@getstrata/core 2.1.0 → 2.2.0

package/dist/entries/http/scimThrottleMiddleware.js

@@ -1,6 +1,182 @@
 // @bun
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+var init_asyncContextStore = () => {};
+
 // ../../src/core/http/scimThrottleMiddleware.ts
+import { createHash as createHash2 } from "crypto";
+
+// ../../src/core/runtime/boundedThrottleStore.ts
+class BoundedThrottleStore {
+  decayMs;
+  now;
+  buckets = new Map;
+  maxBuckets;
+  pruneBatchSize;
+  disposed = false;
+  pruned = 0;
+  constructor(decayMs, options = {}, now = () => performance.now()) {
+    this.decayMs = decayMs;
+    this.now = now;
+    this.maxBuckets = options.maxBuckets ?? 1e4;
+    this.pruneBatchSize = options.pruneBatchSize ?? 32;
+    if (!Number.isFinite(decayMs) || decayMs < 0 || decayMs > 2147483647) {
+      throw new Error("Invalid memory throttle window.");
+    }
+    if (!Number.isSafeInteger(this.maxBuckets) || this.maxBuckets < 1 || this.maxBuckets > 1e6 || !Number.isSafeInteger(this.pruneBatchSize) || this.pruneBatchSize < 1 || this.pruneBatchSize > 1024) {
+      throw new Error("Invalid memory throttle storage bounds.");
+    }
+  }
+  consume(key) {
+    this.pruned = 0;
+    if (this.disposed)
+      return null;
+    const now = this.now();
+    const entries = this.buckets.entries();
+    for (let i = 0;i < this.pruneBatchSize; i++) {
+      const oldest = entries.next().value;
+      if (!oldest || oldest[1].resetAt > now)
+        break;
+      this.buckets.delete(oldest[0]);
+      this.pruned++;
+    }
+    const existing = this.buckets.get(key);
+    if (existing && existing.resetAt > now) {
+      existing.count = Math.min(Number.MAX_SAFE_INTEGER, existing.count + 1);
+      return existing.count;
+    }
+    this.buckets.delete(key);
+    if (this.buckets.size >= this.maxBuckets)
+      return null;
+    this.buckets.set(key, { count: 1, resetAt: now + this.decayMs });
+    return 1;
+  }
+  clear() {
+    this.buckets.clear();
+  }
+  dispose() {
+    this.disposed = true;
+    this.clear();
+  }
+  stats() {
+    return {
+      retainedBuckets: this.buckets.size,
+      prunedOnLastConsume: this.pruned,
+      disposed: this.disposed
+    };
+  }
+}
+
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+// ../../src/core/security/scimTenantTokens.ts
+function parseScimTenantTokens(raw) {
+  const tokens = new Map;
+  if (!raw?.trim()) {
+    return tokens;
+  }
+  for (const entry of raw.split(",")) {
+    const [tenantPart, tokenPart] = entry.split(":");
+    if (!tenantPart || !tokenPart) {
+      continue;
+    }
+    const tenantId = Number.parseInt(tenantPart.trim(), 10);
+    const token = tokenPart.trim();
+    if (Number.isInteger(tenantId) && tenantId > 0 && token.length > 0) {
+      tokens.set(tenantId, token);
+    }
+  }
+  return tokens;
+}
+function resolveScimTenantFromToken(token) {
+  const presented = token.trim();
+  if (presented.length === 0) {
+    return null;
+  }
+  const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
+  for (const [tenantId, expectedToken] of tenantTokens) {
+    if (timingSafeCompareString(presented, expectedToken)) {
+      return tenantId;
+    }
+  }
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN?.trim() ?? "";
+  if (fallbackToken.length === 0) {
+    return null;
+  }
+  if (timingSafeCompareString(presented, fallbackToken)) {
+    return 1;
+  }
+  return null;
+}
+
+// ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+function trustForwardedFor(env = process.env) {
+  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
+}
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
+  }
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
+  }
+  return request.headers.get("x-real-ip")?.trim() || undefined;
+}
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
+
+// ../../src/core/http/throttleMiddleware.ts
 import { createHash } from "crypto";
+import { currentAuthUser } from "@getstrata/core/auth/authContext";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 var {RedisClient } = globalThis.Bun;
 
 // ../../src/core/runtime/appEnv.ts
@@ -89,83 +265,429 @@ function sdkClientClassName() {
   return fromName ? `${fromName}Client` : "AppClient";
 }
 
-// ../../src/core/http/clientIp.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
-function trustForwardedFor(env = process.env) {
-  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
