@riocrypto/common-server 1.0.2275 → 1.0.2278

package/build/helpers/sanitize-bank-account-doc.d.ts

@@ -47,6 +47,7 @@
 /// <reference types="mongoose/types/virtuals" />
 /// <reference types="mongoose" />
 /// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
 /// <reference types="mongoose/types/inferschematype" />
 /// <reference types="mongoose/types/inferrawdoctype" />
 import { BankAccountDoc } from "@riocrypto/common-server";

package/build/helpers/sanitize-crypto-address-doc.d.ts

@@ -47,6 +47,7 @@
 /// <reference types="mongoose/types/virtuals" />
 /// <reference types="mongoose" />
 /// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
 /// <reference types="mongoose/types/inferschematype" />
 /// <reference types="mongoose/types/inferrawdoctype" />
 import { CryptoAddressDoc } from "@riocrypto/common-server";

package/build/helpers/sanitize-order-doc.d.ts

@@ -47,6 +47,7 @@
 /// <reference types="mongoose/types/virtuals" />
 /// <reference types="mongoose" />
 /// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
 /// <reference types="mongoose/types/inferschematype" />
 /// <reference types="mongoose/types/inferrawdoctype" />
 import { OrderDoc } from "@riocrypto/common-server";

package/build/helpers/sanitize-user-doc.d.ts

@@ -47,6 +47,7 @@
 /// <reference types="mongoose/types/virtuals" />
 /// <reference types="mongoose" />
 /// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
 /// <reference types="mongoose/types/inferschematype" />
 /// <reference types="mongoose/types/inferrawdoctype" />
 import { UserDoc } from "@riocrypto/common-server";

package/build/index.d.ts

@@ -7,6 +7,7 @@ export * from "./middlewares/set-trace";
 export * from "./middlewares/require-min-role";
 export * from "./middlewares/require-min-admin-role";
 export * from "./middlewares/verify-csrf-token";
+export * from "./middlewares/dynamic-rate-limiter";
 export * from "./services/apiKey";
 export * from "./services/password";
 export * from "./services/logger";
@@ -91,6 +92,7 @@ export * from "./models/STP-settings";
 export * from "./models/dashboard-push-notification-subscription";
 export * from "./models/webauthn-credential";
 export * from "./models/admin-webauthn-credential";
+export * from "./models/custom-rate-limit";
 export * from "./clients/axios-with-logging";
 export * from "./clients/slack-client";
 export * from "./clients/fireblocks-client";

package/build/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./middlewares/set-trace"), exports);
 __exportStar(require("./middlewares/require-min-role"), exports);
 __exportStar(require("./middlewares/require-min-admin-role"), exports);
 __exportStar(require("./middlewares/verify-csrf-token"), exports);
+__exportStar(require("./middlewares/dynamic-rate-limiter"), exports);
 __exportStar(require("./services/apiKey"), exports);
 __exportStar(require("./services/password"), exports);
 __exportStar(require("./services/logger"), exports);
@@ -107,6 +108,7 @@ __exportStar(require("./models/STP-settings"), exports);
 __exportStar(require("./models/dashboard-push-notification-subscription"), exports);
 __exportStar(require("./models/webauthn-credential"), exports);
 __exportStar(require("./models/admin-webauthn-credential"), exports);
+__exportStar(require("./models/custom-rate-limit"), exports);
 __exportStar(require("./clients/axios-with-logging"), exports);
 __exportStar(require("./clients/slack-client"), exports);
 __exportStar(require("./clients/fireblocks-client"), exports);

package/build/middlewares/dynamic-rate-limiter.d.ts

@@ -0,0 +1,10 @@
+import { Request, Response, NextFunction } from "express";
+import { Options as RateLimitOptions } from "express-rate-limit";
+import { Mongoose } from "mongoose";
+export interface DynamicRateLimiterOptions extends Partial<RateLimitOptions> {
+    windowMs: number;
+    max: number;
+    mongooseConnection: Mongoose;
+    cacheTtlMs?: number;
+}
+export declare function createDynamicRateLimiter(options: DynamicRateLimiterOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/build/middlewares/dynamic-rate-limiter.js

