@tuturuuu/utils 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.13.0](https://github.com/tutur3u/platform/compare/utils-v0.12.1...utils-v0.13.0) (2026-07-05)
+
+
+### Features
+
+* **tools:** add apps/tools public tools app, remove apps/qr ([204aae8](https://github.com/tutur3u/platform/commit/204aae89a04b4163f2859561f8e832526642e271))
+
+
+### Bug Fixes
+
+* **tasks:** route native personal task moves normally ([5bbba3c](https://github.com/tutur3u/platform/commit/5bbba3c3f193e722cc87cdfe2eb2734f61442cd0))
+* **web:** fail open without redis ([74bfcc7](https://github.com/tutur3u/platform/commit/74bfcc7ea5f188a56f49802c6a48bde0b109e02d))
+
+## [0.12.1](https://github.com/tutur3u/platform/compare/utils-v0.12.0...utils-v0.12.1) (2026-07-03)
+
+
+### Bug Fixes
+
+* **infrastructure:** restore canonical auth host access ([9f6715f](https://github.com/tutur3u/platform/commit/9f6715fb1c5a89598556cba33b16938b76995fc6))
+
 ## [0.12.0](https://github.com/tutur3u/platform/compare/utils-v0.11.0...utils-v0.12.0) (2026-07-02)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -22,9 +22,9 @@
     "@tanstack/react-query": "^5.101.2",
     "@tiptap/core": "3.27.1",
     "@tiptap/react": "3.27.1",
-    "@tuturuuu/google": "0.0.2",
+    "@tuturuuu/google": "0.0.3",
     "@tuturuuu/icons": "0.0.6",
-    "@tuturuuu/internal-api": "0.13.0",
+    "@tuturuuu/internal-api": "0.14.1",
     "@tuturuuu/supabase": "0.4.0",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
@@ -45,7 +45,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.13.1",
+    "@tuturuuu/types": "0.14.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.0.1",

package/src/__tests__/api-proxy-guard.test.ts

@@ -278,6 +278,36 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.validateEmoji).toHaveBeenCalled();
   });
 
+  it('skips proxy route buckets when Redis is not configured', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 1,
+      remaining: 0,
+      reset: Date.now() + 60_000,
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'GET'),
+      {
+        prefixBase: 'proxy:test:api',
+        routePolicies: singleReadRoutePolicies(),
+      }
+    );
+
+    expect(response).toBeNull();
+    expect(mocks.redis).not.toHaveBeenCalled();
+    expect(mocks.limit).not.toHaveBeenCalled();
+    expect(mocks.validateEmoji).toHaveBeenCalled();
+  });
+
   it('allows a blocked IP to submit the rate-limit appeal endpoint only', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -1186,7 +1216,7 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.validateEmoji).not.toHaveBeenCalled();
   });
 
-  it('uses local rate limits when the Redis rate limiter is unreachable', async () => {
+  it('skips proxy route buckets when the Redis rate limiter is unreachable', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv(
       'UPSTASH_REDIS_REST_URL',
@@ -1196,7 +1226,7 @@ describe('guardApiProxyRequest', () => {
     mocks.redis.mockReturnValue({});
     mocks.extractIp.mockReturnValue('1.2.3.4');
     mocks.isBlocked.mockResolvedValue(null);
-    mocks.limit.mockRejectedValueOnce(new TypeError('fetch failed'));
+    mocks.limit.mockRejectedValue(new TypeError('fetch failed'));
     mocks.validateEmoji.mockResolvedValue(null);
 
     const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
@@ -1216,22 +1246,17 @@ describe('guardApiProxyRequest', () => {
     expect(response).toBeNull();
     expect(mocks.limit).toHaveBeenCalledTimes(1);
 
-    const blockedResponse = await guardApiProxyRequest(
+    const allowedResponse = await guardApiProxyRequest(
       makeRequest('/api/test', 'GET'),
       options
     );
 
-    expect(blockedResponse?.status).toBe(429);
-    expect(blockedResponse?.headers.get('X-Proxy-Block-Reason')).toBe(
-      'route-rate-limit'
-    );
-    expect(blockedResponse?.headers.get('X-RateLimit-Policy')).toBe(
-      'redis-fallback-test'
-    );
-    expect(mocks.limit).toHaveBeenCalledTimes(1);
+    expect(allowedResponse).toBeNull();
+    expect(mocks.limit).toHaveBeenCalledTimes(2);
+    expect(mocks.validateEmoji).toHaveBeenCalledTimes(2);
   });
 
