@serve.zone/dcrouter 2.12.4

package/test/test.protected-endpoint.ts

@@ -0,0 +1,115 @@
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { DcRouter } from '../ts/index.js';
+import { TypedRequest } from '@api.global/typedrequest';
+import * as interfaces from '../ts_interfaces/index.js';
+
+let testDcRouter: DcRouter;
+let adminIdentity: interfaces.data.IIdentity;
+
+tap.test('should start DCRouter with OpsServer', async () => {
+  testDcRouter = new DcRouter({
+    // Minimal config for testing
+  });
+  
+  await testDcRouter.start();
+  expect(testDcRouter.opsServer).toBeInstanceOf(Object);
+});
+
+tap.test('should login as admin', async () => {
+  const loginRequest = new TypedRequest<interfaces.requests.IReq_AdminLoginWithUsernameAndPassword>(
+    'http://localhost:3000/typedrequest',
+    'adminLoginWithUsernameAndPassword'
+  );
+  
+  const response = await loginRequest.fire({
+    username: 'admin',
+    password: 'admin'
+  });
+  
+  expect(response).toHaveProperty('identity');
+  adminIdentity = response.identity;
+  console.log('Admin logged in with JWT');
+});
+
+tap.test('should allow admin to update configuration', async () => {
+  const updateRequest = new TypedRequest<interfaces.requests.IReq_UpdateConfiguration>(
+    'http://localhost:3000/typedrequest',
+    'updateConfiguration'
+  );
+  
+  const response = await updateRequest.fire({
+    identity: adminIdentity,
+    section: 'security',
+    config: {
+      rateLimit: true,
+      spamDetection: true
+    }
+  });
+  
+  expect(response).toHaveProperty('updated');
+  expect(response.updated).toBeTrue();
+});
+
+tap.test('should reject configuration update without identity', async () => {
+  const updateRequest = new TypedRequest<interfaces.requests.IReq_UpdateConfiguration>(
+    'http://localhost:3000/typedrequest',
+    'updateConfiguration'
+  );
+  
+  try {
+    await updateRequest.fire({
+      section: 'security',
+      config: {
+        rateLimit: false
+      }
+    });
+    expect(true).toBeFalse(); // Should not reach here
+  } catch (error) {
+    expect(error).toBeTruthy();
+    console.log('Successfully rejected request without identity');
+  }
+});
+
+tap.test('should reject configuration update with invalid JWT', async () => {
+  const updateRequest = new TypedRequest<interfaces.requests.IReq_UpdateConfiguration>(
+    'http://localhost:3000/typedrequest',
+    'updateConfiguration'
+  );
+  
+  try {
+    await updateRequest.fire({
+      identity: {
+        ...adminIdentity,
+        jwt: 'invalid.jwt.token'
+      },
+      section: 'security',
+      config: {
+        rateLimit: false
+      }
+    });
+    expect(true).toBeFalse(); // Should not reach here
+  } catch (error) {
+    expect(error).toBeTruthy();
+    console.log('Successfully rejected request with invalid JWT');
+  }
+});
+
+tap.test('should allow access to public endpoints without auth', async () => {
+  const healthRequest = new TypedRequest<interfaces.requests.IReq_GetHealthStatus>(
+    'http://localhost:3000/typedrequest',
+    'getHealthStatus'
+  );
+  
+  // No identity provided
+  const response = await healthRequest.fire({});
+  
+  expect(response).toHaveProperty('health');
+  expect(response.health.healthy).toBeTrue();
+  console.log('Public endpoint accessible without auth');
+});
+
+tap.test('should stop DCRouter', async () => {
+  await testDcRouter.stop();
+});
+
+export default tap.start();

