@tuturuuu/utils 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.8.0](https://github.com/tutur3u/platform/compare/utils-v0.7.0...utils-v0.8.0) (2026-06-17)
+
+
+### Features
+
+* **inventory:** store commerce money in minor units and harden Polar sync ([3f7ee1d](https://github.com/tutur3u/platform/commit/3f7ee1da9335732854037e7e79fca9d5d2a381d0))
+* **web:** rate limits admin center ([fe61dc9](https://github.com/tutur3u/platform/commit/fe61dc933615466f6169a3db3a4a1840f705e80b))
+* **web:** trust-gated per-session read limits and trusted-location uplift ([3e64c89](https://github.com/tutur3u/platform/commit/3e64c8929dbe7987ad83900620a25a9559fe1edf))
+
+
+### Bug Fixes
+
+* **api:** share broad anonymous rate buckets ([04c1dc6](https://github.com/tutur3u/platform/commit/04c1dc616bf6a909b37f798c994aba41ff27d13a))
+* **api:** throttle users database post reads ([698639d](https://github.com/tutur3u/platform/commit/698639d572375a67b850d533e584aa05733dc961))
+* **auth:** preserve password failure pressure ([cf1e970](https://github.com/tutur3u/platform/commit/cf1e970a0f8acbf314cbdccd7abc126535dbd846))
+* **auth:** reserve otp send rate limits ([42012b9](https://github.com/tutur3u/platform/commit/42012b90c75f1041637b1d3ea21ff464c942c6d9))
+* **auth:** restrict Portless return ports ([7977bfc](https://github.com/tutur3u/platform/commit/7977bfc074a211a20b3bf133fe78cf94ff8c1d33))
+* **ci:** format storefront files and harden upstash scan wrapper ([4c82444](https://github.com/tutur3u/platform/commit/4c824446725dc280edde3e54f946bf386a52952d))
+* **ci:** unblock turbopack proxy build, type-safe upstash, format ([42393f8](https://github.com/tutur3u/platform/commit/42393f8519f6695df44f71b8654ba86237296ffe))
+* **email:** keep override traffic in proxy guard ([dd6ed5a](https://github.com/tutur3u/platform/commit/dd6ed5a9a21f536e22f7abbbeb3e83f44a81cdff))
+* **next:** remove loopback image defaults ([9ab8fb9](https://github.com/tutur3u/platform/commit/9ab8fb9489a613e72302d5baf35e44f8cea5c82a))
+* **web:** stop new-workspace setup from trapping users on "Preparing Workspace" ([3f7ee1d](https://github.com/tutur3u/platform/commit/3f7ee1da9335732854037e7e79fca9d5d2a381d0))
+
+
+### Performance Improvements
+
+* **web:** hydrate user-group detail pages and remove fetch waterfalls ([4845cf7](https://github.com/tutur3u/platform/commit/4845cf71cc7e3e321bd6558ba4e20a406e9cd731))
+
 ## [0.7.0](https://github.com/tutur3u/platform/compare/utils-v0.6.1...utils-v0.7.0) (2026-06-15)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,8 +24,8 @@
     "@tiptap/react": "3.26.1",
     "@tuturuuu/google": "0.0.2",
     "@tuturuuu/icons": "0.0.6",
-    "@tuturuuu/internal-api": "0.8.0",
-    "@tuturuuu/supabase": "0.3.3",
+    "@tuturuuu/internal-api": "0.9.0",
+    "@tuturuuu/supabase": "0.3.4",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
     "clsx": "^2.1.1",
@@ -44,7 +44,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.9.0",
+    "@tuturuuu/types": "0.10.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
     "@types/node": "^25.9.3",
@@ -66,6 +66,7 @@
     "./abuse-protection": "./src/abuse-protection/index.ts",
     "./abuse-protection/backend-rate-limit": "./src/abuse-protection/backend-rate-limit.ts",
     "./abuse-protection/edge": "./src/abuse-protection/edge.ts",
+    "./abuse-protection/edge-trust": "./src/abuse-protection/edge-trust.ts",
     "./abuse-protection/user-suspension": "./src/abuse-protection/user-suspension.ts",
     "./currencies": "./src/currencies.ts",
     "./exchange-rates": "./src/exchange-rates.ts",

package/src/__tests__/api-proxy-guard.test.ts

@@ -9,6 +9,7 @@ const mocks = vi.hoisted(() => ({
   extractIp: vi.fn(),
   isBlocked: vi.fn(),
   validateEmoji: vi.fn(),
+  getTrustEntries: vi.fn(),
 }));
 
 vi.mock('@upstash/ratelimit', () => {
@@ -50,6 +51,10 @@ vi.mock('../abuse-protection/edge', () => ({
   isIPBlockedEdge: (ip: string) => mocks.isBlocked(ip),
 }));
 
