@riocrypto/common-server 1.0.2275 → 1.0.2277

package/build/helpers/sanitize-bank-account-doc.d.ts

@@ -47,6 +47,7 @@
 /// <reference types="mongoose/types/virtuals" />
 /// <reference types="mongoose" />
 /// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
 /// <reference types="mongoose/types/inferschematype" />
 /// <reference types="mongoose/types/inferrawdoctype" />
 import { BankAccountDoc } from "@riocrypto/common-server";

package/build/helpers/sanitize-crypto-address-doc.d.ts

@@ -47,6 +47,7 @@
 /// <reference types="mongoose/types/virtuals" />
 /// <reference types="mongoose" />
 /// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
 /// <reference types="mongoose/types/inferschematype" />
 /// <reference types="mongoose/types/inferrawdoctype" />
 import { CryptoAddressDoc } from "@riocrypto/common-server";

package/build/helpers/sanitize-order-doc.d.ts

@@ -47,6 +47,7 @@
 /// <reference types="mongoose/types/virtuals" />
 /// <reference types="mongoose" />
 /// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
 /// <reference types="mongoose/types/inferschematype" />
 /// <reference types="mongoose/types/inferrawdoctype" />
 import { OrderDoc } from "@riocrypto/common-server";

package/build/helpers/sanitize-user-doc.d.ts

@@ -47,6 +47,7 @@
 /// <reference types="mongoose/types/virtuals" />
 /// <reference types="mongoose" />
 /// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
 /// <reference types="mongoose/types/inferschematype" />
 /// <reference types="mongoose/types/inferrawdoctype" />
 import { UserDoc } from "@riocrypto/common-server";

package/build/index.d.ts

@@ -7,6 +7,7 @@ export * from "./middlewares/set-trace";
 export * from "./middlewares/require-min-role";
 export * from "./middlewares/require-min-admin-role";
 export * from "./middlewares/verify-csrf-token";
+export * from "./middlewares/dynamic-rate-limiter";
 export * from "./services/apiKey";
 export * from "./services/password";
 export * from "./services/logger";
@@ -91,6 +92,7 @@ export * from "./models/STP-settings";
 export * from "./models/dashboard-push-notification-subscription";
 export * from "./models/webauthn-credential";
 export * from "./models/admin-webauthn-credential";
+export * from "./models/custom-rate-limit";
 export * from "./clients/axios-with-logging";
 export * from "./clients/slack-client";
 export * from "./clients/fireblocks-client";

package/build/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./middlewares/set-trace"), exports);
 __exportStar(require("./middlewares/require-min-role"), exports);
 __exportStar(require("./middlewares/require-min-admin-role"), exports);
 __exportStar(require("./middlewares/verify-csrf-token"), exports);
+__exportStar(require("./middlewares/dynamic-rate-limiter"), exports);
 __exportStar(require("./services/apiKey"), exports);
 __exportStar(require("./services/password"), exports);
 __exportStar(require("./services/logger"), exports);
@@ -107,6 +108,7 @@ __exportStar(require("./models/STP-settings"), exports);
 __exportStar(require("./models/dashboard-push-notification-subscription"), exports);
 __exportStar(require("./models/webauthn-credential"), exports);
 __exportStar(require("./models/admin-webauthn-credential"), exports);
+__exportStar(require("./models/custom-rate-limit"), exports);
 __exportStar(require("./clients/axios-with-logging"), exports);
 __exportStar(require("./clients/slack-client"), exports);
 __exportStar(require("./clients/fireblocks-client"), exports);

package/build/middlewares/dynamic-rate-limiter.d.ts

@@ -0,0 +1,10 @@
+import { Request, Response, NextFunction } from "express";
+import { Options as RateLimitOptions } from "express-rate-limit";
+import { Mongoose } from "mongoose";
+export interface DynamicRateLimiterOptions extends Partial<RateLimitOptions> {
+    windowMs: number;
+    max: number;
+    mongooseConnection: Mongoose;
+    cacheTtlMs?: number;
+}
+export declare function createDynamicRateLimiter(options: DynamicRateLimiterOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/build/middlewares/dynamic-rate-limiter.js

