@fuzdev/fuz_app 0.107.0 → 0.108.0

package/dist/testing/cross_backend/default_spine_surface.js

@@ -72,20 +72,21 @@ export const create_spine_route_specs = (ctx) => [
         ...create_account_route_specs(ctx.deps, {
             session_options: spine_session_options,
             // Honor the limiters the server was assembled with (on `AppServerContext`
-            // per the `ip_rate_limiter` / `login_account_rate_limiter` TSDoc) rather
-            // than hardcoding `null`. The standard spine binary passes `null` (the
-            // cross suites fire many loopback logins and must not trip a limiter), so
-            // this is behavior-preserving there; the dedicated login-security cross
-            // backend passes real limiters to exercise the 429 + `Retry-After` path
-            // and XFF-keyed bucketing over the wire (see `login_security.ts`).
-            ip_rate_limiter: ctx.ip_rate_limiter,
+            // per the `login_ip_rate_limiter` / `login_account_rate_limiter` TSDoc)
+            // rather than hardcoding `null`. The standard spine binary passes `null`
+            // (the cross suites fire many loopback logins and must not trip a
+            // limiter), so this is behavior-preserving there; the dedicated
+            // login-security cross backend passes real limiters to exercise the 429 +
+            // `Retry-After` path and XFF-keyed bucketing over the wire (see
+            // `login_security.ts`).
+            login_ip_rate_limiter: ctx.login_ip_rate_limiter,
             login_account_rate_limiter: ctx.login_account_rate_limiter,
             login_fail_floor_ms: 0,
             bootstrap_status: ctx.bootstrap_status
         }),
         ...create_signup_route_specs(ctx.deps, {
             session_options: spine_session_options,
-            ip_rate_limiter: null,
+            signup_ip_rate_limiter: null,
             signup_account_rate_limiter: null,
             // Disable the denial floor so the identity-parity suite's accepted
             // cases (valid username/email, no invite → 403 no-matching-invite)

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAqGF,CAAC"}
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA0BD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA2KF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -24,6 +24,13 @@ import '../assert_dev_env.js';
  *   not `429`). A backend that ignored XFF and keyed on the (loopback) TCP
  *   peer would 429 the fresh-IP request too — so the `401` proves the limiter
  *   keys on the resolved `X-Forwarded-For` client IP.
+ * - **a success does not refund the per-IP budget** — the distributed-spray
+ *   backstop. Failed guesses against *distinct* usernames from one forwarded
+ *   IP, interleaved with the attacker's own successful logins, must still 429
+ *   within a bounded total-request budget. Both spines used to clear the IP
+ *   bucket on success, which made that budget unbounded: one credential (or,
+ *   under open signup, none) bought unlimited guesses against arbitrary victims
+ *   from a single address. Only the account-grain bucket is forgiven now.
  *
  * **Determinism without a limiter reset.** Limiter state is in-memory and the
  * per-test `_testing_reset` wipes only the DB, never the buckets — so each
@@ -58,6 +65,7 @@ import { default_login_account_rate_limit, default_login_ip_rate_limit } from '.
 const XFF_IP_LIMIT = '203.0.113.1';
 const XFF_SEGREGATION_EXHAUST = '203.0.113.2';
 const XFF_SEGREGATION_FRESH = '203.0.113.3';
+const XFF_SPRAY = '203.0.113.4';
 /** A non-routable, non-existent identifier — login resolves to the not-found path (records the bucket, returns 401). */
 const PROBE_PASSWORD = 'login_security_wrong_password';
 export const describe_login_security_cross_tests = (options) => {
@@ -93,6 +101,20 @@ export const describe_login_security_cross_tests = (options) => {
             retry_after_header: res.headers.get('retry-after')
         };
     };
+    /**
+     * POST a login expected to *succeed*, on a fresh transport with the given
+     * `X-Forwarded-For`. The mirror of `attempt` — used to prove that a success
+     * does not refund the resolved IP's bucket.
+     */
+    const succeed = async (fixture, forwarded_for, username, password) => {
+        const res = await fixture.fresh_transport()(login_path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-forwarded-for': forwarded_for },
+            body: JSON.stringify({ username, password })
+        });
+        await res.text();
+        return res.status;
+    };
     describe('login rate limiting + trusted-proxy parity', () => {
         test(`per-IP login limit fires 429 + Retry-After after ${ip_limit} attempts from one forwarded IP`, async () => {
             const fixture = await setup_test();
@@ -126,5 +148,42 @@ export const describe_login_security_cross_tests = (options) => {
             const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
             assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
         });
+        test('a success does not refund the per-IP budget (distributed-spray backstop)', async () => {
+            const fixture = await setup_test();
+            // The attacker's own account. Minting rides the setup path from
+            // loopback with no XFF, so it lands on a different bucket than
+            // XFF_SPRAY and can't confound the count.
+            const attacker = await fixture.create_account({
+                username: 'spray_attacker',
+                password_value: 'spray_attacker_password'
+            });
+            let budget = 0;
+            let limited = false;
+            for (let i = 0; i < ip_limit * 3; i++) {
+                // Their own successful login — the move that used to zero the
+                // whole IP window — then one guess against a fresh victim
+                // username, so no per-account bucket accumulates and only the
+                // IP aggregate can stop this.
+                const own = await succeed(fixture, XFF_SPRAY, attacker.account.username, 'spray_attacker_password');
+                budget++;
+                // Either leg may trip: the aggregate governs the *address*, so
+                // once it fills even the attacker's own login is refused. That
+                // is the property — no move from this IP buys more attempts.
+                if (own === 429) {
+                    limited = true;
+                    break;
+                }
+                assert.strictEqual(own, 200, "the attacker's own login must succeed");
+                const guess = await attempt(fixture, XFF_SPRAY, `spray_victim_${i}`);
+                budget++;
+                if (guess.status === 429) {
+                    limited = true;
+                    break;
+                }
+                assert.strictEqual(guess.status, 401, 'a guess against an unknown user must 401');
+            }
+            assert(limited, 'the per-IP aggregate must eventually 429 the spray');
+            assert(budget <= ip_limit * 2 + 2, `interleaved successes must not extend the per-IP budget (spent ${budget})`);
+        });
     });
 };

