@getstrata/core 0.5.55 → 0.5.57

package/dist/entries/http/scimThrottleMiddleware.js

@@ -1,10 +1,44 @@
 // @bun
 // ../../src/core/http/scimThrottleMiddleware.ts
 var {RedisClient } = globalThis.Bun;
+
+// ../../src/core/http/clientIp.ts
+function trustForwardedFor(env = process.env) {
+  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
+}
+function readClientIp(request, env = process.env) {
+  if (!trustForwardedFor(env)) {
+    return;
+  }
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+  if (forwarded) {
+    return forwarded;
+  }
+  return request.headers.get("x-real-ip")?.trim() || undefined;
+}
+
+// ../../src/core/http/scimThrottleMiddleware.ts
+var memoryBuckets = new Map;
+function resolveScimIdentity(request) {
+  return request.headers.get("authorization")?.slice("Bearer ".length, "Bearer ".length + 16) ?? readClientIp(request) ?? "unknown";
+}
+function throttleFromMemory(key, maxAttempts, decaySeconds) {
+  const now = Date.now();
+  const existing = memoryBuckets.get(key);
+  if (!existing || existing.resetAt <= now) {
+    memoryBuckets.set(key, { count: 1, resetAt: now + decaySeconds * 1000 });
+    return null;
+  }
+  existing.count += 1;
+  if (existing.count > maxAttempts) {
+    return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(decaySeconds) } });
+  }
+  return null;
+}
 function createScimThrottleMiddleware(options) {
   const client = options.redisUrl ? new RedisClient(options.redisUrl) : null;
   return async (request, next) => {
-    const identity = request.headers.get("authorization")?.slice("Bearer ".length, "Bearer ".length + 16) ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+    const identity = resolveScimIdentity(request);
     const key = `workhub:scim-throttle:${identity}`;
     if (client) {
       const attempts = Number(await client.incr(key));
@@ -14,6 +48,11 @@ function createScimThrottleMiddleware(options) {
       if (attempts > options.maxAttempts) {
         return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
       }
+      return await next();
+    }
+    const limited = throttleFromMemory(key, options.maxAttempts, options.decaySeconds);
+    if (limited) {
+      return limited;
     }
     return await next();
   };

package/dist/entries/http/securedRouteModelBinding.js

@@ -282,6 +282,6 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
   };
 }
 export {
-  securedBindRouteModelByKey,
-  securedBindRouteModel
+  securedBindRouteModel,
+  securedBindRouteModelByKey
 };

package/dist/entries/http/throttleMiddleware.js

@@ -3,6 +3,23 @@
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentTenant, rateLimitMultiplierForPlan } from "@getstrata/core/tenant/tenantContext";
 var {RedisClient } = globalThis.Bun;
+
+// ../../src/core/http/clientIp.ts
+function trustForwardedFor(env = process.env) {
+  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
+}
+function readClientIp(request, env = process.env) {
+  if (!trustForwardedFor(env)) {
+    return;
+  }
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+  if (forwarded) {
+    return forwarded;
+  }
+  return request.headers.get("x-real-ip")?.trim() || undefined;
+}
+
+// ../../src/core/http/throttleMiddleware.ts
 function resolveThrottleIdentity(request) {
   const user = currentAuthUser();
   if (user?.tokenId !== undefined) {
@@ -11,7 +28,7 @@ function resolveThrottleIdentity(request) {
   if (user) {
     return `user:${user.id}`;
   }
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+  return readClientIp(request) ?? "unknown";
 }
 function createThrottleMiddleware(options) {
   const client = new RedisClient(options.redisUrl);
@@ -37,6 +54,6 @@ function createThrottleMiddleware(options) {
   };
 }
 export {
-  resolveThrottleIdentity,
-  createThrottleMiddleware
+  createThrottleMiddleware,
+  resolveThrottleIdentity
 };

package/dist/entries/http/validation.js

@@ -128,18 +128,18 @@ function parsePositiveIntParam(value, name = "id") {
   return parsed;
 }
 export {
-  readRequiredString,
-  readRequiredPositiveInt,
-  readRequiredEnum,
-  readOptionalString,
-  readOptionalPositiveInt,
-  readOptionalEnum,
-  parsePositiveIntParam,
-  parseOptionalPositiveIntQueryParam,
-  parseOptionalEnumQueryParam,
-  parseOptionalBooleanQueryParam,
-  parseJsonBody,
-  getQueryParams,
+  buildRequestCacheKey,
   expectObject,
-  buildRequestCacheKey
+  getQueryParams,
+  parseJsonBody,
+  parseOptionalBooleanQueryParam,
+  parseOptionalEnumQueryParam,
+  parseOptionalPositiveIntQueryParam,
+  parsePositiveIntParam,
+  readOptionalEnum,
+  readOptionalPositiveInt,
+  readOptionalString,
+  readRequiredEnum,
+  readRequiredPositiveInt,
+  readRequiredString
 };