@@ -0,0 +1,156 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDynamicRateLimiter = void 0;
+const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+// Removed path-to-regexp import
+// Adjust the import path according to your project structure
+const custom_rate_limit_1 = require("../models/custom-rate-limit");
+// Cache for rate limiter instances
+const limiterInstanceCache = new Map();
+// Cache for compiled RegExp objects from path strings
+// Key: regex string pattern, Value: compiled RegExp object
+const regexCache = new Map();
+// In-memory cache for custom IP rules
+let customIpRulesCache = new Map();
+let lastCacheRefreshTime = 0;
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+function refreshCustomIpRulesCache(CustomRateLimit, filePathForLog) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const allRules = yield CustomRateLimit.find({}).lean();
+            const newCache = new Map();
+            allRules.forEach((rule) => {
+                if (rule.ipAddress) {
+                    // Pre-compile and cache regexes when rules are loaded/refreshed
+                    if (rule.routes && Array.isArray(rule.routes)) {
+                        rule.routes.forEach((routeRule) => {
+                            // Use any temporarily if lean typing is tricky
+                            if (typeof routeRule.path === "string" &&
+                                !regexCache.has(routeRule.path)) {
+                                try {
+                                    regexCache.set(routeRule.path, new RegExp(routeRule.path));
+                                }
+                                catch (e) {
+                                    console.error(`[DynamicRateLimiter Refresh] Failed to compile regex: '${routeRule.path}' for IP ${rule.ipAddress}. Skipping rule path. Error:`, e);
+                                    // Optionally mark the rule path as invalid or handle differently
+                                }
+                            }
+                        });
+                    }
+                    newCache.set(rule.ipAddress, rule);
+                }
+            });
+            customIpRulesCache = newCache;
+            lastCacheRefreshTime = Date.now();
+        }
+        catch (error) {
+            console.error(`[DynamicRateLimiter ${filePathForLog}] Error refreshing custom IP rules cache:`, error);
+        }
+    });
+}
+function createDynamicRateLimiter(options) {
+    const { windowMs: defaultWindowMs, max: defaultMax, mongooseConnection, cacheTtlMs = DEFAULT_CACHE_TTL_MS, message, standardHeaders, legacyHeaders, skip, requestPropertyName } = options, otherRateLimitOptions = __rest(options, ["windowMs", "max", "mongooseConnection", "cacheTtlMs", "message", "standardHeaders", "legacyHeaders", "skip", "requestPropertyName"]);
+    if (!mongooseConnection) {
+        throw new Error("[DynamicRateLimiter] Mongoose connection is required.");
+    }
+    const CustomRateLimit = (0, custom_rate_limit_1.buildCustomRateLimit)(mongooseConnection);
+    // Initial cache load (regex compilation happens here too)
+    refreshCustomIpRulesCache(CustomRateLimit, "initialization");
+    return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+        try {
+            // Refresh cache if stale
+            if (Date.now() - lastCacheRefreshTime > cacheTtlMs ||
+                (customIpRulesCache.size === 0 && lastCacheRefreshTime === 0)) {
+                yield refreshCustomIpRulesCache(CustomRateLimit, req.path);
+            }
+            let clientIp = req.ip;
+            let normalizedIp;
+            if (clientIp) {
+                // Normalize IPv4-mapped IPv6 addresses (::ffff:x.x.x.x)
+                if (clientIp.startsWith("::ffff:")) {
+                    normalizedIp = clientIp.substring(7);
+                }
+                else {
+                    normalizedIp = clientIp;
+                }
+            }
+            let currentLimit = defaultMax;
+            let currentWindowMs = defaultWindowMs;
+            let ruleIdentifier = "default"; // Start with default identifier
+            let customRuleDoc;
+            let matchingRule = undefined;
+            if (normalizedIp) {
+                customRuleDoc = customIpRulesCache.get(normalizedIp);
+            }
+            if (customRuleDoc &&
+                customRuleDoc.routes &&
+                customRuleDoc.routes.length > 0) {
+                // Find the first specific rule that matches the request path and method
+                matchingRule = customRuleDoc.routes.find((rule) => {
+                    const methodMatch = rule.action === "*" || rule.action === req.method.toUpperCase();
+                    if (!methodMatch)
+                        return false;
+                    const regex = regexCache.get(rule.path);
+                    if (!regex)
+                        return false; // Should have been compiled on refresh
+                    return regex.test(req.path);
+                });
+                if (matchingRule) {
+                    // Apply limit and window from the *specific matching rule*
+                    currentLimit = matchingRule.limit;
+                    currentWindowMs = matchingRule.windowMs;
+                    // Create a more specific identifier including the matched rule path/action
+                    ruleIdentifier = `custom_ip:${normalizedIp}_rule:${matchingRule.action}:${matchingRule.path}`;
+                }
+                // If no specific rule in the array matches, we just fall through
+                // and the defaults (currentLimit = defaultMax etc.) will be used.
+            }
+            // If customRuleDoc is undefined or routes array is empty, defaults apply.
+            // Generate cache key for the limiter instance. This will be unique for:
+            // - Default limit (if no rule found/matched)
+            // - Each specific matching rule (due to unique ruleIdentifier)
+            const limiterCacheKey = `${currentLimit}-${currentWindowMs}-${ruleIdentifier}`;
+            let selectedLimiter = limiterInstanceCache.get(limiterCacheKey);
+            if (!selectedLimiter) {
+                // Create a new limiter instance with the determined limit/window
+                selectedLimiter = (0, express_rate_limit_1.default)(Object.assign({ windowMs: currentWindowMs, max: currentLimit, keyGenerator: (request) => {
+                        let ipForKey = request.ip;
+                        if (ipForKey === null || ipForKey === void 0 ? void 0 : ipForKey.startsWith("::ffff:")) {
+                            ipForKey = ipForKey.substring(7);
+                        }
+                        return ipForKey || "unknown_ip_for_rate_limit";
+                    }, message: message, standardHeaders: standardHeaders, legacyHeaders: legacyHeaders, skip: skip, requestPropertyName: requestPropertyName }, otherRateLimitOptions));
+                limiterInstanceCache.set(limiterCacheKey, selectedLimiter);
+            }
+            return selectedLimiter(req, res, next);
+        }
+        catch (error) {
+            console.error(`[DynamicRateLimiter ${req.path}] Error in rate limiting middleware (IP: ${req.ip}):`, error);
+            next();
+        }
+    });
+}
+exports.createDynamicRateLimiter = createDynamicRateLimiter;

