@rimelight/security 0.0.15 → 0.0.17

package/dist/config/index.d.mts

@@ -1,3 +1,3 @@
-import { n as SecurityOptions, t as ConstructionOptions } from "../types-BdTXMZBc.mjs";
+import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "../types-Dcvwj-af.mjs";
 import { buildCspHeader } from "../csp.mjs";
-export { ConstructionOptions, SecurityOptions, buildCspHeader };
+export { ConstructionOptions, RateLimitOptions, RateLimiterBinding, SecurityOptions, buildCspHeader };

package/dist/csp.d.mts

@@ -1,4 +1,4 @@
-import { n as SecurityOptions } from "./types-BdTXMZBc.mjs";
+import { i as SecurityOptions } from "./types-Dcvwj-af.mjs";
 //#region src/csp.d.ts
 /**
  * Builds the Content-Security-Policy header string dynamically for a given request nonce.

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { n as SecurityOptions, t as ConstructionOptions } from "./types-BdTXMZBc.mjs";
+import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "./types-Dcvwj-af.mjs";
 import { buildCspHeader } from "./csp.mjs";
 import { RimelightSecurityPlugin, SecurityPluginOptions, security } from "./vite.mjs";
 import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./middleware/construction.mjs";
-export { CONSTRUCTION_GUEST_COOKIE, ConstructionOptions, RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, construction, isConstructionGuest, security, security as sri, signInConstructionGuest };
+export { CONSTRUCTION_GUEST_COOKIE, ConstructionOptions, RateLimitOptions, RateLimiterBinding, RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, construction, isConstructionGuest, security, security as sri, signInConstructionGuest };

package/dist/middleware/construction.d.mts

@@ -1,4 +1,4 @@
-import { t as ConstructionOptions } from "../types-BdTXMZBc.mjs";
+import { t as ConstructionOptions } from "../types-Dcvwj-af.mjs";
 //#region src/middleware/construction.d.ts
 export declare const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
 /**

package/dist/middleware/index.d.mts

@@ -1,4 +1,5 @@
 import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./construction.mjs";
 import { devOnly } from "./dev-only.mjs";
 import { security } from "./security.mjs";
-export { CONSTRUCTION_GUEST_COOKIE, construction, devOnly, isConstructionGuest, security, signInConstructionGuest };
+import { ratelimit } from "./ratelimit.mjs";
+export { CONSTRUCTION_GUEST_COOKIE, construction, devOnly, isConstructionGuest, ratelimit, security, signInConstructionGuest };

package/dist/middleware/index.mjs

@@ -1,4 +1,5 @@
 import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./construction.mjs";
 import { devOnly } from "./dev-only.mjs";
 import { security } from "./security.mjs";
-export { CONSTRUCTION_GUEST_COOKIE, construction, devOnly, isConstructionGuest, security, signInConstructionGuest };
+import { ratelimit } from "./ratelimit.mjs";
+export { CONSTRUCTION_GUEST_COOKIE, construction, devOnly, isConstructionGuest, ratelimit, security, signInConstructionGuest };

package/dist/middleware/ratelimit.d.mts

@@ -0,0 +1,22 @@
+import { n as RateLimitOptions } from "../types-Dcvwj-af.mjs";
+//#region src/middleware/ratelimit.d.ts
+/**
+ * Middleware to enforce rate limits on sensitive endpoints using Cloudflare Rate Limiting bindings.
+ *
+ * @example
+ *   // fetch.ts
+ *   import { ratelimit } from "@rimelight/security/middleware"
+ *   app.use(ratelimit())
+ *
+ * @example
+ *   // Custom configuration
+ *   app.use(
+ *     ratelimit({
+ *       routes: ["/api/checkout", "/auth/login"],
+ *       retryAfter: 30,
+ *       bindingName: "MY_RATE_LIMITER"
+ *     })
+ *   )
+ */
+export declare const ratelimit: (options?: RateLimitOptions) => (c: any, next: () => Promise<any> | any) => Promise<Response | any>;
+//#endregion

