@tuturuuu/utils 0.12.1 → 0.15.0

package/src/abuse-protection/index.ts

@@ -31,9 +31,6 @@ export * from './reputation';
 export * from './types';
 export * from './user-agent';
 
-// In-memory fallback store
-const memoryStore = new Map<string, { count: number; expiresAt: number }>();
-
 const SHARED_IP_THROTTLE_ONLY_BLOCK_REASONS = new Set<AbuseEventType>([
   'otp_send',
   'otp_verify_failed',
@@ -50,6 +47,28 @@ export function isSharedIpThrottleOnlyBlockReason(reason: AbuseEventType) {
 let redisClient: RedisClient | null = null;
 let redisInitialized = false;
 
+function markRedisUnavailable(message: string, ...details: unknown[]): void {
+  if (details.length > 0) {
+    console.warn(message, ...details);
+  } else {
+    console.warn(message);
+  }
+
+  redisClient = null;
+  redisInitialized = true;
+}
+
+function markRedisCommandFailed(message: string, ...details: unknown[]): void {
+  if (details.length > 0) {
+    console.warn(message, ...details);
+  } else {
+    console.warn(message);
+  }
+
+  redisClient = null;
+  redisInitialized = false;
+}
+
 function parsePositiveIntEnv(name: string, fallback: number): number {
   const rawValue = process.env[name];
   if (!rawValue) {
@@ -85,19 +104,22 @@ async function getRedisClient(): Promise<RedisClient | null> {
 
   try {
     if (!hasUpstashRestEnv()) {
-      console.warn(
-        '[Abuse Protection] Redis not configured - falling back to memory'
+      markRedisUnavailable(
+        '[Abuse Protection] Redis not configured - failing open'
       );
-      redisInitialized = true;
       return null;
     }
 
     redisClient = await getUpstashRestRedisClient();
+    if (!redisClient) {
+      markRedisUnavailable(
+        '[Abuse Protection] Redis client unavailable - failing open'
+      );
+    }
     redisInitialized = true;
     return redisClient;
   } catch (error) {
-    console.warn('[Abuse Protection] Redis unavailable:', error);
-    redisInitialized = true;
+    markRedisUnavailable('[Abuse Protection] Redis unavailable:', error);
     return null;
   }
 }
@@ -191,83 +213,70 @@ function createAbuseLogContext(
 }
 
 /**
- * Increment a counter in Redis or memory with automatic expiration
+ * Increment a Redis counter with automatic expiration.
+ * Fails open when Redis is unavailable so abuse protection never becomes an
+ * app availability dependency.
  */
 async function incrementCounter(
   key: string,
   windowMs: number
 ): Promise<{ count: number; ttl: number }> {
   const redis = await getRedisClient();
+  const neutral = { count: 0, ttl: Math.ceil(windowMs / 1000) };
 
-  if (redis) {
-    try {
-      const count = await redis.incr(key);
-      if (count === 1) {
-        await redis.expire(key, Math.ceil(windowMs / 1000));
-      }
-      const ttl = await redis.ttl(key);
-      return { count, ttl: ttl > 0 ? ttl : Math.ceil(windowMs / 1000) };
-    } catch (error) {
-      console.error('[Abuse Protection] Redis error:', error);
-      // Fall through to memory
-    }
+  if (!redis) {
+    return neutral;
   }
 
-  // Memory fallback
-  const now = Date.now();
-  const existing = memoryStore.get(key);
-
-  if (!existing || now > existing.expiresAt) {
-    memoryStore.set(key, { count: 1, expiresAt: now + windowMs });
-    return { count: 1, ttl: Math.ceil(windowMs / 1000) };
+  try {
+    const count = await redis.incr(key);
+    if (count === 1) {
+      await redis.expire(key, Math.ceil(windowMs / 1000));
+    }
+    const ttl = await redis.ttl(key);
+    return { count, ttl: ttl > 0 ? ttl : Math.ceil(windowMs / 1000) };
+  } catch (error) {
+    markRedisCommandFailed('[Abuse Protection] Redis counter error:', error);
+    return neutral;
   }
-
-  existing.count++;
-  return {
-    count: existing.count,
-    ttl: Math.ceil((existing.expiresAt - now) / 1000),
-  };
 }
 
 /**
- * Get counter value from Redis or memory
+ * Get a counter value from Redis.
  */
 async function getCounter(key: string): Promise<number> {
   const redis = await getRedisClient();
 