package/dist/testing/cross_backend/session_cap.d.ts

@@ -0,0 +1,19 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the session-cap parity suite. */
+export interface SessionCapCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /**
+     * The cap both spines enforce. Defaults to `DEFAULT_MAX_SESSIONS` — the TS
+     * route default and the Rust `const`. A consumer that overrides
+     * `max_sessions` on the TS side passes its value here.
+     */
+    readonly max_sessions?: number;
+    /** REST login route path. Default `/api/account/login`. */
+    readonly login_path?: string;
+    /** REST account-status route path. Default `/api/account/status`. */
+    readonly status_path?: string;
+}
+export declare const describe_session_cap_cross_tests: (options: SessionCapCrossTestOptions) => void;
+//# sourceMappingURL=session_cap.d.ts.map

package/dist/testing/cross_backend/session_cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA6DtF,CAAC"}

package/dist/testing/cross_backend/session_cap.js

@@ -0,0 +1,93 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the **per-account concurrent-session cap**
+ * over real HTTP.
+ *
+ * The cap is a shipped control on the TS spine (`query_session_enforce_limit`,
+ * `DEFAULT_MAX_SESSIONS`) that the Rust spine went without — its session INSERT
+ * carried no eviction, so every Rust-backed deployment served unlimited
+ * concurrent sessions per account. That divergence survived because nothing crossed the
+ * wire on it — the TS half is pinned by in-process tests
+ * (`session_middleware.lifecycle.db.test.ts`, `session_token_limits.integration.db.test.ts`)
+ * whose Rust counterparts simply didn't exist to fail. This suite is the pin
+ * that runs on *both*, so the next spine to lose the cap fails here rather than
+ * in production. Two properties:
+ *
+ * - **the cap bounds concurrent sessions, by eviction not refusal** — logging in
+ *   `max_sessions + 1` times succeeds every time (a login is never denied for
+ *   being the one over the line), and the newest cookie resolves afterward.
+ * - **the evicted session is the oldest** — the first login's cookie no longer
+ *   authenticates once the cap is exceeded. A spine with no cap authenticates it
+ *   fine, which is exactly the defect this catches.
+ *
+ * **Why `max_sessions + 1` logins and not `max_sessions`.** The starting session
+ * count isn't zero and isn't guaranteed equal across impls — `create_account`
+ * seeds its own session on the Rust cradle. Overshooting by one guarantees at
+ * least one eviction whatever the baseline is, and the *oldest* login is the
+ * first to go either way. Asserting on the first and last sessions rather than
+ * on a row count keeps the case wire-observable (no DB channel) and
+ * baseline-independent.
+ *
+ * Both surfaces are flat REST (`POST /api/account/login`, `GET /api/account/status`)
+ * on every spine, so this is an imperative suite (not a `conformance_table` row)
+ * — the sibling of `cookie_attributes.ts` / `origin.ts` / `login_security.ts`.
+ * **Cross-process only**, and load-bearingly so: each login is held on its own
+ * `fresh_transport` and identified by that transport's cookie jar, which
+ * in-process is a jar-less passthrough. That also keeps the suite free of a
+ * fourth `Set-Cookie` parser — reading the raw header is `cookie_attributes.ts`'s
+ * job, and this case only needs "does this login still authenticate".
+ *
+ * What it does **not** pin: concurrent creators. Two simultaneous logins can
+ * each evict against a stale count under Read Committed and both commit above
+ * the cap — see `query_session_enforce_limit`'s race note. That needs a
+ * barrier-based test against one backend, not a parity case.
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { DEFAULT_MAX_SESSIONS } from '../../auth/account_route_schema.js';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+export const describe_session_cap_cross_tests = (options) => {
+    const { setup_test } = options;
+    const max_sessions = options.max_sessions ?? DEFAULT_MAX_SESSIONS;
+    const login_path = options.login_path ?? '/api/account/login';
