@etus/bhono-app 0.1.1

package/templates/base/src/server/middleware/rate-limit.ts

@@ -0,0 +1,294 @@
+/**
+ * Rate Limiting Middleware
+ *
+ * Provides rate limiting protection against API abuse using an in-memory store.
+ * Can be configured per-route with different limits and windows.
+ *
+ * For production with multiple Workers instances, consider using
+ * Cloudflare Rate Limiting or a distributed store like Durable Objects.
+ */
+
+import { createMiddleware } from 'hono/factory'
+import type { HonoEnv } from '../types'
+
+// ============================================================================
+// TYPES
+// ============================================================================
+
+export interface RateLimitOptions {
+  /** Time window in milliseconds (default: 60000 = 1 minute) */
+  windowMs?: number
+  /** Maximum requests per window (default: 100) */
+  max?: number
+  /** Key generator function - defaults to IP address */
+  keyGenerator?: (c: Parameters<ReturnType<typeof createMiddleware<HonoEnv>>>[0]) => string
+  /** Custom message for rate limit exceeded response */
+  message?: string
+  /** Whether to include standard rate limit headers (default: true) */
+  standardHeaders?: boolean
+  /** Skip rate limiting for certain requests */
+  skip?: (c: Parameters<ReturnType<typeof createMiddleware<HonoEnv>>>[0]) => boolean
+}
+
+interface RateLimitRecord {
+  count: number
+  resetTime: number
+}
+
+// ============================================================================
+// IN-MEMORY STORE
+// ============================================================================
+
+/**
+ * In-memory rate limit store.
+ * Note: This is process-local and won't work correctly with multiple Workers instances.
+ * For production, use Cloudflare Rate Limiting or Durable Objects.
+ */
+class RateLimitStore {
+  private store = new Map<string, RateLimitRecord>()
+  private cleanupInterval: ReturnType<typeof setInterval> | null = null
+  private lastCleanup = 0
+
+  constructor() {
+    // Don't use setInterval at construction time - Cloudflare Workers
+    // don't allow async I/O at global scope. Instead, we'll cleanup
+    // lazily during request processing.
+  }
+
+  /**
+   * Start periodic cleanup (call from within a handler, not at global scope)
+   */
+  startPeriodicCleanup(): void {
+    if (this.cleanupInterval) return
+    this.cleanupInterval = setInterval(() => {
+      this.cleanup()
+    }, 60000)
+  }
+
+  get(key: string): RateLimitRecord | undefined {
+    return this.store.get(key)
+  }
+
+  set(key: string, record: RateLimitRecord): void {
+    this.store.set(key, record)
+  }
+
+  increment(key: string, windowMs: number): RateLimitRecord {
+    const now = Date.now()
+
+    // Lazy cleanup: run cleanup every 60 seconds during request processing
+    // This avoids using setInterval at global scope (not allowed in Workers)
+    if (now - this.lastCleanup > 60000) {
+      this.cleanup()
+      this.lastCleanup = now
+    }
+
+    const existing = this.store.get(key)
+
+    if (!existing || now > existing.resetTime) {
+      // Start new window
+      const record: RateLimitRecord = {
+        count: 1,
+        resetTime: now + windowMs,
+      }
+      this.store.set(key, record)
+      return record
+    }
+
+    // Increment existing window
+    existing.count++
+    return existing
+  }
+
+  private cleanup(): void {
+    const now = Date.now()
+    for (const [key, record] of this.store.entries()) {
+      if (now > record.resetTime) {
+        this.store.delete(key)
+      }
+    }
+  }
+
+  /**
+   * Clear all entries (useful for testing)
+   */
+  clear(): void {
+    this.store.clear()
+  }
+
+  /**
+   * Stop the cleanup interval (useful for testing)
+   */
+  destroy(): void {
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval)
+      this.cleanupInterval = null
+    }
+  }
+
+  /**
+   * Get the current size of the store (useful for testing)
+   */
+  get size(): number {
+    return this.store.size
+  }
+}
+
+// Global store instance
+const globalStore = new RateLimitStore()
+
+// Export for testing
+export { RateLimitStore, globalStore }
+
