@johpaz/hive-core 1.0.7 → 1.0.10

package/src/security/rate-limit.test.ts

@@ -0,0 +1,239 @@
+import { describe, it, expect, beforeEach } from "bun:test";
+import { TokenBucketRateLimiter, SlidingWindowRateLimiter } from "./rate-limit.ts";
+
+describe("TokenBucketRateLimiter", () => {
+  let limiter: TokenBucketRateLimiter;
+
+  beforeEach(() => {
+    limiter = new TokenBucketRateLimiter({
+      maxTokens: 10,
+      refillRate: 2,
+      refillIntervalMs: 1000,
+    });
+  });
+
+  describe("canProceed", () => {
+    it("should allow requests when tokens available", () => {
+      const result = limiter.canProceed("user1");
+
+      expect(result.allowed).toBe(true);
+      expect(result.remaining).toBe(9);
+      expect(result.retryAfterMs).toBe(0);
+    });
+
+    it("should deny requests when bucket empty", () => {
+      for (let i = 0; i < 10; i++) {
+        limiter.canProceed("user1");
+      }
+
+      const result = limiter.canProceed("user1");
+
+      expect(result.allowed).toBe(false);
+      expect(result.remaining).toBe(0);
+      expect(result.retryAfterMs).toBeGreaterThan(0);
+    });
+
+    it("should track separate buckets per key", () => {
+      for (let i = 0; i < 10; i++) {
+        limiter.canProceed("user1");
+      }
+
+      expect(limiter.canProceed("user1").allowed).toBe(false);
+      expect(limiter.canProceed("user2").allowed).toBe(true);
+    });
+
+    it("should refill tokens over time", async () => {
+      for (let i = 0; i < 10; i++) {
+        limiter.canProceed("user1");
+      }
+
+      expect(limiter.canProceed("user1").allowed).toBe(false);
+
+      await new Promise((r) => setTimeout(r, 1500));
+
+      const result = limiter.canProceed("user1");
+      expect(result.allowed).toBe(true);
+      expect(result.remaining).toBeGreaterThanOrEqual(1);
+    });
+  });
+
+  describe("consume", () => {
+    it("should consume multiple tokens", () => {
+      const result = limiter.consume("user1", 5);
+
+      expect(result.allowed).toBe(true);
+      expect(result.remaining).toBe(5);
+    });
+
+    it("should deny if not enough tokens", () => {
+      limiter.consume("user1", 8);
+
+      const result = limiter.consume("user1", 5);
+
+      expect(result.allowed).toBe(false);
+    });
+  });
+
+  describe("peek", () => {
+    it("should return available tokens without consuming", () => {
+      limiter.canProceed("user1");
+      limiter.canProceed("user1");
+
+      const tokens = limiter.peek("user1");
+
+      expect(tokens).toBe(8);
+    });
+
+    it("should return max tokens for unknown key", () => {
+      expect(limiter.peek("unknown")).toBe(10);
+    });
+  });
+
+  describe("refill", () => {
+    it("should refill tokens", () => {
+      for (let i = 0; i < 10; i++) {
+        limiter.canProceed("user1");
+      }
+
+      limiter.refill("user1", 5);
+
+      expect(limiter.peek("user1")).toBe(5);
+    });
+
+    it("should not exceed max tokens", () => {
+      limiter.refill("user1", 100);
+
+      expect(limiter.peek("user1")).toBe(10);
+    });
+  });
+
+  describe("reset", () => {
+    it("should reset specific key", () => {
+      for (let i = 0; i < 5; i++) {
+        limiter.canProceed("user1");
+      }
+      for (let i = 0; i < 3; i++) {
+        limiter.canProceed("user2");
+      }
+
+      limiter.reset("user1");
+
+      expect(limiter.peek("user1")).toBe(10);
+      expect(limiter.peek("user2")).toBeCloseTo(7, 0);
+    });
+  });
+
+  describe("resetAll", () => {
+    it("should reset all buckets", () => {
+      for (let i = 0; i < 5; i++) {
+        limiter.canProceed("user1");
+        limiter.canProceed("user2");
+      }
+
+      limiter.resetAll();
+
+      expect(limiter.peek("user1")).toBe(10);
+      expect(limiter.peek("user2")).toBe(10);
+    });
+  });
+
+  describe("getStats", () => {
+    it("should return correct stats", () => {
+      limiter.canProceed("user1");
+      limiter.canProceed("user1");
+      limiter.canProceed("user2");
+
+      const stats = limiter.getStats();
+
+      expect(stats.totalBuckets).toBe(2);