+    const status_path = options.status_path ?? '/api/account/status';
+    // Fresh-keeper-per-test wipes the DB between tests, so a literal username
+    // never collides (see `setup.ts`).
+    const username = 'session_cap_user';
+    describe('per-account session cap parity', () => {
+        test(`logging in ${max_sessions + 1} times evicts the oldest session (newest cookie resolves, first does not)`, async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            // One transport per login, each with its own empty jar, so each ends up
+            // holding exactly that login's session cookie and re-sends it on any
+            // later request. That's why this suite is cross-process only: in-process
+            // `fresh_transport` is a jar-less passthrough and every session would
+            // look alike. Held oldest-first.
+            const sessions = [];
+            for (let i = 0; i < max_sessions + 1; i++) {
+                const transport = fixture.fresh_transport();
+                const res = await transport(login_path, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD })
+                });
+                assert.strictEqual(res.status, 200, `login ${i + 1}/${max_sessions + 1} must succeed — the cap evicts, it never refuses`);
+                assert.ok(transport.cookies().length > 0, `login ${i + 1} must set a session cookie on its jar`);
+                sessions.push(transport);
+            }
+            /** `GET /status` on one login's transport: 200 authenticated, 401 not. */
+            const status_on = async (transport) => {
+                const res = await transport(status_path, { method: 'GET' });
+                await res.text();
+                return res.status;
+            };
+            assert.strictEqual(await status_on(sessions[sessions.length - 1]), 200, 'the newest session must still resolve — the cap must evict, not refuse');
+            assert.strictEqual(await status_on(sessions[0]), 401, `the oldest session must be evicted once the account exceeds ${max_sessions} sessions ` +
+                '(a spine with no cap authenticates this cookie)');
+        });
+    });
+};

package/dist/testing/middleware.d.ts

@@ -11,7 +11,6 @@ import './assert_dev_env.js';
 import { vi } from 'vitest';
 import { Hono } from 'hono';
 import type { z } from 'zod';
-import type { RateLimiter } from '../rate_limiter.js';
 import { type RequestContext } from '../auth/request_context.js';
 /** Mock configuration for bearer auth middleware test setup. */
 export interface BearerAuthTestOptions {
@@ -80,7 +79,7 @@ export declare const TEST_CLIENT_IP = "127.0.0.1";
  * The route handler at `/api/test` returns the resolved context in the response body,
  * enabling assertions on `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY`.
  */
-export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions, ip_rate_limiter?: RateLimiter | null) => {
+export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions) => {
     app: Hono;
     mocks: BearerAuthMocks;
 };
@@ -89,7 +88,7 @@ export declare const create_bearer_auth_test_app: (tc: BearerAuthTestOptions, ip
  *
  * Generates one `test()` per case inside a `describe()` block.
  */
-export declare const describe_bearer_auth_cases: (suite_name: string, cases: Array<BearerAuthTestCase>, ip_rate_limiter?: RateLimiter | null) => void;
+export declare const describe_bearer_auth_cases: (suite_name: string, cases: Array<BearerAuthTestCase>) => void;
 /** Path used by the echo route in `create_test_middleware_stack_app`. */
 export declare const TEST_MIDDLEWARE_PATH = "/api/test";
 /** Options for `create_test_middleware_stack_app`. */
@@ -100,8 +99,6 @@ export interface TestMiddlewareStackOptions {
     allowed_origins?: string;
     /** Connection IP or factory. @default first trusted proxy */
     connection_ip?: string | (() => string | undefined);
-    /** Rate limiter for bearer auth. @default `null` */
-    ip_rate_limiter?: RateLimiter | null;
 }
 /** Return type of `create_test_middleware_stack_app`. */
 export interface TestMiddlewareStackApp {