package/test/test.rate-limiting-integration.ts

@@ -0,0 +1,236 @@
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import * as plugins from './helpers/server.loader.js';
+import { createTestSmtpClient } from './helpers/smtp.client.js';
+import { SmtpClient } from '../ts/mail/delivery/smtpclient/smtp-client.js';
+
+const TEST_PORT = 2525;
+
+// Test email configuration with rate limits
+const testEmailConfig = {
+  ports: [TEST_PORT],
+  hostname: 'localhost',
+  domains: [
+    {
+      domain: 'test.local',
+      dnsMode: 'forward' as const,
+      rateLimits: {
+        inbound: {
+          messagesPerMinute: 3, // Very low limit for testing
+          recipientsPerMessage: 2,
+          connectionsPerIp: 5
+        }
+      }
+    }
+  ],
+  routes: [
+    {
+      name: 'test-route',
+      match: { recipients: '*@test.local' },
+      action: { type: 'process' as const, process: { scan: false, queue: 'normal' } }
+    }
+  ],
+  rateLimits: {
+    global: {
+      maxMessagesPerMinute: 10,
+      maxConnectionsPerIP: 10,
+      maxErrorsPerIP: 3,
+      maxAuthFailuresPerIP: 2,
+      blockDuration: 5000 // 5 seconds for testing
+    }
+  }
+};
+
+tap.test('prepare server with rate limiting', async () => {
+  await plugins.startTestServer(testEmailConfig);
+  // Give server time to start
+  await new Promise(resolve => setTimeout(resolve, 1000));
+});
+
+tap.test('should enforce connection rate limits', async (tools) => {
+  const done = tools.defer();
+  const clients: SmtpClient[] = [];
+  
+  try {
+    // Try to create many connections quickly
+    for (let i = 0; i < 12; i++) {
+      const client = createTestSmtpClient();
+      clients.push(client);
+      
+      // Connection should fail after limit is exceeded
+      const verified = await client.verify().catch(() => false);
+      
+      if (i < 10) {
+        // First 10 should succeed (global limit)
+        expect(verified).toBeTrue();
+      } else {
+        // After 10, should be rate limited
+        expect(verified).toBeFalse();
+      }
+    }
+    
+    done.resolve();
+  } catch (error) {
+    done.reject(error);
+  } finally {
+    // Clean up connections
+    for (const client of clients) {
+      await client.close().catch(() => {});
+    }
+  }
+});
+
+tap.test('should enforce message rate limits per domain', async (tools) => {
+  const done = tools.defer();
+  const client = createTestSmtpClient();
+  
+  try {
+    // Send messages rapidly to test domain-specific rate limit
+    for (let i = 0; i < 5; i++) {
+      const email = {
+        from: `sender${i}@example.com`,
+        to: 'recipient@test.local',
+        subject: `Test ${i}`,
+        text: 'Test message'
+      };
+      
+      const result = await client.sendMail(email).catch(err => err);
+      
+      if (i < 3) {
+        // First 3 should succeed (domain limit is 3 per minute)
+        expect(result.accepted).toBeDefined();
+        expect(result.accepted.length).toEqual(1);
+      } else {
+        // After 3, should be rate limited
+        expect(result.code).toEqual('EENVELOPE');
+        expect(result.response).toContain('try again later');
+      }
+    }
+    
+    done.resolve();
+  } catch (error) {
+    done.reject(error);
+  } finally {
+    await client.close();
+  }
+});
+
+tap.test('should enforce recipient limits', async (tools) => {
+  const done = tools.defer();
+  const client = createTestSmtpClient();
+  
+  try {
+    // Try to send to many recipients (domain limit is 2 per message)
+    const email = {
+      from: 'sender@example.com',
+      to: ['user1@test.local', 'user2@test.local', 'user3@test.local'],
+      subject: 'Test with multiple recipients',
+      text: 'Test message'
+    };
+    
+    const result = await client.sendMail(email).catch(err => err);
+    
+    // Should fail due to recipient limit
+    expect(result.code).toEqual('EENVELOPE');
+    expect(result.response).toContain('try again later');
+    
+    done.resolve();
+  } catch (error) {
+    done.reject(error);
+  } finally {
+    await client.close();
+  }
+});
+
+tap.test('should enforce error rate limits', async (tools) => {
+  const done = tools.defer();
+  const client = createTestSmtpClient();
+  
+  try {
+    // Send multiple invalid commands to trigger error rate limit
+    const socket = (client as any).socket;
+    
+    // Wait for connection
+    await new Promise(resolve => setTimeout(resolve, 100));
+    
+    // Send invalid commands
+    for (let i = 0; i < 5; i++) {
+      socket.write('INVALID_COMMAND\r\n');
+      
+      // Wait for response
+      await new Promise(resolve => {
+        socket.once('data', resolve);
+      });
+    }
+    
+    // After 3 errors, connection should be blocked
+    const lastResponse = await new Promise<string>(resolve => {
+      socket.once('data', (data: Buffer) => resolve(data.toString()));
+      socket.write('NOOP\r\n');
+    });
+    
+    expect(lastResponse).toContain('421 Too many errors');
+    
+    done.resolve();
+  } catch (error) {
+    done.reject(error);
+  } finally {
+    await client.close().catch(() => {});
+  }
+});
+
+tap.test('should enforce authentication failure limits', async (tools) => {
+  const done = tools.defer();
+  
+  // Create config with auth required
+  const authConfig = {
+    ...testEmailConfig,
+    auth: {
+      required: true,
+      methods: ['PLAIN' as const]
+    }
+  };
+  
+  // Restart server with auth config
+  await plugins.stopTestServer();
+  await plugins.startTestServer(authConfig);
+  await new Promise(resolve => setTimeout(resolve, 1000));
+  
+  const client = createTestSmtpClient();
+  
+  try {
+    // Try multiple failed authentications
+    for (let i = 0; i < 3; i++) {
+      const result = await client.sendMail({
+        from: 'sender@example.com',
+        to: 'recipient@test.local',
+        subject: 'Test',
+        text: 'Test'
+      }, {
+        auth: {
+          user: 'wronguser',
+          pass: 'wrongpass'
+        }
+      }).catch(err => err);
+      
+      if (i < 2) {
+        // First 2 should fail with auth error
+        expect(result.code).toEqual('EAUTH');
+      } else {
+        // After 2 failures, should be blocked
+        expect(result.code).toEqual('ECONNECTION');
+      }
+    }
+    
+    done.resolve();
+  } catch (error) {
+    done.reject(error);
+  } finally {
+    await client.close().catch(() => {});
+  }
+});
+
+tap.test('cleanup server', async () => {
+  await plugins.stopTestServer();
+});
+
+tap.start();

