@open-mercato/shared 0.6.7-develop.6606.1.3b1ec9b1ea → 0.6.7-develop.6621.1.cdbe9dee3d

package/dist/lib/ratelimit/config.js

@@ -1,11 +1,13 @@
 import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
+import { createLogger } from "@open-mercato/shared/lib/logger";
 const VALID_STRATEGIES = ["memory", "redis"];
+const logger = createLogger("ratelimit").child({ component: "config" });
 function readRateLimitConfig() {
   const strategy = process.env.RATE_LIMIT_STRATEGY ?? "memory";
   if (!VALID_STRATEGIES.includes(strategy)) {
     throw new Error(`Invalid RATE_LIMIT_STRATEGY "${strategy}". Must be one of: ${VALID_STRATEGIES.join(", ")}`);
   }
-  const trustProxyDepth = parsePositiveInt(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH) ?? 1;
+  const trustProxyDepth = parseTrustProxyDepth(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH);
   const integrationTest = parseBooleanWithDefault(process.env.OM_INTEGRATION_TEST, false);
   const enabled = integrationTest ? false : parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true);
   return {
@@ -29,6 +31,13 @@ function parsePositiveInt(raw) {
   const parsed = Number(raw);
   return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
 }
+function parseTrustProxyDepth(raw) {
+  if (raw === void 0 || raw.trim() === "") return 0;
+  const parsed = Number(raw);
+  if (Number.isInteger(parsed) && parsed >= 0) return parsed;
+  logger.warn("Invalid RATE_LIMIT_TRUST_PROXY_DEPTH; using safe direct mode", { value: raw });
+  return 0;
+}
 export {
   readEndpointRateLimitConfig,
   readRateLimitConfig