package/dist/testing/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAe7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2BtF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,EACzB,kBAAiB,WAAW,GAAG,IAAW,KACxC;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAyDrC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,EAChC,kBAAiB,WAAW,GAAG,IAAW,KACxC,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,oDAAoD;IACpD,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBA4DF,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,EAAE,EAA0B,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAe7B,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2BtF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,KACvB;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAwDrC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAC9B,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBAwDF,CAAC"}

package/dist/testing/middleware.js

@@ -91,9 +91,9 @@ export const TEST_CLIENT_IP = '127.0.0.1';
  * The route handler at `/api/test` returns the resolved context in the response body,
  * enabling assertions on `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY`.
  */
-export const create_bearer_auth_test_app = (tc, ip_rate_limiter = null) => {
+export const create_bearer_auth_test_app = (tc) => {
     const mocks = create_bearer_auth_mocks(tc);
-    const bearer_middleware = create_bearer_auth_middleware(STUB_DEPS, ip_rate_limiter, new Logger('test', { level: 'off' }));
+    const bearer_middleware = create_bearer_auth_middleware(STUB_DEPS, new Logger('test', { level: 'off' }));
     const app = new Hono();
     // inject pre-existing session identity if the test case specifies one.
     // `pre_context` simulates the session middleware having authenticated
@@ -144,11 +144,11 @@ export const create_bearer_auth_test_app = (tc, ip_rate_limiter = null) => {
  *
  * Generates one `test()` per case inside a `describe()` block.
  */
-export const describe_bearer_auth_cases = (suite_name, cases, ip_rate_limiter = null) => {
+export const describe_bearer_auth_cases = (suite_name, cases) => {
     describe(suite_name, () => {
         for (const tc of cases) {
             test(tc.name, async () => {
-                const { app, mocks } = create_bearer_auth_test_app(tc, ip_rate_limiter);
+                const { app, mocks } = create_bearer_auth_test_app(tc);
                 const res = await app.request('/api/test', {
                     method: 'GET',
                     headers: tc.headers
@@ -227,7 +227,7 @@ export const create_test_middleware_stack_app = (options) => {
     });
     const allowed_patterns = parse_allowed_origins(allowed_origins_str);
     const origin_mw = verify_request_source(allowed_patterns);
-    const bearer_mw = create_bearer_auth_middleware(STUB_DEPS, options?.ip_rate_limiter ?? null, new Logger('test', { level: 'off' }));
+    const bearer_mw = create_bearer_auth_middleware(STUB_DEPS, new Logger('test', { level: 'off' }));
     const app = new Hono();
     app.use('*', proxy_mw);
     app.use('/api/*', origin_mw);

