@stacksjs/defaults 0.75.63 → 0.75.64

package/app/Middleware/Throttle.ts

@@ -1,13 +1,40 @@
-import { createRateLimitMiddleware, Middleware, parseThrottleString } from '@stacksjs/router'
+import { clientAddress, createRateLimitMiddleware, Middleware, parseThrottleString } from '@stacksjs/router'
 
 // Cache for rate limiters to avoid creating new instances for each request
 const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware>>()
 
+const RATE_LIMIT_HEADERS = ['X-RateLimit-Limit', 'X-RateLimit-Remaining', 'X-RateLimit-Reset'] as const
+
+/**
+ * Whose budget a request spends.
+ *
+ * A signed-in request spends its user's: the Auth middleware stamps
+ * `_authenticatedUser`, and Throttle runs after it (priority 2 to Auth's 1),
+ * so people sharing an address - an office, a phone carrier's NAT, every test
+ * user on 127.0.0.1 - do not exhaust each other. bun-router's own default
+ * reads `request.user.id`, which on a Stacks request is the async `user()`
+ * accessor, so it never saw a user and every request fell through to an
+ * address.
+ *
+ * Anything else spends its client address's, as `clientAddress()` resolves
+ * it: the socket peer, or - only when that peer is a trusted proxy - the
+ * forwarding headers it vouches for (`CF-Connecting-IP` only when the hop
+ * that delivered the request is Cloudflare). A client-written
+ * `X-Forwarded-For` no longer buys a fresh budget.
+ */
+function throttleKey(request: { _authenticatedUser?: unknown }): string {
+  const user = request._authenticatedUser as { id?: unknown } | null | undefined
+  const id = user?.id
+  if ((typeof id === 'number' && Number.isFinite(id)) || (typeof id === 'string' && id !== ''))
+    return `user:${id}`
+  return `ip:${clientAddress(request as unknown as Request) ?? 'unknown'}`
+}
+
 /**
  * Throttle Middleware
  *
- * Rate limits requests based on IP address or authenticated user.
- * Uses Laravel-style throttle patterns.
+ * Rate limits requests per authenticated user, or per client address for
+ * anonymous requests (see `throttleKey`). Uses Laravel-style throttle patterns.
  *
  * Usage:
  *   .middleware('throttle:60,1')     // 60 requests per 1 minute
@@ -29,7 +56,7 @@ const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware
  *   "retryAfter": X
  * }
  *
- * Headers added to all responses:
+ * Headers added to all responses (successful ones via `_responseHeaders`):
  *   - X-RateLimit-Limit: Maximum requests allowed
  *   - X-RateLimit-Remaining: Remaining requests in current window
  *   - X-RateLimit-Reset: Unix timestamp when the limit resets
@@ -37,7 +64,9 @@ const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware
  */
 export default new Middleware({
   name: 'throttle',
-  priority: 1, // Run early, after maintenance but before auth
+  // After Auth (1), so an authenticated request is keyed on its user rather
+  // than on an address it may share with strangers.
+  priority: 2,
 
   async handle(request) {
     // Get throttle params from middleware params (e.g., '60,1' from 'throttle:60,1')
@@ -48,24 +77,25 @@ export default new Middleware({
     if (!limiter) {
       try {
         const config = parseThrottleString(params as Parameters<typeof parseThrottleString>[0])
-        limiter = createRateLimitMiddleware(config, `throttle:${params}`)
+        limiter = createRateLimitMiddleware({ ...config, keyGenerator: throttleKey }, `throttle:${params}`)
         limiterCache.set(params, limiter)
       }
       catch (error) {
         console.error(`[Throttle] Invalid throttle pattern: ${params}`, error)
         // Use default if pattern is invalid
         const defaultConfig = parseThrottleString('60,1')
-        limiter = createRateLimitMiddleware(defaultConfig, 'throttle:default')
+        limiter = createRateLimitMiddleware({ ...defaultConfig, keyGenerator: throttleKey }, 'throttle:default')
         limiterCache.set(params, limiter)
       }
     }
 
-    // Create a next function that continues the request
-    // The middleware will handle rate limiting and return 429 if needed
-    const result = await limiter(request as any, async () => null)
+    // The limiter stamps its X-RateLimit-* headers onto whatever `next()`
+    // answers, so hand it a placeholder and read them back. Passing `null`
+    // here meant a request that got through never learned its budget.
+    const result = await limiter(request as any, async () => new Response(null, { status: 204 }))
 
-    // If result is a Response (429), throw it to short-circuit the request
-    if (result instanceof Response) {
+    // A 429 short-circuits the request
+    if (result instanceof Response && result.status === 429) {
       // Transform the response to match stacks format
       const retryAfter = result.headers.get('Retry-After') || '60'
 
@@ -90,6 +120,15 @@ export default new Middleware({
       })
     }
 
-    // Continue normally - rate limit not exceeded
+    // Within the limit: ask the router to put the budget on the real response.
+    if (result instanceof Response) {
+      const headers: Record<string, string> = { ...request._responseHeaders }
+      for (const name of RATE_LIMIT_HEADERS) {
+        const value = result.headers.get(name)
+        if (value !== null)
+          headers[name] = value
+      }
+      request._responseHeaders = headers
+    }
   },
 })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.63",
+  "version": "0.75.64",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.63",
+  "version": "0.75.64",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "^0.75.63",
+    "@stacksjs/mobile": "^0.75.64",
     "@stacksjs/sanitizer": "^0.2.348",
     "ts-qr-codes": "^0.1.8"
   }