@revealui/core 0.0.0-canary-20260409021642

package/dist/api/rate-limit.js

@@ -0,0 +1,376 @@
+/**
+ * API Rate Limiting
+ *
+ * Implements rate limiting to prevent API abuse
+ */
+import { NextResponse } from 'next/server';
+import { logger } from '../observability/logger.js';
+// WARNING: In-memory store — resets on every serverless cold start or process restart.
+// This module is NOT used by any app in production (API uses apps/api/src/middleware/rate-limit.ts,
+// CMS uses @revealui/auth/server which is DB-backed). Exported for framework consumers only.
+// Replace with a database-backed store before using in production.
+const rateLimitStore = new Map();
+/**
+ * Default key generator (by IP address)
+ */
+function defaultKeyGenerator(request) {
+    // Try to get real IP from headers
+    const forwarded = request.headers.get('x-forwarded-for');
+    const realIp = request.headers.get('x-real-ip');
+    if (forwarded) {
+        const parts = forwarded.split(',');
+        return parts[0]?.trim() || 'unknown';
+    }
+    if (realIp) {
+        return realIp;
+    }
+    // Fallback to unknown (NextRequest doesn't have ip property)
+    return 'unknown';
+}
+/**
+ * Check if rate limit exceeded
+ */
+export function checkRateLimit(request, config) {
+    const { windowMs, maxRequests, keyGenerator = defaultKeyGenerator, skip } = config;
+    // Skip rate limiting if configured
+    if (skip?.(request)) {
+        return {
+            allowed: true,
+            limit: maxRequests,
+            remaining: maxRequests,
+            resetTime: Date.now() + windowMs,
+        };
+    }
+    // Get key
+    const key = keyGenerator(request);
+    // Get or create entry
+    const now = Date.now();
+    let entry = rateLimitStore.get(key);
+    // Reset if window expired
+    if (!entry || now > entry.resetTime) {
+        entry = {
+            count: 0,
+            resetTime: now + windowMs,
+        };
+        rateLimitStore.set(key, entry);
+    }
+    // Increment count
+    entry.count++;
+    // Check limit
+    const allowed = entry.count <= maxRequests;
+    const remaining = Math.max(0, maxRequests - entry.count);
+    return {
+        allowed,
+        limit: maxRequests,
+        remaining,
+        resetTime: entry.resetTime,
+    };
+}
+/**
+ * Create rate limit middleware
+ */
+export function createRateLimitMiddleware(config) {
+    return async (request, next) => {
+        const result = checkRateLimit(request, config);
+        // Set rate limit headers
+        const response = result.allowed
+            ? await next()
+            : config.handler
+                ? config.handler(request)
+                : createRateLimitResponse(result);
+        // Add rate limit headers
+        response.headers.set('X-RateLimit-Limit', result.limit.toString());
+        response.headers.set('X-RateLimit-Remaining', result.remaining.toString());
+        response.headers.set('X-RateLimit-Reset', new Date(result.resetTime).toISOString());
+        return response;
+    };
+}
+/**
+ * Create rate limit exceeded response
+ */
+function createRateLimitResponse(result) {
+    const retryAfter = Math.ceil((result.resetTime - Date.now()) / 1000);
+    return NextResponse.json({
+        error: 'Too Many Requests',
+        message: 'Rate limit exceeded. Please try again later.',
+        limit: result.limit,
+        remaining: result.remaining,
+        resetTime: new Date(result.resetTime).toISOString(),
+        retryAfter,
+    }, {
+        status: 429,
+        headers: {
+            'Retry-After': retryAfter.toString(),
+        },
+    });
+}
+/**
+ * Cleanup expired rate limit entries across all stores