package/dist/testing/rate_limiting.d.ts

@@ -4,7 +4,7 @@ import type { AppServerContext } from '../server/app_server_context.js';
 import type { RouteSpec } from '../http/route_spec.js';
 import { type SuiteAppOptions } from './app_server.js';
 import { type DbFactory } from './db.js';
-import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
+import type { RpcEndpointsSuiteOption } from './rpc_helpers.js';
 /**
  * Configuration for `describe_rate_limiting_tests`.
  */
@@ -25,37 +25,31 @@ export interface RateLimitingTestOptions {
      */
     max_attempts?: number;
     /**
-     * RPC endpoint specs — required so the bearer-auth rate limiting test
-     * can probe an authenticated method via the `account_verify` RPC
-     * action. Hard-fails via `require_rpc_endpoint_path` on setup.
+     * RPC endpoint specs mounted on the test app. Optional — both suites below
+     * exercise REST auth routes, so nothing here needs an RPC path.
      *
      * Accepts either an array (eager) or a factory
      * `(ctx: AppServerContext) => Array<RpcEndpointSpec>` — the factory form
      * is required when action handlers must close over the per-test
-     * `ctx.deps`. The factory must return the same
-     * endpoint `path` regardless of ctx — it is invoked once at setup with
-     * a stub ctx for path lookup and again per-test by `create_app_server`
-     * for live dispatch.
+     * `ctx.deps`.
      */
-    rpc_endpoints: RpcEndpointsSuiteOption;
+    rpc_endpoints?: RpcEndpointsSuiteOption;
 }
 /**
  * Standard rate limiting integration test suite.
  *
- * Creates 3 test groups:
+ * Creates 2 test groups:
  * 1. IP rate limiting on login — fires `max_attempts + 1` login requests,
  *    verifies the last returns 429 with a valid `RateLimitError` body.
  * 2. Per-account rate limiting on login — fires `max_attempts + 1` login
  *    requests with the same username, verifies the last returns 429.
- * 3. Bearer auth IP rate limiting — fires `max_attempts + 1` bearer requests
- *    with an invalid token, verifies the last returns 429.
+ *
+ * There is deliberately no bearer-auth group: the bearer path carries no rate
+ * limiter on either spine, because an API token's entropy — not throttling —
+ * is what bounds guessing it. See `auth/bearer_auth.ts`.
  *
  * Each test group asserts that required routes exist, failing with a descriptive
  * message if the consumer's route specs are misconfigured.
- *
- * @throws Error at setup time when `options.rpc_endpoints` is empty — the
- *   bearer-auth rate-limit test probes via the `account_verify` RPC action,
- *   so the suite hard-fails via `require_rpc_endpoint_path`.
  */
 export declare const describe_rate_limiting_tests: (options: RateLimitingTestOptions) => void;
 //# sourceMappingURL=rate_limiting.d.ts.map

package/dist/testing/rate_limiting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate_limiting.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rate_limiting.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA0B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAK1B;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IAgQ/E,CAAC"}
+{"version":3,"file":"rate_limiting.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rate_limiting.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA0B7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAEjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IAqK/E,CAAC"}

