@fuzdev/fuz_app 0.92.0 → 0.94.0

package/dist/testing/cross_backend/conformance_table.js

@@ -16,11 +16,17 @@ import '../assert_dev_env.js';
  * row runs `as` resolves to a `TestFixture` accessor via
  * `resolve_principal` — no inline credential minting.
  *
+ * Every response also passes an always-on **no-fingerprint** invariant
+ * (`assert_no_fingerprint_headers` over `FINGERPRINT_HEADERS` — `Server` /
+ * `X-Powered-By` / `WWW-Authenticate` must stay absent on both spines), and
+ * a row may pin further header expectations via `expect.headers`. Headers are
+ * deliberately kept out of the equivalence-group `{status, body}` comparison.
+ *
  * @module
  */
 import { assert, describe, test } from 'vitest';
 import { find_auth_route, rest_auth_route_suffixes, } from '../integration_helpers.js';
-import { find_rpc_action, rpc_call, resolve_rpc_endpoints_for_setup, } from '../rpc_helpers.js';
+import { find_rpc_action, headers_to_record, rpc_call, resolve_rpc_endpoints_for_setup, } from '../rpc_helpers.js';
 import {} from './conformance_case.js';
 import { xfail_until } from './xfail.js';
 /**
@@ -91,19 +97,70 @@ const assert_fields = (actual, fields, label) => {
         assert.deepEqual(record[key], expected, `${label}: field '${key}'`);
     }
 };
+/**
+ * Response headers that fingerprint the backend implementation or framework.
+ * Neither spine emits these; the runner asserts they stay absent on EVERY
+ * conformance response so a framework upgrade or consumer middleware that adds
+ * (say) `Server:` to one spine can't silently become a backend-identifying
+ * oracle. Lowercased — matched against the lowercased-key snapshot
+ * `headers_to_record` produces.
+ */
+export const FINGERPRINT_HEADERS = [
+    'server',
+    'x-powered-by',
+    'www-authenticate',
+];
+/**
+ * Assert a response carries none of the `FINGERPRINT_HEADERS`. Run on every
+ * case unconditionally — the always-on no-fingerprint floor.
+ */
+export const assert_no_fingerprint_headers = (headers, label) => {
+    for (const name of FINGERPRINT_HEADERS) {
+        assert.ok(!(name in headers), `${label}: response leaked backend-fingerprinting header '${name}: ${headers[name]}' — ` +
+            `Server / X-Powered-By / WWW-Authenticate must stay absent on both spines.`);
+    }
+};
+/**
+ * Assert each declared header expectation: a string value must be present and
+ * equal (header name matched case-insensitively), `null` must be absent. The
+ * negative-space twin for headers — `expect.headers` pins a header beyond the
+ * always-on no-fingerprint floor.
+ */
+export const assert_expected_headers = (headers, expected, label) => {
+    for (const [name, value] of Object.entries(expected)) {
+        const key = name.toLowerCase();
+        if (value === null) {
+            assert.ok(!(key in headers), `${label}: header '${name}' expected absent but present as '${headers[key]}'`);
+        }
+        else {
+            assert.strictEqual(headers[key], value, `${label}: header '${name}'`);
+        }
+    }
+};
+/**
+ * Run a case's header invariants: the always-on no-fingerprint floor on every
+ * response plus any declared `expect.headers`. Header assertions are kept off
+ * the equivalence-group `{status, body}` normalized response — `Set-Cookie` /
+ * `Date` legitimately vary, so headers are never compared for byte-identity.
+ */
+const assert_response_headers = (headers, c) => {
+    assert_no_fingerprint_headers(headers, c.name);
+    if (c.expect.headers)
+        assert_expected_headers(headers, c.expect.headers, c.name);
+};
 const is_success_status = (status) => status >= 200 && status < 300;
 /**
  * Run one conformance case end-to-end: resolve the principal, dispatch the
- * request, and assert the expected status / reason / fields.
+ * request, and assert the expected status / reason / fields. Returns the
+ * normalized response so the caller can feed an equivalence group.
