@oxyhq/core 3.10.1 → 3.11.0

package/dist/esm/server/rateLimit.js

@@ -19,12 +19,36 @@ function isBuiltInExempt(req) {
 function ipKeyGenerator(ip) {
     return ip.replace(/:/g, '_');
 }
-/** Resolve the rate-limit key: per authenticated user, else per (IPv6-safe) IP. */
-function resolveKey(req) {
+/**
+ * Resolve the trusted authenticated rate-limit key.
+ *
+ * `oxy.auth({ optional: true })` preserves legacy non-session user tokens by
+ * decoding their JWT claims locally. Those claims are not cryptographically
+ * verified and therefore MUST NOT influence abuse-control buckets. Only use
+ * identities that came from a server-validated session or a verified service
+ * token/delegation.
+ */
+function resolveTrustedAuthenticatedKey(req) {
     const userId = req.userId ?? req.user?.id ?? req.user?._id;
-    if (userId) {
+    if (userId && req.sessionId) {
         return `user:${userId}`;
     }
+    const delegatedUserId = req.serviceActingAs?.userId;
+    if (delegatedUserId && req.serviceApp?.appId) {
+        return `user:${delegatedUserId}`;
+    }
+    const serviceAppId = req.serviceApp?.appId;
+    if (serviceAppId) {
+        return `service:${serviceAppId}`;
+    }
+    return null;
+}
+/** Resolve the rate-limit key: per trusted authenticated identity, else per (IPv6-safe) IP. */
+function resolveKey(req) {
+    const authenticatedKey = resolveTrustedAuthenticatedKey(req);
+    if (authenticatedKey) {
+        return authenticatedKey;
+    }
     const ip = req.ip || req.socket.remoteAddress || 'unknown';
     return ipKeyGenerator(ip);
 }
@@ -41,9 +65,9 @@ export function createOxyRateLimit(oxy, options = {}) {
         windowMs,
         ...(store ? { store } : {}),
         max: (req) => {
-            const authed = req;
-            const userId = authed.userId ?? authed.user?.id ?? authed.user?._id;
-            return userId ? authenticatedMax : anonymousMax;
+            return resolveTrustedAuthenticatedKey(req)
+                ? authenticatedMax
+                : anonymousMax;
         },
         keyGenerator: (req) => resolveKey(req),
         message,
@@ -61,8 +85,8 @@ export function createOxyRateLimit(oxy, options = {}) {
         resolveSession(req, res, (err) => {
             if (err) {
                 // Optional auth never rejects; a token error just means "anonymous".
-                // Swallow the error and continue to limit as anonymous.
-                next();
+                // Swallow the error and continue through the anonymous limiter.
+                limiter(req, res, next);
                 return;
             }
             limiter(req, res, next);

package/dist/esm/utils/ssoReturn.js

@@ -237,7 +237,7 @@ export async function consumeSsoReturn(oxy, deps = {}) {
     }
     let session;
     try {
-        session = await oxy.exchangeSsoCode(ret.code);
+        session = await oxy.exchangeSsoCode(ret.code, ret.state);
     }
     catch (error) {
         onExchangeError?.(error);