-  if (redis) {
-    try {
-      const count = await redis.get<number>(key);
-      return count || 0;
-    } catch {
-      // Fall through to memory
-    }
+  if (!redis) {
+    return 0;
   }
 
-  const existing = memoryStore.get(key);
-  if (!existing || Date.now() > existing.expiresAt) {
+  try {
+    const count = await redis.get<number>(key);
+    return count || 0;
+  } catch (error) {
+    markRedisCommandFailed(
+      '[Abuse Protection] Redis counter read error:',
+      error
+    );
     return 0;
   }
-  return existing.count;
 }
 
 /**
- * Delete keys from Redis or memory
+ * Delete Redis keys when Redis is available.
  */
 async function deleteKeys(...keys: string[]): Promise<void> {
   const redis = await getRedisClient();
 
-  if (redis) {
-    try {
-      await redis.del(...keys);
-      return;
-    } catch {
-      // Fall through to memory
-    }
+  if (!redis) {
+    return;
   }
 
-  for (const key of keys) {
-    memoryStore.delete(key);
+  try {
+    await redis.del(...keys);
+  } catch (error) {
+    markRedisCommandFailed('[Abuse Protection] Redis delete error:', error);
   }
 }
 
@@ -278,23 +287,17 @@ async function deleteKeysWithCount(...keys: string[]): Promise<number> {
 
   const redis = await getRedisClient();
 
-  if (redis) {
-    try {
-      const deleted = await redis.del(...keys);
-      return typeof deleted === 'number' ? deleted : 0;
-    } catch {
-      // Fall through to memory
-    }
+  if (!redis) {
+    return 0;
   }
 
-  let deleted = 0;
-  for (const key of keys) {
-    if (memoryStore.delete(key)) {
-      deleted++;
-    }
+  try {
+    const deleted = await redis.del(...keys);
+    return typeof deleted === 'number' ? deleted : 0;
+  } catch (error) {
+    markRedisCommandFailed('[Abuse Protection] Redis delete error:', error);
+    return 0;
   }
-
-  return deleted;
 }
 
 /**
@@ -324,30 +327,33 @@ export async function isIPBlocked(
 ): Promise<BlockInfo | null> {
   const redis = await getRedisClient();
 
+  if (!redis) {
+    return null;
+  }
+
   // Check Redis cache first
-  if (redis) {
-    try {
-      const cached = await redis.get<string>(REDIS_KEYS.IP_BLOCKED(ipAddress));
-      if (cached) {
-        const blockInfo =
-          typeof cached === 'string' ? JSON.parse(cached) : cached;
-        if (new Date(blockInfo.expiresAt) > new Date()) {
-          return {
-            id: blockInfo.id,
-            blockLevel: blockInfo.level,
-            reason: blockInfo.reason,
-            expiresAt: new Date(blockInfo.expiresAt),
-            blockedAt: new Date(blockInfo.blockedAt),
-          };
-        }
+  try {
+    const cached = await redis.get<string>(REDIS_KEYS.IP_BLOCKED(ipAddress));
+    if (cached) {
+      const blockInfo =
+        typeof cached === 'string' ? JSON.parse(cached) : cached;
+      if (new Date(blockInfo.expiresAt) > new Date()) {
+        return {
+          id: blockInfo.id,
+          blockLevel: blockInfo.level,
+          reason: blockInfo.reason,
+          expiresAt: new Date(blockInfo.expiresAt),
+          blockedAt: new Date(blockInfo.blockedAt),
+        };
       }
-    } catch (error) {
-      console.error(
-        '[Abuse Protection] Redis cache error:',
-        error,
-        createAbuseLogContext(ipAddress, context)
-      );
     }
+  } catch (error) {
+    markRedisCommandFailed(
+      '[Abuse Protection] Redis cache error:',
+      error,
+      createAbuseLogContext(ipAddress, context)
+    );
+    return null;
   }
 
   // Check database
@@ -376,21 +382,29 @@ export async function isIPBlocked(
     };
 