  */
 const run_case = async (c, options, resolved_rpc_endpoints) => {
     const fixture = await options.setup_test();
     const { transport, headers, suppress_default_origin } = await resolve_principal(fixture, c.request.as, options.principals);
     if (c.request.method.startsWith('/')) {
-        await run_rest_case(c, options, transport, headers);
-        return;
+        return run_rest_case(c, options, transport, headers);
     }
-    await run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
+    return run_rpc_case(c, transport, headers, suppress_default_origin, resolved_rpc_endpoints);
 };
 /** Dispatch + assert a case targeting an RPC method. */
 const run_rpc_case = async (c, transport, headers, suppress_default_origin, resolved_rpc_endpoints) => {
@@ -121,6 +178,7 @@ const run_rpc_case = async (c, transport, headers, suppress_default_origin, reso
         ...(c.request.verb && { verb: c.request.verb }),
         ...(suppress_default_origin && { suppress_default_origin: true }),
     });
+    assert_response_headers(res.headers, c);
     if (is_success_status(c.expect.status)) {
         assert.ok(res.ok, `${c.name}: expected success (${c.expect.status}) but got error ${JSON.stringify(res.ok ? undefined : res.error)}`);
         assert.strictEqual(res.status, c.expect.status, `${c.name}: status`);
@@ -128,7 +186,7 @@ const run_rpc_case = async (c, transport, headers, suppress_default_origin, reso
         assert.ok(parsed.success, `${c.name}: result does not match spec.output: ${JSON.stringify(parsed.success ? undefined : parsed.error.issues)}`);
         if (c.expect.fields)
             assert_fields(res.result, c.expect.fields, c.name);
-        return;
+        return { status: res.status, body: res.result };
     }
     assert.ok(!res.ok, `${c.name}: expected error status ${c.expect.status} but got success`);
     assert.strictEqual(res.status, c.expect.status, `${c.name}: error status`);
@@ -145,6 +203,7 @@ const run_rpc_case = async (c, transport, headers, suppress_default_origin, reso
     }
     if (c.expect.fields)
         assert_fields(res.error.data, c.expect.fields, c.name);
+    return { status: res.status, body: res.error };
 };
 /** Dispatch + assert a case targeting one of the 6 REST auth routes. */
 const run_rest_case = async (c, options, transport, headers) => {
@@ -165,6 +224,7 @@ const run_rest_case = async (c, options, transport, headers) => {
             c.request.params !== undefined && { body: JSON.stringify(c.request.params) }),
     };
     const response = await transport(route.path, init);
+    assert_response_headers(headers_to_record(response.headers), c);
     assert.strictEqual(response.status, c.expect.status, `${c.name}: status`);
     const body = await response.json().catch(() => undefined);
     if (is_success_status(c.expect.status)) {
@@ -177,6 +237,7 @@ const run_rest_case = async (c, options, transport, headers) => {
     }
     if (c.expect.fields)
         assert_fields(body, c.expect.fields, c.name);
+    return { status: response.status, body };
 };
 /**
  * Register a `describe` block running every `ConformanceCase` as a
@@ -186,10 +247,28 @@ const run_rest_case = async (c, options, transport, headers) => {
  */
 export const describe_conformance_table_tests = (options) => {
     const resolved_rpc_endpoints = resolve_rpc_endpoints_for_setup(options.rpc_endpoints, options.session_options);
+    // Per-group normalized responses, populated as the member case tests run
+    // and consulted by the per-group byte-identity assertions registered after
+    // the case loop — vitest runs a describe's tests in registration order, so
+    // the group assertions execute last, after every member has recorded.
+    const equivalence_groups = new Map();
+    const group_names = new Set();
+    for (const c of options.cases) {
+        if (c.expect.equivalence_group)
+            group_names.add(c.expect.equivalence_group);
+    }
     describe(options.suite_name ?? 'conformance table', () => {
         for (const c of options.cases) {
             const label = c.note ? `${c.name} — ${c.note}` : c.name;
-            const body = () => run_case(c, options, resolved_rpc_endpoints);
+            const group = c.expect.equivalence_group;
+            const body = async () => {
+                const normalized = await run_case(c, options, resolved_rpc_endpoints);
+                if (group) {
+                    const members = equivalence_groups.get(group) ?? [];
+                    members.push({ name: c.name, normalized });
+                    equivalence_groups.set(group, members);
+                }
+            };
             if (c.xfail) {
                 xfail_until(c.xfail.tracking_id, c.xfail.reason, label, body);
             }
@@ -197,5 +276,28 @@ export const describe_conformance_table_tests = (options) => {
                 test(label, body);
             }
         }
+        // Negative-space gate: every member of an equivalence group must have
+        // produced a byte-identical `{status, body}`. This holds the impl under
+        // test to "a prober cannot distinguish these masked paths" — the
+        // promotion of a masked pair (wrong-password ≡ account-not-found,
+        // found-but-unauthorized ≡ not-found) from "same status + reason" to
+        // "wire-indistinguishable". Runs per impl, so each spine is held to it.