package/dist/lib/ratelimit/config.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/ratelimit/config.ts"],
-  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport type { RateLimitConfig, RateLimitGlobalConfig, RateLimitStrategy } from './types'\n\nconst VALID_STRATEGIES: RateLimitStrategy[] = ['memory', 'redis']\n\nexport function readRateLimitConfig(): RateLimitGlobalConfig {\n  const strategy = (process.env.RATE_LIMIT_STRATEGY ?? 'memory') as RateLimitStrategy\n  if (!VALID_STRATEGIES.includes(strategy)) {\n    throw new Error(`Invalid RATE_LIMIT_STRATEGY \"${strategy}\". Must be one of: ${VALID_STRATEGIES.join(', ')}`)\n  }\n\n  const trustProxyDepth = parsePositiveInt(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH) ?? 1\n\n  // Integration test runs disable rate limiting globally so suites do not\n  // have to juggle per-endpoint bypass headers or reshape default caps.\n  // The targeted OM_TEST_MODE + OM_TEST_AUTH_RATE_LIMIT_MODE=opt-in escape\n  // hatch (checkAuthRateLimit) still works for suites that explicitly test\n  // rate-limit behavior.\n  const integrationTest = parseBooleanWithDefault(process.env.OM_INTEGRATION_TEST, false)\n  const enabled = integrationTest\n    ? false\n    : parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true)\n\n  return {\n    enabled,\n    strategy,\n    keyPrefix: process.env.RATE_LIMIT_KEY_PREFIX ?? 'rl',\n    redisUrl: process.env.REDIS_URL,\n    trustProxyDepth,\n  }\n}\n\n/**\n * Read per-endpoint rate limit config from environment variables with hardcoded defaults.\n * Environment variable names follow the pattern: RATE_LIMIT_{PREFIX}_POINTS, RATE_LIMIT_{PREFIX}_DURATION, etc.\n */\nexport function readEndpointRateLimitConfig(\n  envPrefix: string,\n  defaults: { points: number; duration: number; blockDuration?: number; keyPrefix: string },\n): RateLimitConfig {\n  return {\n    points: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_POINTS`]) ?? defaults.points,\n    duration: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_DURATION`]) ?? defaults.duration,\n    blockDuration: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_BLOCK_DURATION`]) ?? defaults.blockDuration,\n    keyPrefix: defaults.keyPrefix,\n  }\n}\n\nfunction parsePositiveInt(raw: string | undefined): number | undefined {\n  if (raw === undefined || raw === '') return undefined\n  const parsed = Number(raw)\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined\n}\n"],
-  "mappings": "AAAA,SAAS,+BAA+B;AAGxC,MAAM,mBAAwC,CAAC,UAAU,OAAO;AAEzD,SAAS,sBAA6C;AAC3D,QAAM,WAAY,QAAQ,IAAI,uBAAuB;AACrD,MAAI,CAAC,iBAAiB,SAAS,QAAQ,GAAG;AACxC,UAAM,IAAI,MAAM,gCAAgC,QAAQ,sBAAsB,iBAAiB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7G;AAEA,QAAM,kBAAkB,iBAAiB,QAAQ,IAAI,4BAA4B,KAAK;AAOtF,QAAM,kBAAkB,wBAAwB,QAAQ,IAAI,qBAAqB,KAAK;AACtF,QAAM,UAAU,kBACZ,QACA,wBAAwB,QAAQ,IAAI,oBAAoB,IAAI;AAEhE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,QAAQ,IAAI,yBAAyB;AAAA,IAChD,UAAU,QAAQ,IAAI;AAAA,IACtB;AAAA,EACF;AACF;AAMO,SAAS,4BACd,WACA,UACiB;AACjB,SAAO;AAAA,IACL,QAAQ,iBAAiB,QAAQ,IAAI,cAAc,SAAS,SAAS,CAAC,KAAK,SAAS;AAAA,IACpF,UAAU,iBAAiB,QAAQ,IAAI,cAAc,SAAS,WAAW,CAAC,KAAK,SAAS;AAAA,IACxF,eAAe,iBAAiB,QAAQ,IAAI,cAAc,SAAS,iBAAiB,CAAC,KAAK,SAAS;AAAA,IACnG,WAAW,SAAS;AAAA,EACtB;AACF;AAEA,SAAS,iBAAiB,KAA6C;AACrE,MAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAC5C,QAAM,SAAS,OAAO,GAAG;AACzB,SAAO,OAAO,SAAS,MAAM,KAAK,UAAU,IAAI,SAAS;AAC3D;",
+  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { RateLimitConfig, RateLimitGlobalConfig, RateLimitStrategy } from './types'\n\nconst VALID_STRATEGIES: RateLimitStrategy[] = ['memory', 'redis']\nconst logger = createLogger('ratelimit').child({ component: 'config' })\n\nexport function readRateLimitConfig(): RateLimitGlobalConfig {\n  const strategy = (process.env.RATE_LIMIT_STRATEGY ?? 'memory') as RateLimitStrategy\n  if (!VALID_STRATEGIES.includes(strategy)) {\n    throw new Error(`Invalid RATE_LIMIT_STRATEGY \"${strategy}\". Must be one of: ${VALID_STRATEGIES.join(', ')}`)\n  }\n\n  const trustProxyDepth = parseTrustProxyDepth(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH)\n\n  // Integration test runs disable rate limiting globally so suites do not\n  // have to juggle per-endpoint bypass headers or reshape default caps.\n  // The targeted OM_TEST_MODE + OM_TEST_AUTH_RATE_LIMIT_MODE=opt-in escape\n  // hatch (checkAuthRateLimit) still works for suites that explicitly test\n  // rate-limit behavior.\n  const integrationTest = parseBooleanWithDefault(process.env.OM_INTEGRATION_TEST, false)\n  const enabled = integrationTest\n    ? false\n    : parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true)\n\n  return {\n    enabled,\n    strategy,\n    keyPrefix: process.env.RATE_LIMIT_KEY_PREFIX ?? 'rl',\n    redisUrl: process.env.REDIS_URL,\n    trustProxyDepth,\n  }\n}\n\n/**\n * Read per-endpoint rate limit config from environment variables with hardcoded defaults.\n * Environment variable names follow the pattern: RATE_LIMIT_{PREFIX}_POINTS, RATE_LIMIT_{PREFIX}_DURATION, etc.\n */\nexport function readEndpointRateLimitConfig(\n  envPrefix: string,\n  defaults: { points: number; duration: number; blockDuration?: number; keyPrefix: string },\n): RateLimitConfig {\n  return {\n    points: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_POINTS`]) ?? defaults.points,\n    duration: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_DURATION`]) ?? defaults.duration,\n    blockDuration: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_BLOCK_DURATION`]) ?? defaults.blockDuration,\n    keyPrefix: defaults.keyPrefix,\n  }\n}\n\nfunction parsePositiveInt(raw: string | undefined): number | undefined {\n  if (raw === undefined || raw === '') return undefined\n  const parsed = Number(raw)\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined\n}\n\nfunction parseTrustProxyDepth(raw: string | undefined): number {\n  if (raw === undefined || raw.trim() === '') return 0\n  const parsed = Number(raw)\n  if (Number.isInteger(parsed) && parsed >= 0) return parsed\n  logger.warn('Invalid RATE_LIMIT_TRUST_PROXY_DEPTH; using safe direct mode', { value: raw })\n  return 0\n}\n"],
+  "mappings": "AAAA,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAG7B,MAAM,mBAAwC,CAAC,UAAU,OAAO;AAChE,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAE/D,SAAS,sBAA6C;AAC3D,QAAM,WAAY,QAAQ,IAAI,uBAAuB;AACrD,MAAI,CAAC,iBAAiB,SAAS,QAAQ,GAAG;AACxC,UAAM,IAAI,MAAM,gCAAgC,QAAQ,sBAAsB,iBAAiB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7G;AAEA,QAAM,kBAAkB,qBAAqB,QAAQ,IAAI,4BAA4B;AAOrF,QAAM,kBAAkB,wBAAwB,QAAQ,IAAI,qBAAqB,KAAK;AACtF,QAAM,UAAU,kBACZ,QACA,wBAAwB,QAAQ,IAAI,oBAAoB,IAAI;AAEhE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,QAAQ,IAAI,yBAAyB;AAAA,IAChD,UAAU,QAAQ,IAAI;AAAA,IACtB;AAAA,EACF;AACF;AAMO,SAAS,4BACd,WACA,UACiB;AACjB,SAAO;AAAA,IACL,QAAQ,iBAAiB,QAAQ,IAAI,cAAc,SAAS,SAAS,CAAC,KAAK,SAAS;AAAA,IACpF,UAAU,iBAAiB,QAAQ,IAAI,cAAc,SAAS,WAAW,CAAC,KAAK,SAAS;AAAA,IACxF,eAAe,iBAAiB,QAAQ,IAAI,cAAc,SAAS,iBAAiB,CAAC,KAAK,SAAS;AAAA,IACnG,WAAW,SAAS;AAAA,EACtB;AACF;AAEA,SAAS,iBAAiB,KAA6C;AACrE,MAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAC5C,QAAM,SAAS,OAAO,GAAG;AACzB,SAAO,OAAO,SAAS,MAAM,KAAK,UAAU,IAAI,SAAS;AAC3D;AAEA,SAAS,qBAAqB,KAAiC;AAC7D,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,QAAM,SAAS,OAAO,GAAG;AACzB,MAAI,OAAO,UAAU,MAAM,KAAK,UAAU,EAAG,QAAO;AACpD,SAAO,KAAK,gEAAgE,EAAE,OAAO,IAAI,CAAC;AAC1F,SAAO;AACT;",
   "names": []
 }

