@farm.js/core 0.1.0-beta.16 → 0.1.0-beta.17

package/dist/middleware.cjs

@@ -32,6 +32,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var middleware_exports = {};
 __export(middleware_exports, {
   MiddlewareManager: () => MiddlewareManager,
+  UnsupportedRateLimitStorageError: () => UnsupportedRateLimitStorageError,
   _runWithMiddlewareContext: () => _runWithMiddlewareContext,
   _runWithMiddlewareData: () => _runWithMiddlewareData,
   applyProductionMiddlewareHeaders: () => applyProductionMiddlewareHeaders,
@@ -44,89 +45,76 @@ __export(middleware_exports, {
   getMiddlewareValue: () => getMiddlewareValue,
   getRateLimitStatus: () => getRateLimitStatus,
   hasMiddlewareData: () => hasMiddlewareData,
+  memoryRateLimitStorage: () => memoryRateLimitStorage,
   middleware: () => middleware,
   unwrapMiddleware: () => unwrapMiddleware
 });
 module.exports = __toCommonJS(middleware_exports);
 
-// src/storage/index.ts
-var import_unstorage = require("unstorage");
-var import_memory = __toESM(require("unstorage/drivers/memory"));
-function createMemoryStorage() {
-  return (0, import_unstorage.createStorage)({
-    driver: (0, import_memory.default)()
-  });
-}
-__name(createMemoryStorage, "createMemoryStorage");
-var GLOBAL_STORAGE_KEY = /* @__PURE__ */ Symbol.for("farmjs.storage.global");
-function readGlobalStorage() {
-  return globalThis[GLOBAL_STORAGE_KEY];
-}
-__name(readGlobalStorage, "readGlobalStorage");
-function writeGlobalStorage(storage) {
-  globalThis[GLOBAL_STORAGE_KEY] = storage;
-  return storage;
-}
-__name(writeGlobalStorage, "writeGlobalStorage");
-function getActiveGlobalStorage() {
-  const existing = readGlobalStorage();
-  if (existing) {
-    return existing;
+// src/middleware/chain.ts
+var DEFAULT_MEMORY_RATE_LIMIT_ENTRIES = 1e5;
+var _UnsupportedRateLimitStorageError = class _UnsupportedRateLimitStorageError extends TypeError {
+  constructor() {
+    super(
+      "RateLimitStorage must implement atomic increment(key, windowMs). Legacy get/set adapters can lose increments under concurrency. Use memoryRateLimitStorage() for one process or redisRateLimitStorage() from @farm.js/cache-redis for production."
+    );
+    this.name = "UnsupportedRateLimitStorageError";
   }
-  return writeGlobalStorage(createMemoryStorage());
-}
-__name(getActiveGlobalStorage, "getActiveGlobalStorage");
-var globalStorage = getActiveGlobalStorage();
-function normalizeMountKey(base) {
-  return (base || "").trim().replace(/^[:/\\]+|[:/\\]+$/g, "").replace(/[\\/]+/g, ":");
-}
-__name(normalizeMountKey, "normalizeMountKey");
-function getStorage(namespace) {
-  globalStorage = getActiveGlobalStorage();
-  const base = normalizeMountKey(namespace);
-  if (!base) {
-    return globalStorage;
+};
+__name(_UnsupportedRateLimitStorageError, "UnsupportedRateLimitStorageError");
+var UnsupportedRateLimitStorageError = _UnsupportedRateLimitStorageError;
+function memoryRateLimitStorage(options = {}) {
+  const maxEntries = options.maxEntries ?? DEFAULT_MEMORY_RATE_LIMIT_ENTRIES;
+  if (!Number.isSafeInteger(maxEntries) || maxEntries <= 0) {
+    throw new TypeError("memoryRateLimitStorage maxEntries must be a positive safe integer.");
+  }
+  const records = /* @__PURE__ */ new Map();
+  function read(key, now) {
+    const record = records.get(key);
+    if (!record) return null;
+    if (record.resetAt <= now) {
+      records.delete(key);
+      return null;
+    }
+    return record;
+  }
+  __name(read, "read");
+  function pruneExpired(now) {
+    for (const [key, record] of records) {
+      if (record.resetAt <= now) records.delete(key);
+    }
   }
-  const namespaced = (0, import_unstorage.prefixStorage)(globalStorage, base);
+  __name(pruneExpired, "pruneExpired");
   return {
-    ...namespaced,
-    async clear() {
-      const keys = await namespaced.getKeys();
-      await Promise.all(keys.map((key) => namespaced.removeItem(key)));