package/build/models/admin-webauthn-credential.d.ts

@@ -1,4 +1,5 @@
 /// <reference types="node" />
+/// <reference types="node" />
 import { Mongoose, Model, Document } from "mongoose";
 import { AdminAuthDoc } from "./admin-auth";
 export interface AdminWebAuthnCredentialAttrs {

package/build/models/custom-rate-limit.d.ts

@@ -0,0 +1,22 @@
+import mongoose from "mongoose";
+interface RouteRule {
+    path: string;
+    action: string;
+    limit: number;
+    windowMs: number;
+}
+interface CustomRateLimitAttrs {
+    createdAt: Date;
+    ipAddress: string;
+    routes: RouteRule[];
+}
+interface CustomRateLimitDoc extends mongoose.Document {
+    createdAt: Date;
+    ipAddress: string;
+    routes: RouteRule[];
+}
+interface CustomRateLimitModel extends mongoose.Model<CustomRateLimitDoc> {
+    build(attrs: CustomRateLimitAttrs): CustomRateLimitDoc;
+}
+declare const buildCustomRateLimit: (mongoose: typeof mongoose) => CustomRateLimitModel;
+export { buildCustomRateLimit, CustomRateLimitDoc, CustomRateLimitAttrs, RouteRule, };

package/build/models/custom-rate-limit.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCustomRateLimit = void 0;
+const buildCustomRateLimit = (mongoose) => {
+    if (mongoose.models.CustomRateLimit) {
+        return mongoose.model("CustomRateLimit");
+    }
+    // Updated: Define the schema for the nested RouteRule object including limits
+    const RouteRuleSchema = new mongoose.Schema({
+        path: {
+            type: String,
+            required: [true, "Path (regex string) is required for a route rule"],
+        },
+        action: {
+            type: String,
+            required: [true, "Action (HTTP method) is required for a route rule"],
+            uppercase: true,
+            // enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', '*']
+        },
+        limit: {
+            type: Number,
+            required: [true, "Limit is required for a specific route rule"],
+            min: [0, "Limit cannot be negative"], // Allow 0 for blocking?
+        },
+        windowMs: {
+            type: Number,
+            required: [true, "windowMs is required for a specific route rule"],
+            min: [1000, "windowMs must be at least 1000 (1 second)"],
+        },
+    }, { _id: false });
+    const CustomRateLimitSchema = new mongoose.Schema({
+        createdAt: {
+            type: mongoose.Schema.Types.Date,
+            default: Date.now,
+        },
+        ipAddress: {
+            type: String,
+            required: true,
+            // Add index for faster IP lookups
+            index: true,
+        },
+        // Removed limit and windowMs from top level schema
+        routes: {
+            type: [RouteRuleSchema],
+            required: true,
+            // Default to empty array. If empty, default limiter settings apply.
+            default: [],
+        },
+    }, {
+        toJSON: {
+            transform(doc, ret) {
+                ret.id = ret._id;
+                delete ret._id;
+                delete ret.__v;
+            },
+        },
+    });
+    CustomRateLimitSchema.statics.build = (attrs) => {
+        var _a;
+        return new CustomRateLimit(Object.assign(Object.assign({}, attrs), { createdAt: (_a = attrs.createdAt) !== null && _a !== void 0 ? _a : new Date() }));
+    };
+    const CustomRateLimit = mongoose.model("CustomRateLimit", CustomRateLimitSchema);
+    return CustomRateLimit;
+};
+exports.buildCustomRateLimit = buildCustomRateLimit;

package/build/models/webauthn-credential.d.ts

@@ -1,4 +1,5 @@
 /// <reference types="node" />
+/// <reference types="node" />
 import { Mongoose, Model, Document } from "mongoose";
 import { AuthDoc } from "./auth";
 export interface WebAuthnCredentialAttrs {