+      expect(stats.activeBuckets).toBe(2);
+    });
+  });
+});
+
+describe("SlidingWindowRateLimiter", () => {
+  let limiter: SlidingWindowRateLimiter;
+
+  beforeEach(() => {
+    limiter = new SlidingWindowRateLimiter({
+      windowMs: 1000,
+      maxRequests: 5,
+    });
+  });
+
+  describe("check", () => {
+    it("should allow requests within limit", () => {
+      for (let i = 0; i < 5; i++) {
+        const result = limiter.check("user1");
+        expect(result.allowed).toBe(true);
+      }
+    });
+
+    it("should deny requests over limit", () => {
+      for (let i = 0; i < 5; i++) {
+        limiter.check("user1");
+      }
+
+      const result = limiter.check("user1");
+
+      expect(result.allowed).toBe(false);
+      expect(result.retryAfterMs).toBeGreaterThan(0);
+    });
+
+    it("should allow after window expires", async () => {
+      for (let i = 0; i < 5; i++) {
+        limiter.check("user1");
+      }
+
+      expect(limiter.check("user1").allowed).toBe(false);
+
+      await new Promise((r) => setTimeout(r, 1100));
+
+      expect(limiter.check("user1").allowed).toBe(true);
+    });
+
+    it("should track remaining count", () => {
+      limiter.check("user1");
+      limiter.check("user1");
+
+      const result = limiter.check("user1");
+
+      expect(result.remaining).toBe(2);
+    });
+
+    it("should track separate windows per key", () => {
+      for (let i = 0; i < 5; i++) {
+        limiter.check("user1");
+      }
+
+      expect(limiter.check("user1").allowed).toBe(false);
+      expect(limiter.check("user2").allowed).toBe(true);
+    });
+  });
+
+  describe("reset", () => {
+    it("should reset specific key", () => {
+      for (let i = 0; i < 5; i++) {
+        limiter.check("user1");
+      }
+
+      limiter.reset("user1");
+
+      expect(limiter.check("user1").allowed).toBe(true);
+    });
+  });
+
+  describe("resetAll", () => {
+    it("should reset all windows", () => {
+      for (let i = 0; i < 5; i++) {
+        limiter.check("user1");
+        limiter.check("user2");
+      }
+
+      limiter.resetAll();
+
+      expect(limiter.check("user1").allowed).toBe(true);
+      expect(limiter.check("user2").allowed).toBe(true);
+    });
+  });
+});

package/src/security/rate-limit.ts

@@ -0,0 +1,270 @@
+import { logger } from "../utils/logger.ts";
+
+export interface TokenBucketConfig {
+  maxTokens: number;
+  refillRate: number;
+  refillIntervalMs?: number;
+}
+
+export interface TokenBucket {
+  tokens: number;
+  lastUpdate: number;
+}
+
+export interface RateLimitResult {
+  allowed: boolean;
+  remaining: number;
+  retryAfterMs: number;
+}
+
+export interface TokenBucketStats {
+  totalBuckets: number;
+  activeBuckets: number;
+  totalTokensAvailable: number;
+}
+
+export class TokenBucketRateLimiter {
+  private buckets: Map<string, TokenBucket> = new Map();
+  private config: Required<TokenBucketConfig>;
+  private log = logger.child("token-bucket-limiter");
+
+  constructor(config: TokenBucketConfig) {
+    this.config = {
+      maxTokens: config.maxTokens,
+      refillRate: config.refillRate,
+      refillIntervalMs: config.refillIntervalMs ?? 1000,
+    };
+
+    this.startCleanup();
+  }
+
+  canProceed(key: string): RateLimitResult {
+    const now = Date.now();
+    let bucket = this.buckets.get(key);
+
+    if (!bucket) {
+      bucket = {
+        tokens: this.config.maxTokens,
+        lastUpdate: now,
+      };
+      this.buckets.set(key, bucket);
+    }
+
+    const elapsed = now - bucket.lastUpdate;
+    const tokensToAdd = (elapsed / this.config.refillIntervalMs) * this.config.refillRate;
+    bucket.tokens = Math.min(this.config.maxTokens, bucket.tokens + tokensToAdd);
+    bucket.lastUpdate = now;
+
+    if (bucket.tokens >= 1) {
+      bucket.tokens--;
+      return {
+        allowed: true,
+        remaining: Math.floor(bucket.tokens),
+        retryAfterMs: 0,
+      };
+    }
+
+    const retryAfterMs = Math.ceil(
+      ((1 - bucket.tokens) / this.config.refillRate) * this.config.refillIntervalMs