     // Cache in Redis
-    if (redis && blockInfo.expiresAt > new Date()) {
+    if (blockInfo.expiresAt > new Date()) {
       const ttl = Math.ceil(
         (blockInfo.expiresAt.getTime() - Date.now()) / 1000
       );
-      await redis.set(
-        REDIS_KEYS.IP_BLOCKED(ipAddress),
-        JSON.stringify({
-          id: blockInfo.id,
-          level: blockInfo.blockLevel,
-          reason: blockInfo.reason,
-          expiresAt: blockInfo.expiresAt.toISOString(),
-          blockedAt: blockInfo.blockedAt.toISOString(),
-        }),
-        { ex: ttl }
-      );
+      try {
+        await redis.set(
+          REDIS_KEYS.IP_BLOCKED(ipAddress),
+          JSON.stringify({
+            id: blockInfo.id,
+            level: blockInfo.blockLevel,
+            reason: blockInfo.reason,
+            expiresAt: blockInfo.expiresAt.toISOString(),
+            blockedAt: blockInfo.blockedAt.toISOString(),
+          }),
+          { ex: ttl }
+        );
+      } catch (error) {
+        markRedisCommandFailed(
+          '[Abuse Protection] Redis cache set error:',
+          error
+        );
+        return null;
+      }
     }
 
     return blockInfo;
@@ -413,31 +427,25 @@ export async function blockIP(
   }
 
   try {
+    const redis = await getRedisClient();
+    if (!redis) return;
+
     const sbAdmin = await getSupabaseAdmin();
     if (!sbAdmin) return;
 
-    const redis = await getRedisClient();
-
     // Get current block level
     let currentLevel = 0;
-    if (redis) {
-      try {
-        const level = await redis.get<number>(
-          REDIS_KEYS.IP_BLOCK_LEVEL(ipAddress)
-        );
-        currentLevel = level || 0;
-      } catch {
-        // Check DB fallback
-        const { data } = await sbAdmin.rpc('get_ip_block_level', {
-          p_ip_address: ipAddress,
-        });
-        currentLevel = (data as number) || 0;
-      }
-    } else {
-      const { data } = await sbAdmin.rpc('get_ip_block_level', {
-        p_ip_address: ipAddress,
-      });
-      currentLevel = (data as number) || 0;
+    try {
+      const level = await redis.get<number>(
+        REDIS_KEYS.IP_BLOCK_LEVEL(ipAddress)
+      );
+      currentLevel = level || 0;
+    } catch (error) {
+      markRedisCommandFailed(
+        '[Abuse Protection] Redis block-level error:',
+        error
+      );
+      return;
     }
 
     // Calculate new block level (max 4)
@@ -470,7 +478,7 @@ export async function blockIP(
     }
 
     // Update Redis cache
-    if (redis) {
+    try {
       await Promise.all([
         redis.set(
           REDIS_KEYS.IP_BLOCKED(ipAddress),
@@ -487,6 +495,11 @@ export async function blockIP(
           ex: WINDOW_MS.TWENTY_FOUR_HOURS / 1000,
         }),
       ]);
+    } catch (error) {
+      markRedisCommandFailed(
+        '[Abuse Protection] Redis block cache error:',
+        error
+      );
     }
 
     console.log(

package/src/api-proxy-guard.ts

@@ -112,13 +112,7 @@ type RateLimiter = {
   limit: (identifier: string) => Promise<RateLimitResult>;
 };
 
-type LocalRateLimitState = {
-  count: number;
-  reset: number;
-};
-
 const limiterCache = new Map<string, Limiters>();
-const localLimiterState = new Map<string, LocalRateLimitState>();
 const GENERIC_SUPABASE_AUTH_COOKIE_NAME_PATTERN =
   /^sb-[a-z0-9-]+-auth-token(?:\.\d+)?$/i;
 const UUID_PATH_SEGMENT =
@@ -697,87 +691,10 @@ function createRedisRateLimitBuckets(
   }));
 }
 
