@meridianjs/framework 0.1.11 → 0.1.12

package/dist/index.d.ts

@@ -173,8 +173,20 @@ declare class ConsoleLogger implements ILogger {
 
 declare function createServer(container: MeridianContainer, config: MeridianConfig): Express;
 
-/** Strict limiter for auth endpoints: 10 requests per minute per IP. */
+/**
+ * Strict limiter for password-based auth endpoints (login, register).
+ * 10 requests per minute per IP — guards against brute-force attacks.
+ */
 declare const authRateLimit: express_rate_limit.RateLimitRequestHandler;
+/**
+ * Loose limiter for OAuth redirect/callback endpoints.
+ * 30 requests per minute per IP — a complete OAuth flow (initiate → callback →
+ * exchange) consumes 3 requests, so 30/min allows ~10 flows per minute.
+ * OAuth routes are not brute-forceable at the application level because they
+ * require a real interaction with the external identity provider and a
+ * cryptographic CSRF nonce.
+ */
+declare const oauthRateLimit: express_rate_limit.RateLimitRequestHandler;
 /** General API limiter: 300 requests per minute per IP. */
 declare const apiRateLimit: express_rate_limit.RateLimitRequestHandler;
 
@@ -211,4 +223,4 @@ declare class SseManager {
 /** Singleton shared across all routes and subscribers. */
 declare const sseManager: SseManager;
 
-export { type BootstrapOptions, ConsoleLogger, type MeridianApp, type MiddlewareRoute, type MiddlewaresConfig, SseManager, apiRateLimit, authRateLimit, bootstrap, createMeridianContainer, createServer, defineConfig, defineMiddlewares, loadConfig, loadJobs, loadLinks, loadModules, loadPlugins, loadRoutes, loadSubscribers, resolveModuleDefinition, sseManager, validate };
+export { type BootstrapOptions, ConsoleLogger, type MeridianApp, type MiddlewareRoute, type MiddlewaresConfig, SseManager, apiRateLimit, authRateLimit, bootstrap, createMeridianContainer, createServer, defineConfig, defineMiddlewares, loadConfig, loadJobs, loadLinks, loadModules, loadPlugins, loadRoutes, loadSubscribers, oauthRateLimit, resolveModuleDefinition, sseManager, validate };

package/dist/index.js

@@ -730,6 +730,11 @@ var authRateLimit = rateLimit({
   max: 10,
   ...sharedOpts
 });
+var oauthRateLimit = rateLimit({
+  windowMs: 6e4,
+  max: 30,
+  ...sharedOpts
+});
 var apiRateLimit = rateLimit({
   windowMs: 6e4,
   max: 300,
@@ -820,6 +825,7 @@ export {
   loadPlugins,
   loadRoutes,
   loadSubscribers,
+  oauthRateLimit,
   resolveModuleDefinition,
   sseManager,
   validate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridianjs/framework",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Core Meridian framework: bootstrap, DI container, module/route/subscriber/job loaders",
   "main": "./dist/index.js",
   "module": "./dist/index.js",