package/dist/lib/ratelimit/helpers.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 const RATE_LIMIT_ERROR_KEY = "api.errors.rateLimit";
 const RATE_LIMIT_ERROR_FALLBACK = "Too many requests. Please try again later.";
+const RATE_LIMIT_FALLBACK_KEY = "global";
 const rateLimitErrorSchema = z.object({
   error: z.string().describe("Rate limit exceeded message")
 });
@@ -26,19 +27,20 @@ async function checkRateLimit(rateLimiterService, config, key, errorMessage) {
 }
 function getClientIp(req, trustProxyDepth = 0) {
   const forwarded = req.headers.get("x-forwarded-for");
-  if (trustProxyDepth <= 0) {
+  if (!Number.isInteger(trustProxyDepth) || trustProxyDepth <= 0) {
     return null;
   }
   if (forwarded) {
     const ips = forwarded.split(",").map((ip) => ip.trim());
     const clientIndex = ips.length - trustProxyDepth;
-    return clientIndex >= 0 ? ips[clientIndex] : ips[0];
+    return clientIndex >= 0 ? ips[clientIndex] || null : null;
   }
-  return req.headers.get("x-real-ip") ?? null;
+  return trustProxyDepth === 1 ? req.headers.get("x-real-ip")?.trim() || null : null;
 }
 export {
   RATE_LIMIT_ERROR_FALLBACK,
   RATE_LIMIT_ERROR_KEY,
+  RATE_LIMIT_FALLBACK_KEY,
   checkRateLimit,
   getClientIp,
   rateLimitErrorSchema

package/dist/lib/ratelimit/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/ratelimit/helpers.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { RateLimitConfig } from './types'\nimport type { RateLimiterService } from './service'\n\nexport const RATE_LIMIT_ERROR_KEY = 'api.errors.rateLimit'\nexport const RATE_LIMIT_ERROR_FALLBACK = 'Too many requests. Please try again later.'\n\nexport const rateLimitErrorSchema = z.object({\n  error: z.string().describe('Rate limit exceeded message'),\n})\n\n/**\n * Check rate limit for a request. Returns a 429 NextResponse if rate limited, or null if allowed.\n * Rate limit headers (X-RateLimit-*, Retry-After) are only included on 429 responses.\n */\nexport async function checkRateLimit(\n  rateLimiterService: RateLimiterService,\n  config: RateLimitConfig,\n  key: string,\n  errorMessage: string,\n): Promise<NextResponse | null> {\n  const result = await rateLimiterService.consume(key, config)\n\n  if (!result.allowed) {\n    const retryAfterSec = Math.ceil(result.msBeforeNext / 1000)\n    return NextResponse.json(\n      { error: errorMessage },\n      {\n        status: 429,\n        headers: {\n          'Retry-After': String(retryAfterSec),\n          'X-RateLimit-Limit': String(config.points),\n          'X-RateLimit-Remaining': String(result.remainingPoints),\n          'X-RateLimit-Reset': String(retryAfterSec),\n        },\n      },\n    )\n  }\n\n  return null\n}\n\n/**\n * Extract client IP from a request, respecting reverse proxy trust depth.\n *\n * @param trustProxyDepth Number of trusted reverse proxies between the client and the app.\n *   - 0 (default): Do not trust proxy-provided IP headers; return null.\n *   - 1: One trusted proxy (e.g. nginx) \u2014 the last entry in X-Forwarded-For is the client IP.\n *   - N: N trusted proxies \u2014 the Nth-from-last entry is the client IP.\n *\n * With depth=0, X-Forwarded-For and X-Real-IP are ignored entirely to prevent spoofing.\n */\nexport function getClientIp(req: Request, trustProxyDepth: number = 0): string | null {\n  const forwarded = req.headers.get('x-forwarded-for')\n  if (trustProxyDepth <= 0) {\n    return null\n  }\n\n  if (forwarded) {\n    const ips = forwarded.split(',').map((ip) => ip.trim())\n    const clientIndex = ips.length - trustProxyDepth\n    return clientIndex >= 0 ? ips[clientIndex] : ips[0]\n  }\n  return req.headers.get('x-real-ip') ?? null\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAIX,MAAM,uBAAuB;AAC7B,MAAM,4BAA4B;AAElC,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,6BAA6B;AAC1D,CAAC;AAMD,eAAsB,eACpB,oBACA,QACA,KACA,cAC8B;AAC9B,QAAM,SAAS,MAAM,mBAAmB,QAAQ,KAAK,MAAM;AAE3D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,gBAAgB,KAAK,KAAK,OAAO,eAAe,GAAI;AAC1D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,aAAa;AAAA,MACtB;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,OAAO,aAAa;AAAA,UACnC,qBAAqB,OAAO,OAAO,MAAM;AAAA,UACzC,yBAAyB,OAAO,OAAO,eAAe;AAAA,UACtD,qBAAqB,OAAO,aAAa;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAYO,SAAS,YAAY,KAAc,kBAA0B,GAAkB;AACpF,QAAM,YAAY,IAAI,QAAQ,IAAI,iBAAiB;AACnD,MAAI,mBAAmB,GAAG;AACxB,WAAO;AAAA,EACT;AAEA,MAAI,WAAW;AACb,UAAM,MAAM,UAAU,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;AACtD,UAAM,cAAc,IAAI,SAAS;AACjC,WAAO,eAAe,IAAI,IAAI,WAAW,IAAI,IAAI,CAAC;AAAA,EACpD;AACA,SAAO,IAAI,QAAQ,IAAI,WAAW,KAAK;AACzC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { RateLimitConfig } from './types'\nimport type { RateLimiterService } from './service'\n\nexport const RATE_LIMIT_ERROR_KEY = 'api.errors.rateLimit'\nexport const RATE_LIMIT_ERROR_FALLBACK = 'Too many requests. Please try again later.'\nexport const RATE_LIMIT_FALLBACK_KEY = 'global'\n\nexport const rateLimitErrorSchema = z.object({\n  error: z.string().describe('Rate limit exceeded message'),\n})\n\n/**\n * Check rate limit for a request. Returns a 429 NextResponse if rate limited, or null if allowed.\n * Rate limit headers (X-RateLimit-*, Retry-After) are only included on 429 responses.\n */\nexport async function checkRateLimit(\n  rateLimiterService: RateLimiterService,\n  config: RateLimitConfig,\n  key: string,\n  errorMessage: string,\n): Promise<NextResponse | null> {\n  const result = await rateLimiterService.consume(key, config)\n\n  if (!result.allowed) {\n    const retryAfterSec = Math.ceil(result.msBeforeNext / 1000)\n    return NextResponse.json(\n      { error: errorMessage },\n      {\n        status: 429,\n        headers: {\n          'Retry-After': String(retryAfterSec),\n          'X-RateLimit-Limit': String(config.points),\n          'X-RateLimit-Remaining': String(result.remainingPoints),\n          'X-RateLimit-Reset': String(retryAfterSec),\n        },\n      },\n    )\n  }\n\n  return null\n}\n\n/**\n * Extract client IP from a request, respecting reverse proxy trust depth.\n *\n * @param trustProxyDepth Number of trusted reverse proxies between the client and the app.\n *   - 0 (default): Do not trust proxy-provided IP headers; return null.\n *   - 1: One trusted proxy (e.g. nginx) \u2014 the last entry in X-Forwarded-For is the client IP;\n *     X-Real-IP is accepted only as a single-proxy fallback when X-Forwarded-For is absent.\n *   - N: N trusted proxies \u2014 the Nth-from-last entry is the client IP. If the\n *     forwarded chain is shorter than N, return null rather than trusting an\n *     attacker-controlled entry.\n *\n * With depth=0, X-Forwarded-For and X-Real-IP are ignored entirely to prevent spoofing.\n */\nexport function getClientIp(req: Request, trustProxyDepth: number = 0): string | null {\n  const forwarded = req.headers.get('x-forwarded-for')\n  if (!Number.isInteger(trustProxyDepth) || trustProxyDepth <= 0) {\n    return null\n  }\n\n  if (forwarded) {\n    const ips = forwarded.split(',').map((ip) => ip.trim())\n    const clientIndex = ips.length - trustProxyDepth\n    return clientIndex >= 0 ? ips[clientIndex] || null : null\n  }\n  return trustProxyDepth === 1 ? req.headers.get('x-real-ip')?.trim() || null : null\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAIX,MAAM,uBAAuB;AAC7B,MAAM,4BAA4B;AAClC,MAAM,0BAA0B;AAEhC,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,6BAA6B;AAC1D,CAAC;AAMD,eAAsB,eACpB,oBACA,QACA,KACA,cAC8B;AAC9B,QAAM,SAAS,MAAM,mBAAmB,QAAQ,KAAK,MAAM;AAE3D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,gBAAgB,KAAK,KAAK,OAAO,eAAe,GAAI;AAC1D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,aAAa;AAAA,MACtB;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,OAAO,aAAa;AAAA,UACnC,qBAAqB,OAAO,OAAO,MAAM;AAAA,UACzC,yBAAyB,OAAO,OAAO,eAAe;AAAA,UACtD,qBAAqB,OAAO,aAAa;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAeO,SAAS,YAAY,KAAc,kBAA0B,GAAkB;AACpF,QAAM,YAAY,IAAI,QAAQ,IAAI,iBAAiB;AACnD,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,mBAAmB,GAAG;AAC9D,WAAO;AAAA,EACT;AAEA,MAAI,WAAW;AACb,UAAM,MAAM,UAAU,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;AACtD,UAAM,cAAc,IAAI,SAAS;AACjC,WAAO,eAAe,IAAI,IAAI,WAAW,KAAK,OAAO;AAAA,EACvD;AACA,SAAO,oBAAoB,IAAI,IAAI,QAAQ,IAAI,WAAW,GAAG,KAAK,KAAK,OAAO;AAChF;",
   "names": []
 }