+// ============================================================================
+// MIDDLEWARE
+// ============================================================================
+
+/**
+ * Default key generator - uses IP address from request context
+ */
+function defaultKeyGenerator(c: Parameters<ReturnType<typeof createMiddleware<HonoEnv>>>[0]): string {
+  // Try to get IP from context (set by request-context middleware)
+  const contextIp = c.get('ip')
+  if (contextIp && contextIp !== 'unknown') {
+    return contextIp
+  }
+
+  // Fallback to headers
+  const forwardedFor = c.req.header('x-forwarded-for')
+  if (forwardedFor) {
+    // Take the first IP if there are multiple
+    return forwardedFor.split(',')[0].trim()
+  }
+
+  const realIp = c.req.header('x-real-ip')
+  if (realIp) {
+    return realIp
+  }
+
+  return 'unknown'
+}
+
+/**
+ * Create rate limiting middleware
+ *
+ * @example
+ * // Apply global rate limit of 100 requests per minute
+ * app.use('*', rateLimit())
+ *
+ * @example
+ * // Apply stricter limit to auth endpoints
+ * app.use('/auth/*', rateLimit({ windowMs: 60000, max: 10 }))
+ *
+ * @example
+ * // Custom key generator (e.g., by user ID for authenticated routes)
+ * app.use('/api/*', rateLimit({
+ *   keyGenerator: (c) => c.get('user')?.id ?? defaultKeyGenerator(c)
+ * }))
+ */
+export function rateLimit(options: RateLimitOptions = {}) {
+  const {
+    windowMs = 60000, // 1 minute
+    max = 100, // 100 requests per window
+    keyGenerator = defaultKeyGenerator,
+    message = 'Too many requests, please try again later',
+    standardHeaders = true,
+    skip,
+  } = options
+
+  return createMiddleware<HonoEnv>(async (c, next) => {
+    // Check if we should skip rate limiting
+    if (skip?.(c)) {
+      return next()
+    }
+
+    const key = `ratelimit:${keyGenerator(c)}`
+    const record = globalStore.increment(key, windowMs)
+
+    // Set standard rate limit headers
+    if (standardHeaders) {
+      c.header('X-RateLimit-Limit', String(max))
+      c.header('X-RateLimit-Remaining', String(Math.max(0, max - record.count)))
+      c.header('X-RateLimit-Reset', String(Math.ceil(record.resetTime / 1000)))
+    }
+
+    // Check if rate limit exceeded
+    if (record.count > max) {
+      const retryAfter = Math.ceil((record.resetTime - Date.now()) / 1000)
+
+      c.header('Retry-After', String(Math.max(1, retryAfter)))
+
+      return c.json(
+        {
+          error: {
+            message,
+            code: 'RATE_LIMIT_EXCEEDED',
+            retryAfter,
+          },
+        },
+        429
+      )
+    }
+
+    await next()
+  })
+}
+
+/**
+ * Create a stricter rate limit for sensitive endpoints (e.g., auth)
+ */
+export function authRateLimit() {
+  return rateLimit({
+    windowMs: 60000, // 1 minute
+    max: 10, // 10 requests per minute for auth endpoints
+    message: 'Too many authentication attempts, please try again later',
+  })
+}
+
+/**
+ * Create rate limit with custom store (useful for testing)
+ */
+export function rateLimitWithStore(store: RateLimitStore, options: RateLimitOptions = {}) {
+  const {
+    windowMs = 60000,
+    max = 100,
+    keyGenerator = defaultKeyGenerator,
+    message = 'Too many requests, please try again later',
+    standardHeaders = true,
+    skip,
+  } = options
+
+  return createMiddleware<HonoEnv>(async (c, next) => {
+    if (skip?.(c)) {
+      return next()
+    }
+
+    const key = `ratelimit:${keyGenerator(c)}`
+    const record = store.increment(key, windowMs)
+
+    if (standardHeaders) {
+      c.header('X-RateLimit-Limit', String(max))
+      c.header('X-RateLimit-Remaining', String(Math.max(0, max - record.count)))
+      c.header('X-RateLimit-Reset', String(Math.ceil(record.resetTime / 1000)))
+    }
+
+    if (record.count > max) {
+      const retryAfter = Math.ceil((record.resetTime - Date.now()) / 1000)
+
+      c.header('Retry-After', String(Math.max(1, retryAfter)))
+
+      return c.json(
+        {
+          error: {
+            message,
+            code: 'RATE_LIMIT_EXCEEDED',
+            retryAfter,
+          },
+        },
+        429
+      )
+    }
+
+    await next()
+  })
+}