+ */
+export function cleanupRateLimits() {
+    const now = Date.now();
+    let cleaned = 0;
+    for (const [key, entry] of rateLimitStore.entries()) {
+        if (now > entry.resetTime) {
+            rateLimitStore.delete(key);
+            cleaned++;
+        }
+    }
+    // Evict stale sliding window entries (no timestamps within last hour)
+    for (const [key, entry] of slidingWindowStore.entries()) {
+        entry.timestamps = entry.timestamps.filter((ts) => now - ts < 3_600_000);
+        if (entry.timestamps.length === 0) {
+            slidingWindowStore.delete(key);
+            cleaned++;
+        }
+    }
+    // Evict stale token bucket entries (idle for more than 1 hour)
+    for (const [key, entry] of tokenBucketStore.entries()) {
+        if (now - entry.lastRefill > 3_600_000) {
+            tokenBucketStore.delete(key);
+            cleaned++;
+        }
+    }
+    return cleaned;
+}
+/**
+ * Start rate limit cleanup interval
+ */
+export function startRateLimitCleanup(intervalMs = 60000) {
+    return setInterval(() => {
+        const cleaned = cleanupRateLimits();
+        if (cleaned > 0) {
+            logger.info('Cleaned up expired rate limit entries', { count: cleaned });
+        }
+    }, intervalMs);
+}
+/**
+ * Get rate limit stats
+ */
+export function getRateLimitStats() {
+    const now = Date.now();
+    let active = 0;
+    let expired = 0;
+    for (const entry of rateLimitStore.values()) {
+        if (now > entry.resetTime) {
+            expired++;
+        }
+        else {
+            active++;
+        }
+    }
+    return {
+        total: rateLimitStore.size,
+        active,
+        expired,
+    };
+}
+/**
+ * Default rate limit presets (immutable reference copy)
+ */
+const DEFAULT_RATE_LIMIT_PRESETS = {
+    // Very strict (10 requests per minute)
+    veryStrict: {
+        windowMs: 60 * 1000,
+        maxRequests: 10,
+    },
+    // Strict (30 requests per minute)
+    strict: {
+        windowMs: 60 * 1000,
+        maxRequests: 30,
+    },
+    // Standard (100 requests per minute)
+    standard: {
+        windowMs: 60 * 1000,
+        maxRequests: 100,
+    },
+    // Relaxed (500 requests per minute)
+    relaxed: {
+        windowMs: 60 * 1000,
+        maxRequests: 500,
+    },
+    // Per hour (1000 requests per hour)
+    hourly: {
+        windowMs: 60 * 60 * 1000,
+        maxRequests: 1000,
+    },
+    // Per day (10000 requests per day)
+    daily: {
+        windowMs: 24 * 60 * 60 * 1000,
+        maxRequests: 10000,
+    },
+};
+/** Mutable presets (overridable via configureRateLimitPresets) */
+let rateLimitPresets = {
+    ...DEFAULT_RATE_LIMIT_PRESETS,
+};
+/**
+ * Override one or more rate limit presets.
+ *
+ * Unknown keys create new presets; existing keys are merged with defaults.
+ */
+export function configureRateLimitPresets(overrides) {
+    for (const [key, override] of Object.entries(overrides)) {
+        const base = DEFAULT_RATE_LIMIT_PRESETS[key] ?? {
+            windowMs: 60_000,
+            maxRequests: 100,
+        };
+        rateLimitPresets[key] = { ...base, ...override };
+    }
+}
+/**
+ * Get the current (possibly overridden) rate limit presets.
+ */
+export function getRateLimitPresets() {
+    return rateLimitPresets;
+}
+/**
+ * Reset all presets to their defaults.
+ */
+export function resetRateLimitPresets() {
+    rateLimitPresets = { ...DEFAULT_RATE_LIMIT_PRESETS };
+}
+/**
+ * Rate limit presets — backward-compatible accessor.
+ *
+ * Reads from the mutable `rateLimitPresets` so overrides from
+ * `configureRateLimitPresets()` are reflected automatically.
