
 

package/src/api/trust-proxy.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, test } from "bun:test";
+import { parseTrustProxy } from "./http-server.ts";
+
+describe("parseTrustProxy", () => {
+  test("defaults to trusting every hop", () => {
+    expect(parseTrustProxy(undefined)).toBe(true);
+    expect(parseTrustProxy("")).toBe(true);
+    expect(parseTrustProxy("true")).toBe(true);
+    expect(parseTrustProxy("TRUE")).toBe(true);
+    expect(parseTrustProxy("1")).toBe(true);
+  });
+  test("can be switched off", () => {
+    expect(parseTrustProxy("false")).toBe(false);
+    expect(parseTrustProxy("0")).toBe(false);
+  });
+  test("a bare number that is not 0/1 is treated as an address list entry", () => {
+    expect(parseTrustProxy("2")).toEqual(["2"]);
+  });
+  test("a list becomes trimmed proxy addresses", () => {
+    expect(parseTrustProxy(" 127.0.0.1, 10.0.0.0/8 ,")).toEqual(["127.0.0.1", "10.0.0.0/8"]);
+  });
+});