@stacksjs/defaults 0.75.62 → 0.75.64

package/app/Middleware/Throttle.ts

@@ -1,13 +1,40 @@
-import { createRateLimitMiddleware, Middleware, parseThrottleString } from '@stacksjs/router'
+import { clientAddress, createRateLimitMiddleware, Middleware, parseThrottleString } from '@stacksjs/router'
 
 // Cache for rate limiters to avoid creating new instances for each request
 const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware>>()
 
+const RATE_LIMIT_HEADERS = ['X-RateLimit-Limit', 'X-RateLimit-Remaining', 'X-RateLimit-Reset'] as const
+
+/**
+ * Whose budget a request spends.
+ *
+ * A signed-in request spends its user's: the Auth middleware stamps
+ * `_authenticatedUser`, and Throttle runs after it (priority 2 to Auth's 1),
+ * so people sharing an address - an office, a phone carrier's NAT, every test
+ * user on 127.0.0.1 - do not exhaust each other. bun-router's own default
+ * reads `request.user.id`, which on a Stacks request is the async `user()`
+ * accessor, so it never saw a user and every request fell through to an
+ * address.
+ *
+ * Anything else spends its client address's, as `clientAddress()` resolves
+ * it: the socket peer, or - only when that peer is a trusted proxy - the
+ * forwarding headers it vouches for (`CF-Connecting-IP` only when the hop
+ * that delivered the request is Cloudflare). A client-written
+ * `X-Forwarded-For` no longer buys a fresh budget.
+ */
+function throttleKey(request: { _authenticatedUser?: unknown }): string {
+  const user = request._authenticatedUser as { id?: unknown } | null | undefined
+  const id = user?.id
+  if ((typeof id === 'number' && Number.isFinite(id)) || (typeof id === 'string' && id !== ''))
+    return `user:${id}`
+  return `ip:${clientAddress(request as unknown as Request) ?? 'unknown'}`
+}
+
 /**
  * Throttle Middleware
  *
- * Rate limits requests based on IP address or authenticated user.
- * Uses Laravel-style throttle patterns.
+ * Rate limits requests per authenticated user, or per client address for
+ * anonymous requests (see `throttleKey`). Uses Laravel-style throttle patterns.
  *
  * Usage:
  *   .middleware('throttle:60,1')     // 60 requests per 1 minute
@@ -29,7 +56,7 @@ const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware
  *   "retryAfter": X
  * }
  *
- * Headers added to all responses:
+ * Headers added to all responses (successful ones via `_responseHeaders`):
  *   - X-RateLimit-Limit: Maximum requests allowed
  *   - X-RateLimit-Remaining: Remaining requests in current window
  *   - X-RateLimit-Reset: Unix timestamp when the limit resets
@@ -37,7 +64,9 @@ const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware
  */
 export default new Middleware({
   name: 'throttle',
-  priority: 1, // Run early, after maintenance but before auth
+  // After Auth (1), so an authenticated request is keyed on its user rather
+  // than on an address it may share with strangers.
+  priority: 2,
 
   async handle(request) {
     // Get throttle params from middleware params (e.g., '60,1' from 'throttle:60,1')
@@ -48,24 +77,25 @@ export default new Middleware({
     if (!limiter) {
       try {
         const config = parseThrottleString(params as Parameters<typeof parseThrottleString>[0])
-        limiter = createRateLimitMiddleware(config, `throttle:${params}`)
+        limiter = createRateLimitMiddleware({ ...config, keyGenerator: throttleKey }, `throttle:${params}`)
         limiterCache.set(params, limiter)
       }
       catch (error) {
         console.error(`[Throttle] Invalid throttle pattern: ${params}`, error)
         // Use default if pattern is invalid
         const defaultConfig = parseThrottleString('60,1')
-        limiter = createRateLimitMiddleware(defaultConfig, 'throttle:default')
+        limiter = createRateLimitMiddleware({ ...defaultConfig, keyGenerator: throttleKey }, 'throttle:default')
         limiterCache.set(params, limiter)
       }
     }
 
-    // Create a next function that continues the request
-    // The middleware will handle rate limiting and return 429 if needed
-    const result = await limiter(request as any, async () => null)
+    // The limiter stamps its X-RateLimit-* headers onto whatever `next()`
+    // answers, so hand it a placeholder and read them back. Passing `null`
+    // here meant a request that got through never learned its budget.
+    const result = await limiter(request as any, async () => new Response(null, { status: 204 }))
 