+    );
+
+    this.log.debug(`Rate limit hit for ${key}, retry after ${retryAfterMs}ms`);
+
+    return {
+      allowed: false,
+      remaining: 0,
+      retryAfterMs,
+    };
+  }
+
+  consume(key: string, tokens: number = 1): RateLimitResult {
+    const now = Date.now();
+    let bucket = this.buckets.get(key);
+
+    if (!bucket) {
+      bucket = {
+        tokens: this.config.maxTokens,
+        lastUpdate: now,
+      };
+      this.buckets.set(key, bucket);
+    }
+
+    const elapsed = now - bucket.lastUpdate;
+    const tokensToAdd = (elapsed / this.config.refillIntervalMs) * this.config.refillRate;
+    bucket.tokens = Math.min(this.config.maxTokens, bucket.tokens + tokensToAdd);
+    bucket.lastUpdate = now;
+
+    if (bucket.tokens >= tokens) {
+      bucket.tokens -= tokens;
+      return {
+        allowed: true,
+        remaining: Math.floor(bucket.tokens),
+        retryAfterMs: 0,
+      };
+    }
+
+    const retryAfterMs = Math.ceil(
+      ((tokens - bucket.tokens) / this.config.refillRate) * this.config.refillIntervalMs
+    );
+
+    return {
+      allowed: false,
+      remaining: 0,
+      retryAfterMs,
+    };
+  }
+
+  peek(key: string): number {
+    const bucket = this.buckets.get(key);
+    if (!bucket) return this.config.maxTokens;
+
+    const now = Date.now();
+    const elapsed = now - bucket.lastUpdate;
+    const tokensToAdd = (elapsed / this.config.refillIntervalMs) * this.config.refillRate;
+
+    return Math.min(this.config.maxTokens, bucket.tokens + tokensToAdd);
+  }
+
+  refill(key: string, tokens?: number): void {
+    const bucket = this.buckets.get(key);
+    if (!bucket) return;
+
+    bucket.tokens = Math.min(
+      this.config.maxTokens,
+      bucket.tokens + (tokens ?? this.config.maxTokens)
+    );
+  }
+
+  reset(key: string): void {
+    this.buckets.delete(key);
+  }
+
+  resetAll(): void {
+    this.buckets.clear();
+    this.log.info("All rate limit buckets cleared");
+  }
+
+  getStats(): TokenBucketStats {
+    let totalTokens = 0;
+    let activeBuckets = 0;
+    const now = Date.now();
+
+    for (const bucket of this.buckets.values()) {
+      const elapsed = now - bucket.lastUpdate;
+      const tokens = Math.min(
+        this.config.maxTokens,
+        bucket.tokens + (elapsed / this.config.refillIntervalMs) * this.config.refillRate
+      );
+
+      if (tokens < this.config.maxTokens) {
+        activeBuckets++;
+      }
+      totalTokens += tokens;
+    }
+
+    return {
+      totalBuckets: this.buckets.size,
+      activeBuckets,
+      totalTokensAvailable: Math.floor(totalTokens),
+    };
+  }
+
+  private startCleanup(): void {
+    setInterval(() => {
+      const now = Date.now();
+      for (const [key, bucket] of this.buckets) {
+        const elapsed = now - bucket.lastUpdate;
+        const fullTokens =
+          bucket.tokens + (elapsed / this.config.refillIntervalMs) * this.config.refillRate;
+
+        if (fullTokens >= this.config.maxTokens) {
+          this.buckets.delete(key);
+        }
+      }
+    }, 5 * 60 * 1000);
+  }
+}
+
+export interface SlidingWindowConfig {
+  windowMs: number;
+  maxRequests: number;
+}
+
+export interface SlidingWindowEntry {
+  timestamps: number[];
+}
+
+export class SlidingWindowRateLimiter {
+  private windows: Map<string, SlidingWindowEntry> = new Map();
+  private config: SlidingWindowConfig;
+  private log = logger.child("sliding-window-limiter");
+
+  constructor(config: SlidingWindowConfig) {
+    this.config = config;
+    this.startCleanup();
+  }
+
+  check(key: string): RateLimitResult {
+    const now = Date.now();
+    const windowStart = now - this.config.windowMs;
+
+    let entry = this.windows.get(key);
+    if (!entry) {
+      entry = { timestamps: [] };
+      this.windows.set(key, entry);
+    }
+
+    entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+
+    if (entry.timestamps.length >= this.config.maxRequests) {
+      const oldestInWindow = entry.timestamps[0];
+      const retryAfterMs = oldestInWindow + this.config.windowMs - now;