+        for (const group of group_names) {
+            test(`equivalence group '${group}' — members are wire-indistinguishable`, () => {
+                const members = equivalence_groups.get(group) ?? [];
+                assert.ok(members.length >= 2, `equivalence group '${group}': expected >= 2 members to have recorded, got ` +
+                    `${members.length} — a group pins indistinguishability between paths, so it ` +
+                    `needs at least a pair (check the member cases ran and weren't all xfail).`);
+                const [first, ...rest] = members;
+                // `members.length >= 2` guarantees `first` is defined; the explicit
+                // assert narrows it for the typechecker (noUncheckedIndexedAccess).
+                assert.ok(first);
+                for (const member of rest) {
+                    assert.deepStrictEqual(member.normalized, first.normalized, `equivalence group '${group}': '${member.name}' is distinguishable from ` +
+                        `'${first.name}' — a prober could tell these masked paths apart. The ` +
+                        `normalized {status, body} must be byte-identical across all members.`);
+                }
+            });
+        }
     });
 };

package/dist/testing/cross_backend/create_cross_backend_global_setup.d.ts

@@ -13,7 +13,7 @@ import '../assert_dev_env.js';
  *
  * ```ts
  * import {create_cross_backend_global_setup} from
- *   '@fuzdev/fuz_app/testing/cross_backend/create_cross_backend_global_setup.js';
+ *   '@fuzdev/fuz_app/testing/cross_backend/create_cross_backend_global_setup.ts';
  * import {deno_backend_config, rust_backend_config} from './my_backend_config.js';
  * import './cross_test_types.js'; // augments inject('backend_handle')
  *

package/dist/testing/cross_backend/create_dual_spawn_global_setup.d.ts

@@ -0,0 +1,64 @@
+import '../assert_dev_env.js';
+/**
+ * Generic **dual-spawn** vitest `globalSetup` factory — spawns + bootstraps
+ * *two* backends at once and `provide`s both serialized handles, for any
+ * cross-impl gate that needs both alive together. (The per-backend
+ * `create_cross_backend_global_setup` derives one backend from the project
+ * name; this brings up a pair.)
+ *
+ * Its primary use is the **schema- / action-manifest-parity** gates (capture
+ * each backend over a `_testing_*` introspection RPC and diff with
+ * `assert_schema_snapshots_equal` / `assert_action_manifests_equal`) — which is
+ * why the default `provide_keys` are `parity_handle_*`. The login-security gate
+ * (`global_setup_login_security.ts`) reuses it with its own keys; any future
+ * two-backend gate can too.
+ *
+ * A consumer's dual-spawn `global_setup.ts` collapses to:
+ *
+ * ```ts
+ * import {create_dual_spawn_global_setup} from
+ *   '@fuzdev/fuz_app/testing/cross_backend/create_dual_spawn_global_setup.ts';
+ * import {deno_backend_config, rust_backend_config} from './my_backend_config.js';
+ * import './cross_test_types.js'; // augments the two provide keys
+ *
+ * export default create_dual_spawn_global_setup({
+ *   configs: {a: deno_backend_config, b: rust_backend_config},
+ * });
+ * ```
+ *
+ * The `.cross.test.ts` `inject`s both keys, rebuilds each with
+ * `reconstruct_bootstrapped_handle`, and asserts. Run this project in a
+ * later `groupOrder` than the single-backend projects (or with distinct
+ * ports) — it reuses both configs' ports, so it must not run concurrently
+ * with the per-backend projects.
+ *
+ * @module
+ */
+import type { TestProject } from 'vitest/node';
+import type { BackendConfig } from './backend_config.js';
+export interface DualSpawnGlobalSetupOptions {
+    /**
+     * The two backend config factories to spawn. `a` is spawned first; on
+     * its success `b` is spawned (with `a` torn down if `b` throws). Label
+     * them in the consuming test (e.g. via `assert_schema_snapshots_equal`'s labels).