@@ -0,0 +1,148 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDynamicRateLimiter = void 0;
+const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+// Removed path-to-regexp import
+// Adjust the import path according to your project structure
+const custom_rate_limit_1 = require("../models/custom-rate-limit");
+// Cache for rate limiter instances
+const limiterInstanceCache = new Map();
+// Cache for compiled RegExp objects from path strings
+// Key: regex string pattern, Value: compiled RegExp object
+const regexCache = new Map();
+// In-memory cache for custom IP rules
+let customIpRulesCache = new Map();
+let lastCacheRefreshTime = 0;
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+function refreshCustomIpRulesCache(CustomRateLimit, filePathForLog) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const allRules = yield CustomRateLimit.find({}).lean();
+            const newCache = new Map();
+            allRules.forEach((rule) => {
+                if (rule.ipAddress) {
+                    // Pre-compile and cache regexes when rules are loaded/refreshed
+                    if (rule.routes && Array.isArray(rule.routes)) {
+                        rule.routes.forEach((routeRule) => {
+                            // Use any temporarily if lean typing is tricky
+                            if (typeof routeRule.path === "string" &&
+                                !regexCache.has(routeRule.path)) {
+                                try {
+                                    regexCache.set(routeRule.path, new RegExp(routeRule.path));
+                                }
+                                catch (e) {
+                                    console.error(`[DynamicRateLimiter Refresh] Failed to compile regex: '${routeRule.path}' for IP ${rule.ipAddress}. Skipping rule path. Error:`, e);
+                                    // Optionally mark the rule path as invalid or handle differently
+                                }
+                            }
+                        });
+                    }
+                    newCache.set(rule.ipAddress, rule);
+                }
+            });
+            customIpRulesCache = newCache;
+            lastCacheRefreshTime = Date.now();
+        }
+        catch (error) {
+            console.error(`[DynamicRateLimiter ${filePathForLog}] Error refreshing custom IP rules cache:`, error);
+        }
+    });
+}
+function createDynamicRateLimiter(options) {
+    const { windowMs: defaultWindowMs, // Rename for clarity
+    max: defaultMax, // Rename for clarity
+    mongooseConnection, cacheTtlMs = DEFAULT_CACHE_TTL_MS, 
+    // Capture other express-rate-limit options passed in
+    message, standardHeaders, legacyHeaders, skip, requestPropertyName } = options, 
+    // Add any other valid RateLimitOptions you might pass
+    otherRateLimitOptions = __rest(options, ["windowMs", "max", "mongooseConnection", "cacheTtlMs", "message", "standardHeaders", "legacyHeaders", "skip", "requestPropertyName"]) // Use a specific variable if you know exactly what else you pass
+    ;
+    if (!mongooseConnection) {
+        throw new Error("[DynamicRateLimiter] Mongoose connection is required.");
+    }
+    const CustomRateLimit = (0, custom_rate_limit_1.buildCustomRateLimit)(mongooseConnection);
+    refreshCustomIpRulesCache(CustomRateLimit, "initialization");
+    return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+        try {
+            // Refresh cache if stale
+            if (Date.now() - lastCacheRefreshTime > cacheTtlMs ||
+                (customIpRulesCache.size === 0 && lastCacheRefreshTime === 0)) {
+                yield refreshCustomIpRulesCache(CustomRateLimit, req.path);
+            }
+            const clientIp = req.ip;
+            let currentLimit = defaultMax; // Use destructured default
+            let currentWindowMs = defaultWindowMs; // Use destructured default
+            let ruleIdentifier = "default";
+            let customRule;
+            if (clientIp) {
+                customRule = customIpRulesCache.get(clientIp);
+            }
+            if (customRule) {
+                // Check if routes array exists and is not empty
+                const appliesToCurrentRoute = !customRule.routes || // Should not happen if default is []
+                    customRule.routes.length === 0 || // Empty array means apply custom limit to ALL requests for this IP
+                    customRule.routes.some((rule) => {
+                        // Check HTTP Method first (faster check)
+                        const methodMatch = rule.action === "*" || rule.action === req.method.toUpperCase();
+                        if (!methodMatch) {
+                            return false;
+                        }
+                        // Get the compiled regex from cache
+                        const regex = regexCache.get(rule.path);
+                        if (!regex) {
+                            // Regex failed compilation during refresh, skip this rule path
+                            // Error was already logged during refreshCustomIpRulesCache
+                            return false;
+                        }
+                        // Test the path against the regex
+                        return regex.test(req.path);
+                    });
+                if (appliesToCurrentRoute) {
+                    currentLimit = customRule.limit;
+                    currentWindowMs = customRule.windowMs;
+                    ruleIdentifier = `custom_ip:${clientIp}`;
+                }
+            }
+            // Get/create limiter instance using currentLimit, currentWindowMs, ruleIdentifier
+            const limiterCacheKey = `${currentLimit}-${currentWindowMs}-${ruleIdentifier}`;
+            let selectedLimiter = limiterInstanceCache.get(limiterCacheKey);
+            if (!selectedLimiter) {
+                selectedLimiter = (0, express_rate_limit_1.default)(Object.assign({ windowMs: currentWindowMs, max: currentLimit, keyGenerator: (request) => {
+                        return request.ip || "unknown_ip_for_rate_limit";
+                    }, 
+                    // Pass through other specified options
+                    message: message, standardHeaders: standardHeaders, legacyHeaders: legacyHeaders, skip: skip, requestPropertyName: requestPropertyName }, otherRateLimitOptions));
+                limiterInstanceCache.set(limiterCacheKey, selectedLimiter);
+            }
+            return selectedLimiter(req, res, next);
+        }
+        catch (error) {
+            console.error(`[DynamicRateLimiter ${req.path}] Error in rate limiting middleware (IP: ${req.ip}):`, error);
+            next();
+        }
+    });
+}
+exports.createDynamicRateLimiter = createDynamicRateLimiter;

