@fuzdev/fuz_app 0.92.0 → 0.93.0

package/dist/testing/CLAUDE.md

@@ -1347,6 +1347,33 @@ The accepted-case 403s rely on `create_spine_route_specs` zeroing
 `signup_fail_floor_ms` (mirroring `login_fail_floor_ms: 0`) so they don't each
 pay the 250ms denial floor.
 
+### Login rate-limit + trusted-proxy parity — `cross_backend/login_security.ts`
+
+`describe_login_security_cross_tests({setup_test, login_path?})` — the imperative
+suite pinning **login rate limiting + `X-Forwarded-For` client-IP resolution**
+over real HTTP on both spines. Two cases:
+
+- **per-IP limit fires** — `default_login_ip_rate_limit.max_attempts` (5, the
+  shared cap on both impls) failed logins from one forwarded IP → 401, the next →
+  `429` with the canonical `{error: "rate_limit_exceeded", retry_after}` body +
+  `Retry-After: ceil(retry_after)` header (TS `rate_limit_exceeded_response` ↔
+  Rust `route_response::rate_limit_exceeded`).
+- **XFF keying** — exhaust one forwarded IP to 429, then a _distinct_ forwarded IP
+  → 401 (not 429), proving the limiter keys on the resolved `X-Forwarded-For` IP,
+  not the loopback TCP peer (a backend ignoring XFF would 429 the fresh IP too).
+
+**Cross-process only**, on a **dedicated dual-spawn project** (`cross_backend_security`
+via `global_setup_login_security.ts`) — the limiters can't be enabled on a backend
+the standard suites share (they fire many loopback logins a live limiter would
+429), so the standard backends keep every limiter null. Determinism without a
+limiter reset: each case uses its own forwarded IP (a fresh bucket) plus its own
+non-existent username. Zero Rust code change — the stub's `FUZ_LOGIN_RATE_LIMIT_ENABLED`
+and `FUZ_TRUSTED_PROXIES` env-gates were already wired; the TS side env-gates the
+limiters in the binary, and `create_spine_route_specs` honors `ctx.ip_rate_limiter`.
+The in-process counterparts already exist (`describe_rate_limiting_tests` plus the
+proxy middleware tests), so there's no in-process leg. `npm run test:cross:security`.
+Cited property: `docs/security.md` §"Rate Limiting" + §"Trusted Proxy / Client IP".
+
 ### Building a TS test-server binary — `testing_server_core.ts` + adapters
 