+// ../../src/core/http/requestMetaContext.ts
+init_asyncContextStore();
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
 }
-function isPrivateAddress(address) {
-  const ip = address.replace(/^::ffff:/i, "");
-  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+function currentRequestMeta2() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
 }
-function forwardedClientIp(request) {
-  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
-  for (let index = hops.length - 1;index >= 0; index -= 1) {
-    const hop = hops[index];
-    if (hop && !isPrivateAddress(hop)) {
-      return hop;
+
+// ../../src/core/runtime/frontendMode.ts
+var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
+var DEFAULT_SPA_PREFIX = "/app";
+var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
+function parseFrontendMode(value) {
+  const mode = (value ?? "api").trim();
+  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
+    return mode;
+  }
+  return "api";
+}
+function readFrontendMode() {
+  return parseFrontendMode(process.env.FRONTEND_MODE);
+}
+function isViewsMode(mode) {
+  return mode === "server-htmx" || mode === "hybrid";
+}
+function isSpaMode(mode) {
+  return mode === "spa-react" || mode === "hybrid";
+}
+function isViewsEnabled() {
+  return isViewsMode(readFrontendMode());
+}
+function isSpaEnabled() {
+  return isSpaMode(readFrontendMode());
+}
+function normalizeSpaPrefix(value) {
+  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  if (trimmed.length === 0 || trimmed === "/") {
+    return DEFAULT_SPA_PREFIX;
+  }
+  return trimmed;
+}
+function readSpaPrefix() {
+  return normalizeSpaPrefix(process.env.SPA_PREFIX);
+}
+
+// ../../src/core/view/webErrorView.ts
+import { currentRequestMeta as currentRequestMeta3 } from "@getstrata/core/http/requestMetaContext";
+
+// ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
     }
+  } catch {
+    return true;
   }
-  if (hops.length > 0) {
-    return hops[hops.length - 1];
+  return false;
+}
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
   }
-  return request.headers.get("x-real-ip")?.trim() || undefined;
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
 }
-function readClientIp(request, env = process.env) {
-  if (trustForwardedFor(env)) {
-    const forwarded = forwardedClientIp(request);
-    if (forwarded) {
-      return forwarded;
+function sanitizeInternalPath(raw, fallback = "/") {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
+    return fallback;
+  }
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
     }
+  });
+}
+
+// ../../src/core/view/webErrorView.ts
+var configuredErrorView = {};
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderKernelErrorChrome(input) {
+  const title = escapeHtml(input.title);
+  const message = escapeHtml(input.message);
+  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
+  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
+  const goBack = input.status === 422 ? `<p><a href="javascript:history.back()">Go back</a></p>` : "";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${title}</title>
+    <link rel="stylesheet" href="/assets/app.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">Home</a>
+    </header>
+    <main class="site-main">
+      <section class="page-header">
+        <h1>${title}</h1>
+        <p>${message}</p>
+        ${details}
+        ${goBack}
+      </section>
+    </main>
+  </body>
+</html>
+`;
+}
+async function renderWebErrorHtml(input) {
+  const render = configuredErrorView.render;
+  if (!render) {
+    return renderKernelErrorChrome(input);
   }
-  return currentRequestMeta().ipAddress ?? undefined;
+  try {
+    return await render({
+      ...input,
+      request: input.request ?? currentRequestMeta3().request
+    });
+  } catch {
+    return renderKernelErrorChrome(input);
+  }
+}
+async function htmlErrorResponse(input) {
+  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+}
+
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  return false;
+}
+
+// ../../src/core/http/throttleResponse.ts
+async function tooManyRequestsResponse(request, message, decaySeconds) {
+  const retryAfter = { "retry-after": String(decaySeconds) };
+  if (requestPrefersJson(request) || !isViewsEnabled()) {
+    return Response.json({ error: message }, {
+      status: 429,
+      headers: retryAfter
+    });
+  }
+  const html = await htmlErrorResponse({