package/build/models/admin-webauthn-credential.d.ts

@@ -1,4 +1,5 @@
 /// <reference types="node" />
+/// <reference types="node" />
 import { Mongoose, Model, Document } from "mongoose";
 import { AdminAuthDoc } from "./admin-auth";
 export interface AdminWebAuthnCredentialAttrs {

package/build/models/custom-rate-limit.d.ts

@@ -0,0 +1,24 @@
+import mongoose from "mongoose";
+interface RouteRule {
+    path: string;
+    action: string;
+}
+interface CustomRateLimitAttrs {
+    createdAt?: Date;
+    ipAddress: string;
+    limit: number;
+    windowMs: number;
+    routes: RouteRule[];
+}
+interface CustomRateLimitDoc extends mongoose.Document {
+    createdAt: Date;
+    ipAddress: string;
+    limit: number;
+    windowMs: number;
+    routes: RouteRule[];
+}
+interface CustomRateLimitModel extends mongoose.Model<CustomRateLimitDoc> {
+    build(attrs: CustomRateLimitAttrs): CustomRateLimitDoc;
+}
+declare const buildCustomRateLimit: (mongoose: typeof mongoose) => CustomRateLimitModel;
+export { buildCustomRateLimit, CustomRateLimitDoc, CustomRateLimitAttrs, RouteRule, };

package/build/models/custom-rate-limit.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCustomRateLimit = void 0;
+const buildCustomRateLimit = (mongoose) => {
+    // if model is already defined, return it
+    if (mongoose.models.CustomRateLimit) {
+        return mongoose.model("CustomRateLimit");
+    }
+    // Define the schema for the nested RouteRule object
+    const RouteRuleSchema = new mongoose.Schema({
+        path: {
+            type: String,
+            required: [true, "Path (regex string) is required for a route rule"],
+        },
+        action: {
+            type: String,
+            required: [true, "Action (HTTP method) is required for a route rule"],
+            uppercase: true, // Store methods consistently (e.g., 'GET')
+            // Optional: Add enum validation if you want to restrict methods
+            // enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', '*'] // Example enum
+        },
+    }, { _id: false }); // Don't create separate IDs for subdocuments
+    const CustomRateLimitSchema = new mongoose.Schema({
+        createdAt: {
+            type: mongoose.Schema.Types.Date,
+            default: Date.now, // Add default value for createdAt
+        },
+        ipAddress: {
+            type: String,
+            required: true,
+        },
+        limit: {
+            type: Number,
+            required: true,
+        },
+        windowMs: {
+            type: Number,
+            required: true,
+        },
+        routes: {
+            type: [RouteRuleSchema],
+            required: true,
+            // Default to empty array, meaning applies to all routes/methods if not specified
+            default: [],
+        },
+    }, {
+        toJSON: {
+            transform(doc, ret) {
+                ret.id = ret._id;
+                delete ret._id;
+                delete ret.__v;
+            },
+        },
+    });
+    CustomRateLimitSchema.statics.build = (attrs) => {
+        var _a;
+        // Ensure default createdAt is handled if not provided
+        return new CustomRateLimit(Object.assign(Object.assign({}, attrs), { createdAt: (_a = attrs.createdAt) !== null && _a !== void 0 ? _a : new Date() }));
+    };
+    const CustomRateLimit = mongoose.model("CustomRateLimit", CustomRateLimitSchema);
+    return CustomRateLimit;
+};
+exports.buildCustomRateLimit = buildCustomRateLimit;

