@prosopo/provider 4.15.14 → 4.15.15

package/dist/api/hardBlockVerdictCache.js

@@ -1,119 +1,116 @@
-const DEFAULT_VERDICT_CACHE_TTL_MS = 1e4;
-const DEFAULT_VERDICT_CACHE_MAX_ENTRIES = 5e4;
-class HardBlockVerdictCache {
-  constructor(ttlMs = DEFAULT_VERDICT_CACHE_TTL_MS, maxEntries = DEFAULT_VERDICT_CACHE_MAX_ENTRIES) {
-    this.ttlMs = ttlMs;
-    this.maxEntries = maxEntries;
-    this.store = /* @__PURE__ */ new Map();
-    this.inflight = /* @__PURE__ */ new Map();
-  }
-  get(key) {
-    const entry = this.store.get(key);
-    if (entry === void 0) {
-      return void 0;
-    }
-    if (entry.expiresAt <= Date.now()) {
-      this.store.delete(key);
-      return void 0;
-    }
-    this.store.delete(key);
-    this.store.set(key, entry);
-    return entry.value;
-  }
-  set(key, value) {
-    this.store.delete(key);
-    if (this.store.size >= this.maxEntries) {
-      const oldest = this.store.keys().next().value;
-      if (oldest !== void 0) {
-        this.store.delete(oldest);
-      }
-    }
-    this.store.set(key, {
-      value,
-      expiresAt: Date.now() + this.ttlMs
-    });
-  }
-  /**
-   * Cache lookup with singleflight dedupe of concurrent misses.
-   *
-   * Fast path: cache hit → return immediately (with LRU move-to-tail
-   * via `get()`).
-   *
-   * Slow path: cache miss →
-   *   1. If an in-flight Promise exists for this key, join it. This
-   *      is the coalescing behaviour — N concurrent identical misses
-   *      all await the same underlying storage call.
-   *   2. Otherwise, invoke `compute()`, register the Promise, and
-   *      populate the cache with the result on resolve. The Promise
-   *      is removed from the in-flight map in a `finally` so a
-   *      rejection doesn't wedge future callers.
-   *
-   * Rejection semantics: if `compute()` throws, all joined waiters
-   * see the same rejection. Callers should handle it — the underlying
-   * `getPrioritisedAccessRule` catches its own storage errors and
-   * returns `[]` (fail-open), so in practice this never propagates.
-   */
-  async getOrCompute(key, compute) {
-    const cached = this.get(key);
-    if (cached !== void 0) {
-      return cached;
-    }
-    const existing = this.inflight.get(key);
-    if (existing !== void 0) {
-      return existing;
-    }
-    const promise = (async () => {
-      const value = await compute();
-      this.set(key, value);
-      return value;
-    })();
-    this.inflight.set(key, promise);
-    try {
-      return await promise;
-    } finally {
-      if (this.inflight.get(key) === promise) {
-        this.inflight.delete(key);
-      }
-    }
-  }
-  // Test/ops hook — the running cache is not exposed on the wire, but
-  // admin tooling (e.g. a rule-mutation notifier) may need to flush
-  // after a bulk insert to bound the staleness window. Clears both
-  // the stored entries and any in-flight Promises so a rule mutation
-  // can't leave a stale computation in flight.
-  clear() {
-    this.store.clear();
-    this.inflight.clear();
-  }
-  size() {
-    return this.store.size;
-  }
-  // Test hook: number of in-flight computations. Not on the hot path.
-  inflightSize() {
-    return this.inflight.size;
-  }
-}
-const hardBlockCacheKey = (clientId, userScope, blockOnly) => {
-  const bo = blockOnly ? "1" : "0";
-  const parts = [
-    clientId ?? "",
-    userScope.numericIp === void 0 ? "" : userScope.numericIp.toString(),
-    userScope.numericIpMaskMin === void 0 ? "" : userScope.numericIpMaskMin.toString(),
-    userScope.numericIpMaskMax === void 0 ? "" : userScope.numericIpMaskMax.toString(),
-    userScope.userId ?? "",
-    userScope.ja4Hash ?? "",
-    userScope.headersHash ?? "",
-    userScope.userAgentHash ?? "",
-    userScope.headHash ?? "",
-    userScope.coords ?? "",
-    userScope.countryCode ?? "",
-    userScope.asn === void 0 ? "" : String(userScope.asn)
-  ];
-  return `${bo}|${parts.join("|")}`;
+//#region src/api/hardBlockVerdictCache.ts
+var DEFAULT_VERDICT_CACHE_TTL_MS = 1e4;
+var DEFAULT_VERDICT_CACHE_MAX_ENTRIES = 5e4;
+/**
+* Bounded LRU + TTL cache for hard-block verdicts, with singleflight