-    // If result is a Response (429), throw it to short-circuit the request
-    if (result instanceof Response) {
+    // A 429 short-circuits the request
+    if (result instanceof Response && result.status === 429) {
       // Transform the response to match stacks format
       const retryAfter = result.headers.get('Retry-After') || '60'
 
@@ -90,6 +120,15 @@ export default new Middleware({
       })
     }
 
-    // Continue normally - rate limit not exceeded
+    // Within the limit: ask the router to put the budget on the real response.
+    if (result instanceof Response) {
+      const headers: Record<string, string> = { ...request._responseHeaders }
+      for (const name of RATE_LIMIT_HEADERS) {
+        const value = result.headers.get(name)
+        if (value !== null)
+          headers[name] = value
+      }
+      request._responseHeaders = headers
+    }
   },
 })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.62",
+  "version": "0.75.64",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.62",
+  "version": "0.75.64",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "^0.75.62",
+    "@stacksjs/mobile": "^0.75.64",
     "@stacksjs/sanitizer": "^0.2.348",
     "ts-qr-codes": "^0.1.8"
   }

package/ide/vscode/build.ts

@@ -1,52 +0,0 @@
-/**
- * Builds the extension into dist/:
- *
- *   extension.js                the extension, for VS Code's Node host; only `vscode` is external
- *   pickier-worker.js           the Bun process that runs the project's pickier (src/pickier-worker.ts)
- *   pickier-worker.bunfig.toml  an empty bunfig, so the worker skips the project's preloads
- *   stx/                        grammar, language configuration and snippets from @stacksjs/stx-vscode
- *   stx-typescript-plugin/      the stx TypeScript server plugin from @stacksjs/stx-vscode
- *
- * `vsce package` runs this first (`vscode:prepublish`), and `files` in
- * package.json ships exactly these. tsserver loads the plugin from
- * node_modules, so a forwarder to it is written there as well, which is what
- * a development host (`--extensionDevelopmentPath`) loads; scripts/package.ts
- * adds the same forwarder to the VSIX (see scripts/ts-plugin.ts).
- */
-import { cpSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import process from 'node:process'
-import { copyTsPlugin, tsPluginName, writeTsPluginForwarder } from './scripts/ts-plugin'
-
-const here = import.meta.dir
-const dist = join(here, 'dist')
-
-rmSync(dist, { recursive: true, force: true })
-mkdirSync(dist, { recursive: true })
-
-const builds = await Promise.all([
-  // bunfig stays out: the stx utility-class engine imports it only to load a
-  // config file, which the extension never asks for, and its module-scope
-  // `await` and `import.meta.require` would make the CommonJS bundle a syntax
-  // error in VS Code's Node host. tests/build.test.ts parses the bundle.
-  Bun.build({ entrypoints: [join(here, 'src/extension.ts')], outdir: dist, target: 'node', format: 'cjs', external: ['vscode', 'bunfig'], minify: true }),
-  Bun.build({ entrypoints: [join(here, 'src/pickier-worker.ts')], outdir: dist, target: 'bun', format: 'esm' }),
-])
-
-for (const build of builds) {
-  if (!build.success) {
-    console.error(build.logs)
-    process.exit(1)
-  }
-}
-
-writeFileSync(join(dist, 'pickier-worker.bunfig.toml'), '# Intentionally empty: the pickier worker must not run the project\'s bunfig preloads.\n')
-
-const stxAssets = join(dirname(Bun.resolveSync('@stacksjs/stx-vscode/contributes.json', here)), 'assets')
-cpSync(stxAssets, join(dist, 'stx'), { recursive: true })
-
-copyTsPlugin(here)
-const { version } = JSON.parse(readFileSync(join(here, 'package.json'), 'utf8'))
-writeTsPluginForwarder(here, tsPluginName(here), version)
-
-console.log('Built dist/')