-  it('uses local rate limits when Redis client initialization fails', async () => {
+  it('skips proxy route buckets when Redis client initialization fails', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
@@ -1258,16 +1283,14 @@ describe('guardApiProxyRequest', () => {
 
     expect(response).toBeNull();
 
-    const blockedResponse = await guardApiProxyRequest(
+    const allowedResponse = await guardApiProxyRequest(
       makeRequest('/api/test', 'GET'),
       options
     );
 
-    expect(blockedResponse?.status).toBe(429);
-    expect(blockedResponse?.headers.get('X-Proxy-Block-Reason')).toBe(
-      'route-rate-limit'
-    );
+    expect(allowedResponse).toBeNull();
     expect(mocks.limit).not.toHaveBeenCalled();
+    expect(mocks.validateEmoji).toHaveBeenCalledTimes(2);
   });
 
   it('rate limits anonymous users/me reads', async () => {

package/src/__tests__/app-url.test.ts

@@ -137,6 +137,29 @@ describe('resolveInternalAppUrl', () => {
     ).toBeNull();
   });
 
+  it('recognizes canonical and legacy infrastructure production origins', () => {
+    expect(
+      getAppDomainByUrl(
+        'https://infrastructure.tuturuuu.com/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toMatchObject({
+      canonicalUrl:
+        'https://infrastructure.tuturuuu.com/verify-token?nextUrl=%2Fpersonal',
+      kind: 'internal',
+      name: 'infra',
+    });
+    expect(
+      getAppDomainByUrl(
+        'https://infra.tuturuuu.com/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toMatchObject({
+      canonicalUrl:
+        'https://infra.tuturuuu.com/verify-token?nextUrl=%2Fpersonal',
+      kind: 'internal',
+      name: 'infra',
+    });
+  });
+
   it('canonicalizes production internal app URLs to their registered HTTPS origins', () => {
     expect(
       resolveInternalAppUrl({
@@ -152,6 +175,13 @@ describe('resolveInternalAppUrl', () => {
         fallback: 'http://localhost:7807',
       })
     ).toBe('https://meet.tuturuuu.com');
+    expect(
+      resolveInternalAppUrl({
+        appName: 'infra',
+        candidates: ['http://infrastructure.tuturuuu.com/'],
+        fallback: 'http://localhost:7823',
+      })
+    ).toBe('https://infrastructure.tuturuuu.com');
   });
 
   it('falls back when every configured URL points at another internal app', () => {
@@ -203,6 +233,7 @@ describe('getLocalInternalAppUrl', () => {
     ['chat', 'https://chat.tuturuuu.localhost'],
     ['drive', 'https://drive.tuturuuu.localhost'],
     ['qr', 'https://qr.tuturuuu.localhost'],
+    ['tools', 'https://tools.tuturuuu.localhost'],
     ['nova', 'https://nova.tuturuuu.localhost'],
     ['rewise', 'https://rewise.tuturuuu.localhost'],
     ['tasks', 'https://tasks.tuturuuu.localhost'],
@@ -275,6 +306,7 @@ describe('Portless app origin registry', () => {
       'https://playground.tuturuuu.localhost',
       'https://qr.tuturuuu.localhost',
       'https://rewise.tuturuuu.localhost',
+      'https://tools.tuturuuu.localhost',
       'https://shortener.tuturuuu.localhost',
       'https://storefront.tuturuuu.localhost',
       'https://tanstack.tuturuuu.localhost',

package/src/__tests__/task-transformers.test.ts

@@ -58,5 +58,26 @@ describe('transformTaskRecord', () => {
     expect(transformed.projects).toEqual([
       { id: 'project-1', name: 'Platform', status: 'active' },
     ]);
+    expect(transformed).toMatchObject({
+      is_personal_external: false,
+      is_personal_external_default: false,
+    });
+  });
+
+  it('preserves explicit personal external flags from API responses', () => {
+    const transformed = transformTaskRecord({
+      id: 'task-1',
+      name: 'Task',
+      list_id: 'list-1',
+      display_number: 1,
+      created_at: '2026-01-01T00:00:00.000Z',
+      is_personal_external: true,
+      is_personal_external_default: true,
+    });
+
+    expect(transformed).toMatchObject({
+      is_personal_external: true,
+      is_personal_external_default: true,
+    });
   });
 });