 The reusable shape for standing up a **spawnable TS** cross-process test

package/dist/testing/cross_backend/create_dual_spawn_global_setup.d.ts

@@ -0,0 +1,64 @@
+import '../assert_dev_env.js';
+/**
+ * Generic **dual-spawn** vitest `globalSetup` factory — spawns + bootstraps
+ * *two* backends at once and `provide`s both serialized handles, for any
+ * cross-impl gate that needs both alive together. (The per-backend
+ * `create_cross_backend_global_setup` derives one backend from the project
+ * name; this brings up a pair.)
+ *
+ * Its primary use is the **schema- / action-manifest-parity** gates (capture
+ * each backend over a `_testing_*` introspection RPC and diff with
+ * `assert_schema_snapshots_equal` / `assert_action_manifests_equal`) — which is
+ * why the default `provide_keys` are `parity_handle_*`. The login-security gate
+ * (`global_setup_login_security.ts`) reuses it with its own keys; any future
+ * two-backend gate can too.
+ *
+ * A consumer's dual-spawn `global_setup.ts` collapses to:
+ *
+ * ```ts
+ * import {create_dual_spawn_global_setup} from
+ *   '@fuzdev/fuz_app/testing/cross_backend/create_dual_spawn_global_setup.js';
+ * import {deno_backend_config, rust_backend_config} from './my_backend_config.js';
+ * import './cross_test_types.js'; // augments the two provide keys
+ *
+ * export default create_dual_spawn_global_setup({
+ *   configs: {a: deno_backend_config, b: rust_backend_config},
+ * });
+ * ```
+ *
+ * The `.cross.test.ts` `inject`s both keys, rebuilds each with
+ * `reconstruct_bootstrapped_handle`, and asserts. Run this project in a
+ * later `groupOrder` than the single-backend projects (or with distinct
+ * ports) — it reuses both configs' ports, so it must not run concurrently
+ * with the per-backend projects.
+ *
+ * @module
+ */
+import type { TestProject } from 'vitest/node';
+import type { BackendConfig } from './backend_config.js';
+export interface DualSpawnGlobalSetupOptions {
+    /**
+     * The two backend config factories to spawn. `a` is spawned first; on
+     * its success `b` is spawned (with `a` torn down if `b` throws). Label
+     * them in the consuming test (e.g. via `assert_schema_snapshots_equal`'s labels).
+     */
+    readonly configs: {
+        readonly a: () => BackendConfig;
+        readonly b: () => BackendConfig;
+    };
+    /**
+     * `project.provide` keys for the two serialized handles (read by
+     * `inject` in the test). Default `parity_handle_a` / `parity_handle_b`
+     * (the primary parity use); override for other dual-spawn gates. Augment
+     * vitest's `ProvidedContext` for whichever keys you use.
+     */
+    readonly provide_keys?: {
+        readonly a: string;
+        readonly b: string;
+    };
+}
+/**
+ * Build a vitest `globalSetup` default export that spawns both backends.
+ */
+export declare const create_dual_spawn_global_setup: ({ configs, provide_keys, }: DualSpawnGlobalSetupOptions) => ((project: TestProject) => Promise<() => Promise<void>>);
+//# sourceMappingURL=create_dual_spawn_global_setup.d.ts.map

package/dist/testing/cross_backend/create_dual_spawn_global_setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_dual_spawn_global_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/create_dual_spawn_global_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAIvD,MAAM,WAAW,2BAA2B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAA;KAAC,CAAC;IACrF;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;CACjE;AAED;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,4BAG5C,2BAA2B,KAAG,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAmBvF,CAAC"}

package/dist/testing/cross_backend/{create_schema_parity_global_setup.js → create_dual_spawn_global_setup.js}

@@ -4,7 +4,7 @@ import { serialize_bootstrapped_handle } from './setup.js';
 /**
  * Build a vitest `globalSetup` default export that spawns both backends.
  */
-export const create_schema_parity_global_setup = ({ configs, provide_keys = { a: 'parity_handle_a', b: 'parity_handle_b' }, }) => {
+export const create_dual_spawn_global_setup = ({ configs, provide_keys = { a: 'parity_handle_a', b: 'parity_handle_b' }, }) => {
     return async (project) => {
         const a = await bootstrap_backend(configs.a());
         // Tear `a` down if `b` fails to spawn — no orphaned child process.

package/dist/testing/cross_backend/default_backend_configs.d.ts

@@ -35,6 +35,18 @@ import '../assert_dev_env.js';
 import type { BackendBootstrapConfig, BackendConfig } from './backend_config.js';
 import type { BackendCapabilities, BackendShapeNotes } from './capabilities.js';
 import { type TestBackendPaths } from './build_test_backend_paths.js';
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls. Shared home
+ * here because both `ts_spine_backend_config` and `rust_spine_stub_backend_config`
+ * already import this module. (The spawned TS binary re-declares the literal
+ * locally — it can't import this module, which transitively pulls `vitest` —
+ * mirroring how `testing_spine_server_node.ts` re-declares `TS_SPINE_DIR_ENV`.)
+ */
+export declare const LOGIN_RATE_LIMIT_ENABLED_ENV = "FUZ_LOGIN_RATE_LIMIT_ENABLED";
 /**
  * Capabilities shared by TS-family backends — same canonical implementation,
  * same feature set. The non-gating wiring facts (`bearer_auth` /

