@suveren/gateway 0.7.6 → 0.8.0

package/node_modules/express-rate-limit/dist/index.d.mts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.d.ts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.mjs

@@ -254,9 +254,9 @@ var setDraft8Headers = (response, info, windowMs, name, key) => {
   response.append("RateLimit", `"${name}"; ${header}`);
   response.append("RateLimit-Policy", `"${name}"; ${policy}`);
 };
-var setRetryAfterHeader = (response, info, windowMs) => {
+var setRetryAfterHeader = (response, info, windowMs, retryAfter) => {
   if (response.headersSent) return;
-  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  const resetSeconds = retryAfter ?? getResetSeconds(windowMs, info.resetTime);
   response.setHeader("Retry-After", resetSeconds.toString());
 };
 
@@ -523,6 +523,7 @@ var validations = {
       legacyHeaders: true,
       standardHeaders: true,
       identifier: true,
+      retryAfter: true,
       requestPropertyName: true,
       skipFailedRequests: true,
       skipSuccessfulRequests: true,
@@ -1007,7 +1008,9 @@ var rateLimit = (passedOptions) => {
         debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
           debug("set retry-after header");
-          setRetryAfterHeader(response, info, config.windowMs);
+          const retrieveRetryAfter = typeof config.retryAfter === "function" ? config.retryAfter(request, response) : config.retryAfter;
+          const retryAfter = await retrieveRetryAfter;
+          setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
         config.handler(request, response, next, options);
         return;

package/node_modules/express-rate-limit/{license.md → license}

@@ -1,4 +1,4 @@
-# MIT License
+MIT License
 
 Copyright 2023 Nathan Friedly, Vedant K
 
@@ -13,8 +13,9 @@ The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.6.2",
+	"version": "8.7.0",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -90,16 +90,16 @@
 		"@types/debug": "4.1.13",
 		"@types/express": "5.0.6",
 		"@types/jest": "30.0.0",
-		"@types/node": "26.1.2",
+		"@types/node": "26.2.0",
 		"@types/supertest": "7.2.1",
 		"del-cli": "7.0.0",
 		"dts-bundle-generator": "8.1.2",
-		"esbuild": "0.28.1",
+		"esbuild": "0.28.2",
 		"express": "5.2.1",
 		"husky": "9.1.7",
 		"jest": "30.4.2",
-		"lint-staged": "17.2.0",
-		"mintlify": "4.2.743",
+		"lint-staged": "17.3.0",
+		"mintlify": "4.2.817",
 		"npm-run-all": "4.1.5",
 		"prettier": "3.9.6",
 		"ratelimit-header-parser": "0.1.0",

package/node_modules/express-rate-limit/readme.md

@@ -5,6 +5,7 @@
 [![tests](https://img.shields.io/github/actions/workflow/status/express-rate-limit/express-rate-limit/ci.yaml)](https://github.com/express-rate-limit/express-rate-limit/actions/workflows/ci.yaml)
 [![npm version](https://img.shields.io/npm/v/express-rate-limit.svg)](https://npmjs.org/package/express-rate-limit 'View this project on NPM')
 [![npm downloads](https://img.shields.io/npm/dm/express-rate-limit)](https://www.npmjs.com/package/express-rate-limit)
+[![inspect.software](https://raw.githubusercontent.com/inspect-software/badges/main/v1/e/express-rate-limit/express-rate-limit.svg)](https://inspect.software/software/express-rate-limit/express-rate-limit)
 [![license](https://img.shields.io/npm/l/express-rate-limit)](license.md)
 
 </div>

package/node_modules/fast-uri/index.js

@@ -324,6 +324,18 @@ function hasMalformedPercentEncoding (component) {
   return false
 }
 
+/**
+ * Whether the host is a bracketed IP literal (RFC 3986 `IP-literal`).
+ * An unterminated `[` is not a literal, so it must still be validated as a
+ * reg-name instead of being waved through as an IP.
+ *
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isIPLiteral (host) {
+  return host[0] === '[' && host[host.length - 1] === ']'
+}
+
 /**
  * @param {RegExpMatchArray} matches
  * @returns {boolean}
@@ -333,7 +345,7 @@ function hasMalformedComponentPercentEncoding (matches) {
   // compatibility. Their parsing is intentionally left to normalizeIPv6.
   const host = matches[4]
   return hasMalformedPercentEncoding(matches[3]) ||
-    (host !== undefined && !(host[0] === '[' && host[host.length - 1] === ']') && hasMalformedPercentEncoding(host)) ||
+    (host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host)) ||
     hasMalformedPercentEncoding(matches[6]) ||
     hasMalformedPercentEncoding(matches[7]) ||
     hasMalformedPercentEncoding(matches[8])
@@ -351,7 +363,7 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
     parsed.host &&
-    parsed.host[0] !== '[' &&
+    !isIPLiteral(parsed.host) &&
     (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
     isIP === false &&
     nonSimpleDomain(parsed.host)
@@ -476,10 +488,11 @@ function parseWithStatus (uri, opts) {
     if (parsed.host) {
       const ipv4result = isIPv4(parsed.host)
       if (ipv4result === false) {
-        const bracketedIPLiteral = parsed.host[0] === '[' && parsed.host[parsed.host.length - 1] === ']'
+        const bracketedIPLiteral = isIPLiteral(parsed.host)
+        const hasIPLiteralBracket = parsed.host.indexOf('[') !== -1 || parsed.host.indexOf(']') !== -1
         const ipv6result = normalizeIPv6(parsed.host)
         isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true
-        malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true
+        malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true)
         parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
 
         if (malformedIPLiteral) {
@@ -509,7 +522,9 @@ function parseWithStatus (uri, opts) {
     const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme)
 
