@tuturuuu/utils 0.6.1 → 0.8.0

package/src/__tests__/api-proxy-guard.test.ts

@@ -9,6 +9,7 @@ const mocks = vi.hoisted(() => ({
   extractIp: vi.fn(),
   isBlocked: vi.fn(),
   validateEmoji: vi.fn(),
+  getTrustEntries: vi.fn(),
 }));
 
 vi.mock('@upstash/ratelimit', () => {
@@ -50,6 +51,10 @@ vi.mock('../abuse-protection/edge', () => ({
   isIPBlockedEdge: (ip: string) => mocks.isBlocked(ip),
 }));
 
+vi.mock('../abuse-protection/edge-trust', () => ({
+  getCachedTrustEntries: (keys: string[]) => mocks.getTrustEntries(keys),
+}));
+
 vi.mock('../request-emoji-limit', () => ({
   validateRequestEmojiLimit: (
     req: NextRequest,
@@ -98,6 +103,9 @@ describe('guardApiProxyRequest', () => {
     mocks.extractIp.mockReset();
     mocks.isBlocked.mockReset();
     mocks.validateEmoji.mockReset();
+    mocks.getTrustEntries.mockReset();
+    // Default: no cached trust (untrusted). Tests opt in by overriding.
+    mocks.getTrustEntries.mockResolvedValue(new Map<string, { m: number }>());
   });
 
   afterEach(() => {
@@ -204,7 +212,7 @@ describe('guardApiProxyRequest', () => {
     mocks.isBlocked.mockResolvedValue(null);
     mocks.limit.mockResolvedValueOnce({
       success: false,
-      limit: 300,
+      limit: 600,
       remaining: 0,
       reset: Date.now() + 15_000,
     });
@@ -221,10 +229,10 @@ describe('guardApiProxyRequest', () => {
     );
 
     expect(response?.status).toBe(429);
-    expect(response?.headers.get('X-RateLimit-Limit')).toBe('300');
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('600');
     expect(response?.headers.get('X-RateLimit-Policy')).toBe('task-board-read');
     expect(mocks.ratelimitConfigs).toContainEqual({
-      limit: 300,
+      limit: 600,
       window: '1 m',
     });
     expect(mocks.ratelimitPrefixes).toContain(
@@ -542,6 +550,90 @@ describe('guardApiProxyRequest', () => {
     });
   });
 
+  it('uses the users database read-over-post bucket for search and filter POST reads', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 300,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    for (const path of [
+      '/api/v1/workspaces/ws-1/users/database',
+      '/api/v1/workspaces/ws-1/users/groups/featured-counts',
+      '/api/v1/workspaces/ws-1/users/groups/possible-excluded',
+    ]) {
+      const response = await guardApiProxyRequest(makeRequest(path, 'POST'), {
+        prefixBase: 'proxy:test:api',
+      });
+
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get('X-RateLimit-Limit')).toBe('300');
+      expect(response?.headers.get('X-RateLimit-Policy')).toBe(
+        'users-database-read-over-post'
+      );
+    }
+
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 300,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 3000,
+      window: '1 h',
+    });
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 20_000,
+      window: '1 d',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:users-database-read-over-post:anonymous:mutate:minute'
+    );
+  });
+
+  it('keeps users mutations on the default mutation bucket', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 30,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest(
+        '/api/v1/workspaces/ws-1/users/11111111-1111-4111-8111-111111111111/referrals',
+        'POST'
+      ),
+      {
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+  });
+
   it('keeps finance invoice mutations on the default mutation bucket', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -574,7 +666,7 @@ describe('guardApiProxyRequest', () => {
     }
 
     expect(mocks.ratelimitPrefixes).toContain(
-      'proxy:test:api:default:anonymous::api:v1:workspaces:ws-1:finance:invoices:mutate:minute'
+      'proxy:test:api:default:anonymous:mutate:minute'
     );
     expect(mocks.ratelimitPrefixes).not.toContain(
       'proxy:test:api:finance-invoice-create-read:anonymous:mutate:minute'
@@ -931,7 +1023,7 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.limit).not.toHaveBeenCalled();
   });
 