+    status: 429,
+    title: "Too Many Requests",
+    message,
+    request
+  });
+  const headers = new Headers(html.headers);
+  headers.set("retry-after", String(decaySeconds));
+  return new Response(html.body, { status: 429, headers });
+}
+
+// ../../src/core/http/throttleMiddleware.ts
+function resolveThrottleIdentity(request) {
+  const user = currentAuthUser();
+  if (user?.tokenId !== undefined) {
+    return `token:${user.tokenId}`;
+  }
+  if (user) {
+    return `user:${user.id}`;
+  }
+  return readClientIp(request) ?? "unknown";
+}
+var CONSUME_THROTTLE = `
+local count = redis.call('INCR', KEYS[1])
+local ttl = redis.call('PTTL', KEYS[1])
+if ttl < 0 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return count
+`;
+function redisThrottleKey(request, prefix, identity, tenantId = currentTenant()?.id ?? null) {
+  const bucket = JSON.stringify([
+    tenantId,
+    request.method,
+    currentRequestMeta2().routeTemplate ?? "__unmatched__",
+    identity
+  ]);
+  return namespacedRedisKey(`${prefix}:${createHash("sha256").update(bucket).digest("hex")}`);
+}
+async function consumeRedisThrottle(client, key, decaySeconds, timeoutMs = 1000, signal) {
+  const expiryMs = Math.max(1, Math.ceil(decaySeconds * 1000));
+  if (!Number.isFinite(decaySeconds) || decaySeconds < 0 || !Number.isSafeInteger(expiryMs) || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+    throw new Error("Invalid throttle expiry or command timeout.");
+  }
+  if (signal?.aborted)
+    throw new Error("Throttle consumer is disposed.");
+  let onAbort;
+  let timer;
+  try {
+    const cancelled = new Promise((_resolve, reject) => {
+      onAbort = () => reject(new Error("Throttle consumer is disposed."));
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+    const result = await Promise.race([
+      cancelled,
+      client.send("EVAL", [CONSUME_THROTTLE, "1", key, String(expiryMs)]),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error("Throttle store deadline exceeded.")), timeoutMs);
+      })
+    ]);
+    const count = Number(result);
+    if (!Number.isSafeInteger(count) || count < 1)
+      throw new Error("Invalid throttle store response.");
+    return count;
+  } finally {
+    clearTimeout(timer);
+    if (onAbort)
+      signal?.removeEventListener("abort", onAbort);
+  }
+}
+function createRedisThrottleConsumer(options) {
+  let ownedClient;
+  const controller = new AbortController;
+  const consume = async (key, decaySeconds) => {
+    if (controller.signal.aborted)
+      throw new Error("Throttle consumer is disposed.");
+    if (!options.redisClient && !ownedClient) {
+      ownedClient = new RedisClient(options.redisUrl, { autoReconnect: false, maxRetries: 0 });
+    }
+    const client = options.redisClient ?? ownedClient;
+    if (!client)
+      throw new Error("Throttle client is required.");
+    try {
+      const attempts = await consumeRedisThrottle(client, key, decaySeconds, options.commandTimeoutMs, controller.signal);
+      if (controller.signal.aborted)
+        throw new Error("Throttle consumer is disposed.");
+      return attempts;
+    } catch (error) {
+      if (client === ownedClient) {
+        ownedClient.close();
+        ownedClient = undefined;
+      }
+      throw error;
+    }
+  };
+  return Object.assign(consume, {
+    isDisposed: () => controller.signal.aborted,
+    dispose() {
+      if (controller.signal.aborted)
+        return;
+      controller.abort();
+      const client = ownedClient;
+      ownedClient = undefined;
+      client?.close();
+    }
+  });
+}
+function throttleUnavailableResponse() {
+  return Response.json({ error: "Rate limiting is temporarily unavailable." }, {
+    status: 503,
+    headers: { "retry-after": "1" }
+  });
+}
+function resolveThrottleQuota(request, options, identity = resolveThrottleIdentity(request)) {
+  const limit = options.quotaPolicy ? options.quotaPolicy({
+    request,
+    tenant: currentTenant(),
+    identity,
+    routeTemplate: currentRequestMeta2().routeTemplate ?? "__unmatched__",
+    maxAttempts: options.maxAttempts
+  }) : options.maxAttempts;
+  if (!Number.isSafeInteger(limit) || limit < 0) {
+    throw new Error("Invalid application quota.");
+  }
+  return limit;
+}
+function createThrottleMiddleware(options) {
+  if (!Number.isSafeInteger(options.maxAttempts) || options.maxAttempts < 0) {