package/dist/lib/ratelimit/index.js

@@ -1,9 +1,10 @@
 import { RateLimiterService } from "./service.js";
 import { readRateLimitConfig, readEndpointRateLimitConfig } from "./config.js";
-import { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK, rateLimitErrorSchema } from "./helpers.js";
+import { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_FALLBACK_KEY, rateLimitErrorSchema } from "./helpers.js";
 export {
   RATE_LIMIT_ERROR_FALLBACK,
   RATE_LIMIT_ERROR_KEY,
+  RATE_LIMIT_FALLBACK_KEY,
   RateLimiterService,
   checkRateLimit,
   getClientIp,

package/dist/lib/ratelimit/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/ratelimit/index.ts"],
-  "sourcesContent": ["export { RateLimiterService } from './service'\nexport { readRateLimitConfig, readEndpointRateLimitConfig } from './config'\nexport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK, rateLimitErrorSchema } from './helpers'\nexport type { RateLimitConfig, RateLimitResult, RateLimitStrategy, RateLimitGlobalConfig } from './types'\n"],
-  "mappings": "AAAA,SAAS,0BAA0B;AACnC,SAAS,qBAAqB,mCAAmC;AACjE,SAAS,gBAAgB,aAAa,sBAAsB,2BAA2B,4BAA4B;",
+  "sourcesContent": ["export { RateLimiterService } from './service'\nexport { readRateLimitConfig, readEndpointRateLimitConfig } from './config'\nexport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_FALLBACK_KEY, rateLimitErrorSchema } from './helpers'\nexport type { RateLimitConfig, RateLimitResult, RateLimitStrategy, RateLimitGlobalConfig } from './types'\n"],
+  "mappings": "AAAA,SAAS,0BAA0B;AACnC,SAAS,qBAAqB,mCAAmC;AACjE,SAAS,gBAAgB,aAAa,sBAAsB,2BAA2B,yBAAyB,4BAA4B;",
   "names": []
 }

package/dist/lib/ratelimit/service.js

@@ -4,7 +4,7 @@ class RateLimiterService {
     this.limiters = /* @__PURE__ */ new Map();
     this.redisClient = null;
     this.globalConfig = globalConfig;
-    this.trustProxyDepth = globalConfig.trustProxyDepth ?? 1;
+    this.trustProxyDepth = globalConfig.trustProxyDepth ?? 0;
   }
   async initialize() {
     if (this.globalConfig.strategy === "redis" && this.globalConfig.redisUrl) {