package/build/models/webauthn-credential.d.ts

@@ -1,4 +1,5 @@
 /// <reference types="node" />
+/// <reference types="node" />
 import { Mongoose, Model, Document } from "mongoose";
 import { AuthDoc } from "./auth";
 export interface WebAuthnCredentialAttrs {

package/build/services/logger.js

@@ -14,8 +14,10 @@ const winston_1 = require("winston");
 class LoggerService {
     constructor() {
         this.maskSensitiveData = (0, winston_1.format)((info) => {
+            var _a, _b, _c, _d, _e;
             // Mask sensitive headers
-            if (info.meta && info.meta.req && info.meta.req.headers) {
+            if ((_b = (_a = info.meta) === null || _a === void 0 ? void 0 : _a.req) === null || _b === void 0 ? void 0 : _b.headers) {
+                // Use optional chaining
                 const headers = info.meta.req.headers;
                 const headerKeysToMask = [
                     "x-api-key",
@@ -24,7 +26,8 @@ class LoggerService {
                 ];
                 headerKeysToMask.forEach((key) => {
                     if (headers[key]) {
-                        headers[key] = this.maskValue(headers[key]); // Use maskValue function
+                        // Type assertion might be needed if headers[key] is not strictly string
+                        headers[key] = this.maskValue(String(headers[key]));
                     }
                 });
                 // Mask cookies specifically
@@ -38,22 +41,26 @@ class LoggerService {
                             key === "refreshToken" ||
                             key === "adminRefreshToken" ||
                             key === "phoneVerifiedJWT") {
-                            return `${key}=${this.maskValue(value, true)}`; // Mask the sensitive cookie
+                            return `${key}=${this.maskValue(value, true)}`;
                         }
-                        return cookie; // Return unmodified if not sensitive
+                        return cookie;
                     })
                         .join("; ");
                 }
             }
             // Mask sensitive request body fields
-            if (info.meta && info.meta.req && info.meta.req.body) {
+            if (((_d = (_c = info.meta) === null || _c === void 0 ? void 0 : _c.req) === null || _d === void 0 ? void 0 : _d.body) &&
+                typeof info.meta.req.body === "object" &&
+                info.meta.req.body !== null) {
+                const requestBody = info.meta.req.body; // Type assertion
                 const requestBodyFieldsToMaskWithLastFour = [
                     "accountNumber",
                     "routingNumber",
                 ];
                 requestBodyFieldsToMaskWithLastFour.forEach((field) => {
-                    if (info.meta.req.body.hasOwnProperty(field)) {
-                        info.meta.req.body[field] = this.maskValue(info.meta.req.body[field], true);
+                    if (requestBody.hasOwnProperty(field) &&
+                        typeof requestBody[field] === "string") {
+                        requestBody[field] = this.maskValue(requestBody[field], true);
                     }
                 });
                 const requestBodyFieldsToMaskWithoutLastFour = [
@@ -64,26 +71,34 @@ class LoggerService {
                     "authenticatorCode",
                 ];
                 requestBodyFieldsToMaskWithoutLastFour.forEach((field) => {
-                    if (info.meta.req.body.hasOwnProperty(field)) {
-                        info.meta.req.body[field] = this.maskValue(info.meta.req.body[field]);
+                    if (requestBody.hasOwnProperty(field) &&
+                        typeof requestBody[field] === "string") {
+                        requestBody[field] = this.maskValue(requestBody[field]);
                     }
                 });
             }
             // Mask sensitive response body fields
-            if (info.meta && info.meta.res && info.meta.res.body) {
+            const resAsAny = (_e = info.meta) === null || _e === void 0 ? void 0 : _e.res;
+            if ((resAsAny === null || resAsAny === void 0 ? void 0 : resAsAny.body) &&
+                typeof resAsAny.body === "object" &&
+                resAsAny.body !== null) {