package/src/abuse-protection/__tests__/index-fail-open.test.ts

@@ -0,0 +1,93 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+describe('abuse protection Redis fail-open behavior', () => {
+  afterEach(() => {
+    vi.doUnmock('../../upstash-rest');
+    vi.doUnmock('@tuturuuu/supabase/next/server');
+    vi.resetModules();
+    vi.restoreAllMocks();
+  });
+
+  it('allows checks and skips persistent IP block lookups when Redis is not configured', async () => {
+    const from = vi.fn(() => ({
+      insert: vi.fn(async () => ({ error: null })),
+    }));
+    const rpc = vi.fn();
+    const createAdminClient = vi.fn(async () => ({ from, rpc }));
+    const getRedis = vi.fn();
+
+    vi.doMock('../../upstash-rest', () => ({
+      getUpstashRestRedisClient: getRedis,
+      hasUpstashRestEnv: () => false,
+    }));
+    vi.doMock('@tuturuuu/supabase/next/server', () => ({
+      createAdminClient,
+    }));
+
+    const { checkPasswordLoginLimit, isIPBlocked, recordPasswordLoginFailure } =
+      await import('../index.js');
+
+    for (let attempt = 0; attempt < 20; attempt += 1) {
+      await recordPasswordLoginFailure('203.0.113.80', 'user@example.com');
+    }
+
+    await expect(isIPBlocked('203.0.113.80')).resolves.toBeNull();
+    await expect(
+      checkPasswordLoginLimit('203.0.113.80', 'user@example.com')
+    ).resolves.toMatchObject({
+      allowed: true,
+    });
+    expect(getRedis).not.toHaveBeenCalled();
+    expect(rpc).not.toHaveBeenCalledWith('get_active_ip_block', {
+      p_ip_address: '203.0.113.80',
+    });
+    expect(from).not.toHaveBeenCalledWith('blocked_ips');
+  });
+
+  it('allows checks and skips counter writes after Redis commands fail', async () => {
+    const from = vi.fn(() => ({
+      insert: vi.fn(async () => ({ error: null })),
+    }));
+    const rpc = vi.fn();
+    const createAdminClient = vi.fn(async () => ({ from, rpc }));
+    const redis = {
+      del: vi.fn(),
+      expire: vi.fn(),
+      get: vi.fn(async () => {
+        throw new Error('redis unavailable');
+      }),
+      incr: vi.fn(async () => {
+        throw new Error('redis unavailable');
+      }),
+      set: vi.fn(),
+      ttl: vi.fn(),
+    };
+
+    vi.doMock('../../upstash-rest', () => ({
+      getUpstashRestRedisClient: async () => redis,
+      hasUpstashRestEnv: () => true,
+    }));
+    vi.doMock('@tuturuuu/supabase/next/server', () => ({
+      createAdminClient,
+    }));
+
+    const { checkPasswordLoginLimit, isIPBlocked, recordPasswordLoginFailure } =
+      await import('../index.js');
+
+    await expect(isIPBlocked('203.0.113.81')).resolves.toBeNull();
+    await expect(
+      checkPasswordLoginLimit('203.0.113.81', 'user@example.com')
+    ).resolves.toMatchObject({
+      allowed: true,
+    });
+    await expect(
+      recordPasswordLoginFailure('203.0.113.81', 'user@example.com')
+    ).resolves.toBeUndefined();
+    expect(redis.expire).not.toHaveBeenCalled();
+    expect(redis.set).not.toHaveBeenCalled();
+    expect(rpc).not.toHaveBeenCalledWith('get_active_ip_block', {
+      p_ip_address: '203.0.113.81',
+    });
+    expect(from).not.toHaveBeenCalledWith('blocked_ips');
+  });
+});