-  it('scopes anonymous read buckets by pathname to avoid cross-route collisions', async () => {
+  it('shares broad anonymous read buckets across path variants', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
@@ -952,13 +1044,28 @@ describe('guardApiProxyRequest', () => {
     await guardApiProxyRequest(makeRequest('/api/v1/users/me/profile', 'GET'), {
       prefixBase: 'proxy:test:api',
     });
+    await guardApiProxyRequest(
+      makeRequest('/api/v1/users/me/nonexistent/random-nonce', 'GET'),
+      {
+        prefixBase: 'proxy:test:api',
+      }
+    );
 
     expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:users-me:anonymous:get:minute'
+    );
+    expect(mocks.ratelimitPrefixes).not.toContain(
       'proxy:test:api:users-me:anonymous::api:v1:users:me:profile:get:minute'
     );
+    expect(mocks.ratelimitPrefixes).not.toContain(
+      'proxy:test:api:users-me:anonymous::api:v1:users:me:nonexistent:random-nonce:get:minute'
+    );
   });
 
-  it('uses a classroom-friendly OTP send bucket', async () => {
+  it.each([
+    '/api/v1/auth/otp/send',
+    '/api/v1/auth/mobile/send-otp',
+  ])('uses a classroom-friendly OTP send bucket for %s', async (path) => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
@@ -976,12 +1083,9 @@ describe('guardApiProxyRequest', () => {
       await import('../api-proxy-guard.js');
     clearApiProxyGuardLimiterCache();
 
-    const response = await guardApiProxyRequest(
-      makeRequest('/api/v1/auth/otp/send', 'POST'),
-      {
-        prefixBase: 'proxy:test:api',
-      }
-    );
+    const response = await guardApiProxyRequest(makeRequest(path, 'POST'), {
+      prefixBase: 'proxy:test:api',
+    });
 
     expect(response?.status).toBe(429);
     expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
@@ -1191,6 +1295,59 @@ describe('guardApiProxyRequest', () => {
     expect(response?.headers.get('X-RateLimit-Policy')).toBe('high-fanout');
   });
 
+  it('prepends additional route policies before default high-fanout buckets', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 30,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/mail/send', 'POST'),
+      {
+        additionalRoutePolicies: [
+          {
+            key: 'email-rate-limit-override',
+            matches: (req) =>
+              /^\/api\/v1\/workspaces\/[^/]+\/mail\/send(?:\/|$)/.test(
+                req.nextUrl.pathname
+              ),
+            rateLimits: {
+              get: [],
+              mutate: [{ duration: '1 m', limit: 30, window: 'minute' }],
+            },
+          },
+        ],
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe(
+      'email-rate-limit-override'
+    );
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 30,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitConfigs).not.toContainEqual({
+      limit: 2,
+      window: '1 m',
+    });
+  });
+
   it('uses relaxed buckets for task description persistence routes', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -1403,6 +1560,340 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.validateEmoji).toHaveBeenCalledTimes(1);
   });
 