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAiBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAiBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -1,6 +1,18 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { default_test_bootstrap_token, default_test_cookie_keys, default_test_keeper_password, default_test_keeper_username, } from './default_secrets.js';
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls. Shared home
+ * here because both `ts_spine_backend_config` and `rust_spine_stub_backend_config`
+ * already import this module. (The spawned TS binary re-declares the literal
+ * locally — it can't import this module, which transitively pulls `vitest` —
+ * mirroring how `testing_spine_server_node.ts` re-declares `TS_SPINE_DIR_ENV`.)
+ */
+export const LOGIN_RATE_LIMIT_ENABLED_ENV = 'FUZ_LOGIN_RATE_LIMIT_ENABLED';
 /**
  * Capabilities shared by TS-family backends — same canonical implementation,
  * same feature set. The non-gating wiring facts (`bearer_auth` /

package/dist/testing/cross_backend/default_spine_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAwB/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}
+{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CA+B/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}

package/dist/testing/cross_backend/default_spine_surface.js

@@ -77,8 +77,15 @@ export const create_spine_route_specs = (ctx) => [
     ...prefix_route_specs('/api/account', [
         ...create_account_route_specs(ctx.deps, {
             session_options: spine_session_options,
-            ip_rate_limiter: null,
-            login_account_rate_limiter: null,
+            // Honor the limiters the server was assembled with (on `AppServerContext`
+            // per the `ip_rate_limiter` / `login_account_rate_limiter` TSDoc) rather
+            // than hardcoding `null`. The standard spine binary passes `null` (the
+            // cross suites fire many loopback logins and must not trip a limiter), so
+            // this is behavior-preserving there; the dedicated login-security cross
+            // backend passes real limiters to exercise the 429 + `Retry-After` path
+            // and XFF-keyed bucketing over the wire (see `login_security.ts`).
+            ip_rate_limiter: ctx.ip_rate_limiter,
+            login_account_rate_limiter: ctx.login_account_rate_limiter,
             login_fail_floor_ms: 0,
             bootstrap_status: ctx.bootstrap_status,
         }),

package/dist/testing/cross_backend/login_security.d.ts

@@ -0,0 +1,11 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the login-security parity suite. */
+export interface LoginSecurityCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /** REST login route path. Default `/api/account/login` (the spine convention). */
+    readonly login_path?: string;
+}
+export declare const describe_login_security_cross_tests: (options: LoginSecurityCrossTestOptions) => void;
+//# sourceMappingURL=login_security.d.ts.map

