@riocrypto/common-server 1.0.2277 → 1.0.2279

package/build/middlewares/dynamic-rate-limiter.js

@@ -25,8 +25,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createDynamicRateLimiter = void 0;
 const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
-// Removed path-to-regexp import
-// Adjust the import path according to your project structure
 const custom_rate_limit_1 = require("../models/custom-rate-limit");
 // Cache for rate limiter instances
 const limiterInstanceCache = new Map();
@@ -72,18 +70,12 @@ function refreshCustomIpRulesCache(CustomRateLimit, filePathForLog) {
     });
 }
 function createDynamicRateLimiter(options) {
-    const { windowMs: defaultWindowMs, // Rename for clarity
-    max: defaultMax, // Rename for clarity
-    mongooseConnection, cacheTtlMs = DEFAULT_CACHE_TTL_MS, 
-    // Capture other express-rate-limit options passed in
-    message, standardHeaders, legacyHeaders, skip, requestPropertyName } = options, 
-    // Add any other valid RateLimitOptions you might pass
-    otherRateLimitOptions = __rest(options, ["windowMs", "max", "mongooseConnection", "cacheTtlMs", "message", "standardHeaders", "legacyHeaders", "skip", "requestPropertyName"]) // Use a specific variable if you know exactly what else you pass
-    ;
+    const { windowMs: defaultWindowMs, max: defaultMax, mongooseConnection, cacheTtlMs = DEFAULT_CACHE_TTL_MS, message, standardHeaders, legacyHeaders, skip, requestPropertyName } = options, otherRateLimitOptions = __rest(options, ["windowMs", "max", "mongooseConnection", "cacheTtlMs", "message", "standardHeaders", "legacyHeaders", "skip", "requestPropertyName"]);
     if (!mongooseConnection) {
         throw new Error("[DynamicRateLimiter] Mongoose connection is required.");
     }
     const CustomRateLimit = (0, custom_rate_limit_1.buildCustomRateLimit)(mongooseConnection);
+    // Initial cache load (regex compilation happens here too)
     refreshCustomIpRulesCache(CustomRateLimit, "initialization");
     return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
         try {
@@ -92,49 +84,78 @@ function createDynamicRateLimiter(options) {
                 (customIpRulesCache.size === 0 && lastCacheRefreshTime === 0)) {
                 yield refreshCustomIpRulesCache(CustomRateLimit, req.path);
             }
-            const clientIp = req.ip;
-            let currentLimit = defaultMax; // Use destructured default
-            let currentWindowMs = defaultWindowMs; // Use destructured default
-            let ruleIdentifier = "default";
-            let customRule;
-            if (clientIp) {
-                customRule = customIpRulesCache.get(clientIp);
+            // Determine the client's IP address, prioritizing Cloudflare/proxy headers
+            let rawClientIp;
+            const cfConnectingIp = req.headers["cf-connecting-ip"];
+            const xForwardedForHeader = req.headers["x-forwarded-for"];
+            if (cfConnectingIp) {
+                rawClientIp = cfConnectingIp;
             }
-            if (customRule) {
-                // Check if routes array exists and is not empty
-                const appliesToCurrentRoute = !customRule.routes || // Should not happen if default is []
-                    customRule.routes.length === 0 || // Empty array means apply custom limit to ALL requests for this IP
-                    customRule.routes.some((rule) => {
-                        // Check HTTP Method first (faster check)
-                        const methodMatch = rule.action === "*" || rule.action === req.method.toUpperCase();
-                        if (!methodMatch) {
-                            return false;
-                        }
-                        // Get the compiled regex from cache
-                        const regex = regexCache.get(rule.path);
-                        if (!regex) {
-                            // Regex failed compilation during refresh, skip this rule path
-                            // Error was already logged during refreshCustomIpRulesCache
-                            return false;
-                        }
-                        // Test the path against the regex
-                        return regex.test(req.path);
-                    });
-                if (appliesToCurrentRoute) {
-                    currentLimit = customRule.limit;
-                    currentWindowMs = customRule.windowMs;
-                    ruleIdentifier = `custom_ip:${clientIp}`;
+            else if (xForwardedForHeader) {
+                // X-Forwarded-For can be a comma-separated list (client, proxy1, proxy2)
+                // The first IP is the original client IP
+                rawClientIp = xForwardedForHeader.split(",")[0].trim();
+            }
+            else {
+                rawClientIp = req.ip; // Fallback to Express's req.ip
+            }
+            let normalizedIp;
+            if (rawClientIp) {
+                // Normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:192.0.2.1 -> 192.0.2.1)
+                // Also handles direct IPv4 and standard IPv6 addresses
+                if (rawClientIp.startsWith("::ffff:")) {
+                    normalizedIp = rawClientIp.substring(7);
+                }
+                else {
+                    normalizedIp = rawClientIp;
                 }
             }
-            // Get/create limiter instance using currentLimit, currentWindowMs, ruleIdentifier
+            let currentLimit = defaultMax;
+            let currentWindowMs = defaultWindowMs;
+            let ruleIdentifier = "default"; // Start with default identifier
+            let customRuleDoc;
+            let matchingRule = undefined;
+            if (normalizedIp) {
+                customRuleDoc = customIpRulesCache.get(normalizedIp);
+            }
+            if (customRuleDoc &&
+                customRuleDoc.routes &&
+                customRuleDoc.routes.length > 0) {
+                // Find the first specific rule that matches the request path and method
+                matchingRule = customRuleDoc.routes.find((rule) => {
+                    const methodMatch = rule.action === "*" || rule.action === req.method.toUpperCase();
+                    if (!methodMatch)
+                        return false;
+                    const regex = regexCache.get(rule.path);
+                    if (!regex)
+                        return false; // Should have been compiled on refresh
+                    return regex.test(req.path);
+                });
+                if (matchingRule) {
+                    // Apply limit and window from the *specific matching rule*
+                    currentLimit = matchingRule.limit;
+                    currentWindowMs = matchingRule.windowMs;
+                    // Create a more specific identifier including the matched rule path/action
+                    ruleIdentifier = `custom_ip:${normalizedIp}_rule:${matchingRule.action}:${matchingRule.path}`;
+                }
+                // If no specific rule in the array matches, we just fall through
+                // and the defaults (currentLimit = defaultMax etc.) will be used.
+            }
+            // If customRuleDoc is undefined or routes array is empty, defaults apply.
+            // Generate cache key for the limiter instance. This will be unique for:
+            // - Default limit (if no rule found/matched)
+            // - Each specific matching rule (due to unique ruleIdentifier)
             const limiterCacheKey = `${currentLimit}-${currentWindowMs}-${ruleIdentifier}`;
             let selectedLimiter = limiterInstanceCache.get(limiterCacheKey);
             if (!selectedLimiter) {
+                // Create a new limiter instance with the determined limit/window
                 selectedLimiter = (0, express_rate_limit_1.default)(Object.assign({ windowMs: currentWindowMs, max: currentLimit, keyGenerator: (request) => {
-                        return request.ip || "unknown_ip_for_rate_limit";
-                    }, 
-                    // Pass through other specified options
-                    message: message, standardHeaders: standardHeaders, legacyHeaders: legacyHeaders, skip: skip, requestPropertyName: requestPropertyName }, otherRateLimitOptions));
+                        let ipForKey = request.ip;
+                        if (ipForKey === null || ipForKey === void 0 ? void 0 : ipForKey.startsWith("::ffff:")) {
+                            ipForKey = ipForKey.substring(7);
+                        }
+                        return ipForKey || "unknown_ip_for_rate_limit";
+                    }, message: message, standardHeaders: standardHeaders, legacyHeaders: legacyHeaders, skip: skip, requestPropertyName: requestPropertyName }, otherRateLimitOptions));
                 limiterInstanceCache.set(limiterCacheKey, selectedLimiter);
             }
             return selectedLimiter(req, res, next);