+    throw new Error("Throttle maxAttempts must be a non-negative safe integer.");
+  }
+  const consume = createRedisThrottleConsumer(options);
+  const prefix = options.keyPrefix ?? "throttle";
+  const middleware = async (request, next) => {
+    const identity = resolveThrottleIdentity(request);
+    let maxAttempts;
+    try {
+      maxAttempts = resolveThrottleQuota(request, options, identity);
+    } catch {
+      return throttleUnavailableResponse();
+    }
+    const key = redisThrottleKey(request, prefix, identity);
+    let attempts;
+    try {
+      attempts = await consume(key, options.decaySeconds);
+    } catch {
+      return throttleUnavailableResponse();
+    }
+    if (consume.isDisposed())
+      return throttleUnavailableResponse();
+    if (attempts > maxAttempts) {
+      return await tooManyRequestsResponse(request, "Too many requests.", options.decaySeconds);
+    }
+    return await next();
+  };
+  return Object.assign(middleware, { dispose: () => consume.dispose() });
 }
 
 // ../../src/core/http/scimThrottleMiddleware.ts
-var memoryBuckets = new Map;
 function resolveScimIdentity(request) {
   const authorization = request.headers.get("authorization") ?? "";
   const presented = authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length).trim() : "";
   if (presented.length > 0) {
-    return createHash("sha256").update(presented).digest("hex");
+    return createHash2("sha256").update(presented).digest("hex");
   }
   return readClientIp(request) ?? "unknown";
 }
-function throttleFromMemory(key, maxAttempts, decaySeconds) {
-  const now = Date.now();
-  const existing = memoryBuckets.get(key);
-  if (!existing || existing.resetAt <= now) {
-    memoryBuckets.set(key, { count: 1, resetAt: now + decaySeconds * 1000 });
-    return null;
-  }
-  existing.count += 1;
-  if (existing.count > maxAttempts) {
-    return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(decaySeconds) } });
-  }
-  return null;
-}
 function createScimThrottleMiddleware(options) {
-  const client = options.redisUrl ? new RedisClient(options.redisUrl) : null;
-  return async (request, next) => {
+  if (!Number.isSafeInteger(options.maxAttempts) || options.maxAttempts < 0)
+    throw new Error("Invalid SCIM throttle limit.");
+  const redisUrl = options.redisUrl?.trim() ?? "";
+  const distributed = Boolean(redisUrl || options.redisClient);
+  const store = distributed ? null : new BoundedThrottleStore(options.decaySeconds * 1000, options);
+  const consume = distributed ? createRedisThrottleConsumer({ ...options, redisUrl }) : null;
+  let disposed = false;
+  const middleware = async (request, next) => {
+    if (disposed)
+      return throttleUnavailableResponse();
     const identity = resolveScimIdentity(request);
-    const key = `${namespacedRedisKey("scim-throttle:")}${identity}`;
-    if (client) {
-      const attempts = Number(await client.incr(key));
-      if (attempts === 1) {
-        await client.expire(key, options.decaySeconds);
-      }
-      if (attempts > options.maxAttempts) {
-        return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
-      }
-      return await next();
-    }
-    const limited = throttleFromMemory(key, options.maxAttempts, options.decaySeconds);
-    if (limited) {
-      return limited;
+    const token = request.headers.get("authorization")?.startsWith("Bearer ") ? request.headers.get("authorization")?.slice("Bearer ".length).trim() ?? "" : "";
+    const key = redisThrottleKey(request, options.keyPrefix ?? "scim-throttle:v2", identity, resolveScimTenantFromToken(token) ?? undefined);
+    let attempts;
+    try {
+      attempts = consume ? await consume(key, options.decaySeconds) : store?.consume(key);
+    } catch {
+      return throttleUnavailableResponse();
     }
+    if (disposed)
+      return throttleUnavailableResponse();
+    if (attempts === null || attempts === undefined)
+      return throttleUnavailableResponse();
+    if (attempts > options.maxAttempts)
+      return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
     return await next();
   };
+  return Object.assign(middleware, {
+    dispose: () => {
+      if (disposed)
+        return;
+      disposed = true;
+      store?.dispose();
+      consume?.dispose();
+    },
+    stats: () => store?.stats()
+  });
 }
 export {
-  createScimThrottleMiddleware
+  createScimThrottleMiddleware,
+  resolveScimIdentity
 };