package/dist/middleware/ratelimit.mjs

@@ -0,0 +1,74 @@
+//#region src/middleware/ratelimit.ts
+const DEFAULT_SENSITIVE_ROUTES = [
+	"/auth/sign-in",
+	"/auth/sign-up",
+	"/api/upload",
+	"/api/chat"
+];
+/**
+* Middleware to enforce rate limits on sensitive endpoints using Cloudflare Rate Limiting bindings.
+*
+* @example
+*   // fetch.ts
+*   import { ratelimit } from "@rimelight/security/middleware"
+*   app.use(ratelimit())
+*
+* @example
+*   // Custom configuration
+*   app.use(
+*     ratelimit({
+*       routes: ["/api/checkout", "/auth/login"],
+*       retryAfter: 30,
+*       bindingName: "MY_RATE_LIMITER"
+*     })
+*   )
+*/
+const ratelimit = (options = {}) => {
+	const { bindingName = "MY_RATE_LIMITER", routes = DEFAULT_SENSITIVE_ROUTES, retryAfter = 60, fallback = "pass", keyGenerator = (c) => c.req.header("CF-Connecting-IP") || c.req.header("x-forwarded-for") || "unknown", onRateLimited = (c, retry) => {
+		if (typeof c.json === "function") return c.json({
+			error: "Too Many Requests",
+			message: "Rate limit exceeded. Please try again later."
+		}, 429, { "Retry-After": String(retry) });
+		return new Response(JSON.stringify({
+			error: "Too Many Requests",
+			message: "Rate limit exceeded. Please try again later."
+		}), {
+			status: 429,
+			headers: {
+				"Content-Type": "application/json",
+				"Retry-After": String(retry)
+			}
+		});
+	} } = options;
+	return async (c, next) => {
+		const path = c?.req?.path || "";
+		if (!(typeof routes === "function" ? routes(c) : routes.some((route) => typeof route === "string" ? path.includes(route) : route.test(path)))) return next();
+		const bindings = c?.env;
+		const limiter = options.limiter ? options.limiter(c) : bindings?.[bindingName];
+		if (!limiter || typeof limiter.limit !== "function") {
+			if (fallback === "pass") return next();
+			if (typeof c.json === "function") return c.json({ error: "Rate limiter not configured" }, 500);
+			return new Response(JSON.stringify({ error: "Rate limiter not configured" }), {
+				status: 500,
+				headers: { "Content-Type": "application/json" }
+			});
+		}
+		try {
+			const clientKey = await keyGenerator(c);
+			const { success } = await limiter.limit({ key: clientKey });
+			if (!success) return onRateLimited(c, retryAfter);
+		} catch (error) {
+			console.error("[Rate Limit Error]", error);
+			if (fallback !== "pass") {
+				if (typeof c.json === "function") return c.json({ error: "Rate limit check failed" }, 500);
+				return new Response(JSON.stringify({ error: "Rate limit check failed" }), {
+					status: 500,
+					headers: { "Content-Type": "application/json" }
+				});
+			}
+		}
+		return next();
+	};
+};
+//#endregion
+export { ratelimit };

package/dist/middleware/security.d.mts

@@ -1,4 +1,4 @@
-import { n as SecurityOptions } from "../types-BdTXMZBc.mjs";
+import { i as SecurityOptions } from "../types-Dcvwj-af.mjs";
 //#region src/middleware/security.d.ts
 /**
  * Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,

package/dist/{types-BdTXMZBc.d.mts → types-Dcvwj-af.d.mts}

@@ -117,5 +117,56 @@ interface ConstructionOptions {
     redirectUrl: string;
   }) => Response | Promise<Response>;
 }
+interface RateLimiterBinding {
+  limit(options: {
+    key: string;
+  }): Promise<{
+    success: boolean;
+  }>;
+}
+interface RateLimitOptions {
+  /**
+   * Name of the Cloudflare Rate Limiter binding on `c.env` / `env`.
+   *
+   * @default "MY_RATE_LIMITER"
+   */
+  bindingName?: string;
+  /**
+   * Direct rate limiter instance or binding resolver.
+   */
+  limiter?: (c: any) => RateLimiterBinding | undefined;
+  /**
+   * Routes / path prefixes or a custom predicate to check if the request should be rate limited.
+   * Can be an array of strings/RegExp or a matcher function `(c: any) => boolean`.
+   *
+   * @default ["/auth/sign-in", "/auth/sign-up", "/api/upload", "/api/chat"]
+   */
+  routes?: (string | RegExp)[] | ((c: any) => boolean);
+  /**
+   * Function to extract the rate limit key from the context (e.g., client IP, user ID, API key).
+   *
+   * @default c.req.header("CF-Connecting-IP") || c.req.header("x-forwarded-for") || "unknown"
+   */
+  keyGenerator?: (c: any) => string | Promise<string>;
+  /**
+   * Retry-After header value in seconds.
+   *
+   * @default 60
+   */
+  retryAfter?: number;
+  /**
+   * Behavior when no rate limiter binding exists (e.g., in local development without mock binding).
+   *
+   * - "pass": Fail open (call `next()`)
+   * - "block": Fail closed (return 429/500)
+   *
+   * @default "pass"
+   */
+  fallback?: "pass" | "block";
+  /**
+   * Custom handler when the rate limit is exceeded.
+   */
+  onRateLimited?: (c: any, retryAfter: number) => Response | Promise<Response>;
+}
 //#endregion
-export { SecurityOptions as n, ConstructionOptions as t };
+export { SecurityOptions as i, RateLimitOptions as n, RateLimiterBinding as r, ConstructionOptions as t };

package/dist/types.d.mts

@@ -1,2 +1,2 @@
-import { n as SecurityOptions, t as ConstructionOptions } from "./types-BdTXMZBc.mjs";
-export { ConstructionOptions, SecurityOptions };
+import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "./types-Dcvwj-af.mjs";
+export { ConstructionOptions, RateLimitOptions, RateLimiterBinding, SecurityOptions };

package/dist/vite.d.mts

@@ -1,4 +1,4 @@
-import { n as SecurityOptions } from "./types-BdTXMZBc.mjs";
+import { i as SecurityOptions } from "./types-Dcvwj-af.mjs";
 //#region src/vite.d.ts
 export interface RimelightSecurityPlugin {
   name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -39,13 +39,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@rimelight/ui": "0.0.52"
+    "@rimelight/ui": "0.0.56"
   },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.11",
-    "astro": "7.3.2",
-    "hono": "4.13.7",
+    "@rimelight/config": "0.0.13",
+    "astro": "7.3.3",
+    "hono": "4.13.8",
     "typescript": "6.0.3"
   },
   "peerDependencies": {