+     */
+    readonly configs: {
+        readonly a: () => BackendConfig;
+        readonly b: () => BackendConfig;
+    };
+    /**
+     * `project.provide` keys for the two serialized handles (read by
+     * `inject` in the test). Default `parity_handle_a` / `parity_handle_b`
+     * (the primary parity use); override for other dual-spawn gates. Augment
+     * vitest's `ProvidedContext` for whichever keys you use.
+     */
+    readonly provide_keys?: {
+        readonly a: string;
+        readonly b: string;
+    };
+}
+/**
+ * Build a vitest `globalSetup` default export that spawns both backends.
+ */
+export declare const create_dual_spawn_global_setup: ({ configs, provide_keys, }: DualSpawnGlobalSetupOptions) => ((project: TestProject) => Promise<() => Promise<void>>);
+//# sourceMappingURL=create_dual_spawn_global_setup.d.ts.map

package/dist/testing/cross_backend/create_dual_spawn_global_setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_dual_spawn_global_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/create_dual_spawn_global_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAIvD,MAAM,WAAW,2BAA2B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAA;KAAC,CAAC;IACrF;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;CACjE;AAED;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,4BAG5C,2BAA2B,KAAG,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAmBvF,CAAC"}

package/dist/testing/cross_backend/{create_schema_parity_global_setup.js → create_dual_spawn_global_setup.js}

@@ -4,7 +4,7 @@ import { serialize_bootstrapped_handle } from './setup.js';
 /**
  * Build a vitest `globalSetup` default export that spawns both backends.
  */
-export const create_schema_parity_global_setup = ({ configs, provide_keys = { a: 'parity_handle_a', b: 'parity_handle_b' }, }) => {
+export const create_dual_spawn_global_setup = ({ configs, provide_keys = { a: 'parity_handle_a', b: 'parity_handle_b' }, }) => {
     return async (project) => {
         const a = await bootstrap_backend(configs.a());
         // Tear `a` down if `b` fails to spawn — no orphaned child process.

package/dist/testing/cross_backend/default_backend_configs.d.ts

@@ -35,6 +35,18 @@ import '../assert_dev_env.js';
 import type { BackendBootstrapConfig, BackendConfig } from './backend_config.js';
 import type { BackendCapabilities, BackendShapeNotes } from './capabilities.js';
 import { type TestBackendPaths } from './build_test_backend_paths.js';
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls. Shared home
+ * here because both `ts_spine_backend_config` and `rust_spine_stub_backend_config`
+ * already import this module. (The spawned TS binary re-declares the literal
+ * locally — it can't import this module, which transitively pulls `vitest` —
+ * mirroring how `testing_spine_server_node.ts` re-declares `TS_SPINE_DIR_ENV`.)
+ */
+export declare const LOGIN_RATE_LIMIT_ENABLED_ENV = "FUZ_LOGIN_RATE_LIMIT_ENABLED";
 /**
  * Capabilities shared by TS-family backends — same canonical implementation,
  * same feature set. The non-gating wiring facts (`bearer_auth` /

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAiBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAiBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -1,6 +1,18 @@
 import '../assert_dev_env.js';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { default_test_bootstrap_token, default_test_cookie_keys, default_test_keeper_password, default_test_keeper_username, } from './default_secrets.js';
+/**
+ * Env var both spine binaries read to enable their login rate limiters
+ * (`'true'` on / unset off). The cross-language contract for the login-security
+ * cross project: the TS binary reads it via `runtime.env_get` (a test-only flag,
+ * not in `BaseServerEnv`); the Rust `testing_spine_stub` reads it via
+ * `std::env::var` — so one backend-config option drives both impls. Shared home
+ * here because both `ts_spine_backend_config` and `rust_spine_stub_backend_config`
+ * already import this module. (The spawned TS binary re-declares the literal
+ * locally — it can't import this module, which transitively pulls `vitest` —
+ * mirroring how `testing_spine_server_node.ts` re-declares `TS_SPINE_DIR_ENV`.)