package/ide/vscode/scripts/package.ts

@@ -1,71 +0,0 @@
-/**
- * Package (and with `--publish`, publish) the extension.
- *
- *   bun scripts/package.ts [--out <file.vsix>] [--publish]
- *
- * `vsce package --no-dependencies` keeps the VSIX to what `files` lists, and it
- * leaves out everything under node_modules - including the one package the
- * extension needs there: the stx TypeScript server plugin, which tsserver will
- * only load by package name from `<extension>/node_modules` (see ts-plugin.ts).
- * So its forwarder is added to the VSIX after vsce writes it, and a publish
- * uploads that VSIX rather than letting vsce package a second time.
- */
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join, resolve } from 'node:path'
-import process from 'node:process'
-import { TS_PLUGIN_DIST, tsPluginModuleDir, tsPluginName, writeTsPluginForwarder } from './ts-plugin'
-
-const ROOT = join(import.meta.dir, '..')
-
-function run(command: string[], cwd = ROOT, capture = false): string {
-  const result = Bun.spawnSync(command, { cwd, stdout: capture ? 'pipe' : 'inherit', stderr: 'inherit', env: process.env })
-  if (result.exitCode !== 0)
-    throw new Error(`${command.join(' ')} exited with ${result.exitCode}`)
-  return capture ? String(result.stdout ?? '') : ''
-}
-
-/** Build the VSIX at `out`, with the TypeScript plugin's forwarder in it. */
-export function packageExtension(out: string): string {
-  const manifest = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'))
-  const name = tsPluginName(ROOT)
-
-  // vsce runs `vscode:prepublish` (the build) first.
-  run(['bun', 'x', '--bun', 'vsce', 'package', '--no-dependencies', '--out', out])
-
-  // A staging tree whose layout is the VSIX's, so zip records the paths VS
-  // Code extracts: extension/node_modules/<package>/...
-  const stage = mkdtempSync(join(tmpdir(), 'stacks-vsix-'))
-  try {
-    writeTsPluginForwarder(join(stage, 'extension'), name, manifest.version)
-    run(['zip', '-q', '-r', '-X', '-D', out, `extension/${tsPluginModuleDir(name)}`], stage)
-  }
-  finally {
-    rmSync(stage, { recursive: true, force: true })
-  }
-
-  const listing = run(['unzip', '-Z1', out], ROOT, true).split('\n')
-  for (const file of [`extension/${tsPluginModuleDir(name)}/index.js`, `extension/${TS_PLUGIN_DIST}/index.js`, `extension/${TS_PLUGIN_DIST}/typescript-stx-plugin.js`]) {
-    if (!listing.includes(file))
-      throw new Error(`${out} is missing ${file}`)
-  }
-
-  return out
-}
-
-if (import.meta.main) {
-  const args = process.argv.slice(2)
-  const outFlag = args.indexOf('--out')
-  const manifest = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'))
-  const out = resolve(outFlag === -1 ? join(ROOT, `${manifest.name}-${manifest.version}.vsix`) : args[outFlag + 1]!)
-
-  packageExtension(out)
-  console.log(`Packaged ${out}`)
-
-  if (args.includes('--publish')) {
-    if (!existsSync(out))
-      throw new Error(`${out} was not written`)
-    run(['bun', 'x', '--bun', 'vsce', 'publish', '--packagePath', out])
-    console.log(`Published ${manifest.publisher}.${manifest.name}@${manifest.version}`)
-  }
-}

package/ide/vscode/scripts/stx-contributes.ts

@@ -1,78 +0,0 @@
-/**
- * Keeps the stx half of package.json's `contributes` equal to what
- * `@stacksjs/stx-vscode` ships.
- *
- * VS Code reads languages, grammars, commands and settings only from the
- * manifest, so the built-in stx support needs them declared here, pointing at
- * dist/stx/ (copied there by build.ts). The library describes them in
- * `contributes.json`; this derives the manifest from it rather than keeping a
- * second copy by hand. That includes the TypeScript server plugin entry, which
- * type-checks `.stx` files (see ts-plugin.ts). Snippets are left out on purpose: the extension offers
- * them as completions only when the stx extension is not installed, because
- * a manifest entry would show every snippet twice next to it.
- *
- *   bun scripts/stx-contributes.ts --write   update package.json (`bun run sync:stx`)
- *
- * tests/manifest.test.ts fails while the two disagree.
- */
-import { readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-import process from 'node:process'
-
-export interface StxContributes {
-  languages: Array<Record<string, unknown> & { id: string, configuration: string }>
-  grammars: Array<Record<string, unknown> & { language: string, path: string }>
-  commands: Array<{ command: string, title: string, category?: string }>
-  configuration: { title: string, properties: Record<string, unknown> }
-  typescriptServerPlugins: Array<Record<string, unknown> & { name: string, languages?: string[] }>
-}
-
-const STX_DIR = './dist/stx/'
-
-function fromStx(path: string): string {
-  return STX_DIR + path.replace(/^\.\//, '')
-}
-
-/** The namespace of the extension's own commands; every other one is stx's. */
-export const OWN_COMMAND_PREFIX = 'stacks.'
-
-/**
- * `manifest` with its stx contributions replaced by the library's.
- *
- * Commands are told apart by namespace, not by the library's current list: a
- * command stx renamed or dropped is no longer in that list, and filtering by
- * it kept the old entry as if it were this extension's own (`css.reload`
- * outlived its rename to `stx.reloadUtilityClasses` that way).
- */
-export function withStxContributes(manifest: any, stx: StxContributes): any {
-  const contributes = manifest.contributes
-  const sections: Array<{ title: string }> = Array.isArray(contributes.configuration) ? contributes.configuration : [contributes.configuration]
-
-  return {
-    ...manifest,
-    contributes: {
-      ...contributes,
-      languages: stx.languages.map(language => ({ ...language, configuration: fromStx(language.configuration) })),
-      grammars: stx.grammars.map(grammar => ({ ...grammar, path: fromStx(grammar.path) })),
-      commands: [...contributes.commands.filter((command: { command: string }) => command.command.startsWith(OWN_COMMAND_PREFIX)), ...stx.commands],
-      configuration: [...sections.filter(section => section.title !== stx.configuration.title), stx.configuration],
-      typescriptServerPlugins: stx.typescriptServerPlugins,
-    },
-  }
-}
-
-export function libraryContributes(root: string): StxContributes {
-  return JSON.parse(readFileSync(Bun.resolveSync('@stacksjs/stx-vscode/contributes.json', root), 'utf8'))
-}
-
-if (import.meta.main) {
-  const root = join(import.meta.dir, '..')
-  const path = join(root, 'package.json')
-  const manifest = JSON.parse(readFileSync(path, 'utf8'))
-  const next = `${JSON.stringify(withStxContributes(manifest, libraryContributes(root)), null, 2)}\n`
-
-  if (process.argv.includes('--write'))
-    writeFileSync(path, next)
-  else
-    process.stdout.write(next)
-}