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoD9B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AAE1C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAoGF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -0,0 +1,130 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for **login rate limiting + trusted-proxy
+ * (X-Forwarded-For) resolution** over real HTTP.
+ *
+ * Login throttling and client-IP resolution are wired-but-never-crossed: the
+ * in-process `describe_rate_limiting_tests` covers the limiter, and the
+ * `fuz_http` / proxy middleware unit tests cover XFF resolution, but no case
+ * exercised either over a real socket on both impls — the limiter is nulled
+ * on every standard cross backend and the resolved client IP has no
+ * wire-observable downstream there. This dedicated suite spawns a backend
+ * with the login limiters enabled + the loopback proxy trusted (see
+ * `global_setup_login_security.ts`), then pins two properties end-to-end:
+ *
+ * - **per-IP login limit fires** — the first `default_login_ip_rate_limit`
+ *   failed logins from one forwarded IP each return `401`, and the next
+ *   returns `429` with the canonical `{error: "rate_limit_exceeded",
+ *   retry_after}` body **and** a `Retry-After: ceil(retry_after)` header. The
+ *   429 wire shape is the cross-impl contract — TS `rate_limit_exceeded_response`
+ *   and Rust `route_response::rate_limit_exceeded` must agree.
+ * - **trusted-proxy / XFF resolution is honored** — distinct
+ *   `X-Forwarded-For` IPs get independent buckets: after exhausting one
+ *   forwarded IP to `429`, a *different* forwarded IP is unaffected (`401`,
+ *   not `429`). A backend that ignored XFF and keyed on the (loopback) TCP
+ *   peer would 429 the fresh-IP request too — so the `401` proves the limiter
+ *   keys on the resolved `X-Forwarded-For` client IP.
+ *
+ * **Determinism without a limiter reset.** Limiter state is in-memory and the
+ * per-test `_testing_reset` wipes only the DB, never the buckets — so each
+ * case uses its own forwarded IP and its own (non-existent) username, keeping
+ * every bucket independent across cases and across the two impls (separate
+ * processes). The login floor is zeroed on both spines, so the failed-login
+ * loop stays fast.
+ *
+ * Both surfaces are flat REST (`POST /api/account/login`) on every spine, so
+ * this is an imperative suite (not a `conformance_table` row) — the sibling of
+ * `origin.ts` / `identity_parity.ts`. Cross-process only: the limiter+proxy
+ * wiring is the point, and the in-process counterparts already exist
+ * (`describe_rate_limiting_tests` + the proxy middleware tests). Cited
+ * property: `docs/security.md` §"Rate Limiting" + §"Trusted Proxy / Client IP".
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { ERROR_RATE_LIMIT_EXCEEDED } from '../../http/error_schemas.js';
+import { default_login_account_rate_limit, default_login_ip_rate_limit } from '../../rate_limiter.js';
+/**
+ * RFC 5737 TEST-NET-3 (`203.0.113.0/24`) documentation addresses — guaranteed
+ * non-routable, so they never collide with a real client IP. One per bucket the
+ * suite needs; distinct across cases so no case inherits another's count (the
+ * limiter is not reset between cases). Spoofed via `X-Forwarded-For`; the
+ * loopback TCP peer is trusted, so the rightmost untrusted hop (these) is the
+ * resolved client IP.
+ */
+const XFF_IP_LIMIT = '203.0.113.1';
+const XFF_SEGREGATION_EXHAUST = '203.0.113.2';
+const XFF_SEGREGATION_FRESH = '203.0.113.3';
+/** A non-routable, non-existent identifier — login resolves to the not-found path (records the bucket, returns 401). */
+const PROBE_PASSWORD = 'login_security_wrong_password';
+export const describe_login_security_cross_tests = (options) => {
+    const { setup_test } = options;
+    const login_path = options.login_path ?? '/api/account/login';
+    /** Per-IP cap shared by both impls (TS `default_login_ip_rate_limit`, Rust `DEFAULT_LOGIN_IP_RATE_LIMIT`). */
+    const ip_limit = default_login_ip_rate_limit.max_attempts;
+    // The XFF-segregation case enables both limiters (one flag drives both), so
+    // the per-account bucket is live too. After exhausting an IP, the shared
+    // username holds exactly `ip_limit` account records, so the fresh-IP probe
+    // only stays a 401 (not 429) while the account cap sits above the IP cap.
+    // Assert the ordering so a future cap change fails loud here instead of as a
+    // confusing 429-instead-of-401 mid-case.
+    assert(default_login_account_rate_limit.max_attempts > ip_limit, 'login-security XFF segregation needs the per-account cap above the per-IP cap');
+    /**
+     * POST a login with the given `X-Forwarded-For` on a fresh (cookie-jar-free)
+     * transport — wrong password against a non-existent username, so the handler
+     * clears origin + input validation, records the resolved-IP bucket, and
+     * returns `401` (or `429` once the bucket trips). Always reads the body so
+     * the cross-process socket releases.
+     */
+    const attempt = async (fixture, forwarded_for, username) => {
+        const res = await fixture.fresh_transport()(login_path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-forwarded-for': forwarded_for },
+            body: JSON.stringify({ username, password: PROBE_PASSWORD }),
+        });
+        const body = (await res.json().catch(() => undefined));
+        return {
+            status: res.status,
+            error: typeof body?.error === 'string' ? body.error : undefined,
+            retry_after: typeof body?.retry_after === 'number' ? body.retry_after : undefined,
+            retry_after_header: res.headers.get('retry-after'),
+        };
+    };
+    describe('login rate limiting + trusted-proxy parity', () => {
+        test(`per-IP login limit fires 429 + Retry-After after ${ip_limit} attempts from one forwarded IP`, async () => {
+            const fixture = await setup_test();
+            // The first `ip_limit` failed logins from one forwarded IP each clear the
+            // limiter (a normal 401), recording against the resolved client IP.
+            for (let i = 0; i < ip_limit; i++) {
+                const r = await attempt(fixture, XFF_IP_LIMIT, 'probe_ip_limit');
+                assert.strictEqual(r.status, 401, `attempt ${i + 1}/${ip_limit} must be a normal 401, not rate-limited`);
+            }
+            // The next request from the SAME forwarded IP trips the per-IP bucket.
+            const limited = await attempt(fixture, XFF_IP_LIMIT, 'probe_ip_limit');
+            assert.strictEqual(limited.status, 429, `attempt ${ip_limit + 1} must be 429`);
+            assert.strictEqual(limited.error, ERROR_RATE_LIMIT_EXCEEDED, '429 body must carry the canonical rate_limit_exceeded reason');
+            assert(limited.retry_after !== undefined && limited.retry_after > 0, '429 body must carry a positive numeric retry_after');
+            assert(limited.retry_after_header !== null, 'Retry-After header must be present on the 429');
+            assert.strictEqual(Number(limited.retry_after_header), Math.ceil(limited.retry_after), 'Retry-After header must equal ceil(retry_after)');
+        });
+        test('distinct X-Forwarded-For IPs get independent buckets (XFF resolution honored)', async () => {
+            const fixture = await setup_test();
+            // Exhaust one forwarded IP to its cap (own username, so the per-account
+            // bucket never confounds — these stay well under the account cap).
+            for (let i = 0; i < ip_limit; i++) {
+                await attempt(fixture, XFF_SEGREGATION_EXHAUST, 'probe_xff');
+            }
+            const exhausted = await attempt(fixture, XFF_SEGREGATION_EXHAUST, 'probe_xff');
+            assert.strictEqual(exhausted.status, 429, 'the exhausted forwarded IP must be rate-limited');
+            // A DIFFERENT forwarded IP is a fresh bucket → not limited. If the backend
+            // ignored XFF and keyed on the loopback TCP peer, this would land in the
+            // already-exhausted peer bucket and 429 — so a 401 proves the limiter keys
+            // on the resolved X-Forwarded-For client IP.
+            const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
+            assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
+        });
+    });
+};