+                const responseBody = resAsAny.body; // Keep this assertion for object access
                 const responseBodyFieldsToMask = ["secret", "value"];
                 responseBodyFieldsToMask.forEach((field) => {
-                    if (info.meta.res.body.hasOwnProperty(field)) {
-                        info.meta.res.body[field] = this.maskValue(info.meta.res.body[field]); // Use maskValue function
+                    if (responseBody.hasOwnProperty(field) &&
+                        typeof responseBody[field] === "string") {
+                        responseBody[field] = this.maskValue(responseBody[field]);
                     }
                 });
             }
             return info;
         });
         this.requestMethodFilter = (0, winston_1.format)((info) => {
+            var _a, _b;
             const allowedMethods = ["POST", "PATCH", "DELETE"];
             // Only apply filter if req.method is defined
-            if (info.meta && info.meta.req && info.meta.req.method) {
+            if ((_b = (_a = info.meta) === null || _a === void 0 ? void 0 : _a.req) === null || _b === void 0 ? void 0 : _b.method) {
+                // Use optional chaining
                 if (allowedMethods.includes(info.meta.req.method)) {
                     return info;
                 }
@@ -96,41 +111,41 @@ class LoggerService {
         });
         // Custom format to handle CustomError serialization
         this.handleCustomErrorFormat = (0, winston_1.format)((info) => {
+            var _a, _b, _c;
             let error;
             // express-winston errorLogger often puts the error in info.message or info.meta.err
             if (info.message instanceof Error) {
                 error = info.message;
             }
-            else if (info.meta && info.meta.err instanceof Error) {
+            else if (((_a = info.meta) === null || _a === void 0 ? void 0 : _a.err) instanceof Error) {
+                // Use optional chaining
                 error = info.meta.err;
             }
             else if (info.level === "error" &&
                 info.message &&
                 typeof info.message === "object" &&
-                info.message.stack) {
-                // Sometimes the error object might be directly in message for non-express-winston logs
+                info.message.stack // Type assertion to check for stack
+            ) {
                 error = info.message;
             }
             if (error instanceof common_1.CustomError) {
-                // Replace the error object/message with serialized details
-                // Log serialized errors under 'errorDetails' and keep original message if it's just a string
                 info.errorDetails = error.serializeErrors();
                 if (typeof info.message === "object") {
-                    info.message = error.message; // Keep the original error message string
+                    info.message = error.message;
                 }
-                // Prevent Winston from trying to serialize the original complex error object
-                if (info.meta && info.meta.err) {
+                if ((_b = info.meta) === null || _b === void 0 ? void 0 : _b.err) {
+                    // Use optional chaining
                     delete info.meta.err;
                 }
             }
             else if (error) {
-                // For generic errors, ensure the stack is included if available
                 info.errorMessage = error.message;
                 info.errorStack = error.stack;
                 if (typeof info.message === "object") {
                     info.message = error.message;
                 }
-                if (info.meta && info.meta.err) {
+                if ((_c = info.meta) === null || _c === void 0 ? void 0 : _c.err) {
+                    // Use optional chaining
                     delete info.meta.err;
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2275",
+  "version": "1.0.2277",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -34,6 +34,7 @@
     "crypto-js": "^4.2.0",
     "csurf": "^1.11.0",
     "express": "^4.21.1",
+    "express-rate-limit": "^7.5.0",
     "express-validator": "^6.14.2",
     "fireblocks-sdk": "^5.13.0",
     "googleapis": "^135.1.0",