+* dedupe of concurrent misses.
+*
+* Eviction is real LRU: `get()` moves the hit entry to the tail of the
+* Map's iteration order (Map iteration = insertion order in JS), so
+* `set()` drops the least-recently-used entry once the cap is reached.
+* Absolute TTL is preserved on hit — `expiresAt` is set at insert and
+* never refreshed, so a hot key can't stay stale beyond ttlMs no matter
+* how often it's accessed.
+*
+* `getOrCompute()` is the singleflight entry point: if a concurrent
+* caller is already computing the value for `key`, joiners return the
+* same in-flight Promise instead of racing to the underlying storage.
+* Kills the wave-1 stampede where N identical concurrent requests all
+* miss the cache simultaneously and all hit Redis before the first has
+* populated the entry.
+*/
+var HardBlockVerdictCache = class {
+	constructor(ttlMs = DEFAULT_VERDICT_CACHE_TTL_MS, maxEntries = DEFAULT_VERDICT_CACHE_MAX_ENTRIES) {
+		this.ttlMs = ttlMs;
+		this.maxEntries = maxEntries;
+		this.store = /* @__PURE__ */ new Map();
+		this.inflight = /* @__PURE__ */ new Map();
+	}
+	get(key) {
+		const entry = this.store.get(key);
+		if (entry === void 0) return;
+		if (entry.expiresAt <= Date.now()) {
+			this.store.delete(key);
+			return;
+		}
+		this.store.delete(key);
+		this.store.set(key, entry);
+		return entry.value;
+	}
+	set(key, value) {
+		this.store.delete(key);
+		if (this.store.size >= this.maxEntries) {
+			const oldest = this.store.keys().next().value;
+			if (oldest !== void 0) this.store.delete(oldest);
+		}
+		this.store.set(key, {
+			value,
+			expiresAt: Date.now() + this.ttlMs
+		});
+	}
+	/**
+	* Cache lookup with singleflight dedupe of concurrent misses.
+	*
+	* Fast path: cache hit → return immediately (with LRU move-to-tail
+	* via `get()`).
+	*
+	* Slow path: cache miss →
+	*   1. If an in-flight Promise exists for this key, join it. This
+	*      is the coalescing behaviour — N concurrent identical misses
+	*      all await the same underlying storage call.
+	*   2. Otherwise, invoke `compute()`, register the Promise, and
+	*      populate the cache with the result on resolve. The Promise
+	*      is removed from the in-flight map in a `finally` so a
+	*      rejection doesn't wedge future callers.
+	*
+	* Rejection semantics: if `compute()` throws, all joined waiters
+	* see the same rejection. Callers should handle it — the underlying
+	* `getPrioritisedAccessRule` catches its own storage errors and
+	* returns `[]` (fail-open), so in practice this never propagates.
+	*/
+	async getOrCompute(key, compute) {
+		const cached = this.get(key);
+		if (cached !== void 0) return cached;
+		const existing = this.inflight.get(key);
+		if (existing !== void 0) return existing;
+		const promise = (async () => {
+			const value = await compute();
+			this.set(key, value);
+			return value;
+		})();
+		this.inflight.set(key, promise);
+		try {
+			return await promise;
+		} finally {
+			if (this.inflight.get(key) === promise) this.inflight.delete(key);
+		}
+	}
+	clear() {
+		this.store.clear();
+		this.inflight.clear();
+	}
+	size() {
+		return this.store.size;
+	}
+	inflightSize() {
+		return this.inflight.size;
+	}
 };
-export {
-  DEFAULT_VERDICT_CACHE_MAX_ENTRIES,
-  DEFAULT_VERDICT_CACHE_TTL_MS,
-  HardBlockVerdictCache,
-  hardBlockCacheKey
+var hardBlockCacheKey = (clientId, userScope, blockOnly) => {
+	return `${blockOnly ? "1" : "0"}|${[
+		clientId ?? "",
+		userScope.numericIp === void 0 ? "" : userScope.numericIp.toString(),
+		userScope.numericIpMaskMin === void 0 ? "" : userScope.numericIpMaskMin.toString(),
+		userScope.numericIpMaskMax === void 0 ? "" : userScope.numericIpMaskMax.toString(),
+		userScope.userId ?? "",
+		userScope.ja4Hash ?? "",
+		userScope.headersHash ?? "",
+		userScope.userAgentHash ?? "",
+		userScope.headHash ?? "",
+		userScope.coords ?? "",
+		userScope.countryCode ?? "",
+		userScope.asn === void 0 ? "" : String(userScope.asn)
+	].join("|")}`;
 };
+//#endregion
+export { DEFAULT_VERDICT_CACHE_MAX_ENTRIES, DEFAULT_VERDICT_CACHE_TTL_MS, HardBlockVerdictCache, hardBlockCacheKey };

