@medi-car-bd/mcb-shared-auth 0.0.18 → 0.0.19

package/dist/utils/authProxy.js

@@ -46,6 +46,10 @@ const authProxy = (authServiceUrl, options = {}) => {
             if (typeof value === "string")
                 headers[name] = value;
         }
+        // The real caller, so the auth service's per-IP limit does not count every
+        // user of this service as one client.
+        if (req.ip)
+            headers["x-forwarded-for"] = req.ip;
         let upstream;
         let text;
         try {

package/dist/utils/limiter.d.ts

@@ -1 +1,22 @@
+import "../config";
+/**
+ * Per-caller request limit for a service. It counts each client address, so a
+ * service behind the gateway must also trust the gateway (see
+ * trustProxySetting), or every user counts as one caller.
+ *
+ * RATE_LIMIT_MAX and RATE_LIMIT_WINDOW_MS override the defaults. The default
+ * matches the gateway's per-service limit: field apps on mobile networks share
+ * addresses, so a low ceiling throttles real users rather than attackers.
+ */
 export declare const limiter: import("express-rate-limit").RateLimitRequestHandler;
+/**
+ * The value for Express's "trust proxy": which directly connected addresses may
+ * state the real client through X-Forwarded-For. By default that is this
+ * machine and private networks, where the gateway and the other services run.
+ * A caller connecting from a public address is not trusted, so it cannot fake
+ * its address with that header.
+ *
+ * TRUST_PROXY overrides it: a number of hops, "true", "false", or a
+ * comma-separated list of addresses or names such as "loopback, uniquelocal".
+ */
+export declare const trustProxySetting: (raw?: string | undefined) => string | number | boolean;

package/dist/utils/limiter.js

@@ -3,10 +3,52 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.limiter = void 0;
+exports.trustProxySetting = exports.limiter = void 0;
 const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+require("../config");
+const DEFAULT_MAX = 600;
+const DEFAULT_WINDOW_MS = 15 * 60 * 1000;
+const positive = (raw, fallback) => {
+    const value = Number(raw);
+    return raw && Number.isFinite(value) && value > 0 ? value : fallback;
+};
+/**
+ * Per-caller request limit for a service. It counts each client address, so a
+ * service behind the gateway must also trust the gateway (see
+ * trustProxySetting), or every user counts as one caller.
+ *
+ * RATE_LIMIT_MAX and RATE_LIMIT_WINDOW_MS override the defaults. The default
+ * matches the gateway's per-service limit: field apps on mobile networks share
+ * addresses, so a low ceiling throttles real users rather than attackers.
+ */
 exports.limiter = (0, express_rate_limit_1.default)({
-    max: 100, // 100 requests
-    windowMs: 15 * 60 * 1000, // 15 minutes
-    message: "Too many requests from this IP, please try again in an hour!", // message to send
+    max: positive(process.env.RATE_LIMIT_MAX, DEFAULT_MAX),
+    windowMs: positive(process.env.RATE_LIMIT_WINDOW_MS, DEFAULT_WINDOW_MS),
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: {
+        state: "fail",
+        message: "Too many requests, please try again later.",
+    },
 });
+/**
+ * The value for Express's "trust proxy": which directly connected addresses may
+ * state the real client through X-Forwarded-For. By default that is this
+ * machine and private networks, where the gateway and the other services run.
+ * A caller connecting from a public address is not trusted, so it cannot fake
+ * its address with that header.
+ *
+ * TRUST_PROXY overrides it: a number of hops, "true", "false", or a
+ * comma-separated list of addresses or names such as "loopback, uniquelocal".
+ */
+const trustProxySetting = (raw = process.env.TRUST_PROXY) => {
+    const value = raw === null || raw === void 0 ? void 0 : raw.trim();
+    if (!value)
+        return "loopback, uniquelocal";
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    return /^\d+$/.test(value) ? Number(value) : value;
+};
+exports.trustProxySetting = trustProxySetting;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@medi-car-bd/mcb-shared-auth",
-  "version": "0.0.18",
+  "version": "0.0.19",
   "description": "Shared authentication module for MCB applications",
   "packageManager": "pnpm@10.18.0",
   "main": "dist/index.js",