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -23,6 +23,23 @@ export interface SpineStubBackendConfigOptions {
      * var. When neither is set the preset throws.
      */
     readonly binary_path?: string;
+    /**
+     * Enable the per-IP + per-account login rate limiters on the stub
+     * (`FUZ_LOGIN_RATE_LIMIT_ENABLED=true`). Off by default — the standard cross
+     * suites fire many loopback logins a live limiter would 429. Set `true` only
+     * for the dedicated login-security cross project (`global_setup_login_security.ts`).
+     * Pair with `trusted_proxies` so the limiter keys on the resolved
+     * `X-Forwarded-For` client IP. Mirrors `TsSpineBackendConfigOptions.enable_login_rate_limit`.
+     */
+    readonly enable_login_rate_limit?: boolean;
+    /**
+     * Comma-separated trusted-proxy allowlist passed as `FUZ_TRUSTED_PROXIES`
+     * (e.g. `'127.0.0.1,::1'`). Unset by default (the stub leaves XFF parsing
+     * off, keying on the raw TCP peer). The login-security project sets the
+     * loopback set so the limiter keys on the `X-Forwarded-For` client IP — the
+     * TS spine binary wires the equivalent set unconditionally.
+     */
+    readonly trusted_proxies?: string;
 }
 /**
  * Build the `BackendConfig` for `testing_spine_stub`. Resolves the binary