+ */
+export const RATE_LIMIT_PRESETS = new Proxy({}, {
+    get(_target, prop) {
+        return rateLimitPresets[prop];
+    },
+    ownKeys() {
+        return Object.keys(rateLimitPresets);
+    },
+    getOwnPropertyDescriptor(_target, prop) {
+        if (prop in rateLimitPresets) {
+            return {
+                configurable: true,
+                enumerable: true,
+                value: rateLimitPresets[prop],
+            };
+        }
+        return undefined;
+    },
+    has(_target, prop) {
+        return prop in rateLimitPresets;
+    },
+});
+/**
+ * Rate limit by user ID
+ */
+export function createUserRateLimit(config) {
+    return createRateLimitMiddleware({
+        ...config,
+        keyGenerator: (request) => {
+            // Get user ID from auth header or session
+            const userId = request.headers.get('x-user-id') || 'anonymous';
+            return `user:${userId}`;
+        },
+    });
+}
+/**
+ * Rate limit by API key
+ */
+export function createAPIKeyRateLimit(config) {
+    return createRateLimitMiddleware({
+        ...config,
+        keyGenerator: (request) => {
+            const apiKey = request.headers.get('x-api-key') || 'unknown';
+            return `apikey:${apiKey}`;
+        },
+    });
+}
+/**
+ * Rate limit by endpoint
+ */
+export function createEndpointRateLimit(config) {
+    return createRateLimitMiddleware({
+        ...config,
+        keyGenerator: (request) => {
+            const ip = defaultKeyGenerator(request);
+            const url = new URL(request.url);
+            const path = url.pathname;
+            return `${ip}:${path}`;
+        },
+    });
+}
+const slidingWindowStore = new Map();
+export function checkSlidingWindowRateLimit(request, config) {
+    const { windowMs, maxRequests, keyGenerator = defaultKeyGenerator } = config;
+    const key = keyGenerator(request);
+    const now = Date.now();
+    // Get or create entry
+    let entry = slidingWindowStore.get(key);
+    if (!entry) {
+        entry = { timestamps: [] };
+        slidingWindowStore.set(key, entry);
+    }
+    // Remove expired timestamps
+    entry.timestamps = entry.timestamps.filter((ts) => now - ts < windowMs);
+    // Check limit
+    const allowed = entry.timestamps.length < maxRequests;
+    if (allowed) {
+        entry.timestamps.push(now);
+    }
+    return {
+        allowed,
+        limit: maxRequests,
+        remaining: Math.max(0, maxRequests - entry.timestamps.length),
+    };
+}
+const tokenBucketStore = new Map();
+export function checkTokenBucketRateLimit(request, config) {
+    const { maxRequests, refillRate, windowMs, keyGenerator = defaultKeyGenerator } = config;
+    const key = keyGenerator(request);
+    const now = Date.now();
+    // Get or create entry
+    let entry = tokenBucketStore.get(key);
+    if (!entry) {
+        entry = {
+            tokens: maxRequests,
+            lastRefill: now,
+        };
+        tokenBucketStore.set(key, entry);
+    }
+    // Refill tokens
+    const timePassed = now - entry.lastRefill;
+    const tokensToAdd = Math.floor((timePassed / windowMs) * refillRate);
+    if (tokensToAdd > 0) {
+        entry.tokens = Math.min(maxRequests, entry.tokens + tokensToAdd);
+        entry.lastRefill = now;
+    }
+    // Check if tokens available
+    const allowed = entry.tokens > 0;
+    if (allowed) {
+        entry.tokens--;
+    }
+    return {
+        allowed,
+        limit: maxRequests,
+        remaining: entry.tokens,
+    };
+}
+/**
+ * Clear rate limit for specific key
+ */
+export function clearRateLimit(key) {
+    rateLimitStore.delete(key);
+    slidingWindowStore.delete(key);
+    tokenBucketStore.delete(key);
+}
+/**
+ * Clear all rate limits
+ */
+export function clearAllRateLimits() {
+    rateLimitStore.clear();
+    slidingWindowStore.clear();
+    tokenBucketStore.clear();
+}
+/**
+ * Get rate limit info for key
+ */
+export function getRateLimitInfo(key) {
+    return rateLimitStore.get(key) || null;
+}

package/dist/api/response-cache.d.ts

@@ -0,0 +1,125 @@
+/**
+ * API Response Caching Layer
+ *
+ * Implements HTTP caching for API responses
+ */
+import { type NextRequest, NextResponse } from 'next/server';
+interface CacheOptions {
+    ttl?: number;
+    staleWhileRevalidate?: number;
+    tags?: string[];
+    vary?: string[];
