@meridianjs/framework 0.1.9 → 0.1.12

package/dist/index.d.ts

@@ -173,8 +173,20 @@ declare class ConsoleLogger implements ILogger {
 
 declare function createServer(container: MeridianContainer, config: MeridianConfig): Express;
 
-/** Strict limiter for auth endpoints: 10 requests per minute per IP. */
+/**
+ * Strict limiter for password-based auth endpoints (login, register).
+ * 10 requests per minute per IP — guards against brute-force attacks.
+ */
 declare const authRateLimit: express_rate_limit.RateLimitRequestHandler;
+/**
+ * Loose limiter for OAuth redirect/callback endpoints.
+ * 30 requests per minute per IP — a complete OAuth flow (initiate → callback →
+ * exchange) consumes 3 requests, so 30/min allows ~10 flows per minute.
+ * OAuth routes are not brute-forceable at the application level because they
+ * require a real interaction with the external identity provider and a
+ * cryptographic CSRF nonce.
+ */
+declare const oauthRateLimit: express_rate_limit.RateLimitRequestHandler;
 /** General API limiter: 300 requests per minute per IP. */
 declare const apiRateLimit: express_rate_limit.RateLimitRequestHandler;
 
@@ -211,4 +223,4 @@ declare class SseManager {
 /** Singleton shared across all routes and subscribers. */
 declare const sseManager: SseManager;
 
-export { type BootstrapOptions, ConsoleLogger, type MeridianApp, type MiddlewareRoute, type MiddlewaresConfig, SseManager, apiRateLimit, authRateLimit, bootstrap, createMeridianContainer, createServer, defineConfig, defineMiddlewares, loadConfig, loadJobs, loadLinks, loadModules, loadPlugins, loadRoutes, loadSubscribers, resolveModuleDefinition, sseManager, validate };
+export { type BootstrapOptions, ConsoleLogger, type MeridianApp, type MiddlewareRoute, type MiddlewaresConfig, SseManager, apiRateLimit, authRateLimit, bootstrap, createMeridianContainer, createServer, defineConfig, defineMiddlewares, loadConfig, loadJobs, loadLinks, loadModules, loadPlugins, loadRoutes, loadSubscribers, oauthRateLimit, resolveModuleDefinition, sseManager, validate };

package/dist/index.js

@@ -510,6 +510,7 @@ function resolveNpmPackageRoot(packageName, fromDir) {
 
 // src/server.ts
 import express from "express";
+import cookieParser from "cookie-parser";
 import cors from "cors";
 import helmet from "helmet";
 function createServer(container, config) {
@@ -518,6 +519,7 @@ function createServer(container, config) {
   const logger = container.resolve("logger");
   app.use(express.json({ limit: "10mb" }));
   app.use(express.urlencoded({ extended: true, limit: "10mb" }));
+  app.use(cookieParser());
   app.use(helmet({
     contentSecurityPolicy: {
       directives: {
@@ -728,6 +730,11 @@ var authRateLimit = rateLimit({
   max: 10,
   ...sharedOpts
 });
+var oauthRateLimit = rateLimit({
+  windowMs: 6e4,
+  max: 30,
+  ...sharedOpts
+});
 var apiRateLimit = rateLimit({
   windowMs: 6e4,
   max: 300,
@@ -818,6 +825,7 @@ export {
   loadPlugins,
   loadRoutes,
   loadSubscribers,
+  oauthRateLimit,
   resolveModuleDefinition,
   sseManager,
   validate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridianjs/framework",
-  "version": "0.1.9",
+  "version": "0.1.12",
   "description": "Core Meridian framework: bootstrap, DI container, module/route/subscriber/job loaders",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -26,6 +26,7 @@
     "@meridianjs/framework-utils": "^0.1.0",
     "@meridianjs/types": "^0.1.0",
     "awilix": "^12.0.5",
+    "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
     "express": "^4.21.2",
     "express-rate-limit": "^7.5.0",
@@ -33,6 +34,7 @@
     "zod": "^3.24.0"
   },
   "devDependencies": {
+    "@types/cookie-parser": "^1.4.8",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.0",
     "tsup": "^8.3.5",