package/src/abuse-protection/__tests__/index.test.ts

@@ -2,7 +2,76 @@
  * Unit tests for OTP Abuse Protection System
  */
 
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => {
+  const store = new Map<string, { expiresAt: number | null; value: unknown }>();
+
+  function getEntry(key: string) {
+    const entry = store.get(key);
+    if (!entry) return null;
+
+    if (entry.expiresAt != null && entry.expiresAt <= Date.now()) {
+      store.delete(key);
+      return null;
+    }
+
+    return entry;
+  }
+
+  return {
+    getRedis: vi.fn(),
+    redis: {
+      del: vi.fn(async (...keys: string[]) => {
+        let deleted = 0;
+        for (const key of keys) {
+          if (store.delete(key)) deleted += 1;
+        }
+        return deleted;
+      }),
+      expire: vi.fn(async (key: string, seconds: number) => {
+        const entry = getEntry(key);
+        if (!entry) return 0;
+        entry.expiresAt = Date.now() + seconds * 1000;
+        return 1;
+      }),
+      get: vi.fn(async <T = unknown>(key: string): Promise<T | null> => {
+        return (getEntry(key)?.value as T | undefined) ?? null;
+      }),
+      incr: vi.fn(async (key: string) => {
+        const entry = getEntry(key);
+        const nextValue =
+          typeof entry?.value === 'number' ? entry.value + 1 : 1;
+        store.set(key, {
+          expiresAt: entry?.expiresAt ?? null,
+          value: nextValue,
+        });
+        return nextValue;
+      }),
+      set: vi.fn(
+        async (key: string, value: unknown, options?: { ex?: number }) => {
+          store.set(key, {
+            expiresAt: options?.ex ? Date.now() + options.ex * 1000 : null,
+            value,
+          });
+          return 'OK';
+        }
+      ),
+      ttl: vi.fn(async (key: string) => {
+        const entry = getEntry(key);
+        if (!entry) return -2;
+        if (entry.expiresAt == null) return -1;
+        return Math.ceil((entry.expiresAt - Date.now()) / 1000);
+      }),
+    },
+    store,
+  };
+});
+
+vi.mock('../../upstash-rest', () => ({
+  getUpstashRestRedisClient: () => mocks.getRedis(),
+  hasUpstashRestEnv: () => true,
+}));
 
 import {
   ABUSE_THRESHOLDS,
@@ -29,6 +98,12 @@ import {
 } from '../index';
 
 describe('abuse-protection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.store.clear();
+    mocks.getRedis.mockResolvedValue(mocks.redis);
+  });
+
   afterEach(() => {
     vi.useRealTimers();
     vi.unstubAllEnvs();

package/src/abuse-protection/index.ts

@@ -31,9 +31,6 @@ export * from './reputation';
 export * from './types';
 export * from './user-agent';
 
-// In-memory fallback store
-const memoryStore = new Map<string, { count: number; expiresAt: number }>();
-
 const SHARED_IP_THROTTLE_ONLY_BLOCK_REASONS = new Set<AbuseEventType>([
   'otp_send',
   'otp_verify_failed',
@@ -50,6 +47,28 @@ export function isSharedIpThrottleOnlyBlockReason(reason: AbuseEventType) {
 let redisClient: RedisClient | null = null;
 let redisInitialized = false;
 
+function markRedisUnavailable(message: string, ...details: unknown[]): void {
+  if (details.length > 0) {
+    console.warn(message, ...details);
+  } else {
+    console.warn(message);
+  }
+
+  redisClient = null;
+  redisInitialized = true;
+}
+
+function markRedisCommandFailed(message: string, ...details: unknown[]): void {
+  if (details.length > 0) {
+    console.warn(message, ...details);
+  } else {
+    console.warn(message);
+  }
+
+  redisClient = null;
+  redisInitialized = false;
+}
+
 function parsePositiveIntEnv(name: string, fallback: number): number {
   const rawValue = process.env[name];
   if (!rawValue) {
@@ -85,19 +104,22 @@ async function getRedisClient(): Promise<RedisClient | null> {
 
   try {
     if (!hasUpstashRestEnv()) {
-      console.warn(
-        '[Abuse Protection] Redis not configured - falling back to memory'
+      markRedisUnavailable(
+        '[Abuse Protection] Redis not configured - failing open'
       );
-      redisInitialized = true;
       return null;
     }
 
     redisClient = await getUpstashRestRedisClient();
+    if (!redisClient) {
+      markRedisUnavailable(
+        '[Abuse Protection] Redis client unavailable - failing open'
+      );
+    }
     redisInitialized = true;
     return redisClient;
   } catch (error) {
-    console.warn('[Abuse Protection] Redis unavailable:', error);
-    redisInitialized = true;
+    markRedisUnavailable('[Abuse Protection] Redis unavailable:', error);
     return null;
   }
 }
@@ -191,83 +213,70 @@ function createAbuseLogContext(
 }
 
 /**
- * Increment a counter in Redis or memory with automatic expiration
+ * Increment a Redis counter with automatic expiration.
+ * Fails open when Redis is unavailable so abuse protection never becomes an
+ * app availability dependency.
  */
 async function incrementCounter(
   key: string,
   windowMs: number
 ): Promise<{ count: number; ttl: number }> {
   const redis = await getRedisClient();
+  const neutral = { count: 0, ttl: Math.ceil(windowMs / 1000) };
 