+ */
+export const LOGIN_RATE_LIMIT_ENABLED_ENV = 'FUZ_LOGIN_RATE_LIMIT_ENABLED';
 /**
  * Capabilities shared by TS-family backends — same canonical implementation,
  * same feature set. The non-gating wiring facts (`bearer_auth` /

package/dist/testing/cross_backend/default_spine_surface.d.ts

@@ -23,7 +23,7 @@ import '../assert_dev_env.js';
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { NotificationSender } from '../../auth/role_grant_offer_notifications.js';
 import { type RoleSchemaResult } from '../../auth/role_schema.js';
 import { type SessionOptions } from '../../auth/session_cookie.js';

package/dist/testing/cross_backend/default_spine_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CAwB/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}
+{"version":3,"file":"default_spine_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_spine_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAwB,KAAK,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAIxF,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AAGzE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,gBAExB,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,gBAAgB,EACrB,UAAU,wBAAwB,KAChC,KAAK,CAAC,eAAe,CAQvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,gBAAgB,KAAG,KAAK,CAAC,SAAS,CA+B/E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,SAC6B,CAAC;AAE3F;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,QAAO,cAM1C,CAAC"}

package/dist/testing/cross_backend/default_spine_surface.js

@@ -77,8 +77,15 @@ export const create_spine_route_specs = (ctx) => [
     ...prefix_route_specs('/api/account', [
         ...create_account_route_specs(ctx.deps, {
             session_options: spine_session_options,
-            ip_rate_limiter: null,
-            login_account_rate_limiter: null,
+            // Honor the limiters the server was assembled with (on `AppServerContext`
+            // per the `ip_rate_limiter` / `login_account_rate_limiter` TSDoc) rather
+            // than hardcoding `null`. The standard spine binary passes `null` (the
+            // cross suites fire many loopback logins and must not trip a limiter), so
+            // this is behavior-preserving there; the dedicated login-security cross
+            // backend passes real limiters to exercise the 429 + `Retry-After` path
+            // and XFF-keyed bucketing over the wire (see `login_security.ts`).
+            ip_rate_limiter: ctx.ip_rate_limiter,
+            login_account_rate_limiter: ctx.login_account_rate_limiter,
             login_fail_floor_ms: 0,
             bootstrap_status: ctx.bootstrap_status,
         }),

package/dist/testing/cross_backend/fact_serving.js

@@ -38,7 +38,7 @@ import '../assert_dev_env.js';
  */
 import { describe, assert } from 'vitest';
 import { z } from 'zod';
-import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.js';
+import { FactHashSchema } from '@fuzdev/fuz_util/fact_hash.ts';
 import { CellCreateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, expect_output } from './cell_cross_helpers.js';

package/dist/testing/cross_backend/login_security.d.ts

@@ -0,0 +1,11 @@
+import '../assert_dev_env.js';
+import type { SetupTest } from './setup.js';
+/** Options for the login-security parity suite. */
+export interface LoginSecurityCrossTestOptions {
+    /** Per-test fixture producer (cross-process only — see the module doc). */
+    readonly setup_test: SetupTest;
+    /** REST login route path. Default `/api/account/login` (the spine convention). */
+    readonly login_path?: string;
+}
+export declare const describe_login_security_cross_tests: (options: LoginSecurityCrossTestOptions) => void;
+//# sourceMappingURL=login_security.d.ts.map

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoD9B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AAE1C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAoGF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -0,0 +1,130 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for **login rate limiting + trusted-proxy
+ * (X-Forwarded-For) resolution** over real HTTP.
+ *
+ * Login throttling and client-IP resolution are wired-but-never-crossed: the
+ * in-process `describe_rate_limiting_tests` covers the limiter, and the
+ * `fuz_http` / proxy middleware unit tests cover XFF resolution, but no case
+ * exercised either over a real socket on both impls — the limiter is nulled
+ * on every standard cross backend and the resolved client IP has no
+ * wire-observable downstream there. This dedicated suite spawns a backend
+ * with the login limiters enabled + the loopback proxy trusted (see
+ * `global_setup_login_security.ts`), then pins two properties end-to-end:
+ *
+ * - **per-IP login limit fires** — the first `default_login_ip_rate_limit`
+ *   failed logins from one forwarded IP each return `401`, and the next
+ *   returns `429` with the canonical `{error: "rate_limit_exceeded",
+ *   retry_after}` body **and** a `Retry-After: ceil(retry_after)` header. The
+ *   429 wire shape is the cross-impl contract — TS `rate_limit_exceeded_response`
+ *   and Rust `route_response::rate_limit_exceeded` must agree.