package/build/services/logger.js

@@ -14,8 +14,10 @@ const winston_1 = require("winston");
 class LoggerService {
     constructor() {
         this.maskSensitiveData = (0, winston_1.format)((info) => {
+            var _a, _b, _c, _d, _e;
             // Mask sensitive headers
-            if (info.meta && info.meta.req && info.meta.req.headers) {
+            if ((_b = (_a = info.meta) === null || _a === void 0 ? void 0 : _a.req) === null || _b === void 0 ? void 0 : _b.headers) {
+                // Use optional chaining
                 const headers = info.meta.req.headers;
                 const headerKeysToMask = [
                     "x-api-key",
@@ -24,7 +26,8 @@ class LoggerService {
                 ];
                 headerKeysToMask.forEach((key) => {
                     if (headers[key]) {
-                        headers[key] = this.maskValue(headers[key]); // Use maskValue function
+                        // Type assertion might be needed if headers[key] is not strictly string
+                        headers[key] = this.maskValue(String(headers[key]));
                     }
                 });
                 // Mask cookies specifically
@@ -38,22 +41,26 @@ class LoggerService {
                             key === "refreshToken" ||
                             key === "adminRefreshToken" ||
                             key === "phoneVerifiedJWT") {
-                            return `${key}=${this.maskValue(value, true)}`; // Mask the sensitive cookie
+                            return `${key}=${this.maskValue(value, true)}`;
                         }
-                        return cookie; // Return unmodified if not sensitive
+                        return cookie;
                     })
                         .join("; ");
                 }
             }
             // Mask sensitive request body fields
-            if (info.meta && info.meta.req && info.meta.req.body) {
+            if (((_d = (_c = info.meta) === null || _c === void 0 ? void 0 : _c.req) === null || _d === void 0 ? void 0 : _d.body) &&
+                typeof info.meta.req.body === "object" &&
+                info.meta.req.body !== null) {
+                const requestBody = info.meta.req.body; // Type assertion
                 const requestBodyFieldsToMaskWithLastFour = [
                     "accountNumber",
                     "routingNumber",
                 ];
                 requestBodyFieldsToMaskWithLastFour.forEach((field) => {
-                    if (info.meta.req.body.hasOwnProperty(field)) {
-                        info.meta.req.body[field] = this.maskValue(info.meta.req.body[field], true);
+                    if (requestBody.hasOwnProperty(field) &&
+                        typeof requestBody[field] === "string") {
+                        requestBody[field] = this.maskValue(requestBody[field], true);
                     }
                 });
                 const requestBodyFieldsToMaskWithoutLastFour = [
@@ -64,26 +71,34 @@ class LoggerService {
                     "authenticatorCode",
                 ];
                 requestBodyFieldsToMaskWithoutLastFour.forEach((field) => {
-                    if (info.meta.req.body.hasOwnProperty(field)) {
-                        info.meta.req.body[field] = this.maskValue(info.meta.req.body[field]);
+                    if (requestBody.hasOwnProperty(field) &&
+                        typeof requestBody[field] === "string") {
+                        requestBody[field] = this.maskValue(requestBody[field]);
                     }
                 });
             }
             // Mask sensitive response body fields
-            if (info.meta && info.meta.res && info.meta.res.body) {
+            const resAsAny = (_e = info.meta) === null || _e === void 0 ? void 0 : _e.res;
+            if ((resAsAny === null || resAsAny === void 0 ? void 0 : resAsAny.body) &&
+                typeof resAsAny.body === "object" &&
+                resAsAny.body !== null) {
+                const responseBody = resAsAny.body; // Keep this assertion for object access
                 const responseBodyFieldsToMask = ["secret", "value"];
