@ttt-productions/rate-limit-core 0.8.1 → 0.8.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/rate-limiter.d.ts
CHANGED
|
@@ -43,8 +43,10 @@ export interface RateLimiterFactoryOptions {
|
|
|
43
43
|
onDegraded?: (info: RateLimiterDegradation) => void;
|
|
44
44
|
}
|
|
45
45
|
/**
|
|
46
|
-
* Create a memoized Ratelimit factory.
|
|
47
|
-
*
|
|
46
|
+
* Create a memoized Ratelimit factory. One limiter is kept per `prefix`, and it is
|
|
47
|
+
* reused only while `maxRequests` and `window` still match: a caller that varies
|
|
48
|
+
* the capacity at runtime (a live incident multiplier) gets a limiter built for the
|
|
49
|
+
* new values, counting in the same Redis prefix, instead of the one built first.
|
|
48
50
|
*/
|
|
49
51
|
export declare function createRateLimiterFactory(options: RateLimiterFactoryOptions): {
|
|
50
52
|
getRateLimiter: (config: RateLimitConfig) => Ratelimit | null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../src/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,aAAa,GAAG,aAAa,CAAC;IACtC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,QAAQ,EAAE,MAAM,KAAK,GAAG,IAAI,CAAC;IAC7B,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACrD;AAED
|
|
1
|
+
{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../src/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,aAAa,GAAG,aAAa,CAAC;IACtC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,QAAQ,EAAE,MAAM,KAAK,GAAG,IAAI,CAAC;IAC7B,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACrD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB;6BAczC,eAAe,KAAG,SAAS,GAAG,IAAI;0BA+B3D,MAAM,UACH,eAAe,KACtB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;EAqBlE"}
|
package/dist/rate-limiter.js
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
import { Ratelimit } from "@upstash/ratelimit";
|
|
2
2
|
/**
|
|
3
|
-
* Create a memoized Ratelimit factory.
|
|
4
|
-
*
|
|
3
|
+
* Create a memoized Ratelimit factory. One limiter is kept per `prefix`, and it is
|
|
4
|
+
* reused only while `maxRequests` and `window` still match: a caller that varies
|
|
5
|
+
* the capacity at runtime (a live incident multiplier) gets a limiter built for the
|
|
6
|
+
* new values, counting in the same Redis prefix, instead of the one built first.
|
|
5
7
|
*/
|
|
6
8
|
export function createRateLimiterFactory(options) {
|
|
7
9
|
const limiters = new Map();
|
|
@@ -21,15 +23,16 @@ export function createRateLimiterFactory(options) {
|
|
|
21
23
|
if (!redis)
|
|
22
24
|
return null;
|
|
23
25
|
const existing = limiters.get(config.prefix);
|
|
24
|
-
if (existing)
|
|
25
|
-
return existing;
|
|
26
|
+
if (existing && existing.maxRequests === config.maxRequests && existing.window === config.window) {
|
|
27
|
+
return existing.limiter;
|
|
28
|
+
}
|
|
26
29
|
const limiter = new Ratelimit({
|
|
27
30
|
redis,
|
|
28
31
|
limiter: Ratelimit.slidingWindow(config.maxRequests, config.window),
|
|
29
32
|
analytics,
|
|
30
33
|
prefix: config.prefix,
|
|
31
34
|
});
|
|
32
|
-
limiters.set(config.prefix, limiter);
|
|
35
|
+
limiters.set(config.prefix, { maxRequests: config.maxRequests, window: config.window, limiter });
|
|
33
36
|
return limiter;
|
|
34
37
|
}
|
|
35
38
|
/**
|
package/dist/rate-limiter.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../src/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAgD/C
|
|
1
|
+
{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../src/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAgD/C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuE,CAAC;IAChG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,wEAAwE;IACxE,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAEhC,SAAS,MAAM,CAAC,IAA4B;QAC1C,IAAI,CAAC;YACH,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,MAAuB;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACjG,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC;YAC5B,KAAK;YACL,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAuD,CAAC;YACpH,SAAS;YACT,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,MAAuB;QAEvB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC;AAC5C,CAAC","sourcesContent":["import { Ratelimit } from \"@upstash/ratelimit\";\nimport type { Redis } from \"@upstash/redis\";\n\nexport interface RateLimitConfig {\n /** Unique prefix for this limiter (e.g. \"ratelimit:upload\"). */\n prefix: string;\n /** Max requests allowed in the window. */\n maxRequests: number;\n /** Window duration (e.g. \"1 h\", \"10 m\", \"1 d\"). */\n window: string;\n}\n\n/**\n * Structured report of a rate-limiter degradation. Passed to the injected\n * `onDegraded` hook so the consuming app can decide the alerting posture\n * (e.g. Sentry `captureMessage` in prod, a warn line in the emulator) WITHOUT\n * this generic package importing a monitoring provider directly.