package/build/models/custom-rate-limit.d.ts

@@ -2,19 +2,17 @@ import mongoose from "mongoose";
 interface RouteRule {
     path: string;
     action: string;
+    limit: number;
+    windowMs: number;
 }
 interface CustomRateLimitAttrs {
-    createdAt?: Date;
+    createdAt: Date;
     ipAddress: string;
-    limit: number;
-    windowMs: number;
     routes: RouteRule[];
 }
 interface CustomRateLimitDoc extends mongoose.Document {
     createdAt: Date;
     ipAddress: string;
-    limit: number;
-    windowMs: number;
     routes: RouteRule[];
 }
 interface CustomRateLimitModel extends mongoose.Model<CustomRateLimitDoc> {

package/build/models/custom-rate-limit.js

@@ -2,11 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildCustomRateLimit = void 0;
 const buildCustomRateLimit = (mongoose) => {
-    // if model is already defined, return it
     if (mongoose.models.CustomRateLimit) {
         return mongoose.model("CustomRateLimit");
     }
-    // Define the schema for the nested RouteRule object
+    // Updated: Define the schema for the nested RouteRule object including limits
     const RouteRuleSchema = new mongoose.Schema({
         path: {
             type: String,
@@ -15,32 +14,36 @@ const buildCustomRateLimit = (mongoose) => {
         action: {
             type: String,
             required: [true, "Action (HTTP method) is required for a route rule"],
-            uppercase: true, // Store methods consistently (e.g., 'GET')
-            // Optional: Add enum validation if you want to restrict methods
-            // enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', '*'] // Example enum
+            uppercase: true,
+            // enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', '*']
         },
-    }, { _id: false }); // Don't create separate IDs for subdocuments
+        limit: {
+            type: Number,
+            required: [true, "Limit is required for a specific route rule"],
+            min: [0, "Limit cannot be negative"], // Allow 0 for blocking?
+        },
+        windowMs: {
+            type: Number,
+            required: [true, "windowMs is required for a specific route rule"],
+            min: [1000, "windowMs must be at least 1000 (1 second)"],
+        },
+    }, { _id: false });
     const CustomRateLimitSchema = new mongoose.Schema({
         createdAt: {
             type: mongoose.Schema.Types.Date,
-            default: Date.now, // Add default value for createdAt
+            default: Date.now,
         },
         ipAddress: {
             type: String,
             required: true,
+            // Add index for faster IP lookups
+            index: true,
         },
-        limit: {
-            type: Number,
-            required: true,
-        },
-        windowMs: {
-            type: Number,
-            required: true,
-        },
+        // Removed limit and windowMs from top level schema
         routes: {
             type: [RouteRuleSchema],
             required: true,
-            // Default to empty array, meaning applies to all routes/methods if not specified
+            // Default to empty array. If empty, default limiter settings apply.
             default: [],
         },
     }, {
@@ -54,7 +57,6 @@ const buildCustomRateLimit = (mongoose) => {
     });
     CustomRateLimitSchema.statics.build = (attrs) => {
         var _a;
-        // Ensure default createdAt is handled if not provided
         return new CustomRateLimit(Object.assign(Object.assign({}, attrs), { createdAt: (_a = attrs.createdAt) !== null && _a !== void 0 ? _a : new Date() }));
     };
     const CustomRateLimit = mongoose.model("CustomRateLimit", CustomRateLimitSchema);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2277",
+  "version": "1.0.2279",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",