package/ide/vscode/scripts/ts-plugin.ts

@@ -1,72 +0,0 @@
-/**
- * The stx TypeScript server plugin, as this extension ships it.
- *
- * It is what type-checks the TypeScript in `.stx` files (script blocks and
- * template expressions) in the editor. `@stacksjs/stx-vscode` publishes it as a
- * complete package, `dist/typescript-plugin/`, and its `contributes.json`
- * carries the `typescriptServerPlugins` entry that `bun run sync:stx` copies
- * into package.json.
- *
- * tsserver loads a plugin only by package name, resolved from
- * `<extension>/node_modules`, the probe location VS Code passes for every
- * extension that contributes one. This extension is packaged with
- * `vsce --no-dependencies`, which leaves node_modules out of the VSIX, so:
- *
- *   dist/stx-typescript-plugin/            the package itself, copied by build.ts
- *                                          (shipped through `files`, like the rest of dist/)
- *   node_modules/<name>/{package.json,index.js}
- *                                          a forwarder to it, written by build.ts for
- *                                          a development host and added to the VSIX
- *                                          by scripts/package.ts after vsce writes it
- *
- * The stx extension (Stacks.vscode-stx) contributes the same plugin under the
- * same name. With both installed tsserver loads it twice, and the plugin
- * decorates each project only the first time (stacksjs/stx#2028).
- */
-import { cpSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { libraryContributes } from './stx-contributes'
-
-/** Where build.ts puts the plugin package, relative to the extension root. */
-export const TS_PLUGIN_DIST = 'dist/stx-typescript-plugin'
-
-/** The name the plugin is contributed and configured under. */
-export function tsPluginName(root: string): string {
-  const [plugin] = libraryContributes(root).typescriptServerPlugins
-  if (!plugin)
-    throw new Error('@stacksjs/stx-vscode contributes no TypeScript server plugin')
-  return plugin.name
-}
-
-/** Where tsserver resolves the plugin from, relative to the extension root. */
-export function tsPluginModuleDir(name: string): string {
-  return `node_modules/${name}`
-}
-
-/** The forwarder's files, relative to its directory under node_modules. */
-export function tsPluginForwarder(name: string, version: string): Record<string, string> {
-  const up = '../'.repeat(1 + name.split('/').length)
-  return {
-    'package.json': `${JSON.stringify({ name, version, private: true, main: 'index.js' }, null, 2)}\n`,
-    // tsserver calls `module.exports` as the factory, unwrapped.
-    'index.js': `module.exports = require('${up}${TS_PLUGIN_DIST}/index.js')\n`,
-  }
-}
-
-/** Write the forwarder under `<root>/node_modules`, returning its directory. */
-export function writeTsPluginForwarder(root: string, name: string, version: string): string {
-  const dir = join(root, tsPluginModuleDir(name))
-  mkdirSync(dir, { recursive: true })
-  for (const [file, content] of Object.entries(tsPluginForwarder(name, version)))
-    writeFileSync(join(dir, file), content)
-  return dir
-}
-
-/** Copy the plugin package from `@stacksjs/stx-vscode` into `<root>/dist`. */
-export function copyTsPlugin(root: string): string {
-  const source = dirname(Bun.resolveSync('@stacksjs/stx-vscode/typescript-plugin/package.json', root))
-  const target = join(root, TS_PLUGIN_DIST)
-  rmSync(target, { recursive: true, force: true })
-  cpSync(source, target, { recursive: true })
-  return target
-}