+ * - **trusted-proxy / XFF resolution is honored** — distinct
+ *   `X-Forwarded-For` IPs get independent buckets: after exhausting one
+ *   forwarded IP to `429`, a *different* forwarded IP is unaffected (`401`,
+ *   not `429`). A backend that ignored XFF and keyed on the (loopback) TCP
+ *   peer would 429 the fresh-IP request too — so the `401` proves the limiter
+ *   keys on the resolved `X-Forwarded-For` client IP.
+ *
+ * **Determinism without a limiter reset.** Limiter state is in-memory and the
+ * per-test `_testing_reset` wipes only the DB, never the buckets — so each
+ * case uses its own forwarded IP and its own (non-existent) username, keeping
+ * every bucket independent across cases and across the two impls (separate
+ * processes). The login floor is zeroed on both spines, so the failed-login
+ * loop stays fast.
+ *
+ * Both surfaces are flat REST (`POST /api/account/login`) on every spine, so
+ * this is an imperative suite (not a `conformance_table` row) — the sibling of
+ * `origin.ts` / `identity_parity.ts`. Cross-process only: the limiter+proxy
+ * wiring is the point, and the in-process counterparts already exist
+ * (`describe_rate_limiting_tests` + the proxy middleware tests). Cited
+ * property: `docs/security.md` §"Rate Limiting" + §"Trusted Proxy / Client IP".
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { ERROR_RATE_LIMIT_EXCEEDED } from '../../http/error_schemas.js';
+import { default_login_account_rate_limit, default_login_ip_rate_limit } from '../../rate_limiter.js';
+/**
+ * RFC 5737 TEST-NET-3 (`203.0.113.0/24`) documentation addresses — guaranteed
+ * non-routable, so they never collide with a real client IP. One per bucket the
+ * suite needs; distinct across cases so no case inherits another's count (the
+ * limiter is not reset between cases). Spoofed via `X-Forwarded-For`; the
+ * loopback TCP peer is trusted, so the rightmost untrusted hop (these) is the
+ * resolved client IP.
+ */
+const XFF_IP_LIMIT = '203.0.113.1';
+const XFF_SEGREGATION_EXHAUST = '203.0.113.2';
+const XFF_SEGREGATION_FRESH = '203.0.113.3';
+/** A non-routable, non-existent identifier — login resolves to the not-found path (records the bucket, returns 401). */
+const PROBE_PASSWORD = 'login_security_wrong_password';
+export const describe_login_security_cross_tests = (options) => {
+    const { setup_test } = options;
+    const login_path = options.login_path ?? '/api/account/login';
+    /** Per-IP cap shared by both impls (TS `default_login_ip_rate_limit`, Rust `DEFAULT_LOGIN_IP_RATE_LIMIT`). */
+    const ip_limit = default_login_ip_rate_limit.max_attempts;
+    // The XFF-segregation case enables both limiters (one flag drives both), so
+    // the per-account bucket is live too. After exhausting an IP, the shared
+    // username holds exactly `ip_limit` account records, so the fresh-IP probe
+    // only stays a 401 (not 429) while the account cap sits above the IP cap.
+    // Assert the ordering so a future cap change fails loud here instead of as a
+    // confusing 429-instead-of-401 mid-case.
+    assert(default_login_account_rate_limit.max_attempts > ip_limit, 'login-security XFF segregation needs the per-account cap above the per-IP cap');
+    /**
+     * POST a login with the given `X-Forwarded-For` on a fresh (cookie-jar-free)
+     * transport — wrong password against a non-existent username, so the handler
+     * clears origin + input validation, records the resolved-IP bucket, and
+     * returns `401` (or `429` once the bucket trips). Always reads the body so
+     * the cross-process socket releases.