package/dist/testing/rate_limiting.js

@@ -27,35 +27,25 @@ import { auth_migration_ns } from '../auth/migrations.js';
 import { create_test_app } from './app_server.js';
 import { create_pglite_factory, create_describe_db, auth_integration_truncate_tables } from './db.js';
 import { find_auth_route, assert_rate_limit_retry_after_header } from './integration_helpers.js';
-import { rpc_call_non_browser, require_rpc_endpoint_path, resolve_rpc_endpoints_for_setup } from './rpc_helpers.js';
 import { run_migrations } from '../db/migrate.js';
-import { account_verify_action_spec } from '../auth/account_action_specs.js';
 /**
  * Standard rate limiting integration test suite.
  *
- * Creates 3 test groups:
+ * Creates 2 test groups:
  * 1. IP rate limiting on login — fires `max_attempts + 1` login requests,
  *    verifies the last returns 429 with a valid `RateLimitError` body.
  * 2. Per-account rate limiting on login — fires `max_attempts + 1` login
  *    requests with the same username, verifies the last returns 429.
- * 3. Bearer auth IP rate limiting — fires `max_attempts + 1` bearer requests
- *    with an invalid token, verifies the last returns 429.
+ *
+ * There is deliberately no bearer-auth group: the bearer path carries no rate
+ * limiter on either spine, because an API token's entropy — not throttling —
+ * is what bounds guessing it. See `auth/bearer_auth.ts`.
  *
  * Each test group asserts that required routes exist, failing with a descriptive
  * message if the consumer's route specs are misconfigured.
- *
- * @throws Error at setup time when `options.rpc_endpoints` is empty — the
- *   bearer-auth rate-limit test probes via the `account_verify` RPC action,
- *   so the suite hard-fails via `require_rpc_endpoint_path`.
  */
 export const describe_rate_limiting_tests = (options) => {
     const max_attempts = options.max_attempts ?? 2;
-    // Hard-fail early so consumers see a clear setup error instead of a
-    // confusing test failure when `rpc_endpoints` is missing. Factory-form
-    // callers are resolved with a stub ctx purely to extract the endpoint
-    // path; real handlers run per-test via the top-level `rpc_endpoints` slot on `CreateTestAppOptions`.
-    const rpc_endpoints_for_setup = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
-    const rpc_path = require_rpc_endpoint_path(rpc_endpoints_for_setup);
     const init_schema = async (db) => {
         await run_migrations(db, [auth_migration_ns]);
     };
@@ -67,7 +57,7 @@ export const describe_rate_limiting_tests = (options) => {
         // --- 1. IP rate limiting on login ---
         describe('IP rate limiting on login', () => {
             test(`login is blocked after ${max_attempts} failed attempts`, async () => {
-                const ip_rate_limiter = create_test_rate_limiter();
+                const login_ip_rate_limiter = create_test_rate_limiter();
                 try {
                     const test_app = await create_test_app({
                         session_options: options.session_options,
@@ -76,9 +66,8 @@ export const describe_rate_limiting_tests = (options) => {
                         rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            ip_rate_limiter,
-                            login_account_rate_limiter: null,
-                            bearer_ip_rate_limiter: null
+                            login_ip_rate_limiter,
+                            login_account_rate_limiter: null
                         }
                     });
                     const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
@@ -113,7 +102,7 @@ export const describe_rate_limiting_tests = (options) => {
                     assert_rate_limit_retry_after_header(blocked_res, body);
                 }
                 finally {
-                    ip_rate_limiter.dispose();
+                    login_ip_rate_limiter.dispose();
                 }
             });
         });
@@ -129,9 +118,8 @@ export const describe_rate_limiting_tests = (options) => {
                         rpc_endpoints: options.rpc_endpoints,
                         app_options: {
                             ...options.app_options,
-                            ip_rate_limiter: null,
-                            login_account_rate_limiter,
-                            bearer_ip_rate_limiter: null
+                            login_ip_rate_limiter: null,
+                            login_account_rate_limiter
                         }
                     });
                     const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
@@ -182,77 +170,5 @@ export const describe_rate_limiting_tests = (options) => {
                 }
             });
         });
-        // --- 3. Bearer auth IP rate limiting ---
-        describe('bearer auth IP rate limiting', () => {
-            test(`bearer auth is blocked after ${max_attempts} invalid token attempts`, async () => {
-                const bearer_ip_rate_limiter = create_test_rate_limiter();
-                try {
-                    const test_app = await create_test_app({
-                        session_options: options.session_options,
-                        create_route_specs: options.create_route_specs,
-                        db: get_db(),
-                        rpc_endpoints: options.rpc_endpoints,
-                        app_options: {
-                            ...options.app_options,
-                            ip_rate_limiter: null,
-                            login_account_rate_limiter: null,
-                            bearer_ip_rate_limiter
-                        }
-                    });
-                    // Probe `account_verify` via RPC with an invalid bearer token.
-                    // The REST `/api/account/verify` shim is status-only (empty body
-                    // for nginx `auth_request`), so we use the RPC surface to exercise
-                    // a typed authenticated method. The bearer_auth rate limiter
-                    // increments per attempt regardless of the route's own auth outcome.
-                    // Use `rpc_call_non_browser` so the default `origin` header is
-                    // suppressed — bearer_auth discards the token when Origin or
-                    // Referer is present (browser context), which would short-circuit
-                    // before the rate limiter records the attempt.
-                    //
-                    // Note: the rate limiter short-circuits before the RPC dispatcher,
-                    // so the 429 response is a REST-shaped `RateLimitError`, not a
-                    // JSON-RPC envelope. We use the underlying `app.request` for the
-                    // blocked probe so `rpc_call_non_browser` doesn't throw on the
-                    // non-envelope body.
-                    const bearer_probe_headers = {
-                        authorization: 'Bearer secret_fuz_token_invalid'
-                    };
-                    // Fire max_attempts invalid bearer requests (sequential — must exhaust the window)
-                    for (let i = 0; i < max_attempts; i++) {
-                        const res = await rpc_call_non_browser({
-                            app: test_app.app,
-                            path: rpc_path,
-                            method: account_verify_action_spec.method,
-                            id: 'rl-probe',
-                            headers: bearer_probe_headers
-                        });
-                        assert.notStrictEqual(res.status, 429, `Request ${i + 1}/${max_attempts} should not be rate limited`);
-                    }
-                    // The next request should be rate limited. The 429 body is REST-shape
-                    // (middleware short-circuits before the RPC dispatcher), so go
-                    // direct — `rpc_call_non_browser` would throw on the non-envelope body.
-                    const blocked_res = await test_app.app.request(rpc_path, {
-                        method: 'POST',
-                        headers: {
-                            host: 'localhost',
-                            'content-type': 'application/json',
-                            ...bearer_probe_headers
-                        },
-                        body: JSON.stringify({
-                            jsonrpc: '2.0',
-                            method: account_verify_action_spec.method,
-                            id: 'rl-probe-blocked'
-                        })
-                    });
-                    assert.strictEqual(blocked_res.status, 429);
-                    const body = await blocked_res.json();
-                    RateLimitError.parse(body);
-                    assert_rate_limit_retry_after_header(blocked_res, body);
-                }
-                finally {
-                    bearer_ip_rate_limiter.dispose();
-                }
-            });
-        });
     });
 };

