@shipfox/api-auth 9.2.0 → 9.3.0

package/dist/presentation/routes/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {\n  type AuthRateLimitAction,\n  AuthRateLimitExceededError,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  AuthRateLimitUnavailableError,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<AuthRateLimitAction, Record<AuthRateLimitScope, AuthRateLimitPolicy>> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  try {\n    await checkAuthRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      ...policies[params.action][params.scope],\n    });\n  } catch (error) {\n    if (error instanceof AuthRateLimitExceededError) {\n      params.request.log.warn(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          retryAfterSeconds: error.retryAfterSeconds,\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        'Auth rate limit blocked request',\n      );\n      params.reply.header('Retry-After', String(error.retryAfterSeconds));\n      throw new ClientError('Rate limit exceeded', 'rate-limited', {\n        status: 429,\n        details: {retry_after_seconds: error.retryAfterSeconds},\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    if (error instanceof AuthRateLimitUnavailableError) {\n      params.request.log.error(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n          err: error,\n        },\n        'Auth rate limiter unavailable',\n      );\n      throw new ClientError(\n        'Authentication rate limiter unavailable',\n        'auth-rate-limit-unavailable',\n        {\n          status: 503,\n          data: {\n            action: error.action,\n            scope: error.scope,\n            route: routeName(params.request),\n            identifierHmacPrefix: error.identifierHmacPrefix,\n          },\n          cause: error,\n        },\n      );\n    }\n\n    throw error;\n  }\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n"],"names":["ClientError","AuthRateLimitExceededError","AuthRateLimitUnavailableError","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","routeName","request","routeOptions","url","split","enforceRateLimit","params","action","scope","identifier","error","log","warn","route","retryAfterSeconds","identifierHmacPrefix","reply","header","String","status","details","retry_after_seconds","data","cause","err","createAuthRateLimitPreHandler","body"],"mappings":"AAAA,SAAQA,WAAW,QAA+C,wBAAwB;AAC1F,SAEEC,0BAA0B,EAG1BC,6BAA6B,EAC7BC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAAyF;IAC7FC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;AACF;AAMA,SAASE,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAeC,iBAAiBC,MAM/B;IACC,IAAI;QACF,MAAMb,mBAAmB;YACvBc,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBC,YAAYH,OAAOG,UAAU;YAC7B,GAAGf,QAAQ,CAACY,OAAOC,MAAM,CAAC,CAACD,OAAOE,KAAK,CAAC;QAC1C;IACF,EAAE,OAAOE,OAAO;QACd,IAAIA,iBAAiBnB,4BAA4B;YAC/Ce,OAAOL,OAAO,CAACU,GAAG,CAACC,IAAI,CACrB;gBACEL,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOb,UAAUM,OAAOL,OAAO;gBAC/Ba,mBAAmBJ,MAAMI,iBAAiB;gBAC1CC,sBAAsBL,MAAMK,oBAAoB;YAClD,GACA;YAEFT,OAAOU,KAAK,CAACC,MAAM,CAAC,eAAeC,OAAOR,MAAMI,iBAAiB;YACjE,MAAM,IAAIxB,YAAY,uBAAuB,gBAAgB;gBAC3D6B,QAAQ;gBACRC,SAAS;oBAACC,qBAAqBX,MAAMI,iBAAiB;gBAAA;gBACtDQ,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOb,UAAUM,OAAOL,OAAO;oBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,IAAIA,iBAAiBlB,+BAA+B;YAClDc,OAAOL,OAAO,CAACU,GAAG,CAACD,KAAK,CACtB;gBACEH,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOb,UAAUM,OAAOL,OAAO;gBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAChDS,KAAKd;YACP,GACA;YAEF,MAAM,IAAIpB,YACR,2CACA,+BACA;gBACE6B,QAAQ;gBACRG,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOb,UAAUM,OAAOL,OAAO;oBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QAEJ;QAEA,MAAMA;IACR;AACF;AAEA,OAAO,SAASe,8BAA8BlB,MAA2B;IACvE,OAAO,OAAON,SAA4Ce;QACxD,MAAMX,iBAAiB;YACrBJ;YACAe;YACAT;YACAC,OAAO;YACPC,YAAYR,QAAQL,EAAE;QACxB;QAEA,MAAMS,iBAAiB;YACrBJ;YACAe;YACAT;YACAC,OAAO;YACPC,YAAYR,QAAQyB,IAAI,CAAC3B,KAAK;QAChC;IACF;AACF"}
