@mars-stack/core 8.0.7 → 8.0.8

package/cursor/rules/mars-security.mdc

@@ -9,7 +9,7 @@ alwaysApply: true
 - Every API route under `src/app/api/protected/` MUST use `withAuth`, `withAuthNoParams`, `withRole`, or `withOwnership` from `@/lib/mars`.
 - Admin-only routes MUST use `withRole(['admin'], ...)` which verifies the role against the database on every request. Never trust the JWT role claim alone.
 - Ownership-gated routes MUST use `withOwnership`. Never accept a `userId` parameter from the client for authorization.
-- Public auth endpoints (`login`, `signup`, `forgot`, `reset`, `verify`) MUST call `checkRateLimit` with the appropriate `RATE_LIMITS` config from `@mars-stack/core/rate-limit`.
+- Public auth endpoints (`login`, `signup`, `forgot`, `reset`, `verify`, `me`, `logout`) MUST call `checkRateLimit` with the appropriate `RATE_LIMITS` config from `@mars-stack/core/rate-limit`.
 
 ## Secrets
 

package/dist/rate-limit/index.d.ts

@@ -79,6 +79,20 @@ export declare const RATE_LIMITS: {
         readonly identifier: "email-verification";
         readonly sliding: true;
     };
+    /** Session introspection — unauthenticated callers can probe; cap per IP. */
+    readonly sessionMe: {
+        readonly limit: 60;
+        readonly windowSeconds: 60;
+        readonly identifier: "auth-session-me";
+        readonly sliding: true;
+    };
+    /** Logout revokes sessions — rate limit to reduce abuse / DoS. */
+    readonly logout: {
+        readonly limit: 20;
+        readonly windowSeconds: 60;
+        readonly identifier: "auth-logout";
+        readonly sliding: true;
+    };
     readonly api: {
         readonly limit: 60;
         readonly windowSeconds: 60;

package/dist/rate-limit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkC3C,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAqED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC,CAuC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAYR;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAa/D;AAED,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsBd,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkC3C,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAqED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC,CAuC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAYR;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAa/D;AAED,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAqBtB,6EAA6E;;;;;;;IAO7E,kEAAkE;;;;;;;;;;;;CAQ1D,CAAC"}

package/dist/rate-limit/index.js

@@ -160,6 +160,20 @@ var RATE_LIMITS = {
     identifier: "email-verification",
     sliding: true
   },
+  /** Session introspection — unauthenticated callers can probe; cap per IP. */
+  sessionMe: {
+    limit: 60,
+    windowSeconds: 60,
+    identifier: "auth-session-me",
+    sliding: true
+  },
+  /** Logout revokes sessions — rate limit to reduce abuse / DoS. */
+  logout: {
+    limit: 20,
+    windowSeconds: 60,
+    identifier: "auth-logout",
+    sliding: true
+  },
   api: { limit: 60, windowSeconds: 60, identifier: "api" }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mars-stack/core",
-  "version": "8.0.7",
+  "version": "8.0.8",
   "license": "MIT",
   "repository": {
     "type": "git",