                 responseBodyFieldsToMask.forEach((field) => {
-                    if (info.meta.res.body.hasOwnProperty(field)) {
-                        info.meta.res.body[field] = this.maskValue(info.meta.res.body[field]); // Use maskValue function
+                    if (responseBody.hasOwnProperty(field) &&
+                        typeof responseBody[field] === "string") {
+                        responseBody[field] = this.maskValue(responseBody[field]);
                     }
                 });
             }
             return info;
         });
         this.requestMethodFilter = (0, winston_1.format)((info) => {
+            var _a, _b;
             const allowedMethods = ["POST", "PATCH", "DELETE"];
             // Only apply filter if req.method is defined
-            if (info.meta && info.meta.req && info.meta.req.method) {
+            if ((_b = (_a = info.meta) === null || _a === void 0 ? void 0 : _a.req) === null || _b === void 0 ? void 0 : _b.method) {
+                // Use optional chaining
                 if (allowedMethods.includes(info.meta.req.method)) {
                     return info;
                 }
@@ -96,41 +111,41 @@ class LoggerService {
         });
         // Custom format to handle CustomError serialization
         this.handleCustomErrorFormat = (0, winston_1.format)((info) => {
+            var _a, _b, _c;
             let error;
             // express-winston errorLogger often puts the error in info.message or info.meta.err
             if (info.message instanceof Error) {
                 error = info.message;
             }
-            else if (info.meta && info.meta.err instanceof Error) {
+            else if (((_a = info.meta) === null || _a === void 0 ? void 0 : _a.err) instanceof Error) {
+                // Use optional chaining
                 error = info.meta.err;
             }
             else if (info.level === "error" &&
                 info.message &&
                 typeof info.message === "object" &&
-                info.message.stack) {
-                // Sometimes the error object might be directly in message for non-express-winston logs
+                info.message.stack // Type assertion to check for stack
+            ) {
                 error = info.message;
             }
             if (error instanceof common_1.CustomError) {
-                // Replace the error object/message with serialized details
-                // Log serialized errors under 'errorDetails' and keep original message if it's just a string
                 info.errorDetails = error.serializeErrors();
                 if (typeof info.message === "object") {
-                    info.message = error.message; // Keep the original error message string
+                    info.message = error.message;
                 }
-                // Prevent Winston from trying to serialize the original complex error object
-                if (info.meta && info.meta.err) {
+                if ((_b = info.meta) === null || _b === void 0 ? void 0 : _b.err) {
+                    // Use optional chaining
                     delete info.meta.err;
                 }
             }
             else if (error) {
-                // For generic errors, ensure the stack is included if available
                 info.errorMessage = error.message;
                 info.errorStack = error.stack;
                 if (typeof info.message === "object") {
                     info.message = error.message;
                 }
-                if (info.meta && info.meta.err) {
+                if ((_c = info.meta) === null || _c === void 0 ? void 0 : _c.err) {
+                    // Use optional chaining
                     delete info.meta.err;
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2275",
+  "version": "1.0.2278",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -34,6 +34,7 @@
     "crypto-js": "^4.2.0",
     "csurf": "^1.11.0",
     "express": "^4.21.1",
+    "express-rate-limit": "^7.5.0",
     "express-validator": "^6.14.2",
     "fireblocks-sdk": "^5.13.0",
     "googleapis": "^135.1.0",