+{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {\n  type AuthRateLimitAction,\n  AuthRateLimitExceededError,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  AuthRateLimitUnavailableError,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<\n  AuthRateLimitAction,\n  Partial<Record<AuthRateLimitScope, AuthRateLimitPolicy>>\n> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n  bootstrap: {\n    ip: {limit: 5, windowSeconds: 15 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  const policy = policies[params.action][params.scope];\n  if (!policy) return;\n\n  try {\n    await checkAuthRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      ...policy,\n    });\n  } catch (error) {\n    if (error instanceof AuthRateLimitExceededError) {\n      params.request.log.warn(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          retryAfterSeconds: error.retryAfterSeconds,\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        'Auth rate limit blocked request',\n      );\n      params.reply.header('Retry-After', String(error.retryAfterSeconds));\n      throw new ClientError('Rate limit exceeded', 'rate-limited', {\n        status: 429,\n        details: {retry_after_seconds: error.retryAfterSeconds},\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    if (error instanceof AuthRateLimitUnavailableError) {\n      params.request.log.error(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n          err: error,\n        },\n        'Auth rate limiter unavailable',\n      );\n      throw new ClientError(\n        'Authentication rate limiter unavailable',\n        'auth-rate-limit-unavailable',\n        {\n          status: 503,\n          data: {\n            action: error.action,\n            scope: error.scope,\n            route: routeName(params.request),\n            identifierHmacPrefix: error.identifierHmacPrefix,\n          },\n          cause: error,\n        },\n      );\n    }\n\n    throw error;\n  }\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n\nexport function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n  };\n}\n"],"names":["ClientError","AuthRateLimitExceededError","AuthRateLimitUnavailableError","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","bootstrap","routeName","request","routeOptions","url","split","enforceRateLimit","params","policy","action","scope","identifier","error","log","warn","route","retryAfterSeconds","identifierHmacPrefix","reply","header","String","status","details","retry_after_seconds","data","cause","err","createAuthRateLimitPreHandler","body","createAuthIpRateLimitPreHandler"],"mappings":"AAAA,SAAQA,WAAW,QAA+C,wBAAwB;AAC1F,SAEEC,0BAA0B,EAG1BC,6BAA6B,EAC7BC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAGF;IACFC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;IACAE,WAAW;QACTJ,IAAI;YAACC,OAAO;YAAGC,eAAe,KAAK;QAAE;IACvC;AACF;AAMA,SAASG,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAeC,iBAAiBC,MAM/B;IACC,MAAMC,SAASd,QAAQ,CAACa,OAAOE,MAAM,CAAC,CAACF,OAAOG,KAAK,CAAC;IACpD,IAAI,CAACF,QAAQ;IAEb,IAAI;QACF,MAAMf,mBAAmB;YACvBgB,QAAQF,OAAOE,MAAM;YACrBC,OAAOH,OAAOG,KAAK;YACnBC,YAAYJ,OAAOI,UAAU;YAC7B,GAAGH,MAAM;QACX;IACF,EAAE,OAAOI,OAAO;QACd,IAAIA,iBAAiBrB,4BAA4B;YAC/CgB,OAAOL,OAAO,CAACW,GAAG,CAACC,IAAI,CACrB;gBACEL,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOd,UAAUM,OAAOL,OAAO;gBAC/Bc,mBAAmBJ,MAAMI,iBAAiB;gBAC1CC,sBAAsBL,MAAMK,oBAAoB;YAClD,GACA;YAEFV,OAAOW,KAAK,CAACC,MAAM,CAAC,eAAeC,OAAOR,MAAMI,iBAAiB;YACjE,MAAM,IAAI1B,YAAY,uBAAuB,gBAAgB;gBAC3D+B,QAAQ;gBACRC,SAAS;oBAACC,qBAAqBX,MAAMI,iBAAiB;gBAAA;gBACtDQ,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOd,UAAUM,OAAOL,OAAO;oBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,IAAIA,iBAAiBpB,+BAA+B;YAClDe,OAAOL,OAAO,CAACW,GAAG,CAACD,KAAK,CACtB;gBACEH,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOd,UAAUM,OAAOL,OAAO;gBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAChDS,KAAKd;YACP,GACA;YAEF,MAAM,IAAItB,YACR,2CACA,+BACA;gBACE+B,QAAQ;gBACRG,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOd,UAAUM,OAAOL,OAAO;oBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QAEJ;QAEA,MAAMA;IACR;AACF;AAEA,OAAO,SAASe,8BAA8BlB,MAA2B;IACvE,OAAO,OAAOP,SAA4CgB;QACxD,MAAMZ,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQN,EAAE;QACxB;QAEA,MAAMU,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQ0B,IAAI,CAAC7B,KAAK;QAChC;IACF;AACF;AAEA,OAAO,SAAS8B,gCAAgCpB,MAA2B;IACzE,OAAO,OAAOP,SAAyBgB;QACrC,MAAMZ,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQN,EAAE;QACxB;IACF;AACF"}