package/dist/lib/ratelimit/service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/ratelimit/service.ts"],
-  "sourcesContent": ["import { RateLimiterMemory, RateLimiterRedis, RateLimiterRes } from 'rate-limiter-flexible'\nimport type { RateLimitConfig, RateLimitResult, RateLimitGlobalConfig } from './types'\n\n/** Narrow interface for the ioredis client \u2014 only the methods we actually use. */\ninterface RedisClient {\n  disconnect(): void\n}\n\nexport class RateLimiterService {\n  private globalConfig: RateLimitGlobalConfig\n  private limiters = new Map<string, RateLimiterMemory | RateLimiterRedis>()\n  private redisClient: RedisClient | null = null\n\n  readonly trustProxyDepth: number\n\n  constructor(globalConfig: RateLimitGlobalConfig) {\n    this.globalConfig = globalConfig\n    this.trustProxyDepth = globalConfig.trustProxyDepth ?? 1\n  }\n\n  async initialize(): Promise<void> {\n    if (this.globalConfig.strategy === 'redis' && this.globalConfig.redisUrl) {\n      const { default: Redis } = await import('ioredis')\n      this.redisClient = new Redis(this.globalConfig.redisUrl, {\n        enableOfflineQueue: false,\n        maxRetriesPerRequest: 1,\n      })\n    }\n  }\n\n  async consume(key: string, config: RateLimitConfig): Promise<RateLimitResult> {\n    if (!this.globalConfig.enabled) {\n      return this.disabledResult(config)\n    }\n\n    const limiter = this.getOrCreateLimiter(config)\n\n    try {\n      const res = await limiter.consume(key, 1)\n      return this.toResult(res, true)\n    } catch (error) {\n      if (error instanceof RateLimiterRes) {\n        return this.toResult(error, false)\n      }\n      return this.disabledResult(config)\n    }\n  }\n\n  async get(key: string, config: RateLimitConfig): Promise<RateLimitResult | null> {\n    if (!this.globalConfig.enabled) return null\n\n    const limiter = this.getOrCreateLimiter(config)\n    const res = await limiter.get(key)\n    return res ? this.toResult(res, res.remainingPoints > 0) : null\n  }\n\n  async delete(key: string, config: RateLimitConfig): Promise<void> {\n    if (!this.globalConfig.enabled) return\n    const limiter = this.getOrCreateLimiter(config)\n    await limiter.delete(key)\n  }\n\n  async penalty(key: string, points: number, config: RateLimitConfig): Promise<RateLimitResult> {\n    if (!this.globalConfig.enabled) {\n      return this.disabledResult(config)\n    }\n    const limiter = this.getOrCreateLimiter(config)\n    const res = await limiter.penalty(key, points)\n    return this.toResult(res, res.remainingPoints > 0)\n  }\n\n  async reward(key: string, points: number, config: RateLimitConfig): Promise<RateLimitResult> {\n    if (!this.globalConfig.enabled) {\n      return this.disabledResult(config)\n    }\n    const limiter = this.getOrCreateLimiter(config)\n    const res = await limiter.reward(key, points)\n    return this.toResult(res, true)\n  }\n\n  async block(key: string, durationSec: number, config: RateLimitConfig): Promise<void> {\n    if (!this.globalConfig.enabled) return\n    const limiter = this.getOrCreateLimiter(config)\n    await limiter.block(key, durationSec)\n  }\n\n  async destroy(): Promise<void> {\n    if (this.redisClient) {\n      this.redisClient.disconnect()\n    }\n    this.limiters.clear()\n  }\n\n  private disabledResult(config: RateLimitConfig): RateLimitResult {\n    return { allowed: true, remainingPoints: config.points, msBeforeNext: 0, consumedPoints: 0 }\n  }\n\n  private getOrCreateLimiter(config: RateLimitConfig): RateLimiterMemory | RateLimiterRedis {\n    const cacheKey = `${config.keyPrefix ?? 'default'}:${config.points}:${config.duration}:${config.blockDuration ?? 0}`\n\n    let limiter = this.limiters.get(cacheKey)\n    if (limiter) return limiter\n\n    const prefix = [this.globalConfig.keyPrefix, config.keyPrefix].filter(Boolean).join(':')\n\n    const baseOpts = {\n      keyPrefix: prefix,\n      points: config.points,\n      duration: config.duration,\n      blockDuration: config.blockDuration ?? 0,\n    }\n\n    if (this.globalConfig.strategy === 'redis' && this.redisClient) {\n      const insuranceLimiter = new RateLimiterMemory(baseOpts)\n      limiter = new RateLimiterRedis({\n        ...baseOpts,\n        storeClient: this.redisClient,\n        insuranceLimiter,\n        rejectIfRedisNotReady: false,\n      })\n    } else {\n      limiter = new RateLimiterMemory(baseOpts)\n    }\n\n    this.limiters.set(cacheKey, limiter)\n    return limiter\n  }\n\n  private toResult(res: RateLimiterRes, allowed: boolean): RateLimitResult {\n    return {\n      allowed,\n      remainingPoints: Math.max(res.remainingPoints, 0),\n      msBeforeNext: res.msBeforeNext,\n      consumedPoints: res.consumedPoints,\n    }\n  }\n}\n"],
