@riocrypto/common-server 1.0.2915 → 1.0.2916

package/build/models/auth.js

@@ -208,6 +208,10 @@ const buildAuth = (mongoose) => {
         unique: true,
         partialFilterExpression: { phoneNumber: { $type: "string" } },
     });
+    // API key validation runs before every authenticated request. Without this
+    // an unrecognised key costs a full collection scan, which is also a denial
+    // of service vector on the unauthenticated edge.
+    AuthSchema.index({ "apiKeys.value": 1 });
     const Auth = mongoose.model("Auth", AuthSchema);
     return Auth;
 };

package/build/models/user.js

@@ -255,6 +255,9 @@ const buildUser = (mongoose) => {
     userSchema.index({ brokerId: 1 });
     // Serves the unfiltered admin listing, which sorts on createdAt alone.
     userSchema.index({ createdAt: -1, _id: -1 });
+    // Resolving the user from the auth record runs on every authenticated
+    // request, so this stays on the hot path for the whole API.
+    userSchema.index({ authIds: 1 });
     userSchema.statics.build = (attrs) => {
         return new User(attrs);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2915",
+  "version": "1.0.2916",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",