-  if (redis) {
-    try {
-      const count = await redis.incr(key);
-      if (count === 1) {
-        await redis.expire(key, Math.ceil(windowMs / 1000));
-      }
-      const ttl = await redis.ttl(key);
-      return { count, ttl: ttl > 0 ? ttl : Math.ceil(windowMs / 1000) };
-    } catch (error) {
-      console.error('[Abuse Protection] Redis error:', error);
-      // Fall through to memory
-    }
+  if (!redis) {
+    return neutral;
   }
 
-  // Memory fallback
-  const now = Date.now();
-  const existing = memoryStore.get(key);
-
-  if (!existing || now > existing.expiresAt) {
-    memoryStore.set(key, { count: 1, expiresAt: now + windowMs });
-    return { count: 1, ttl: Math.ceil(windowMs / 1000) };
+  try {
+    const count = await redis.incr(key);
+    if (count === 1) {
+      await redis.expire(key, Math.ceil(windowMs / 1000));
+    }
+    const ttl = await redis.ttl(key);
+    return { count, ttl: ttl > 0 ? ttl : Math.ceil(windowMs / 1000) };
+  } catch (error) {
+    markRedisCommandFailed('[Abuse Protection] Redis counter error:', error);
+    return neutral;
   }
-
-  existing.count++;
-  return {
-    count: existing.count,
-    ttl: Math.ceil((existing.expiresAt - now) / 1000),
-  };
 }
 
 /**
- * Get counter value from Redis or memory
+ * Get a counter value from Redis.
  */
 async function getCounter(key: string): Promise<number> {
   const redis = await getRedisClient();
 
-  if (redis) {
-    try {
-      const count = await redis.get<number>(key);
-      return count || 0;
-    } catch {
-      // Fall through to memory
-    }
+  if (!redis) {
+    return 0;
   }
 
-  const existing = memoryStore.get(key);
-  if (!existing || Date.now() > existing.expiresAt) {
+  try {
+    const count = await redis.get<number>(key);
+    return count || 0;
+  } catch (error) {
+    markRedisCommandFailed(
+      '[Abuse Protection] Redis counter read error:',
+      error
+    );
     return 0;
   }
-  return existing.count;
 }
 
 /**
- * Delete keys from Redis or memory
+ * Delete Redis keys when Redis is available.
  */
 async function deleteKeys(...keys: string[]): Promise<void> {
   const redis = await getRedisClient();
 
-  if (redis) {
-    try {
-      await redis.del(...keys);
-      return;
-    } catch {
-      // Fall through to memory
-    }
+  if (!redis) {
+    return;
   }
 
-  for (const key of keys) {
-    memoryStore.delete(key);
+  try {
+    await redis.del(...keys);
+  } catch (error) {
+    markRedisCommandFailed('[Abuse Protection] Redis delete error:', error);
   }
 }
 
@@ -278,23 +287,17 @@ async function deleteKeysWithCount(...keys: string[]): Promise<number> {
 
   const redis = await getRedisClient();
 
-  if (redis) {
-    try {
-      const deleted = await redis.del(...keys);
-      return typeof deleted === 'number' ? deleted : 0;
-    } catch {
-      // Fall through to memory
-    }
+  if (!redis) {
+    return 0;
   }
 
-  let deleted = 0;
-  for (const key of keys) {
-    if (memoryStore.delete(key)) {
-      deleted++;
-    }
+  try {
+    const deleted = await redis.del(...keys);
+    return typeof deleted === 'number' ? deleted : 0;
+  } catch (error) {
+    markRedisCommandFailed('[Abuse Protection] Redis delete error:', error);
+    return 0;
   }
-
-  return deleted;
 }
 
 /**
@@ -324,30 +327,33 @@ export async function isIPBlocked(
 ): Promise<BlockInfo | null> {
   const redis = await getRedisClient();
 