     // convert Unicode IDN -> ASCII IDN when the effective scheme uses domain hosts
-    malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    if (!malformedIPLiteral) {
+      malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    }
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (uri.indexOf('%') !== -1) {

package/node_modules/fast-uri/lib/utils.js

@@ -6,6 +6,9 @@ const isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\d
 /** @type {(value: string) => boolean} */
 const isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u)
 
+/** @type {(value: string) => boolean} */
+const isPort = RegExp.prototype.test.bind(/^\d*$/u)
+
 /** @type {(value: string) => boolean} */
 const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu)
 
@@ -713,8 +716,12 @@ function recomposeAuthority (component) {
   }
 
   if (typeof component.port === 'number' || typeof component.port === 'string') {
+    const port = String(component.port)
+    if (!isPort(port)) {
+      throw new TypeError('URI port is malformed.')
+    }
     uriTokens.push(':')
-    uriTokens.push(String(component.port))
+    uriTokens.push(port)
   }
 
   return uriTokens.length ? uriTokens.join('') : undefined

package/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "3.1.6",
+  "version": "3.1.7",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/node_modules/fast-uri/test/component-safe-serialization.test.js

@@ -24,6 +24,64 @@ test('userinfo serialization cannot terminate the authority', (t) => {
   t.end()
 })
 
+test('port serialization rejects non-digit values', (t) => {
+  const malformedPorts = [
+    '@127.0.0.1:8124',
+    '8080@evil.example',
+    '8080/path',
+    '8080?query',
+    '8080#fragment',
+    '8080:9000',
+    '-1',
+    '1.5',
+    1.5,
+    NaN,
+    Infinity,
+    '\u0661'
+  ]
+
+  for (const port of malformedPorts) {
+    t.throws(
+      () => fastURI.serialize({ scheme: 'http', host: 'trusted.example', port, path: '/app' }),
+      /URI port is malformed\./,
+      String(port)
+    )
+  }
+
+  t.throws(
+    () => fastURI.normalize({ scheme: 'http', host: 'trusted.example', port: '@evil.example' }),
+    /URI port is malformed\./,
+    'object normalization rejects a malformed port'
+  )
+  t.equal(
+    fastURI.equal(
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' },
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' }
+    ),
+    false,
+    'object equality fails closed for a malformed port'
+  )
+  t.end()
+})
+
+test('port serialization preserves RFC 3986 digit values', (t) => {
+  const validPorts = [
+    [8080, '8080'],
+    ['8080', '8080'],
+    ['00080', '00080'],
+    ['', '']
+  ]
+
+  for (const [port, expected] of validPorts) {
+    t.equal(
+      fastURI.serialize({ scheme: 'uri', host: 'example.test', port }),
+      `uri://example.test:${expected}`,
+      JSON.stringify(port)
+    )
+  }
+  t.end()
+})
+
 test('query and fragment serialization cannot inject component delimiters', (t) => {
   const uri = fastURI.serialize({
     scheme: 'x',

package/node_modules/fast-uri/test/ipv6-validation.test.js

@@ -88,3 +88,37 @@ test('valid IPv6, IPvFuture, embedded IPv4, and zone forms normalize safely', (t
   }
   t.end()
 })
+
+test('hosts with unbalanced or misplaced IP-literal brackets are rejected', (t) => {
+  const malformed = [
+    'http://[fe80',
+    'http://[',
+    'http://[not-an-ip',
+    'http://[\u65e5\u672c',
+    'http://user@[@127.0.0.1:8123/admin',
+    'http://user@]127.0.0.1:8123/admin',
+    'http://user@prefix[@127.0.0.1:8123/admin',
+    'http://user@prefix]@127.0.0.1:8123/admin'
+  ]
+  const modes = [
+    ['default', undefined],
+    ['Unicode', { unicodeSupport: true }]
+  ]
+
+  for (const [mode, options] of modes) {
+    for (const uri of malformed) {
+      const parsed = fastURI.parse(uri, options)
+      const message = `${mode} mode rejects ${uri}`
+
+      t.equal(parsed.error, HOST_ERROR, `parse ${message}`)
+      t.equal(fastURI.normalize(uri, options), uri, `normalize preserves ${uri} in ${mode} mode`)
+      t.equal(fastURI.equal(uri, uri, options), false, `equal ${message}`)
+      t.throws(
+        () => fastURI.resolve('http://example.com/', uri, options),
+        /URI host is malformed\./,
+        `resolve ${message}`
+      )
+    }
+  }
+  t.end()
+})