+  it('gives a trusted session its own per-session bucket with scaled read limits', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    // Trust the session subject key (account trust → per-session keying).
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number }>();
+      const sessionKey = keys.find((key) => key.startsWith('session:'));
+      if (sessionKey) {
+        map.set(sessionKey, { m: 3 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 1800,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+      }),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('task-board-read');
+    // Base task-board read minute limit (600) scaled by the trust tier (3).
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 1800,
+      window: '1 m',
+    });
+    // Trusted traffic gets a tier-suffixed bucket.
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:t3:get:minute'
+    );
+    // The limiter is keyed by the per-session subject key, not the shared IP.
+    const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
+    expect(limiterId.startsWith('session:')).toBe(true);
+  });
+
+  it('uplifts a trusted location per-IP without per-session keying', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    // Trust the location (cidr) subject key only — no session cookie present.
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number }>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { m: 2 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 1200,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 1200,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:t2:get:minute'
+    );
+    // Location trust keeps the shared per-IP bucket (whole team benefits).
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
+  it('keeps a trusted location on per-IP keying even with an untrusted session cookie', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    // Only the cidr is trusted; the session key is absent from the cache.
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number }>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { m: 2 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 1200,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+      }),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    // An untrusted session must not escape the per-IP bucket.
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
+  it('keeps untrusted reads on the legacy per-IP bucket without trust suffix', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    // Default mock: empty trust map (forged or simply untrusted).
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 600,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=forged-value; theme=dark',
+      }),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 600,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:get:minute'
+    );
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
+  it('applies an absolute read limit from a location rule', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, unknown>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { abs: { minute: 50 }, m: 1, mode: 'absolute' });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 50,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    // Absolute exactly sets the minute window (even below the base 600).
+    expect(mocks.ratelimitConfigs).toContainEqual({ limit: 50, window: '1 m' });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:abs-50-x-x:get:minute'
+    );
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
+  it('removes the read cap for an unlimited rule', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, unknown>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { m: 1, mode: 'unlimited' });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    // No read limiter is constructed → request passes the rate-limit stage.
+    expect(response).toBeNull();
+    expect(mocks.limit).not.toHaveBeenCalled();
+  });
+
+  it('uplifts reads for a trusted workspace parsed from the path', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    const receivedKeys: string[] = [];
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      receivedKeys.push(...keys);
+      const map = new Map<string, unknown>();
+      const workspaceKey = keys.find((key) => key.startsWith('workspace:'));
+      if (workspaceKey) {
+        map.set(workspaceKey, { m: 5 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 3000,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const wsId = '33333333-3333-4333-8333-333333333333';
+    const response = await guardApiProxyRequest(
+      makeRequest(`/api/v1/workspaces/${wsId}/tasks?boardId=board-1`, 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(receivedKeys).toContain(`workspace:${wsId}`);
+    // Base task-board minute (600) scaled by the workspace tier (5).
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 3000,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:t5:get:minute'
+    );
+  });
+
+  it('derives the session subject key the same way as server-side reputation', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    const receivedKeys: string[] = [];
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      receivedKeys.push(...keys);
+      return Promise.resolve(new Map<string, { m: number }>());
+    });
+    mocks.limit.mockResolvedValue({
+      success: true,
+      limit: 600,
+      remaining: 599,
+      reset: Date.now() + 15_000,
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const cookieName = 'sb-resolved-kingfish-21146-auth-token.0';
+    const cookieValue = 'base64-validvalue';
+    await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET', {
+        cookie: `${cookieName}=${cookieValue}; theme=dark`,
+      }),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    const { createHash } = await import('node:crypto');
+    const expected = `session:${createHash('sha256')
+      .update(`${cookieName}:${cookieValue}`)
+      .digest('hex')
+      .slice(0, 24)}`;
+
+    expect(receivedKeys).toContain(expected);
+  });
+
   it('skips text-bomb validation for whiteboard snapshots on the whiteboard save route', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');

package/src/__tests__/app-url.test.ts

@@ -110,11 +110,31 @@ describe('resolveInternalAppUrl', () => {
       kind: 'internal',
       name: 'tasks',
     });
+    expect(
+      getAppDomainByUrl(
+        'https://zalo-qr-chat-setup.tasks.tuturuuu.localhost:1355/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toMatchObject({
+      canonicalUrl:
+        'https://zalo-qr-chat-setup.tasks.tuturuuu.localhost/verify-token?nextUrl=%2Fpersonal',
+      kind: 'internal',
+      name: 'tasks',
+    });
     expect(
       getAppDomainByUrl(
         'https://tuturuuu.localhost.evil.test:1355/verify-token?nextUrl=%2F'
       )
     ).toBeNull();
+    expect(
+      getAppDomainByUrl(
+        'https://tasks.tuturuuu.localhost:4444/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toBeNull();
+    expect(
+      getAppDomainByUrl(
+        'https://attacker.tasks.tuturuuu.localhost:4444/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toBeNull();
   });
 
   it('canonicalizes production internal app URLs to their registered HTTPS origins', () => {

package/src/__tests__/upstash-rest.test.ts

@@ -30,12 +30,15 @@ describe('upstash-rest', () => {
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
     const client = {
+      decr: vi.fn(),
       del: vi.fn(),
       eval: vi.fn(),
       evalsha: vi.fn(),
       expire: vi.fn(),
       get: vi.fn(),
       incr: vi.fn(),
+      mget: vi.fn(),
+      scan: vi.fn(),
       set: vi.fn(),
       ttl: vi.fn(),
     };