+
+      this.log.debug(`Sliding window limit hit for ${key}`);
+
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfterMs: Math.max(0, retryAfterMs),
+      };
+    }
+
+    entry.timestamps.push(now);
+
+    return {
+      allowed: true,
+      remaining: this.config.maxRequests - entry.timestamps.length,
+      retryAfterMs: 0,
+    };
+  }
+
+  reset(key: string): void {
+    this.windows.delete(key);
+  }
+
+  resetAll(): void {
+    this.windows.clear();
+  }
+
+  private startCleanup(): void {
+    setInterval(() => {
+      const now = Date.now();
+      const windowStart = now - this.config.windowMs;
+
+      for (const [key, entry] of this.windows) {
+        entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+        if (entry.timestamps.length === 0) {
+          this.windows.delete(key);
+        }
+      }
+    }, 60 * 1000);
+  }
+}
+
+export function createTokenBucketLimiter(config: TokenBucketConfig): TokenBucketRateLimiter {
+  return new TokenBucketRateLimiter(config);
+}
+
+export function createSlidingWindowLimiter(config: SlidingWindowConfig): SlidingWindowRateLimiter {
+  return new SlidingWindowRateLimiter(config);
+}

package/src/security/signal.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect, beforeEach, vi, afterEach } from "bun:test";
+import { SignalChannel, type SignalConfig } from "./signal.ts";
+import { pairingService } from "./pairing.ts";
+import { eventBus } from "../events/event-bus.ts";
+
+describe("SignalChannel", () => {
+  let channel: SignalChannel;
+  const config: SignalConfig = {
+    phoneNumber: "+1234567890",
+    enabled: true,
+    dmPolicy: "pairing",
+    allowFrom: [],
+  };
+
+  beforeEach(() => {
+    channel = new SignalChannel("default", config);
+    pairingService.clear();
+    eventBus.removeAllListeners();
+  });
+
+  afterEach(() => {
+    channel.stop?.();
+  });
+
+  describe("constructor", () => {
+    it("should set default dmPolicy to pairing", () => {
+      const ch = new SignalChannel("default", {
+        phoneNumber: "+123",
+        enabled: true,
+      } as SignalConfig);
+      expect(ch.config.dmPolicy).toBe("pairing");
+    });
+  });
+
+  describe("parseSignalMessage", () => {
+    it("should parse valid JSON message", () => {
+      const raw = JSON.stringify({
+        envelope: {
+          source: "+1234567890",
+          sourceName: "Test User",
+          timestamp: 1234567890000,
+          dataMessage: {
+            message: "Hello World",
+          },
+        },
+      });
+
+      const result = JSON.parse(raw);
+
+      expect(result.envelope.source).toBe("+1234567890");
+      expect(result.envelope.dataMessage.message).toBe("Hello World");
+    });
+
+    it("should ignore non-JSON output", () => {
+      expect(() => JSON.parse("Some random output")).toThrow();
+    });
+  });
+
+  describe("chunkMessage", () => {
+    it("should split long messages", () => {
+      const chunkMessage = (channel as unknown as { chunkMessage: (s: string, n: number) => string[] })
+        .chunkMessage;
+
+      const longMessage = "A".repeat(3000);
+      const chunks = chunkMessage.call(channel, longMessage, 2000);
+
+      expect(chunks.length).toBe(2);
+      expect(chunks[0]!.length).toBeLessThanOrEqual(2000);
+    });
+
+    it("should prefer splitting at newlines", () => {
+      const chunkMessage = (channel as unknown as { chunkMessage: (s: string, n: number) => string[] })
+        .chunkMessage;
+
+      const message = "Line 1\n\nLine 2\n\nLine 3";
+      const chunks = chunkMessage.call(channel, message, 10);
+
+      expect(chunks.length).toBeGreaterThan(1);
+    });
+  });
+
+  describe("extractPhoneFromSession", () => {
+    it("should extract phone from session ID", () => {
+      const extract = (channel as unknown as { extractPhoneFromSession: (s: string) => string | undefined })
+        .extractPhoneFromSession;
+
+      const phone = extract.call(channel, "agent:main:signal:direct:+1234567890");
+
+      expect(phone).toBe("+1234567890");
+    });
+  });
+});