+  if (!redis) {
+    return null;
+  }
+
   // Check Redis cache first
-  if (redis) {
-    try {
-      const cached = await redis.get<string>(REDIS_KEYS.IP_BLOCKED(ipAddress));
-      if (cached) {
-        const blockInfo =
-          typeof cached === 'string' ? JSON.parse(cached) : cached;
-        if (new Date(blockInfo.expiresAt) > new Date()) {
-          return {
-            id: blockInfo.id,
-            blockLevel: blockInfo.level,
-            reason: blockInfo.reason,
-            expiresAt: new Date(blockInfo.expiresAt),
-            blockedAt: new Date(blockInfo.blockedAt),
-          };
-        }
+  try {
+    const cached = await redis.get<string>(REDIS_KEYS.IP_BLOCKED(ipAddress));
+    if (cached) {
+      const blockInfo =
+        typeof cached === 'string' ? JSON.parse(cached) : cached;
+      if (new Date(blockInfo.expiresAt) > new Date()) {
+        return {
+          id: blockInfo.id,
+          blockLevel: blockInfo.level,
+          reason: blockInfo.reason,
+          expiresAt: new Date(blockInfo.expiresAt),
+          blockedAt: new Date(blockInfo.blockedAt),
+        };
       }
-    } catch (error) {
-      console.error(
-        '[Abuse Protection] Redis cache error:',
-        error,
-        createAbuseLogContext(ipAddress, context)
-      );
     }
+  } catch (error) {
+    markRedisCommandFailed(
+      '[Abuse Protection] Redis cache error:',
+      error,
+      createAbuseLogContext(ipAddress, context)
+    );
+    return null;
   }
 
   // Check database
@@ -376,21 +382,29 @@ export async function isIPBlocked(
     };
 
     // Cache in Redis
-    if (redis && blockInfo.expiresAt > new Date()) {
+    if (blockInfo.expiresAt > new Date()) {
       const ttl = Math.ceil(
         (blockInfo.expiresAt.getTime() - Date.now()) / 1000
       );
-      await redis.set(
-        REDIS_KEYS.IP_BLOCKED(ipAddress),
-        JSON.stringify({
-          id: blockInfo.id,
-          level: blockInfo.blockLevel,
-          reason: blockInfo.reason,
-          expiresAt: blockInfo.expiresAt.toISOString(),
-          blockedAt: blockInfo.blockedAt.toISOString(),
-        }),
-        { ex: ttl }
-      );
+      try {
+        await redis.set(
+          REDIS_KEYS.IP_BLOCKED(ipAddress),
+          JSON.stringify({
+            id: blockInfo.id,
+            level: blockInfo.blockLevel,
+            reason: blockInfo.reason,
+            expiresAt: blockInfo.expiresAt.toISOString(),
+            blockedAt: blockInfo.blockedAt.toISOString(),
+          }),
+          { ex: ttl }
+        );
+      } catch (error) {
+        markRedisCommandFailed(
+          '[Abuse Protection] Redis cache set error:',
+          error
+        );
+        return null;
+      }
     }
 
     return blockInfo;
@@ -413,31 +427,25 @@ export async function blockIP(
   }
 
   try {
+    const redis = await getRedisClient();
+    if (!redis) return;
+
     const sbAdmin = await getSupabaseAdmin();
     if (!sbAdmin) return;
 
-    const redis = await getRedisClient();
-
     // Get current block level
     let currentLevel = 0;
-    if (redis) {
-      try {
-        const level = await redis.get<number>(
-          REDIS_KEYS.IP_BLOCK_LEVEL(ipAddress)
-        );
-        currentLevel = level || 0;
-      } catch {
-        // Check DB fallback
-        const { data } = await sbAdmin.rpc('get_ip_block_level', {
-          p_ip_address: ipAddress,
-        });
-        currentLevel = (data as number) || 0;
-      }
-    } else {
-      const { data } = await sbAdmin.rpc('get_ip_block_level', {
-        p_ip_address: ipAddress,
-      });
-      currentLevel = (data as number) || 0;
+    try {
+      const level = await redis.get<number>(
+        REDIS_KEYS.IP_BLOCK_LEVEL(ipAddress)
+      );
+      currentLevel = level || 0;
+    } catch (error) {
+      markRedisCommandFailed(
+        '[Abuse Protection] Redis block-level error:',
+        error
+      );
+      return;
     }
 
     // Calculate new block level (max 4)
@@ -470,7 +478,7 @@ export async function blockIP(
     }
 
     // Update Redis cache
-    if (redis) {
+    try {
       await Promise.all([
         redis.set(
           REDIS_KEYS.IP_BLOCKED(ipAddress),
@@ -487,6 +495,11 @@ export async function blockIP(
           ex: WINDOW_MS.TWENTY_FOUR_HOURS / 1000,
         }),
       ]);
+    } catch (error) {
+      markRedisCommandFailed(
+        '[Abuse Protection] Redis block cache error:',
+        error
+      );
     }
 
     console.log(

package/src/api-proxy-guard.ts

@@ -112,13 +112,7 @@ type RateLimiter = {
   limit: (identifier: string) => Promise<RateLimitResult>;
 };
 