+    increment(key, windowMs) {
+      if (!Number.isSafeInteger(windowMs) || windowMs <= 0) {
+        throw new TypeError("Rate-limit windowMs must be a positive safe integer.");
+      }
+      const now = Date.now();
+      const current = read(key, now);
+      if (current) {
+        const next2 = { count: current.count + 1, resetAt: current.resetAt };
+        records.set(key, next2);
+        return next2;
+      }
+      if (records.size >= maxEntries) pruneExpired(now);
+      if (records.size >= maxEntries) {
+        throw new Error(
+          `Process-local rate-limit storage reached its ${maxEntries} active-key capacity. Configure a shared production adapter or increase maxEntries.`
+        );
+      }
+      const next = { count: 1, resetAt: now + windowMs };
+      records.set(key, next);
+      return next;
+    },
+    get(key) {
+      const record = read(key, Date.now());
+      return record ? { ...record } : null;
     }
   };
 }
-__name(getStorage, "getStorage");
-
-// src/middleware/chain.ts
-function getRateLimitStorage() {
-  return getStorage("ratelimit");
-}
-__name(getRateLimitStorage, "getRateLimitStorage");
-var defaultRateLimitStorage = {
-  async get(key) {
-    const storage = getRateLimitStorage();
-    const value = await storage.getItem(key);
-    return value ?? null;
-  },
-  async set(key, value, ttl) {
-    const storage = getRateLimitStorage();
-    await storage.setItem(key, value, ttl ? { ttl } : void 0);
-  },
-  async delete(key) {
-    const storage = getRateLimitStorage();
-    await storage.removeItem(key);
-  },
-  async ttl(key) {
-    const storage = getRateLimitStorage();
-    const record = await storage.getItem(key);
-    if (!record || !record.resetAt) {
-      return null;
-    }
-    const remainingMs = record.resetAt - Date.now();
-    return remainingMs > 0 ? Math.ceil(remainingMs / 1e3) : null;
-  }
-};
+__name(memoryRateLimitStorage, "memoryRateLimitStorage");
+var defaultRateLimitStorage = memoryRateLimitStorage();
 function parseTimeWindow(window) {
   const match = window.match(/^(\d+)(ms|s|m|h|d)$/);
   if (!match) throw new Error(`Invalid time window: ${window}`);
@@ -139,52 +127,73 @@ function parseTimeWindow(window) {
     h: 60 * 60 * 1e3,
     d: 24 * 60 * 60 * 1e3
   };
-  return value * multipliers[unit];
+  const windowMs = value * multipliers[unit];
+  if (!Number.isSafeInteger(windowMs) || windowMs <= 0) {
+    throw new Error(`Invalid time window: ${window}`);
+  }
+  return windowMs;
 }
 __name(parseTimeWindow, "parseTimeWindow");
 function createRateLimitMiddleware(config) {
+  if (!Number.isSafeInteger(config.requests) || config.requests <= 0) {
+    throw new TypeError("Rate limit requests must be a positive safe integer.");
+  }
   const windowMs = parseTimeWindow(config.window);
   const storage = config.storage || defaultRateLimitStorage;
+  assertAtomicRateLimitStorage(storage);
   return async (ctx, next) => {
     const key = config.keyGenerator ? config.keyGenerator(ctx) : `${ctx.request.socket.remoteAddress}:${ctx.pathname}`;
+    const current = await storage.increment(key, windowMs);
+    assertRateLimitIncrementResult(current);
     const now = Date.now();
-    const ttlSeconds = Math.ceil(windowMs / 1e3);
-    const record = await storage.get(key);
-    if (record && now > record.resetAt) {
-      await storage.delete(key);
-    }
-    const current = await storage.get(key);
-    if (!current) {
-      await storage.set(
-        key,
-        {
-          count: 1,
-          resetAt: now + windowMs
-        },
-        ttlSeconds
-      );
-      return next();
-    }
-    if (current.count >= config.requests) {
+    const resetIn = Math.max(1, Math.ceil((current.resetAt - now) / 1e3));
+    const remaining = Math.max(0, config.requests - current.count);