package/dist/api/headerCheckMiddleware.js

@@ -1,36 +1,36 @@
+import { validateAddr, validateSiteKey } from "./validateAddress.js";
 import { handleErrors } from "@prosopo/api-express-router";
-import { validateSiteKey, validateAddr } from "./validateAddress.js";
-const headerCheckMiddleware = (env) => {
-  return async (req, res, next) => {
-    try {
-      const user = req.headers["prosopo-user"];
-      const siteKey = req.headers["prosopo-site-key"];
-      if (!user) {
-        unauthorised(res);
-        return;
-      }
-      if (!siteKey) {
-        unauthorised(res);
-        return;
-      }
-      validateSiteKey(siteKey, req.logger);
-      validateAddr(user, void 0, req.logger);
-      req.user = user;
-      req.siteKey = siteKey;
-      req.logger = req.logger.with(
-        {
-          user,
-          siteKey
-        },
-        "header-check"
-      );
-      next();
-    } catch (err) {
-      return handleErrors(err, req, res, next);
-    }
-  };
-};
-const unauthorised = (res) => res.status(401).json({ error: "Unauthorized", message: "Unauthorized" });
-export {
-  headerCheckMiddleware
+//#region src/api/headerCheckMiddleware.ts
+var headerCheckMiddleware = (env) => {
+	return async (req, res, next) => {
+		try {
+			const user = req.headers["prosopo-user"];
+			const siteKey = req.headers["prosopo-site-key"];
+			if (!user) {
+				unauthorised(res);
+				return;
+			}
+			if (!siteKey) {
+				unauthorised(res);
+				return;
+			}
+			validateSiteKey(siteKey, req.logger);
+			validateAddr(user, void 0, req.logger);
+			req.user = user;
+			req.siteKey = siteKey;
+			req.logger = req.logger.with({
+				user,
+				siteKey
+			}, "header-check");
+			next();
+		} catch (err) {
+			return handleErrors(err, req, res, next);
+		}
+	};
 };
+var unauthorised = (res) => res.status(401).json({
+	error: "Unauthorized",
+	message: "Unauthorized"
+});
+//#endregion
+export { headerCheckMiddleware };

package/dist/api/ignoreMiddleware.js

@@ -1,17 +1,15 @@
-import { PublicApiPaths, ApiPrefix } from "@prosopo/types";
+import { ApiPrefix, PublicApiPaths } from "@prosopo/types";
+//#region src/api/ignoreMiddleware.ts
 function ignoreMiddleware() {
-  return (req, res, next) => {
-    if (req.originalUrl.indexOf(PublicApiPaths.Healthz) !== -1) {
-      return next();
-    }
-    if (req.originalUrl.indexOf(ApiPrefix) === -1) {
-      res.statusCode = 404;
-      res.send("Not Found");
-      return;
-    }
-    next();
-  };
+	return (req, res, next) => {
+		if (req.originalUrl.indexOf(PublicApiPaths.Healthz) !== -1) return next();
+		if (req.originalUrl.indexOf(ApiPrefix) === -1) {
+			res.statusCode = 404;
+			res.send("Not Found");
+			return;
+		}
+		next();
+	};
 }
-export {
-  ignoreMiddleware
-};
+//#endregion
+export { ignoreMiddleware };

package/dist/api/ipInfoMiddleware.js

@@ -1,20 +1,18 @@
-const ipInfoMiddleware = (env) => {
-  return async (req, _res, next) => {
-    try {
-      const ip = req.ip;
-      if (ip && env.ipInfoService.isAvailable()) {
-        req.ipInfo = await env.ipInfoService.lookup(ip);
-      }
-      next();
-    } catch (err) {
-      req.logger?.warn?.(() => ({
-        msg: "IP info middleware failed",
-        err
-      }));
-      next();
-    }
-  };
-};
-export {
-  ipInfoMiddleware
+//#region src/api/ipInfoMiddleware.ts
+var ipInfoMiddleware = (env) => {
+	return async (req, _res, next) => {
+		try {
+			const ip = req.ip;
+			if (ip && env.ipInfoService.isAvailable()) req.ipInfo = await env.ipInfoService.lookup(ip);
+			next();
+		} catch (err) {
+			req.logger?.warn?.(() => ({
+				msg: "IP info middleware failed",
+				err
+			}));
+			next();
+		}
+	};
 };
+//#endregion
+export { ipInfoMiddleware };