\n *\n * - `reason: 'unavailable'` — a limiter could not be built (Redis is null:\n * missing credentials or the disable hook). Fired at most once per factory\n * instance, on the FIRST `checkRateLimit` call, so an unconfigured prod deploy\n * pages within minutes of traffic instead of silently allowing everything.\n * - `reason: 'limit-error'` — `limiter.limit()` rejected at runtime (e.g. an\n * Upstash outage). The call fails OPEN (`allowed: true`) after reporting.\n */\nexport interface RateLimiterDegradation {\n reason: 'unavailable' | 'limit-error';\n /** The limiter prefix in play, when known. */\n prefix?: string;\n /** The underlying error for `reason: 'limit-error'`. */\n error?: unknown;\n}\n\nexport interface RateLimiterFactoryOptions {\n /** Returns the Redis client or null when disabled. */\n getRedis: () => Redis | null;\n /** When true, includes Upstash analytics. Default true. */\n analytics?: boolean;\n /**\n * Optional degradation hook. The consuming app injects its own alerting\n * (Sentry capture in prod, warn in local/emulator) — this package stays\n * provider-agnostic. `unavailable` fires at most once per factory instance;\n * `limit-error` fires per failed `limit()` call. The hook must never throw\n * (it is invoked inside the fail-open path).\n */\n onDegraded?: (info: RateLimiterDegradation) => void;\n}\n\n/**\n * Create a memoized Ratelimit factory. One limiter is kept per `prefix`, and it is\n * reused only while `maxRequests` and `window` still match: a caller that varies\n * the capacity at runtime (a live incident multiplier) gets a limiter built for the\n * new values, counting in the same Redis prefix, instead of the one built first.\n */\nexport function createRateLimiterFactory(options: RateLimiterFactoryOptions) {\n const limiters = new Map<string, { maxRequests: number; window: string; limiter: Ratelimit }>();\n const analytics = options.analytics ?? true;\n // Fire the `unavailable` degradation at most once per factory instance.\n let reportedUnavailable = false;\n\n function report(info: RateLimiterDegradation): void {\n try {\n options.onDegraded?.(info);\n } catch {\n // The alerting hook must never break the fail-open path.\n }\n }\n\n function getRateLimiter(config: RateLimitConfig): Ratelimit | null {\n const redis = options.getRedis();\n if (!redis) return null;\n\n const existing = limiters.get(config.prefix);\n if (existing && existing.maxRequests === config.maxRequests && existing.window === config.window) {\n return existing.limiter;\n }\n\n const limiter = new Ratelimit({\n redis,\n limiter: Ratelimit.slidingWindow(config.maxRequests, config.window as Parameters<typeof Ratelimit.slidingWindow>[1]),\n analytics,\n prefix: config.prefix,\n });\n limiters.set(config.prefix, { maxRequests: config.maxRequests, window: config.window, limiter });\n return limiter;\n }\n\n /**\n * Check rate limit for a key (e.g. userId). Returns `{ allowed: true }`\n * when Redis is unavailable OR the limit isn't exceeded.\n *\n * FAIL-OPEN POSTURE (decided 2026-07-03): both failure modes degrade to\n * \"allow, but observed\" rather than blocking every write. When the limiter is\n * unavailable (Redis null — missing credentials / disabled), the first call\n * reports `unavailable` so an unconfigured prod deploy is loud. When a built\n * limiter's `limit()` rejects (Upstash outage), the error is reported and the\n * call still allows — an outage must not take down every rate-limited callable.\n */\n async function checkRateLimit(\n key: string,\n config: RateLimitConfig,\n ): Promise<{ allowed: true } | { allowed: false; reset: number }> {\n const limiter = getRateLimiter(config);\n if (!limiter) {\n if (!reportedUnavailable) {\n reportedUnavailable = true;\n report({ reason: 'unavailable', prefix: config.prefix });\n }\n return { allowed: true };\n }\n try {\n const { success, reset } = await limiter.limit(key);\n if (!success) return { allowed: false, reset };\n return { allowed: true };\n } catch (error) {\n // Runtime Redis error (e.g. Upstash outage). Fail OPEN, but report.\n report({ reason: 'limit-error', prefix: config.prefix, error });\n return { allowed: true };\n }\n }\n\n return { getRateLimiter, checkRateLimit };\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ttt-productions/rate-limit-core",
|
|
3
|
-
"version": "0.8.
|
|
3
|
+
"version": "0.8.2",
|
|
4
4
|
"repository": {
|
|
5
5
|
"type": "git",
|
|
6
6
|
"url": "git+https://github.com/ttt-productions/ttt-packages.git",
|
|
@@ -32,8 +32,7 @@
|
|
|
32
32
|
},
|
|
33
33
|
"devDependencies": {
|
|
34
34
|
"@upstash/ratelimit": "^2.0.0",
|
|
35
|
-
"@upstash/redis": "^1.34.0"
|
|
36
|
-
"typescript": "^5.8.3"
|
|
35
|
+
"@upstash/redis": "^1.34.0"
|
|
37
36
|
},
|
|
38
37
|
"engines": {
|
|
39
38
|
"node": ">=22",
|