+     */
+    const attempt = async (fixture, forwarded_for, username) => {
+        const res = await fixture.fresh_transport()(login_path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-forwarded-for': forwarded_for },
+            body: JSON.stringify({ username, password: PROBE_PASSWORD }),
+        });
+        const body = (await res.json().catch(() => undefined));
+        return {
+            status: res.status,
+            error: typeof body?.error === 'string' ? body.error : undefined,
+            retry_after: typeof body?.retry_after === 'number' ? body.retry_after : undefined,
+            retry_after_header: res.headers.get('retry-after'),
+        };
+    };
+    describe('login rate limiting + trusted-proxy parity', () => {
+        test(`per-IP login limit fires 429 + Retry-After after ${ip_limit} attempts from one forwarded IP`, async () => {
+            const fixture = await setup_test();
+            // The first `ip_limit` failed logins from one forwarded IP each clear the
+            // limiter (a normal 401), recording against the resolved client IP.
+            for (let i = 0; i < ip_limit; i++) {
+                const r = await attempt(fixture, XFF_IP_LIMIT, 'probe_ip_limit');
+                assert.strictEqual(r.status, 401, `attempt ${i + 1}/${ip_limit} must be a normal 401, not rate-limited`);
+            }
+            // The next request from the SAME forwarded IP trips the per-IP bucket.
+            const limited = await attempt(fixture, XFF_IP_LIMIT, 'probe_ip_limit');
+            assert.strictEqual(limited.status, 429, `attempt ${ip_limit + 1} must be 429`);
+            assert.strictEqual(limited.error, ERROR_RATE_LIMIT_EXCEEDED, '429 body must carry the canonical rate_limit_exceeded reason');
+            assert(limited.retry_after !== undefined && limited.retry_after > 0, '429 body must carry a positive numeric retry_after');
+            assert(limited.retry_after_header !== null, 'Retry-After header must be present on the 429');
+            assert.strictEqual(Number(limited.retry_after_header), Math.ceil(limited.retry_after), 'Retry-After header must equal ceil(retry_after)');
+        });
+        test('distinct X-Forwarded-For IPs get independent buckets (XFF resolution honored)', async () => {
+            const fixture = await setup_test();
+            // Exhaust one forwarded IP to its cap (own username, so the per-account
+            // bucket never confounds — these stay well under the account cap).
+            for (let i = 0; i < ip_limit; i++) {
+                await attempt(fixture, XFF_SEGREGATION_EXHAUST, 'probe_xff');
+            }
+            const exhausted = await attempt(fixture, XFF_SEGREGATION_EXHAUST, 'probe_xff');
+            assert.strictEqual(exhausted.status, 429, 'the exhausted forwarded IP must be rate-limited');
+            // A DIFFERENT forwarded IP is a fresh bucket → not limited. If the backend
+            // ignored XFF and keyed on the loopback TCP peer, this would land in the
+            // already-exhausted peer bucket and 429 — so a 401 proves the limiter keys
+            // on the resolved X-Forwarded-For client IP.
+            const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
+            assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
+        });
+    });
+};

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -23,6 +23,23 @@ export interface SpineStubBackendConfigOptions {
      * var. When neither is set the preset throws.
      */
     readonly binary_path?: string;
+    /**
+     * Enable the per-IP + per-account login rate limiters on the stub
+     * (`FUZ_LOGIN_RATE_LIMIT_ENABLED=true`). Off by default — the standard cross
+     * suites fire many loopback logins a live limiter would 429. Set `true` only
+     * for the dedicated login-security cross project (`global_setup_login_security.ts`).
+     * Pair with `trusted_proxies` so the limiter keys on the resolved
+     * `X-Forwarded-For` client IP. Mirrors `TsSpineBackendConfigOptions.enable_login_rate_limit`.
+     */
+    readonly enable_login_rate_limit?: boolean;
+    /**
+     * Comma-separated trusted-proxy allowlist passed as `FUZ_TRUSTED_PROXIES`
+     * (e.g. `'127.0.0.1,::1'`). Unset by default (the stub leaves XFF parsing
+     * off, keying on the raw TCP peer). The login-security project sets the
+     * loopback set so the limiter keys on the `X-Forwarded-For` client IP — the
+     * TS spine binary wires the equivalent set unconditionally.
