@podosoft/podokit 0.10.1 → 0.10.2

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.module.ts

@@ -11,6 +11,7 @@ import Redis from "ioredis";
 const ttlSeconds = Number(process.env.RATE_LIMIT_TTL ?? 60);
 const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
 const runtimeLimit = Number(process.env.RATE_LIMIT_RUNTIME_MAX ?? 1000);
+const unthrottledHealthPaths = new Set(["/health", "/health/ready"]);
 
 function forwardedClient(headers: unknown): string | undefined {
   if (!headers || typeof headers !== "object") return undefined;
@@ -29,6 +30,9 @@ class ProxyAwareThrottlerGuard extends ThrottlerGuard {
     const { req } = this.getRequestResponse(requestProps.context);
     const method = typeof req.method === "string" ? req.method : "";
     const path = typeof req.path === "string" ? req.path : "";
+    if (method === "GET" && unthrottledHealthPaths.has(path)) {
+      return Promise.resolve(true);
+    }
     if (method === "GET" && path === "/site/settings") {
       return super.handleRequest({ ...requestProps, limit: runtimeLimit });
     }

package/dist/templates/modules/rate-limit/files/tests/api/rate-limit.api.spec.ts

@@ -13,19 +13,28 @@ const origin = { origin: base };
 // to the module default and allow a little headroom.
 const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
 
-test("rate limit: exceeding the window returns 429 @smoke", async ({ playwright }) => {
+test("rate limit: health probes stay available while ordinary routes return 429 @smoke", async ({
+  playwright,
+}) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  // /health is public — no session needed. If the first hit is a 5xx the
-  // throttler's Redis backing isn't reachable; nothing to assert.
-  const probe = await ctx.get("/api/health");
+  for (const path of ["/api/health", "/api/health/ready"]) {
+    for (let i = 0; i < limit + 5; i++) {
+      const response = await ctx.get(path);
+      expect(response.status(), `${path} request ${i + 1}`).toBe(200);
+    }
+  }
+
+  // The redis module is added automatically and exposes a public demo cache
+  // route, so it provides a stable ordinary endpoint for the global limit.
+  const probe = await ctx.get("/api/cache/rate-limit-probe");
   test.skip(probe.status() >= 500, "throttler storage (redis) not reachable");
 
   let seen200 = probe.status() === 200;
   let got429 = false;
   for (let i = 0; i < limit + 5 && !got429; i++) {
-    const r = await ctx.get("/api/health");
-    if (r.status() === 200) seen200 = true;
-    if (r.status() === 429) got429 = true;
+    const response = await ctx.get("/api/cache/rate-limit-probe");
+    if (response.status() === 200) seen200 = true;
+    if (response.status() === 429) got429 = true;
   }
   // A fresh window serves the first requests (200) and rejects once the limit is
   // crossed (429).

package/dist/templates/modules/rate-limit/module.manifest.json

@@ -22,6 +22,7 @@
     "Ensure Redis is running:  docker compose -f infra/docker/docker-compose.yml up -d",
     "Tune RATE_LIMIT_TTL / RATE_LIMIT_MAX / RATE_LIMIT_RUNTIME_MAX in .env.",
     "Exceeding the limit returns HTTP 429. Skip a route with @SkipThrottle() or tune it with @Throttle().",
+    "GET /health and GET /health/ready bypass request quotas so orchestrator probes remain reliable.",
     "The limit is shared across API replicas because it is stored in Redis.",
     "PodoKit's web proxy forwards the resolved client address, so visitors receive independent counters."
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {