@fitzzero/quickdraw-core 5.1.1 → 5.1.3

package/dist/server/express/index.d.ts

@@ -18,7 +18,13 @@ declare function stripIp(raw: string | undefined): string;
 /**
  * Key by Bearer token when present, falling back to client IP. Lets
  * token-authenticated clients get their own bucket instead of sharing
- * a NAT'd IP.
+ * a NAT'd IP. Nothing here checks the token (the 5.1 audit's
+ * TRANSPORT-4): a caller that sends a new made-up token on each request
+ * gets a fresh bucket each time, even behind `requireSession`, which signs
+ * a request in by its cookie first and never reads the bearer token then.
+ * Key a limiter mounted behind `requireSession` by the user it verified
+ * instead (`keyGenerator: (req) => sessionOf(req).userId`), and anonymous
+ * traffic by IP, as `createPublicApiLimiter` does.
  */
 declare function bearerOrIp(req: Request): string;
 /**
@@ -39,7 +45,8 @@ declare function createPublicApiLimiter(overrides?: PartialOptions): RateLimitRe
  * minute per IP, refused with `429 { ok: false, e: { code: "RATE_LIMITED",
  * message, data: { retryAfterMs } } }`. Server-side prefetch reaches the API
  * from the web server's address, so key it some other way (`keyGenerator`)
- * or raise `max` when the web server prefetches for many users.
+ * or raise `max` when the web server prefetches for many users; never by
+ * an unverified bearer token (`bearerOrIp`).
  */
 declare function createCallLimiter(overrides?: PartialOptions): RateLimitRequestHandler;
 

package/dist/server/express/index.js

@@ -7,7 +7,7 @@ import {
   createPublicApiLimiter,
   createWebhookLimiter,
   stripIp
-} from "../../chunk-TBMKJ26R.js";
+} from "../../chunk-NW6U45HX.js";
 export {
   bearerOrIp,
   createAuthLimiter,