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAoBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}

package/dist/testing/stubs.js

@@ -199,7 +199,9 @@ export const create_stub_app_server_context = (session_options) => {
         },
         bootstrap_status: { available: false, token_path: null },
         session_options,
-        ip_rate_limiter: null,
+        login_ip_rate_limiter: null,
+        signup_ip_rate_limiter: null,
+        bootstrap_ip_rate_limiter: null,
         login_account_rate_limiter: null,
         signup_account_rate_limiter: null,
         action_ip_rate_limiter: null,

package/dist/testing/testing_rate_limiter.d.ts

@@ -20,7 +20,7 @@ import './assert_dev_env.js';
  * import {TestingRateLimiter} from '@fuzdev/fuz_app/testing/testing_rate_limiter.ts';
  *
  * const limiter = new TestingRateLimiter(default_login_ip_rate_limit);
- * await create_app_server({backend, ip_rate_limiter: limiter, ...});
+ * await create_app_server({backend, login_ip_rate_limiter: limiter, ...});
  *
  * // Inside the `_testing_reset` handler's `reset_state`:
  * limiter.reset_all();
@@ -45,6 +45,12 @@ export declare class TestingRateLimiter extends RateLimiter {
      * safe to call before any check/record activity. Designed to be invoked
      * from a `_testing_reset` handler's `reset_state` callback so the test
      * binary's rate-limit buckets don't leak across test cases.
+     *
+     * This is the **one sanctioned caller that clears IP-aggregate keys** —
+     * `RateLimiter.reset` forbids that for production code, because refunding
+     * the IP bucket on a successful auth reopens the distributed-spray path.
+     * Here it is test-state teardown between cases, not success-forgiveness, so
+     * the rule doesn't apply.
      */
     reset_all(): void;
     /**

package/dist/testing/testing_rate_limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_rate_limiter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/testing_rate_limiter.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;;IAGzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKlD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKjC;;;;;OAKG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAEtC;CACD"}
+{"version":3,"file":"testing_rate_limiter.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/testing_rate_limiter.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;;IAGzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe;IAKlD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKjC;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAEtC;CACD"}

package/dist/testing/testing_rate_limiter.js

@@ -20,7 +20,7 @@ import './assert_dev_env.js';
  * import {TestingRateLimiter} from '@fuzdev/fuz_app/testing/testing_rate_limiter.ts';
  *
  * const limiter = new TestingRateLimiter(default_login_ip_rate_limit);
- * await create_app_server({backend, ip_rate_limiter: limiter, ...});
+ * await create_app_server({backend, login_ip_rate_limiter: limiter, ...});
  *
  * // Inside the `_testing_reset` handler's `reset_state`:
  * limiter.reset_all();
@@ -54,6 +54,12 @@ export class TestingRateLimiter extends RateLimiter {
      * safe to call before any check/record activity. Designed to be invoked
      * from a `_testing_reset` handler's `reset_state` callback so the test
      * binary's rate-limit buckets don't leak across test cases.
+     *
+     * This is the **one sanctioned caller that clears IP-aggregate keys** —
+     * `RateLimiter.reset` forbids that for production code, because refunding
+     * the IP bucket on a successful auth reopens the distributed-spray path.
+     * Here it is test-state teardown between cases, not success-forgiveness, so
+     * the rule doesn't apply.
      */
     reset_all() {
         for (const key of this.#seen_keys) {