package/test/test.ratelimiter.ts

@@ -0,0 +1,141 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { RateLimiter } from '../ts/mail/delivery/classes.ratelimiter.js';
+
+tap.test('RateLimiter - should be instantiable', async () => {
+  const limiter = new RateLimiter({
+    maxPerPeriod: 10,
+    periodMs: 1000,
+    perKey: true
+  });
+  
+  expect(limiter).toBeTruthy();
+});
+
+tap.test('RateLimiter - should allow requests within rate limit', async () => {
+  const limiter = new RateLimiter({
+    maxPerPeriod: 5,
+    periodMs: 1000,
+    perKey: true
+  });
+  
+  // Should allow 5 requests
+  for (let i = 0; i < 5; i++) {
+    expect(limiter.isAllowed('test')).toEqual(true);
+  }
+  
+  // 6th request should be denied
+  expect(limiter.isAllowed('test')).toEqual(false);
+});
+
+tap.test('RateLimiter - should enforce per-key limits', async () => {
+  const limiter = new RateLimiter({
+    maxPerPeriod: 3,
+    periodMs: 1000,
+    perKey: true
+  });
+  
+  // Should allow 3 requests for key1
+  for (let i = 0; i < 3; i++) {
+    expect(limiter.isAllowed('key1')).toEqual(true);
+  }
+  
+  // 4th request for key1 should be denied
+  expect(limiter.isAllowed('key1')).toEqual(false);
+  
+  // But key2 should still be allowed
+  expect(limiter.isAllowed('key2')).toEqual(true);
+});
+
+tap.test('RateLimiter - should refill tokens over time', async () => {
+  const limiter = new RateLimiter({
+    maxPerPeriod: 2,
+    periodMs: 100, // Short period for testing
+    perKey: true
+  });
+  
+  // Use all tokens
+  expect(limiter.isAllowed('test')).toEqual(true);
+  expect(limiter.isAllowed('test')).toEqual(true);
+  expect(limiter.isAllowed('test')).toEqual(false);
+  
+  // Wait for refill
+  await new Promise(resolve => setTimeout(resolve, 150));
+  
+  // Should have tokens again
+  expect(limiter.isAllowed('test')).toEqual(true);
+});
+
+tap.test('RateLimiter - should support burst allowance', async () => {
+  const limiter = new RateLimiter({
+    maxPerPeriod: 2,
+    periodMs: 100,
+    perKey: true,
+    burstTokens: 2, // Allow 2 extra tokens for bursts
+    initialTokens: 4  // Start with max + burst tokens
+  });
+  
+  // Should allow 4 requests (2 regular + 2 burst)
+  for (let i = 0; i < 4; i++) {
+    expect(limiter.isAllowed('test')).toEqual(true);
+  }
+  
+  // 5th request should be denied
+  expect(limiter.isAllowed('test')).toEqual(false);
+  
+  // Wait for refill
+  await new Promise(resolve => setTimeout(resolve, 150));
+  
+  // Should have 2 tokens again (rate-limited to normal max, not burst)
+  expect(limiter.isAllowed('test')).toEqual(true);
+  expect(limiter.isAllowed('test')).toEqual(true);
+  
+  // 3rd request after refill should fail (only normal max is refilled, not burst)
+  expect(limiter.isAllowed('test')).toEqual(false);
+});
+
+tap.test('RateLimiter - should return correct stats', async () => {
+  const limiter = new RateLimiter({
+    maxPerPeriod: 10,
+    periodMs: 1000,
+    perKey: true
+  });
+  
+  // Make some requests
+  limiter.isAllowed('test');
+  limiter.isAllowed('test');
+  limiter.isAllowed('test');
+  
+  // Get stats
+  const stats = limiter.getStats('test');
+  
+  expect(stats.remaining).toEqual(7);
+  expect(stats.limit).toEqual(10);
+  expect(stats.allowed).toEqual(3);
+  expect(stats.denied).toEqual(0);
+});
+
+tap.test('RateLimiter - should reset limits', async () => {
+  const limiter = new RateLimiter({
+    maxPerPeriod: 3,
+    periodMs: 1000,
+    perKey: true
+  });
+  
+  // Use all tokens
+  expect(limiter.isAllowed('test')).toEqual(true);
+  expect(limiter.isAllowed('test')).toEqual(true);
+  expect(limiter.isAllowed('test')).toEqual(true);
+  expect(limiter.isAllowed('test')).toEqual(false);
+  
+  // Reset
+  limiter.reset('test');
+  
+  // Should have tokens again
+  expect(limiter.isAllowed('test')).toEqual(true);
+});
+
+tap.test('stop', async () => {
+  await tap.stopForcefully();
+});
+
+export default tap.start();