package/templates/base/src/server/middleware/request-context.test.ts

@@ -0,0 +1,175 @@
+// src/server/middleware/request-context.test.ts
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { Hono } from 'hono'
+import { requestContext } from './request-context'
+
+// Mock uuidv7
+vi.mock('uuidv7', () => ({
+  uuidv7: vi.fn(),
+}))
+
+import { uuidv7 } from 'uuidv7'
+
+describe('requestContext', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    // Default mock for uuidv7
+    vi.mocked(uuidv7).mockReturnValue('01912345-6789-7abc-def0-123456789012')
+  })
+
+  const createApp = () => {
+    const app = new Hono()
+    app.use('*', requestContext)
+    app.get('/test', (c) => {
+      return c.json({
+        transactionId: c.get('transactionId'),
+        ip: c.get('ip'),
+        userAgent: c.get('userAgent'),
+        user: c.get('user'),
+        accountId: c.get('accountId'),
+        userRole: c.get('userRole'),
+        isSystemAdminAccess: c.get('isSystemAdminAccess'),
+      })
+    })
+    return app
+  }
+
+  it('sets transactionId as valid UUID', async () => {
+    const mockUuid = '01912345-6789-7abc-def0-123456789012'
+    vi.mocked(uuidv7).mockReturnValue(mockUuid)
+
+    const app = createApp()
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.transactionId).toBe(mockUuid)
+    expect(uuidv7).toHaveBeenCalled()
+  })
+
+  it('extracts IP from x-forwarded-for header', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: { 'x-forwarded-for': '192.168.1.100' },
+    })
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.ip).toBe('192.168.1.100')
+  })
+
+  it('falls back to x-real-ip header', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: { 'x-real-ip': '10.0.0.50' },
+    })
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.ip).toBe('10.0.0.50')
+  })
+
+  it('falls back to unknown when no IP header', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.ip).toBe('unknown')
+  })
+
+  it('prefers x-forwarded-for over x-real-ip', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: {
+        'x-forwarded-for': '192.168.1.100',
+        'x-real-ip': '10.0.0.50',
+      },
+    })
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.ip).toBe('192.168.1.100')
+  })
+
+  it('sets userAgent from header', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: { 'user-agent': 'Mozilla/5.0 TestBrowser' },
+    })
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.userAgent).toBe('Mozilla/5.0 TestBrowser')
+  })
+
+  it('sets userAgent to unknown when header missing', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.userAgent).toBe('unknown')
+  })
+
+  it('initializes user to null', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.user).toBe(null)
+  })
+
+  it('initializes accountId to empty string', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.accountId).toBe('')
+  })
+
+  it('initializes userRole to null', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.userRole).toBe(null)
+  })
+
+  it('initializes isSystemAdminAccess to false', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body.isSystemAdminAccess).toBe(false)
+  })
+
+  it('sets all context values in one request', async () => {
+    const mockUuid = '01912345-6789-7abc-def0-123456789012'
+    vi.mocked(uuidv7).mockReturnValue(mockUuid)
+
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: {
+        'x-forwarded-for': '192.168.1.100',
+        'user-agent': 'CustomAgent/1.0',
+      },
+    })
+    const body = await res.json()
+
+    expect(res.status).toBe(200)
+    expect(body).toEqual({
+      transactionId: mockUuid,
+      ip: '192.168.1.100',
+      userAgent: 'CustomAgent/1.0',
+      user: null,
+      accountId: '',
+      userRole: null,
+      isSystemAdminAccess: false,
+    })
+  })
+})

package/templates/base/src/server/middleware/request-context.ts

@@ -0,0 +1,28 @@
+// src/middleware/request-context.ts
+import { createMiddleware } from 'hono/factory'
+import { uuidv7 } from 'uuidv7'
+import type { HonoEnv } from '../types'
+
+export const requestContext = createMiddleware<HonoEnv>(async (c, next) => {
+  // Set transaction ID (UUIDv7)
+  c.set('transactionId', uuidv7())
+
+  // Set IP address (take first IP from X-Forwarded-For if present)
+  const forwardedFor = c.req.header('x-forwarded-for')
+  const ip = forwardedFor
+    ? forwardedFor.split(',')[0].trim()
+    : (c.req.header('x-real-ip') ?? 'unknown')
+  c.set('ip', ip)
+
+  // Set User Agent
+  const userAgent = c.req.header('user-agent') ?? 'unknown'
+  c.set('userAgent', userAgent)
+
+  // Initialize user and account context (will be set by auth middleware)
+  c.set('user', null)
+  c.set('accountId', '')
+  c.set('userRole', null)
+  c.set('isSystemAdminAccess', false)
+
+  await next()
+})