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAQvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAwCF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aA+CF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -36,7 +36,7 @@ import '../assert_dev_env.js';
 import { fileURLToPath } from 'node:url';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { SPINE_EXPECTED_SCHEMA_URL } from './default_spine_surface.js';
-import { make_default_rust_backend_config, rust_default_capabilities, } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_rust_backend_config, rust_default_capabilities, } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
 /**
@@ -74,7 +74,7 @@ export const RUST_SPINE_STUB_DEFAULT_DATABASE_URL = 'postgres://localhost/fuz_ap
  * @throws Error when no binary path is available.
  */
 export const rust_spine_stub_backend_config = (options = {}) => {
-    const { port = RUST_SPINE_STUB_DEFAULT_PORT, database_url = RUST_SPINE_STUB_DEFAULT_DATABASE_URL, binary_path = process.env[RUST_SPINE_STUB_BIN_ENV], } = options;
+    const { port = RUST_SPINE_STUB_DEFAULT_PORT, database_url = RUST_SPINE_STUB_DEFAULT_DATABASE_URL, binary_path = process.env[RUST_SPINE_STUB_BIN_ENV], enable_login_rate_limit, trusted_proxies, } = options;
     if (!binary_path) {
         throw new Error(`rust_spine_stub_backend_config: no binary path — set ${RUST_SPINE_STUB_BIN_ENV} to a prebuilt ` +
             '`testing_spine_stub` binary (build it with `cargo build -p testing_spine_stub --release`) ' +
@@ -105,6 +105,11 @@ export const rust_spine_stub_backend_config = (options = {}) => {
             // file the TS spine reads, so the two backends share one cross-impl
             // contract.
             [RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV]: fileURLToPath(SPINE_EXPECTED_SCHEMA_URL),
+            // Login-security project opt-ins (off by default): enable the login
+            // limiters + trust the loopback proxy so the limiter keys on the
+            // resolved `X-Forwarded-For` IP. The stub reads both directly.
+            ...(enable_login_rate_limit ? { [LOGIN_RATE_LIMIT_ENABLED_ENV]: 'true' } : {}),
+            ...(trusted_proxies !== undefined ? { FUZ_TRUSTED_PROXIES: trusted_proxies } : {}),
         },
     });
 };

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts

@@ -47,6 +47,17 @@ export interface TsSpineBackendConfigOptions {
     readonly port?: number;
     /** Database URL. Default `'memory://'` (in-memory PGlite). */
     readonly database_url?: string;
+    /**
+     * Enable the per-IP + per-account login rate limiters on the spawned binary
+     * (`FUZ_LOGIN_RATE_LIMIT_ENABLED=true`). Off by default — the standard cross
+     * suites fire many loopback logins a live limiter would 429. Set `true` only
+     * for the dedicated login-security cross project (`global_setup_login_security.ts`),
+     * which drives the 429 + `Retry-After` path and XFF-keyed bucketing over the
+     * wire (`login_security.ts`). The binary always wires `trusted_proxies` for
+     * `127.0.0.1`/`::1`, so the limiter keys on the resolved `X-Forwarded-For`
+     * client IP. Mirrors `SpineStubBackendConfigOptions.enable_login_rate_limit`.
+     */
+    readonly enable_login_rate_limit?: boolean;
 }
 /**
  * `BackendConfig` for the Node TS spine binary — spawned via `gro run`