+  "sourcesContent": ["import { RateLimiterMemory, RateLimiterRedis, RateLimiterRes } from 'rate-limiter-flexible'\nimport type { RateLimitConfig, RateLimitResult, RateLimitGlobalConfig } from './types'\n\n/** Narrow interface for the ioredis client \u2014 only the methods we actually use. */\ninterface RedisClient {\n  disconnect(): void\n}\n\nexport class RateLimiterService {\n  private globalConfig: RateLimitGlobalConfig\n  private limiters = new Map<string, RateLimiterMemory | RateLimiterRedis>()\n  private redisClient: RedisClient | null = null\n\n  readonly trustProxyDepth: number\n\n  constructor(globalConfig: RateLimitGlobalConfig) {\n    this.globalConfig = globalConfig\n    this.trustProxyDepth = globalConfig.trustProxyDepth ?? 0\n  }\n\n  async initialize(): Promise<void> {\n    if (this.globalConfig.strategy === 'redis' && this.globalConfig.redisUrl) {\n      const { default: Redis } = await import('ioredis')\n      this.redisClient = new Redis(this.globalConfig.redisUrl, {\n        enableOfflineQueue: false,\n        maxRetriesPerRequest: 1,\n      })\n    }\n  }\n\n  async consume(key: string, config: RateLimitConfig): Promise<RateLimitResult> {\n    if (!this.globalConfig.enabled) {\n      return this.disabledResult(config)\n    }\n\n    const limiter = this.getOrCreateLimiter(config)\n\n    try {\n      const res = await limiter.consume(key, 1)\n      return this.toResult(res, true)\n    } catch (error) {\n      if (error instanceof RateLimiterRes) {\n        return this.toResult(error, false)\n      }\n      return this.disabledResult(config)\n    }\n  }\n\n  async get(key: string, config: RateLimitConfig): Promise<RateLimitResult | null> {\n    if (!this.globalConfig.enabled) return null\n\n    const limiter = this.getOrCreateLimiter(config)\n    const res = await limiter.get(key)\n    return res ? this.toResult(res, res.remainingPoints > 0) : null\n  }\n\n  async delete(key: string, config: RateLimitConfig): Promise<void> {\n    if (!this.globalConfig.enabled) return\n    const limiter = this.getOrCreateLimiter(config)\n    await limiter.delete(key)\n  }\n\n  async penalty(key: string, points: number, config: RateLimitConfig): Promise<RateLimitResult> {\n    if (!this.globalConfig.enabled) {\n      return this.disabledResult(config)\n    }\n    const limiter = this.getOrCreateLimiter(config)\n    const res = await limiter.penalty(key, points)\n    return this.toResult(res, res.remainingPoints > 0)\n  }\n\n  async reward(key: string, points: number, config: RateLimitConfig): Promise<RateLimitResult> {\n    if (!this.globalConfig.enabled) {\n      return this.disabledResult(config)\n    }\n    const limiter = this.getOrCreateLimiter(config)\n    const res = await limiter.reward(key, points)\n    return this.toResult(res, true)\n  }\n\n  async block(key: string, durationSec: number, config: RateLimitConfig): Promise<void> {\n    if (!this.globalConfig.enabled) return\n    const limiter = this.getOrCreateLimiter(config)\n    await limiter.block(key, durationSec)\n  }\n\n  async destroy(): Promise<void> {\n    if (this.redisClient) {\n      this.redisClient.disconnect()\n    }\n    this.limiters.clear()\n  }\n\n  private disabledResult(config: RateLimitConfig): RateLimitResult {\n    return { allowed: true, remainingPoints: config.points, msBeforeNext: 0, consumedPoints: 0 }\n  }\n\n  private getOrCreateLimiter(config: RateLimitConfig): RateLimiterMemory | RateLimiterRedis {\n    const cacheKey = `${config.keyPrefix ?? 'default'}:${config.points}:${config.duration}:${config.blockDuration ?? 0}`\n\n    let limiter = this.limiters.get(cacheKey)\n    if (limiter) return limiter\n\n    const prefix = [this.globalConfig.keyPrefix, config.keyPrefix].filter(Boolean).join(':')\n\n    const baseOpts = {\n      keyPrefix: prefix,\n      points: config.points,\n      duration: config.duration,\n      blockDuration: config.blockDuration ?? 