+     */
+    readonly trusted_proxies?: string;
 }
 /**
  * Build the `BackendConfig` for `testing_spine_stub`. Resolves the binary

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAQvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAwCF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aA+CF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -36,7 +36,7 @@ import '../assert_dev_env.js';
 import { fileURLToPath } from 'node:url';
 import { build_test_backend_paths } from './build_test_backend_paths.js';
 import { SPINE_EXPECTED_SCHEMA_URL } from './default_spine_surface.js';
-import { make_default_rust_backend_config, rust_default_capabilities, } from './default_backend_configs.js';
+import { LOGIN_RATE_LIMIT_ENABLED_ENV, make_default_rust_backend_config, rust_default_capabilities, } from './default_backend_configs.js';
 /** Env var naming the prebuilt `testing_spine_stub` binary. Required when `binary_path` is omitted. */
 export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
 /**
@@ -74,7 +74,7 @@ export const RUST_SPINE_STUB_DEFAULT_DATABASE_URL = 'postgres://localhost/fuz_ap
  * @throws Error when no binary path is available.
  */
 export const rust_spine_stub_backend_config = (options = {}) => {
-    const { port = RUST_SPINE_STUB_DEFAULT_PORT, database_url = RUST_SPINE_STUB_DEFAULT_DATABASE_URL, binary_path = process.env[RUST_SPINE_STUB_BIN_ENV], } = options;
+    const { port = RUST_SPINE_STUB_DEFAULT_PORT, database_url = RUST_SPINE_STUB_DEFAULT_DATABASE_URL, binary_path = process.env[RUST_SPINE_STUB_BIN_ENV], enable_login_rate_limit, trusted_proxies, } = options;
     if (!binary_path) {
         throw new Error(`rust_spine_stub_backend_config: no binary path — set ${RUST_SPINE_STUB_BIN_ENV} to a prebuilt ` +
             '`testing_spine_stub` binary (build it with `cargo build -p testing_spine_stub --release`) ' +
@@ -105,6 +105,11 @@ export const rust_spine_stub_backend_config = (options = {}) => {
             // file the TS spine reads, so the two backends share one cross-impl
             // contract.
             [RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV]: fileURLToPath(SPINE_EXPECTED_SCHEMA_URL),
+            // Login-security project opt-ins (off by default): enable the login
+            // limiters + trust the loopback proxy so the limiter keys on the
+            // resolved `X-Forwarded-For` IP. The stub reads both directly.
+            ...(enable_login_rate_limit ? { [LOGIN_RATE_LIMIT_ENABLED_ENV]: 'true' } : {}),
+            ...(trusted_proxies !== undefined ? { FUZ_TRUSTED_PROXIES: trusted_proxies } : {}),
         },
     });
 };

package/dist/testing/cross_backend/setup.d.ts

@@ -1,5 +1,5 @@
 import '../assert_dev_env.js';
-import { Uuid } from '@fuzdev/fuz_util/id.js';
+import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import type { TestAccount } from '../app_server.js';
 import type { BackendCapabilities } from './capabilities.js';
 import { type FetchTransport } from '../transports/fetch_transport.js';

package/dist/testing/cross_backend/setup.js

@@ -22,7 +22,7 @@ import '../assert_dev_env.js';
  * @module
  */
 import { z } from 'zod';
-import { Uuid } from '@fuzdev/fuz_util/id.js';
+import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
 import { USERNAME_LENGTH_MAX } from '../../primitive_schemas.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -66,8 +66,8 @@ import '../assert_dev_env.js';
  * @module
  */
 import { z } from 'zod';
-import { Uuid } from '@fuzdev/fuz_util/id.js';
-import { fact_hash_bytes, FactHashSchema } from '@fuzdev/fuz_util/fact_hash.js';
+import { Uuid } from '@fuzdev/fuz_util/id.ts';
+import { fact_hash_bytes, FactHashSchema } from '@fuzdev/fuz_util/fact_hash.ts';
 import { rpc_action } from '../../actions/action_rpc.js';
 import { query_put_fact } from '../../db/fact_queries.js';
 import { ROLE_ADMIN, ROLE_KEEPER } from '../../auth/role_schema.js';

package/dist/testing/cross_backend/testing_server_core.d.ts

@@ -28,7 +28,7 @@ import '../assert_dev_env.js';
  */
 import type { Context, Hono } from 'hono';
 import type { UpgradeWebSocket } from 'hono/ws';
-import { type Logger as LoggerType } from '@fuzdev/fuz_util/log.js';
+import { type Logger as LoggerType } from '@fuzdev/fuz_util/log.ts';
 import type { RuntimeDeps } from '../../runtime/deps.js';
 /**
  * Adapter-built handle to a bound HTTP server.