+    setRateLimitHeaders(ctx, config.requests, remaining, resetIn, Math.ceil(windowMs / 1e3));
+    if (current.count > config.requests) {
+      setMiddlewareResponseHeader(ctx, "Retry-After", String(resetIn));
       if (config.onLimit) {
         const result = await config.onLimit(ctx);
-        if (result) return;
+        if (result) return result;
       }
       ctx.json(
         {
           error: "Rate limit exceeded",
-          retryAfter: Math.ceil((current.resetAt - now) / 1e3)
+          retryAfter: resetIn
         },
         429
       );
       return;
     }
-    current.count++;
-    await storage.set(key, current, ttlSeconds);
     return next();
   };
 }
 __name(createRateLimitMiddleware, "createRateLimitMiddleware");
+function assertAtomicRateLimitStorage(storage) {
+  if (!storage || typeof storage.increment !== "function") {
+    throw new UnsupportedRateLimitStorageError();
+  }
+}
+__name(assertAtomicRateLimitStorage, "assertAtomicRateLimitStorage");
+function assertRateLimitIncrementResult(result) {
+  if (!result || !Number.isSafeInteger(result.count) || result.count <= 0 || !Number.isFinite(result.resetAt) || result.resetAt <= 0) {
+    throw new TypeError(
+      "RateLimitStorage.increment() must return a positive integer count and a resetAt timestamp."
+    );
+  }
+}
+__name(assertRateLimitIncrementResult, "assertRateLimitIncrementResult");
+function setRateLimitHeaders(ctx, limit, remaining, resetIn, windowSeconds) {
+  setMiddlewareResponseHeader(ctx, "RateLimit-Policy", `"farm";q=${limit};w=${windowSeconds}`);
+  setMiddlewareResponseHeader(ctx, "RateLimit", `"farm";r=${remaining};t=${resetIn}`);
+}
+__name(setRateLimitHeaders, "setRateLimitHeaders");
+function setMiddlewareResponseHeader(ctx, name, value) {
+  ctx.headers.set(name, value);
+  if (!ctx.response.headersSent && !ctx.response.writableEnded) {
+    ctx.response.setHeader(name, value);
+  }
+}
+__name(setMiddlewareResponseHeader, "setMiddlewareResponseHeader");
 function matchPattern(pattern, pathname) {
   if (pattern instanceof RegExp) {
     return pattern.test(pathname);
@@ -334,6 +343,15 @@ var _MiddlewareChainImpl = class _MiddlewareChainImpl {
 __name(_MiddlewareChainImpl, "MiddlewareChainImpl");
 var MiddlewareChainImpl = _MiddlewareChainImpl;
 async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage) {
+  if (!Number.isSafeInteger(limit) || limit <= 0) {
+    throw new TypeError("Rate limit must be a positive safe integer.");
+  }
+  assertAtomicRateLimitStorage(storage);
+  if (typeof storage.get !== "function") {
+    throw new TypeError(
+      "getRateLimitStatus() requires a RateLimitStorage adapter that implements get(key)."
+    );
+  }
   const record = await storage.get(key);
   if (!record) {
     return {
@@ -345,6 +363,7 @@ async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage)
       isLimited: false
     };
   }
+  assertRateLimitIncrementResult(record);
   const now = Date.now();
   if (record.resetAt && now > record.resetAt) {
     return {
@@ -365,9 +384,6 @@ async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage)
     const remainingMs = record.resetAt - now;
     resetIn = remainingMs > 0 ? Math.ceil(remainingMs / 1e3) : null;
     resetAt = new Date(record.resetAt);
-  } else if (storage.ttl) {
-    resetIn = await storage.ttl(key);
-    resetAt = resetIn ? new Date(now + resetIn * 1e3) : null;
   }
   return {
     requests,
@@ -2130,6 +2146,7 @@ __name(farmMiddlewarePlugin, "farmMiddlewarePlugin");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   MiddlewareManager,
+  UnsupportedRateLimitStorageError,
   _runWithMiddlewareContext,
   _runWithMiddlewareData,
   applyProductionMiddlewareHeaders,
@@ -2142,6 +2159,7 @@ __name(farmMiddlewarePlugin, "farmMiddlewarePlugin");
   getMiddlewareValue,
   getRateLimitStatus,
   hasMiddlewareData,
+  memoryRateLimitStorage,
   middleware,
   unwrapMiddleware
 });