0,\n    }\n\n    if (this.globalConfig.strategy === 'redis' && this.redisClient) {\n      const insuranceLimiter = new RateLimiterMemory(baseOpts)\n      limiter = new RateLimiterRedis({\n        ...baseOpts,\n        storeClient: this.redisClient,\n        insuranceLimiter,\n        rejectIfRedisNotReady: false,\n      })\n    } else {\n      limiter = new RateLimiterMemory(baseOpts)\n    }\n\n    this.limiters.set(cacheKey, limiter)\n    return limiter\n  }\n\n  private toResult(res: RateLimiterRes, allowed: boolean): RateLimitResult {\n    return {\n      allowed,\n      remainingPoints: Math.max(res.remainingPoints, 0),\n      msBeforeNext: res.msBeforeNext,\n      consumedPoints: res.consumedPoints,\n    }\n  }\n}\n"],
   "mappings": "AAAA,SAAS,mBAAmB,kBAAkB,sBAAsB;AAQ7D,MAAM,mBAAmB;AAAA,EAO9B,YAAY,cAAqC;AALjD,SAAQ,WAAW,oBAAI,IAAkD;AACzE,SAAQ,cAAkC;AAKxC,SAAK,eAAe;AACpB,SAAK,kBAAkB,aAAa,mBAAmB;AAAA,EACzD;AAAA,EAEA,MAAM,aAA4B;AAChC,QAAI,KAAK,aAAa,aAAa,WAAW,KAAK,aAAa,UAAU;AACxE,YAAM,EAAE,SAAS,MAAM,IAAI,MAAM,OAAO,SAAS;AACjD,WAAK,cAAc,IAAI,MAAM,KAAK,aAAa,UAAU;AAAA,QACvD,oBAAoB;AAAA,QACpB,sBAAsB;AAAA,MACxB,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,KAAa,QAAmD;AAC5E,QAAI,CAAC,KAAK,aAAa,SAAS;AAC9B,aAAO,KAAK,eAAe,MAAM;AAAA,IACnC;AAEA,UAAM,UAAU,KAAK,mBAAmB,MAAM;AAE9C,QAAI;AACF,YAAM,MAAM,MAAM,QAAQ,QAAQ,KAAK,CAAC;AACxC,aAAO,KAAK,SAAS,KAAK,IAAI;AAAA,IAChC,SAAS,OAAO;AACd,UAAI,iBAAiB,gBAAgB;AACnC,eAAO,KAAK,SAAS,OAAO,KAAK;AAAA,MACnC;AACA,aAAO,KAAK,eAAe,MAAM;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,KAAa,QAA0D;AAC/E,QAAI,CAAC,KAAK,aAAa,QAAS,QAAO;AAEvC,UAAM,UAAU,KAAK,mBAAmB,MAAM;AAC9C,UAAM,MAAM,MAAM,QAAQ,IAAI,GAAG;AACjC,WAAO,MAAM,KAAK,SAAS,KAAK,IAAI,kBAAkB,CAAC,IAAI;AAAA,EAC7D;AAAA,EAEA,MAAM,OAAO,KAAa,QAAwC;AAChE,QAAI,CAAC,KAAK,aAAa,QAAS;AAChC,UAAM,UAAU,KAAK,mBAAmB,MAAM;AAC9C,UAAM,QAAQ,OAAO,GAAG;AAAA,EAC1B;AAAA,EAEA,MAAM,QAAQ,KAAa,QAAgB,QAAmD;AAC5F,QAAI,CAAC,KAAK,aAAa,SAAS;AAC9B,aAAO,KAAK,eAAe,MAAM;AAAA,IACnC;AACA,UAAM,UAAU,KAAK,mBAAmB,MAAM;AAC9C,UAAM,MAAM,MAAM,QAAQ,QAAQ,KAAK,MAAM;AAC7C,WAAO,KAAK,SAAS,KAAK,IAAI,kBAAkB,CAAC;AAAA,EACnD;AAAA,EAEA,MAAM,OAAO,KAAa,QAAgB,QAAmD;AAC3F,QAAI,CAAC,KAAK,aAAa,SAAS;AAC9B,aAAO,KAAK,eAAe,MAAM;AAAA,IACnC;AACA,UAAM,UAAU,KAAK,mBAAmB,MAAM;AAC9C,UAAM,MAAM,MAAM,QAAQ,OAAO,KAAK,MAAM;AAC5C,WAAO,KAAK,SAAS,KAAK,IAAI;AAAA,EAChC;AAAA,EAEA,MAAM,MAAM,KAAa,aAAqB,QAAwC;AACpF,QAAI,CAAC,KAAK,aAAa,QAAS;AAChC,UAAM,UAAU,KAAK,mBAAmB,MAAM;AAC9C,UAAM,QAAQ,MAAM,KAAK,WAAW;AAAA,EACtC;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,aAAa;AACpB,WAAK,YAAY,WAAW;AAAA,IAC9B;AACA,SAAK,SAAS,MAAM;AAAA,EACtB;AAAA,EAEQ,eAAe,QAA0C;AAC/D,WAAO,EAAE,SAAS,MAAM,iBAAiB,OAAO,QAAQ,cAAc,GAAG,gBAAgB,EAAE;AAAA,EAC7F;AAAA,EAEQ,mBAAmB,QAA+D;AACxF,UAAM,WAAW,GAAG,OAAO,aAAa,SAAS,IAAI,OAAO,MAAM,IAAI,OAAO,QAAQ,IAAI,OAAO,iBAAiB,CAAC;AAElH,QAAI,UAAU,KAAK,SAAS,IAAI,QAAQ;AACxC,QAAI,QAAS,QAAO;AAEpB,UAAM,SAAS,CAAC,KAAK,aAAa,WAAW,OAAO,SAAS,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAEvF,UAAM,WAAW;AAAA,MACf,WAAW;AAAA,MACX,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,eAAe,OAAO,iBAAiB;AAAA,IACzC;AAEA,QAAI,KAAK,aAAa,aAAa,WAAW,KAAK,aAAa;AAC9D,YAAM,mBAAmB,IAAI,kBAAkB,QAAQ;AACvD,gBAAU,IAAI,iBAAiB;AAAA,QAC7B,GAAG;AAAA,QACH,aAAa,KAAK;AAAA,QAClB;AAAA,QACA,uBAAuB;AAAA,MACzB,CAAC;AAAA,IACH,OAAO;AACL,gBAAU,IAAI,kBAAkB,QAAQ;AAAA,IAC1C;AAEA,SAAK,SAAS,IAAI,UAAU,OAAO;AACnC,WAAO;AAAA,EACT;AAAA,EAEQ,SAAS,KAAqB,SAAmC;AACvE,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,KAAK,IAAI,IAAI,iBAAiB,CAAC;AAAA,MAChD,cAAc,IAAI;AAAA,MAClB,gBAAgB,IAAI;AAAA,IACtB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.7-develop.6606.1.3b1ec9b1ea";
+const APP_VERSION = "0.6.7-develop.6621.1.cdbe9dee3d";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6606.1.3b1ec9b1ea'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6621.1.cdbe9dee3d'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.7-develop.6606.1.3b1ec9b1ea",
+  "version": "0.6.7-develop.6621.1.cdbe9dee3d",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -97,7 +97,7 @@
     "@mikro-orm/core": "^7.1.5",
     "@mikro-orm/decorators": "^7.1.5",
     "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/cache": "0.6.7-develop.6606.1.3b1ec9b1ea",
+    "@open-mercato/cache": "0.6.7-develop.6621.1.cdbe9dee3d",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",
     "pino": "^10.3.1",