+    private?: boolean;
+    noStore?: boolean;
+}
+/**
+ * Generate cache key from request
+ */
+export declare function generateCacheKey(request: NextRequest): string;
+/**
+ * Get cached response
+ */
+export declare function getCachedResponse(request: NextRequest): Promise<NextResponse | null>;
+/**
+ * Set cached response
+ */
+export declare function setCachedResponse(request: NextRequest, response: NextResponse, options?: CacheOptions): Promise<void>;
+/**
+ * Invalidate cache by key
+ */
+export declare function invalidateCacheKey(key: string): void;
+/**
+ * Invalidate cache by pattern
+ */
+export declare function invalidateCachePattern(pattern: string): number;
+/**
+ * Invalidate cache by tags
+ */
+export declare function invalidateCacheTags(tags: string[]): number;
+/**
+ * Clear all cache
+ */
+export declare function clearCache(): void;
+/**
+ * Set Cache-Control headers
+ */
+export declare function setCacheHeaders(response: NextResponse, options: CacheOptions): NextResponse;
+/**
+ * Create caching middleware
+ */
+export declare function createCacheMiddleware(options?: CacheOptions): (request: NextRequest, next: () => Promise<NextResponse>) => Promise<NextResponse<unknown>>;
+/**
+ * Get cache statistics
+ */
+export declare function getCacheStats(): {
+    totalEntries: number;
+    validEntries: number;
+    expiredEntries: number;
+    totalSize: number;
+    averageSize: number;
+};
+/**
+ * Purge expired entries
+ */
+export declare function purgeExpiredCache(): number;
+/**
+ * Start cache cleanup interval
+ */
+export declare function startCacheCleanup(intervalMs?: number): NodeJS.Timeout;
+/**
+ * Cache response with ETag
+ */
+export declare function withETag(response: NextResponse, content: string): NextResponse;
+/**
+ * Check if request has matching ETag
+ */
+export declare function checkETag(request: NextRequest, etag: string): boolean;
+/**
+ * Create 304 Not Modified response
+ */
+export declare function createNotModifiedResponse(): NextResponse;
+/**
+ * Cache presets for common scenarios
+ */
+export declare const CACHE_PRESETS: {
+    readonly noCache: {
+        readonly noStore: true;
+    };
+    readonly short: {
+        readonly ttl: 60;
+        readonly staleWhileRevalidate: 30;
+    };
+    readonly medium: {
+        readonly ttl: 300;
+        readonly staleWhileRevalidate: 60;
+    };
+    readonly long: {
+        readonly ttl: 3600;
+        readonly staleWhileRevalidate: 300;
+    };
+    readonly veryLong: {
+        readonly ttl: 86400;
+        readonly staleWhileRevalidate: 3600;
+    };
+    readonly immutable: {
+        readonly ttl: 31536000;
+        readonly private: false;
+    };
+    readonly private: {
+        readonly ttl: 300;
+        readonly private: true;
+    };
+    readonly public: {
+        readonly ttl: 3600;
+        readonly private: false;
+    };
+};
+/**
+ * Cache API response
+ */
+export declare function cacheAPIResponse<T>(key: string, responseFn: () => Promise<T>, options?: CacheOptions): Promise<{
+    data: T;
+    cached: boolean;
+}>;
+export {};
+//# sourceMappingURL=response-cache.d.ts.map

package/dist/api/response-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-cache.d.ts","sourceRoot":"","sources":["../../src/api/response-cache.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7D,UAAU,YAAY;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAW7D;AAyBD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA0B1F;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,EACtB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAY9D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAW1D;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,YAAY,CA6B3F;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,YAAiB,IAChD,SAAS,WAAW,EAAE,MAAM,MAAM,OAAO,CAAC,YAAY,CAAC,oCAqBtE;AAED;;GAEG;AACH,wBAAgB,aAAa;;;;;;EA0B5B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAc1C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,GAAE,MAAc,GAAG,MAAM,CAAC,OAAO,CAO5E;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAQ9E;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,YAAY,CAKxD;AAED;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+ChB,CAAC;AAEX;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC5B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAsCvC"}