-function rateLimitDurationMs(duration: RateLimitConfig['duration']) {
-  switch (duration) {
-    case '1 m':
-      return 60_000;
-    case '1 h':
-      return 60 * 60_000;
-    case '1 d':
-      return 24 * 60 * 60_000;
-  }
-}
-
-function createLocalRateLimiter(
-  prefix: string,
-  config: RateLimitConfig
-): RateLimiter {
-  const durationMs = rateLimitDurationMs(config.duration);
-
-  return {
-    async limit(identifier: string) {
-      const now = Date.now();
-      const key = `${prefix}:${identifier}`;
-      let state = localLimiterState.get(key);
-
-      if (!state || state.reset <= now) {
-        state = {
-          count: 0,
-          reset: now + durationMs,
-        };
-      }
-
-      if (state.count >= config.limit) {
-        localLimiterState.set(key, state);
-        return {
-          limit: config.limit,
-          remaining: 0,
-          reset: state.reset,
-          success: false,
-        };
-      }
-
-      state.count += 1;
-      localLimiterState.set(key, state);
-
-      return {
-        limit: config.limit,
-        remaining: Math.max(0, config.limit - state.count),
-        reset: state.reset,
-        success: true,
-      };
-    },
-  };
-}
-
-function createLocalRateLimitBuckets(
-  prefixBase: string,
-  kind: 'get' | 'mutate',
-  configs: RateLimitConfig[]
-): RateLimitBucket[] {
-  return configs.map((config) => ({
-    window: config.window,
-    limiter: createLocalRateLimiter(
-      `${prefixBase}:local:${kind}:${config.window}`,
-      config
-    ),
-  }));
-}
-
-function createLocalRateLimiters(
-  prefixBase: string,
-  profile: RateLimitProfile
-): Limiters {
-  return {
-    get: createLocalRateLimitBuckets(prefixBase, 'get', profile.get),
-    mutate: createLocalRateLimitBuckets(prefixBase, 'mutate', profile.mutate),
-  };
-}
-
 async function getRateLimiters(
   prefixBase: string,
   profile: RateLimitProfile
-): Promise<Limiters> {
+): Promise<Limiters | null> {
   const cacheKey = `${prefixBase}:${JSON.stringify(profile)}`;
   const cached = limiterCache.get(cacheKey);
   if (cached) {
@@ -786,9 +703,7 @@ async function getRateLimiters(
 
   const redis = await getUpstashRatelimitRedisClient().catch(() => null);
   if (!redis) {
-    const localLimiters = createLocalRateLimiters(prefixBase, profile);
-    limiterCache.set(cacheKey, localLimiters);
-    return localLimiters;
+    return null;
   }
 
   const limiters = {
@@ -805,16 +720,6 @@ async function getRateLimiters(
   return limiters;
 }
 
-function replaceWithLocalRateLimiters(
-  cacheKey: string,
-  prefixBase: string,
-  profile: RateLimitProfile
-): Limiters {
-  const localLimiters = createLocalRateLimiters(prefixBase, profile);
-  limiterCache.set(cacheKey, localLimiters);
-  return localLimiters;
-}
-
 function getRoutePolicy(
   req: NextRequest,
   routePolicies: ProxyRoutePolicy[]
@@ -1242,7 +1147,6 @@ export function isTrustedProxyBypassRequest(
 
 export function clearApiProxyGuardLimiterCache() {
   limiterCache.clear();
-  localLimiterState.clear();
 }
 
 async function requestBodyExceedsLimit(
@@ -1418,32 +1322,26 @@ export async function guardApiProxyRequest(
       );
       const limiterCacheKey = `${limiterPrefix}:${JSON.stringify(rateLimits)}`;
       const limiters = await getRateLimiters(limiterPrefix, rateLimits);
-      let activeLimiters = isRead ? limiters.get : limiters.mutate;
+      const activeLimiters = limiters
+        ? isRead
+          ? limiters.get
+          : limiters.mutate
+        : [];
 
       for (let index = 0; index < activeLimiters.length; index += 1) {
         const { limiter, window } = activeLimiters[index]!;
-        let result: RateLimitResult;
+        let result: RateLimitResult | null | undefined;
 
         try {
           result = await limiter.limit(limiterId);
         } catch {
-          const fallbackLimiters = replaceWithLocalRateLimiters(
-            limiterCacheKey,
-            limiterPrefix,
-            rateLimits
-          );
-          activeLimiters = isRead
-            ? fallbackLimiters.get
-            : fallbackLimiters.mutate;
-          const fallbackBucket =
-            activeLimiters[index] ??
-            activeLimiters.find((bucket) => bucket.window === window);
-
-          if (!fallbackBucket) {
-            continue;
-          }
-
-          result = await fallbackBucket.limiter.limit(limiterId);
+          limiterCache.delete(limiterCacheKey);
+          break;
+        }
+
+        if (!result) {
+          limiterCache.delete(limiterCacheKey);
+          break;
         }
 
         const { success, limit, remaining, reset } = result;