-type LocalRateLimitState = {
-  count: number;
-  reset: number;
-};
-
 const limiterCache = new Map<string, Limiters>();
-const localLimiterState = new Map<string, LocalRateLimitState>();
 const GENERIC_SUPABASE_AUTH_COOKIE_NAME_PATTERN =
   /^sb-[a-z0-9-]+-auth-token(?:\.\d+)?$/i;
 const UUID_PATH_SEGMENT =
@@ -697,87 +691,10 @@ function createRedisRateLimitBuckets(
   }));
 }
 
-function rateLimitDurationMs(duration: RateLimitConfig['duration']) {
-  switch (duration) {
-    case '1 m':
-      return 60_000;
-    case '1 h':
-      return 60 * 60_000;
-    case '1 d':
-      return 24 * 60 * 60_000;
-  }
-}
-
-function createLocalRateLimiter(
-  prefix: string,
-  config: RateLimitConfig
-): RateLimiter {
-  const durationMs = rateLimitDurationMs(config.duration);
-
-  return {
-    async limit(identifier: string) {
-      const now = Date.now();
-      const key = `${prefix}:${identifier}`;
-      let state = localLimiterState.get(key);
-
-      if (!state || state.reset <= now) {
-        state = {
-          count: 0,
-          reset: now + durationMs,
-        };
-      }
-
-      if (state.count >= config.limit) {
-        localLimiterState.set(key, state);
-        return {
-          limit: config.limit,
-          remaining: 0,
-          reset: state.reset,
-          success: false,
-        };
-      }
-
-      state.count += 1;
-      localLimiterState.set(key, state);
-
-      return {
-        limit: config.limit,
-        remaining: Math.max(0, config.limit - state.count),
-        reset: state.reset,
-        success: true,
-      };
-    },
-  };
-}
-
-function createLocalRateLimitBuckets(
-  prefixBase: string,
-  kind: 'get' | 'mutate',
-  configs: RateLimitConfig[]
-): RateLimitBucket[] {
-  return configs.map((config) => ({
-    window: config.window,
-    limiter: createLocalRateLimiter(
-      `${prefixBase}:local:${kind}:${config.window}`,
-      config
-    ),
-  }));
-}
-
-function createLocalRateLimiters(
-  prefixBase: string,
-  profile: RateLimitProfile
-): Limiters {
-  return {
-    get: createLocalRateLimitBuckets(prefixBase, 'get', profile.get),
-    mutate: createLocalRateLimitBuckets(prefixBase, 'mutate', profile.mutate),
-  };
-}
-
 async function getRateLimiters(
   prefixBase: string,
   profile: RateLimitProfile
-): Promise<Limiters> {
+): Promise<Limiters | null> {
   const cacheKey = `${prefixBase}:${JSON.stringify(profile)}`;
   const cached = limiterCache.get(cacheKey);
   if (cached) {
@@ -786,9 +703,7 @@ async function getRateLimiters(
 
   const redis = await getUpstashRatelimitRedisClient().catch(() => null);
   if (!redis) {
-    const localLimiters = createLocalRateLimiters(prefixBase, profile);
-    limiterCache.set(cacheKey, localLimiters);
-    return localLimiters;
+    return null;
   }
 
   const limiters = {
@@ -805,16 +720,6 @@ async function getRateLimiters(
   return limiters;
 }
 
-function replaceWithLocalRateLimiters(
-  cacheKey: string,
-  prefixBase: string,
-  profile: RateLimitProfile
-): Limiters {
-  const localLimiters = createLocalRateLimiters(prefixBase, profile);
-  limiterCache.set(cacheKey, localLimiters);
-  return localLimiters;
-}
-
 function getRoutePolicy(
   req: NextRequest,
   routePolicies: ProxyRoutePolicy[]
@@ -1242,7 +1147,6 @@ export function isTrustedProxyBypassRequest(
 
 export function clearApiProxyGuardLimiterCache() {
   limiterCache.clear();
-  localLimiterState.clear();
 }
 
 async function requestBodyExceedsLimit(
@@ -1418,32 +1322,26 @@ export async function guardApiProxyRequest(
       );
       const limiterCacheKey = `${limiterPrefix}:${JSON.stringify(rateLimits)}`;
       const limiters = await getRateLimiters(limiterPrefix, rateLimits);
-      let activeLimiters = isRead ? limiters.get : limiters.mutate;
+      const activeLimiters = limiters
+        ? isRead
+          ? limiters.get
+          : limiters.mutate
+        : [];
 
       for (let index = 0; index < activeLimiters.length; index += 1) {
         const { limiter, window } = activeLimiters[index]!;
-        let result: RateLimitResult;
+        let result: RateLimitResult | null | undefined;
 
