@superfunctions/middleware 0.2.0 → 0.3.0

package/dist/rate-limit.d.ts

@@ -27,11 +27,14 @@ export interface CheckLimitInput {
 }
 export interface CheckManyLimitsInput {
     keys: string[];
+    /** Override the shared limit for each unprefixed key. */
+    limitsByKey?: Record<string, number>;
     windowSeconds?: number;
     limit?: number;
 }
 export interface RateLimitManyResult {
     allowed: boolean;
+    blockedKeys?: string[];
     remainingByKey: Map<string, number>;
     resetAtByKey: Map<string, string>;
     resetAt: string;

package/dist/rate-limit.js

@@ -289,6 +289,7 @@ export function createRateLimiter(config) {
             const uniqueKeys = [...new Set(input.keys)];
             const effectiveWindowMs = (input.windowSeconds !== undefined ? input.windowSeconds * 1000 : undefined) ?? windowMs;
             const effectiveLimit = input.limit ?? maxRequests;
+            const limits = uniqueKeys.map((key) => input.limitsByKey && Object.prototype.hasOwnProperty.call(input.limitsByKey, key) ? input.limitsByKey[key] ?? effectiveLimit : effectiveLimit);
             const namespacedKeys = uniqueKeys.map((key) => `${keyPrefix}${key}`);
             if (uniqueKeys.length === 0) {
                 return {
@@ -301,11 +302,12 @@ export function createRateLimiter(config) {
             }
             return withKeyLocks(namespacedKeys, async () => {
                 const currentTime = now();
-                const preflight = await Promise.all(namespacedKeys.map((key) => evaluateConfiguredKey(key, currentTime, effectiveWindowMs, effectiveLimit, false)));
+                const preflight = await Promise.all(namespacedKeys.map((key, index) => evaluateConfiguredKey(key, currentTime, effectiveWindowMs, limits[index], false)));
                 const blocked = preflight.filter((result) => !result.allowed);
                 if (blocked.length > 0) {
                     return {
                         allowed: false,
+                        blockedKeys: uniqueKeys.filter((_key, index) => !preflight[index].allowed),
                         remainingByKey: new Map(uniqueKeys.map((key, index) => [key, preflight[index].remaining])),
                         resetAtByKey: new Map(uniqueKeys.map((key, index) => [key, preflight[index].resetAt])),
                         resetAt: new Date(Math.max(...blocked.map((result) => Date.parse(result.resetAt)))).toISOString(),
@@ -318,13 +320,14 @@ export function createRateLimiter(config) {
                     // Commit each key through the configured store. If a later commit
                     // becomes blocked or fails, retain earlier quota charges (fail
                     // closed) instead of restoring stale snapshots over concurrent work.
-                    const result = await evaluateConfiguredKey(key, currentTime, effectiveWindowMs, effectiveLimit, true);
+                    const result = await evaluateConfiguredKey(key, currentTime, effectiveWindowMs, limits[index], true);
                     committed.push(result);
                     if (!result.allowed) {
                         const actual = preflight.map((entry, entryIndex) => committed[entryIndex] ?? entry);
                         const blockedActual = actual.filter((entry) => !entry.allowed);
                         return {
                             allowed: false,
+                            blockedKeys: uniqueKeys.filter((_key, index) => !actual[index].allowed),
                             remainingByKey: new Map(uniqueKeys.map((entry, entryIndex) => [entry, actual[entryIndex].remaining])),
                             resetAtByKey: new Map(uniqueKeys.map((entry, entryIndex) => [entry, actual[entryIndex].resetAt])),
                             resetAt: new Date(Math.max(...blockedActual.map((entry) => Date.parse(entry.resetAt)))).toISOString(),

package/dist/rate-limit.test.js

@@ -348,3 +348,15 @@ describe('rate-limit', () => {
         });
     });
 });
+it('uses only own limit overrides, including inherited property names', async () => {
+    const limiter = createRateLimiter({ windowMs: 60000, maxRequests: 2, algorithm: 'fixed-window' });
+    const keys = ['constructor', 'toString', '__proto__'];
+    const limitsByKey = Object.create({ constructor: 0 });
+    limitsByKey.toString = 1;
+    const first = await limiter.checkMany({ keys, limitsByKey });
+    expect(first.allowed).toBe(true);
+    expect(first.remainingByKey.get('constructor')).toBe(1);
+    expect(first.remainingByKey.get('toString')).toBe(0);
+    expect(first.remainingByKey.get('__proto__')).toBe(1);
+    expect((await limiter.checkMany({ keys, limitsByKey })).blockedKeys).toEqual(['toString']);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superfunctions/middleware",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Shared middleware utilities for Superfunctions",
   "type": "module",
   "main": "./dist/index.js",
@@ -15,37 +15,50 @@
       "default": "./dist/rate-limit.js"
     }
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "build": "tsc",
-    "test": "vitest",
+    "test": "vitest run",
     "test:watch": "vitest --watch",
     "typecheck": "tsc --noEmit",
     "clean": "rm -rf dist"
   },
-  "keywords": ["middleware", "rate-limit", "superfunctions"],
+  "keywords": [
+    "middleware",
+    "rate-limit",
+    "superfunctions"
+  ],
   "author": "21n",
   "license": "MIT",
-  "bugs": { "url": "https://github.com/21nCo/super-functions/issues" },
+  "bugs": {
+    "url": "https://github.com/21nCo/super-functions/issues"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/21nCo/super-functions.git",
     "directory": "packages/middleware"
   },
-  "publishConfig": { "access": "public" },
+  "publishConfig": {
+    "access": "public"
+  },
   "peerDependencies": {
-    "@superfunctions/db": "0.2.0"
+    "@superfunctions/db": "^0.2.0 || ^0.3.0"
   },
   "peerDependenciesMeta": {
-    "@superfunctions/db": { "optional": true }
+    "@superfunctions/db": {
+      "optional": true
+    }
   },
   "dependencies": {
     "@superfunctions/observability": "0.0.1"
   },
   "devDependencies": {
-    "@superfunctions/db": "^0.2.0",
+    "@superfunctions/db": "0.3.0",
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
     "vitest": "^3.2.4"
-  }
+  },
+  "gitHead": "11f7e104d2d59f62ac94ab2dd06fc01144d0390b"
 }