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAOvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAyB3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAgBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aA6BF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAQvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAyB3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -1,6 +1,6 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
-import { make_default_ts_backend_config, ts_default_capabilities, } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_ts_backend_config, ts_default_capabilities, } from './default_backend_configs.js';
 /** Env var naming the backend root dir; `{dir}/run/daemon_token` must match `bootstrap.daemon_token_path`. */
 export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
 /**
@@ -47,12 +47,19 @@ export const TS_SPINE_NODE_ENTRY = 'src/test/cross_backend/testing_spine_server_
 export const TS_SPINE_DENO_ENTRY = 'src/test/cross_backend/testing_spine_server_deno.ts';
 /** Entry module spawned for the Bun TS spine binary. */
 export const TS_SPINE_BUN_ENTRY = 'src/test/cross_backend/testing_spine_server_bun.ts';
+/**
+ * `extra_env` carrying the login-rate-limit toggle when enabled. The TS binary
+ * reads `FUZ_LOGIN_RATE_LIMIT_ENABLED` directly (a test-only flag, not in
+ * `BaseServerEnv`); the same env-var name the Rust spine-stub reads, so one
+ * backend-config option drives both impls.
+ */
+const login_rate_limit_env = (enable) => enable ? { [LOGIN_RATE_LIMIT_ENABLED_ENV]: 'true' } : {};
 /**
  * `BackendConfig` for the Node TS spine binary — spawned via `gro run`
  * (Gro's TS loader resolves the `$lib`-free entry's relative imports).
  */
 export const ts_spine_node_backend_config = (options = {}) => {
-    const { port = TS_SPINE_NODE_DEFAULT_PORT, database_url } = options;
+    const { port = TS_SPINE_NODE_DEFAULT_PORT, database_url, enable_login_rate_limit } = options;
     const name = 'ts_spine_node';
     const paths = build_test_backend_paths(name);
     return {
@@ -62,7 +69,10 @@ export const ts_spine_node_backend_config = (options = {}) => {
             start_command: ['gro', 'run', TS_SPINE_NODE_ENTRY],
             database_url,
             paths,
-            extra_env: { [TS_SPINE_DIR_ENV]: paths.root },
+            extra_env: {
+                [TS_SPINE_DIR_ENV]: paths.root,
+                ...login_rate_limit_env(enable_login_rate_limit),
+            },
             capabilities: ts_spine_capabilities,
         }),
         sse_path: TS_SPINE_SSE_PATH,
@@ -75,7 +85,7 @@ export const ts_spine_node_backend_config = (options = {}) => {
  * the Node path), and `Bun.serve` + `hono/bun` need no extra deps.
  */
 export const ts_spine_bun_backend_config = (options = {}) => {
-    const { port = TS_SPINE_BUN_DEFAULT_PORT, database_url } = options;
+    const { port = TS_SPINE_BUN_DEFAULT_PORT, database_url, enable_login_rate_limit } = options;
     const name = 'ts_spine_bun';
     const paths = build_test_backend_paths(name);
     return {
@@ -85,7 +95,10 @@ export const ts_spine_bun_backend_config = (options = {}) => {
             start_command: ['bun', 'run', TS_SPINE_BUN_ENTRY],
             database_url,
             paths,
-            extra_env: { [TS_SPINE_DIR_ENV]: paths.root },
+            extra_env: {
+                [TS_SPINE_DIR_ENV]: paths.root,
+                ...login_rate_limit_env(enable_login_rate_limit),
+            },
             capabilities: ts_spine_bun_capabilities,
         }),
         sse_path: TS_SPINE_SSE_PATH,
@@ -103,7 +116,7 @@ export const ts_spine_bun_backend_config = (options = {}) => {
  * built package; this binary tests live source instead.)
  */
 export const ts_spine_deno_backend_config = (options = {}) => {
-    const { port = TS_SPINE_DENO_DEFAULT_PORT, database_url } = options;
+    const { port = TS_SPINE_DENO_DEFAULT_PORT, database_url, enable_login_rate_limit } = options;
     const name = 'ts_spine_deno';
     const paths = build_test_backend_paths(name);
     return {
@@ -126,7 +139,10 @@ export const ts_spine_deno_backend_config = (options = {}) => {
             ],
             database_url,
             paths,
-            extra_env: { [TS_SPINE_DIR_ENV]: paths.root },
+            extra_env: {
+                [TS_SPINE_DIR_ENV]: paths.root,
+                ...login_rate_limit_env(enable_login_rate_limit),
+            },
             capabilities: ts_spine_capabilities,
         }),
         sse_path: TS_SPINE_SSE_PATH,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.92.0",
+  "version": "0.93.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -17,6 +17,7 @@
     "test:cross:ts": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_ts_node --project cross_backend_ts_deno --project cross_backend_ts_bun",
     "test:cross:rust-spine-stub": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_rust_spine_stub",
     "test:cross:parity": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_parity",
+    "test:cross:security": "FUZ_TEST_CROSS_BACKEND=1 vitest run --project cross_backend_security",
     "benchmark:cross-impl": "gro run src/benchmarks/cross_impl.bench.ts",
     "preview": "vite preview",
     "deploy": "gro deploy"