package/src/lib/ratelimit/__tests__/config.test.ts

@@ -13,6 +13,18 @@ describe('readRateLimitConfig', () => {
     expect(readRateLimitConfig().enabled).toBe(true)
   })
 
+  it('defaults to direct mode when proxy depth is not configured', () => {
+    delete process.env.RATE_LIMIT_TRUST_PROXY_DEPTH
+
+    expect(readRateLimitConfig().trustProxyDepth).toBe(0)
+  })
+
+  it.each(['-1', '1.5', 'not-a-number'])('falls back to direct mode for invalid proxy depth %s', (value) => {
+    process.env.RATE_LIMIT_TRUST_PROXY_DEPTH = value
+
+    expect(readRateLimitConfig().trustProxyDepth).toBe(0)
+  })
+
   it('honors RATE_LIMIT_ENABLED=false', () => {
     process.env.RATE_LIMIT_ENABLED = 'false'
     delete process.env.OM_INTEGRATION_TEST

package/src/lib/ratelimit/__tests__/helpers.test.ts

@@ -132,11 +132,11 @@ describe('getClientIp', () => {
     expect(getClientIp(req, 2)).toBe('real-client')
   })
 
-  it('falls back to first IP when fewer entries than trust depth', () => {
+  it('returns null when the forwarded chain is shorter than the configured trust depth', () => {
     const req = new Request('http://localhost', {
       headers: { 'x-forwarded-for': '192.168.1.1' },
     })
-    expect(getClientIp(req, 3)).toBe('192.168.1.1')
+    expect(getClientIp(req, 3)).toBeNull()
   })
 
   it('trims whitespace from x-forwarded-for entries', () => {

package/src/lib/ratelimit/__tests__/service.test.ts

@@ -220,7 +220,7 @@ describe('RateLimiterService', () => {
       expect(config.enabled).toBe(true)
       expect(config.strategy).toBe('memory')
       expect(config.keyPrefix).toBe('rl')
-      expect(config.trustProxyDepth).toBe(1)
+      expect(config.trustProxyDepth).toBe(0)
 
       if (originalEnabled !== undefined) process.env.RATE_LIMIT_ENABLED = originalEnabled; else delete process.env.RATE_LIMIT_ENABLED
       if (originalStrategy !== undefined) process.env.RATE_LIMIT_STRATEGY = originalStrategy; else delete process.env.RATE_LIMIT_STRATEGY

package/src/lib/ratelimit/config.ts

@@ -1,7 +1,9 @@
 import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+import { createLogger } from '@open-mercato/shared/lib/logger'
 import type { RateLimitConfig, RateLimitGlobalConfig, RateLimitStrategy } from './types'
 
 const VALID_STRATEGIES: RateLimitStrategy[] = ['memory', 'redis']
+const logger = createLogger('ratelimit').child({ component: 'config' })
 
 export function readRateLimitConfig(): RateLimitGlobalConfig {
   const strategy = (process.env.RATE_LIMIT_STRATEGY ?? 'memory') as RateLimitStrategy
@@ -9,7 +11,7 @@ export function readRateLimitConfig(): RateLimitGlobalConfig {
     throw new Error(`Invalid RATE_LIMIT_STRATEGY "${strategy}". Must be one of: ${VALID_STRATEGIES.join(', ')}`)
   }
 
-  const trustProxyDepth = parsePositiveInt(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH) ?? 1
+  const trustProxyDepth = parseTrustProxyDepth(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH)
 
   // Integration test runs disable rate limiting globally so suites do not
   // have to juggle per-endpoint bypass headers or reshape default caps.
@@ -51,3 +53,11 @@ function parsePositiveInt(raw: string | undefined): number | undefined {
   const parsed = Number(raw)
   return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined
 }
+
+function parseTrustProxyDepth(raw: string | undefined): number {
+  if (raw === undefined || raw.trim() === '') return 0
+  const parsed = Number(raw)
+  if (Number.isInteger(parsed) && parsed >= 0) return parsed
+  logger.warn('Invalid RATE_LIMIT_TRUST_PROXY_DEPTH; using safe direct mode', { value: raw })
+  return 0
+}

package/src/lib/ratelimit/helpers.ts

@@ -5,6 +5,7 @@ import type { RateLimiterService } from './service'
 
 export const RATE_LIMIT_ERROR_KEY = 'api.errors.rateLimit'
 export const RATE_LIMIT_ERROR_FALLBACK = 'Too many requests. Please try again later.'
+export const RATE_LIMIT_FALLBACK_KEY = 'global'
 
 export const rateLimitErrorSchema = z.object({
   error: z.string().describe('Rate limit exceeded message'),
@@ -46,21 +47,24 @@ export async function checkRateLimit(
  *
  * @param trustProxyDepth Number of trusted reverse proxies between the client and the app.
  *   - 0 (default): Do not trust proxy-provided IP headers; return null.
- *   - 1: One trusted proxy (e.g. nginx) — the last entry in X-Forwarded-For is the client IP.
- *   - N: N trusted proxies — the Nth-from-last entry is the client IP.
+ *   - 1: One trusted proxy (e.g. nginx) — the last entry in X-Forwarded-For is the client IP;
+ *     X-Real-IP is accepted only as a single-proxy fallback when X-Forwarded-For is absent.
+ *   - N: N trusted proxies — the Nth-from-last entry is the client IP. If the
+ *     forwarded chain is shorter than N, return null rather than trusting an
+ *     attacker-controlled entry.
  *
  * With depth=0, X-Forwarded-For and X-Real-IP are ignored entirely to prevent spoofing.
  */
 export function getClientIp(req: Request, trustProxyDepth: number = 0): string | null {
   const forwarded = req.headers.get('x-forwarded-for')
-  if (trustProxyDepth <= 0) {
+  if (!Number.isInteger(trustProxyDepth) || trustProxyDepth <= 0) {
     return null
   }
 
   if (forwarded) {
     const ips = forwarded.split(',').map((ip) => ip.trim())
     const clientIndex = ips.length - trustProxyDepth
-    return clientIndex >= 0 ? ips[clientIndex] : ips[0]
+    return clientIndex >= 0 ? ips[clientIndex] || null : null
   }
-  return req.headers.get('x-real-ip') ?? null
+  return trustProxyDepth === 1 ? req.headers.get('x-real-ip')?.trim() || null : null
 }

package/src/lib/ratelimit/index.ts

@@ -1,4 +1,4 @@
 export { RateLimiterService } from './service'
 export { readRateLimitConfig, readEndpointRateLimitConfig } from './config'
-export { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK, rateLimitErrorSchema } from './helpers'
+export { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_FALLBACK_KEY, rateLimitErrorSchema } from './helpers'
 export type { RateLimitConfig, RateLimitResult, RateLimitStrategy, RateLimitGlobalConfig } from './types'

package/src/lib/ratelimit/service.ts

@@ -15,7 +15,7 @@ export class RateLimiterService {
 
   constructor(globalConfig: RateLimitGlobalConfig) {
     this.globalConfig = globalConfig
-    this.trustProxyDepth = globalConfig.trustProxyDepth ?? 1
+    this.trustProxyDepth = globalConfig.trustProxyDepth ?? 0
   }
 
   async initialize(): Promise<void> {

package/src/lib/ratelimit/types.ts

@@ -27,6 +27,6 @@ export interface RateLimitGlobalConfig {
   strategy: RateLimitStrategy
   keyPrefix: string
   redisUrl?: string
-  /** Number of trusted reverse proxies for X-Forwarded-For IP extraction (default: 1) */
+  /** Number of trusted reverse proxies for X-Forwarded-For IP extraction (default: 0) */
   trustProxyDepth: number
 }