package/ide/vscode/src/env-file.ts

@@ -1,103 +0,0 @@
-/**
- * Env files, read the way Stacks reads them - the pure half of ./env.ts.
- *
- * Decryption and key lookup are not reimplemented here: they are
- * `@stacksjs/env`'s own (core/env/src), bundled into the extension, so a value
- * the hover decrypts is exactly what `./buddy env:get` prints.
- */
-import { basename } from 'node:path'
-import { envPrivateKeyNames } from '../../../../core/env/src/cli'
-import { decryptValue } from '../../../../core/env/src/crypto'
-import { parseEnvFile } from './project'
-
-/** `.env`, `.env.local`, `.env.production`, ... - not `.env.keys`, which holds the private keys themselves. */
-export function isEnvFile(path: string): boolean {
-  const name = basename(path)
-  return /^\.env(?:\..+)?$/.test(name) && name !== '.env.keys'
-}
-
-export function isEncrypted(value: string): boolean {
-  return value.startsWith('encrypted:')
-}
-
-export interface EnvEntry {
-  key: string
-  value: string
-  /** Character offsets of the value on its line, quotes excluded. */
-  start: number
-  end: number
-}
-
-/** The `KEY=value` on one line, with where its value sits, by `parseEnvFile`'s rules. */
-export function envEntryAt(line: string): EnvEntry | undefined {
-  const match = line.match(/^(\s*(?:export\s+)?([A-Z_a-z][\w.-]*)\s*=\s*)(.*)$/)
-  if (!match)
-    return undefined
-
-  const key = match[2] as string
-  const value = parseEnvFile(line)[key]
-  if (value === undefined)
-    return undefined
-
-  const rest = match[3] as string
-  const quoted = rest[0] === '"' || rest[0] === '\'' || rest[0] === '`'
-  const start = (match[1] as string).length + (quoted ? 1 : 0)
-  return { key, value, start, end: start + value.length }
-}
-
-/** Keys `.env.example` declares that the env file does not set, in example order. */
-export function missingKeys(example: string, actual: string): string[] {
-  const present = parseEnvFile(actual)
-  return Object.keys(parseEnvFile(example)).filter(key => !(key in present))
-}
-
-export interface PrivateKey {
-  name: string
-  key: string
-  from: '.env.keys' | 'environment'
-}
-
-/**
- * The private key for an env file, looked up as `./buddy env:get` does:
- * `envPrivateKeyNames` (`DOTENV_PRIVATE_KEY_<ENV>`, then `DOTENV_PRIVATE_KEY`)
- * in `.env.keys`, then in the environment, the dotenvx convention for CI and
- * servers where `.env.keys` must not exist.
- */
-export function findPrivateKey(envFile: string, keysFile: string | undefined, environment: Record<string, string | undefined>): PrivateKey | undefined {
-  const names = envPrivateKeyNames(basename(envFile))
-  const keys = keysFile === undefined ? {} : parseEnvFile(keysFile)
-
-  for (const name of names) {
-    if (keys[name])
-      return { name, key: keys[name] as string, from: '.env.keys' }
-  }
-  for (const name of names) {
-    if (environment[name])
-      return { name, key: environment[name] as string, from: 'environment' }
-  }
-  return undefined
-}
-
-export type Decryption =
-  | { ok: true, value: string, key: PrivateKey }
-  | { ok: false, reason: 'no-key', looked: string[] }
-  | { ok: false, reason: 'failed', key: PrivateKey }
-
-/** Decrypt one value in memory. The result is never cached or written anywhere. */
-export function decryptEnvValue(
-  envFile: string,
-  value: string,
-  keysFile: string | undefined,
-  environment: Record<string, string | undefined>,
-): Decryption {
-  const key = findPrivateKey(envFile, keysFile, environment)
-  if (!key)
-    return { ok: false, reason: 'no-key', looked: envPrivateKeyNames(basename(envFile)) }
-
-  try {
-    return { ok: true, value: decryptValue(value, key.key), key }
-  }
-  catch {
-    return { ok: false, reason: 'failed', key }
-  }
-}