package/dist/testing/cross_backend/create_schema_parity_global_setup.d.ts

@@ -1,59 +0,0 @@
-import '../assert_dev_env.js';
-/**
- * Vitest `globalSetup` factory for cross-impl **schema-parity** projects.
- *
- * The per-backend `create_cross_backend_global_setup` spawns one backend
- * (derived from the project name). A schema-parity gate instead needs
- * *two* backends alive at once so the test process can capture each one's
- * schema (via `capture_schema_snapshot`) and diff them with
- * `assert_schema_snapshots_equal`. This factory spawns + bootstraps both
- * configs and `provide`s both serialized handles.
- *
- * A consumer's parity `global_setup.ts` collapses to:
- *
- * ```ts
- * import {create_schema_parity_global_setup} from
- *   '@fuzdev/fuz_app/testing/cross_backend/create_schema_parity_global_setup.js';
- * import {deno_backend_config, rust_backend_config} from './my_backend_config.js';
- * import './cross_test_types.js'; // augments the two provide keys
- *
- * export default create_schema_parity_global_setup({
- *   configs: {a: deno_backend_config, b: rust_backend_config},
- * });
- * ```
- *
- * The parity `.cross.test.ts` `inject`s both keys, rebuilds each with
- * `reconstruct_bootstrapped_handle`, and asserts. Run this project in a
- * later `groupOrder` than the single-backend projects (or with distinct
- * ports) — it reuses both configs' ports, so it must not run concurrently
- * with the per-backend projects.
- *
- * @module
- */
-import type { TestProject } from 'vitest/node';
-import type { BackendConfig } from './backend_config.js';
-export interface SchemaParityGlobalSetupOptions {
-    /**
-     * The two backend config factories to spawn. `a` is spawned first; on
-     * its success `b` is spawned (with `a` torn down if `b` throws). Label
-     * them in the parity test via `assert_schema_snapshots_equal`'s labels.
-     */
-    readonly configs: {
-        readonly a: () => BackendConfig;
-        readonly b: () => BackendConfig;
-    };
-    /**
-     * `project.provide` keys for the two serialized handles (read by
-     * `inject` in the parity test). Default `parity_handle_a` /
-     * `parity_handle_b`. Augment vitest's `ProvidedContext` for them.
-     */
-    readonly provide_keys?: {
-        readonly a: string;
-        readonly b: string;
-    };
-}
-/**
- * Build a vitest `globalSetup` default export that spawns both backends.
- */
-export declare const create_schema_parity_global_setup: ({ configs, provide_keys, }: SchemaParityGlobalSetupOptions) => ((project: TestProject) => Promise<() => Promise<void>>);
-//# sourceMappingURL=create_schema_parity_global_setup.d.ts.map

package/dist/testing/cross_backend/create_schema_parity_global_setup.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"create_schema_parity_global_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/create_schema_parity_global_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAIvD,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAA;KAAC,CAAC;IACrF;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;CACjE;AAED;;GAEG;AACH,eAAO,MAAM,iCAAiC,GAAI,4BAG/C,8BAA8B,KAAG,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAmB1F,CAAC"}