         try {
           result = await limiter.limit(limiterId);
         } catch {
-          const fallbackLimiters = replaceWithLocalRateLimiters(
-            limiterCacheKey,
-            limiterPrefix,
-            rateLimits
-          );
-          activeLimiters = isRead
-            ? fallbackLimiters.get
-            : fallbackLimiters.mutate;
-          const fallbackBucket =
-            activeLimiters[index] ??
-            activeLimiters.find((bucket) => bucket.window === window);
-
-          if (!fallbackBucket) {
-            continue;
-          }
-
-          result = await fallbackBucket.limiter.limit(limiterId);
+          limiterCache.delete(limiterCacheKey);
+          break;
+        }
+
+        if (!result) {
+          limiterCache.delete(limiterCacheKey);
+          break;
         }
 
         const { success, limit, remaining, reset } = result;

package/src/internal-domains.ts

@@ -40,6 +40,10 @@ export const PRODUCTION_INTERNAL_APP_DOMAINS = [
     name: 'qr',
     url: 'https://qr.tuturuuu.com',
   },
+  {
+    name: 'tools',
+    url: 'https://tools.tuturuuu.com',
+  },
   {
     name: 'nova',
     url: 'https://nova.ai.vn',
@@ -60,6 +64,10 @@ export const PRODUCTION_INTERNAL_APP_DOMAINS = [
     name: 'finance',
     url: 'https://finance.tuturuuu.com',
   },
+  {
+    name: 'infra',
+    url: 'https://infrastructure.tuturuuu.com',
+  },
   {
     name: 'infra',
     url: 'https://infra.tuturuuu.com',
@@ -135,6 +143,10 @@ export const PORTLESS_INTERNAL_APP_DOMAINS = [
     name: 'qr',
     url: getTuturuuuPortlessAppOrigin('qr'),
   },
+  {
+    name: 'tools',
+    url: getTuturuuuPortlessAppOrigin('tools'),
+  },
   {
     name: 'nova',
     url: getTuturuuuPortlessAppOrigin('nova'),
@@ -222,6 +234,10 @@ export const LOCALHOST_INTERNAL_APP_DOMAINS = [
     name: 'qr',
     url: 'http://localhost:7819',
   },
+  {
+    name: 'tools',
+    url: 'http://localhost:7825',
+  },
   {
     name: 'platform',
     url: 'http://localhost:7803',

package/src/launchable-apps.ts

@@ -263,16 +263,16 @@ export const LAUNCHABLE_APPS = [
     title: 'Playground',
   },
   {
-    aliases: ['QR Code', 'Generator'],
-    appRoot: 'apps/qr',
+    aliases: ['QR Code', 'Generator', 'Password', 'Random', 'UUID', 'Token'],
+    appRoot: 'apps/tools',
     category: 'developer',
     defaultPath: '/',
-    localhostOrigin: 'http://localhost:7819',
-    packageName: '@tuturuuu/qr',
-    portlessApp: 'qr',
-    productionUrl: 'https://qr.tuturuuu.com',
-    slug: 'qr',
-    title: 'QR',
+    localhostOrigin: 'http://localhost:7825',
+    packageName: '@tuturuuu/tools',
+    portlessApp: 'tools',
+    productionUrl: 'https://tools.tuturuuu.com',
+    slug: 'tools',
+    title: 'Tools',
   },
   {
     aliases: ['Review', 'Flashcards'],

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.16.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.18.0'); // x-release-please-version
   });
 
   it('normalizes generated metadata and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.16.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.18.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   builtAt?: string | null;

package/src/portless.ts

@@ -26,6 +26,7 @@ export const TUTURUUU_PORTLESS_APP_ORIGINS = {
   playground: `https://playground.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   qr: `https://qr.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   rewise: `https://rewise.${TUTURUUU_PORTLESS_ROOT_HOST}`,
+  tools: `https://tools.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   shortener: `https://shortener.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   storefront: `https://storefront.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   'tanstack-web': `https://tanstack.${TUTURUUU_PORTLESS_ROOT_HOST}`,

package/src/task/transformers.ts

@@ -142,6 +142,8 @@ export function transformTaskRecord(task: any): Task {
 
   return {
     ...task,
+    is_personal_external: task.is_personal_external ?? false,
+    is_personal_external_default: task.is_personal_external_default ?? false,
     assignees: transformAssignees(task.assignees),
     labels: normalizedLabels,
     projects: normalizedProjects,