package/templates/base/src/server/middleware/request-logger.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Hono } from 'hono'
+import { requestLogger } from './request-logger'
+
+describe('requestLogger', () => {
+  let consoleSpy: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    consoleSpy.mockRestore()
+  })
+
+  const createApp = () => {
+    const app = new Hono()
+    app.use('*', async (c, next) => {
+      c.set('transactionId', 'test-tx-id')
+      c.set('user', null)
+      await next()
+    })
+    app.use('*', requestLogger())
+    return app
+  }
+
+  it('logs successful requests with info level', async () => {
+    const app = createApp()
+    app.get('/api/users', (c) => c.json({ ok: true }))
+
+    await app.request('/api/users')
+
+    expect(consoleSpy).toHaveBeenCalled()
+    const logArg = consoleSpy.mock.calls[0][0]
+    const log = JSON.parse(logArg)
+
+    expect(log.level).toBe('info')
+    expect(log.method).toBe('GET')
+    expect(log.path).toBe('/api/users')
+    expect(log.status).toBe(200)
+    expect(log.transactionId).toBe('test-tx-id')
+    expect(typeof log.duration).toBe('number')
+  })
+
+  it('logs 4xx as warn level', async () => {
+    const app = createApp()
+    app.get('/api/users', (c) => c.json({ error: 'Not found' }, 404))
+
+    await app.request('/api/users')
+
+    const log = JSON.parse(consoleSpy.mock.calls[0][0])
+    expect(log.level).toBe('warn')
+    expect(log.status).toBe(404)
+  })
+
+  it('logs 5xx as error level', async () => {
+    const app = createApp()
+    app.get('/api/users', (c) => c.json({ error: 'Server error' }, 500))
+
+    await app.request('/api/users')
+
+    const log = JSON.parse(consoleSpy.mock.calls[0][0])
+    expect(log.level).toBe('error')
+    expect(log.status).toBe(500)
+  })
+
+  it('includes userId when authenticated', async () => {
+    const app = new Hono()
+    app.use('*', async (c, next) => {
+      c.set('transactionId', 'test-tx-id')
+      c.set('user', { id: 'user-123' })
+      await next()
+    })
+    app.use('*', requestLogger())
+    app.get('/api/users', (c) => c.json({ ok: true }))
+
+    await app.request('/api/users')
+
+    const log = JSON.parse(consoleSpy.mock.calls[0][0])
+    expect(log.userId).toBe('user-123')
+  })
+
+  it('includes timestamp in ISO format', async () => {
+    const app = createApp()
+    app.get('/api/users', (c) => c.json({ ok: true }))
+
+    await app.request('/api/users')
+
+    const log = JSON.parse(consoleSpy.mock.calls[0][0])
+    expect(() => new Date(log.timestamp)).not.toThrow()
+  })
+})

package/templates/base/src/server/middleware/request-logger.ts

@@ -0,0 +1,50 @@
+import { createMiddleware } from 'hono/factory'
+import type { HonoEnv } from '../types'
+
+interface RequestLog {
+  level: 'info' | 'warn' | 'error'
+  method: string
+  path: string
+  status: number
+  duration: number
+  transactionId: string
+  ip: string
+  userAgent: string
+  userId?: string
+  timestamp: string
+}
+
+function getLogLevel(status: number): 'info' | 'warn' | 'error' {
+  if (status >= 500) return 'error'
+  if (status >= 400) return 'warn'
+  return 'info'
+}
+
+export const requestLogger = () =>
+  createMiddleware<HonoEnv>(async (c, next) => {
+    const start = Date.now()
+
+    await next()
+
+    const duration = Date.now() - start
+    const status = c.res.status
+    const user = c.get('user')
+
+    const log: RequestLog = {
+      level: getLogLevel(status),
+      method: c.req.method,
+      path: c.req.path,
+      status,
+      duration,
+      transactionId: c.get('transactionId') ?? 'unknown',
+      ip: c.get('ip') ?? c.req.header('x-forwarded-for') ?? 'unknown',
+      userAgent: c.get('userAgent') ?? c.req.header('user-agent') ?? 'unknown',
+      timestamp: new Date().toISOString(),
+    }
+
+    if (user?.id) {
+      log.userId = user.id
+    }
+
+    console.log(JSON.stringify(log))
+  })