+vi.mock('../abuse-protection/edge-trust', () => ({
+  getCachedTrustEntries: (keys: string[]) => mocks.getTrustEntries(keys),
+}));
+
 vi.mock('../request-emoji-limit', () => ({
   validateRequestEmojiLimit: (
     req: NextRequest,
@@ -98,6 +103,9 @@ describe('guardApiProxyRequest', () => {
     mocks.extractIp.mockReset();
     mocks.isBlocked.mockReset();
     mocks.validateEmoji.mockReset();
+    mocks.getTrustEntries.mockReset();
+    // Default: no cached trust (untrusted). Tests opt in by overriding.
+    mocks.getTrustEntries.mockResolvedValue(new Map<string, { m: number }>());
   });
 
   afterEach(() => {
@@ -204,7 +212,7 @@ describe('guardApiProxyRequest', () => {
     mocks.isBlocked.mockResolvedValue(null);
     mocks.limit.mockResolvedValueOnce({
       success: false,
-      limit: 300,
+      limit: 600,
       remaining: 0,
       reset: Date.now() + 15_000,
     });
@@ -221,10 +229,10 @@ describe('guardApiProxyRequest', () => {
     );
 
     expect(response?.status).toBe(429);
-    expect(response?.headers.get('X-RateLimit-Limit')).toBe('300');
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('600');
     expect(response?.headers.get('X-RateLimit-Policy')).toBe('task-board-read');
     expect(mocks.ratelimitConfigs).toContainEqual({
-      limit: 300,
+      limit: 600,
       window: '1 m',
     });
     expect(mocks.ratelimitPrefixes).toContain(
@@ -658,7 +666,7 @@ describe('guardApiProxyRequest', () => {
     }
 
     expect(mocks.ratelimitPrefixes).toContain(
-      'proxy:test:api:default:anonymous::api:v1:workspaces:ws-1:finance:invoices:mutate:minute'
+      'proxy:test:api:default:anonymous:mutate:minute'
     );
     expect(mocks.ratelimitPrefixes).not.toContain(
       'proxy:test:api:finance-invoice-create-read:anonymous:mutate:minute'
@@ -1015,7 +1023,7 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.limit).not.toHaveBeenCalled();
   });
 
-  it('scopes anonymous read buckets by pathname to avoid cross-route collisions', async () => {
+  it('shares broad anonymous read buckets across path variants', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
@@ -1036,13 +1044,28 @@ describe('guardApiProxyRequest', () => {
     await guardApiProxyRequest(makeRequest('/api/v1/users/me/profile', 'GET'), {
       prefixBase: 'proxy:test:api',
     });
+    await guardApiProxyRequest(
+      makeRequest('/api/v1/users/me/nonexistent/random-nonce', 'GET'),
+      {
+        prefixBase: 'proxy:test:api',
+      }
+    );
 
     expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:users-me:anonymous:get:minute'
+    );
+    expect(mocks.ratelimitPrefixes).not.toContain(
       'proxy:test:api:users-me:anonymous::api:v1:users:me:profile:get:minute'
     );
+    expect(mocks.ratelimitPrefixes).not.toContain(
+      'proxy:test:api:users-me:anonymous::api:v1:users:me:nonexistent:random-nonce:get:minute'
+    );
   });
 
-  it('uses a classroom-friendly OTP send bucket', async () => {
+  it.each([
+    '/api/v1/auth/otp/send',
+    '/api/v1/auth/mobile/send-otp',
+  ])('uses a classroom-friendly OTP send bucket for %s', async (path) => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
@@ -1060,12 +1083,9 @@ describe('guardApiProxyRequest', () => {
       await import('../api-proxy-guard.js');
     clearApiProxyGuardLimiterCache();
 
-    const response = await guardApiProxyRequest(
-      makeRequest('/api/v1/auth/otp/send', 'POST'),
-      {
-        prefixBase: 'proxy:test:api',
-      }
-    );
+    const response = await guardApiProxyRequest(makeRequest(path, 'POST'), {
+      prefixBase: 'proxy:test:api',
+    });
 
     expect(response?.status).toBe(429);
     expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
@@ -1275,6 +1295,59 @@ describe('guardApiProxyRequest', () => {
     expect(response?.headers.get('X-RateLimit-Policy')).toBe('high-fanout');
   });
 
+  it('prepends additional route policies before default high-fanout buckets', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 30,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/mail/send', 'POST'),
+      {
+        additionalRoutePolicies: [
+          {
+            key: 'email-rate-limit-override',
+            matches: (req) =>
+              /^\/api\/v1\/workspaces\/[^/]+\/mail\/send(?:\/|$)/.test(
+                req.nextUrl.pathname
+              ),
+            rateLimits: {
+              get: [],
+              mutate: [{ duration: '1 m', limit: 30, window: 'minute' }],
+            },
+          },
+        ],
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe(
+      'email-rate-limit-override'
+    );
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 30,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitConfigs).not.toContainEqual({
+      limit: 2,
+      window: '1 m',
+    });
+  });
+
   it('uses relaxed buckets for task description persistence routes', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -1487,6 +1560,340 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.validateEmoji).toHaveBeenCalledTimes(1);
   });
 
+  it('gives a trusted session its own per-session bucket with scaled read limits', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    // Trust the session subject key (account trust → per-session keying).
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number }>();
+      const sessionKey = keys.find((key) => key.startsWith('session:'));
+      if (sessionKey) {
+        map.set(sessionKey, { m: 3 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 1800,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+      }),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('task-board-read');
+    // Base task-board read minute limit (600) scaled by the trust tier (3).
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 1800,
+      window: '1 m',
+    });
+    // Trusted traffic gets a tier-suffixed bucket.
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:t3:get:minute'
+    );
+    // The limiter is keyed by the per-session subject key, not the shared IP.
+    const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
+    expect(limiterId.startsWith('session:')).toBe(true);
+  });
+
+  it('uplifts a trusted location per-IP without per-session keying', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    // Trust the location (cidr) subject key only — no session cookie present.
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number }>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { m: 2 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 1200,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 1200,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:t2:get:minute'
+    );
+    // Location trust keeps the shared per-IP bucket (whole team benefits).
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
+  it('keeps a trusted location on per-IP keying even with an untrusted session cookie', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    // Only the cidr is trusted; the session key is absent from the cache.
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number }>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { m: 2 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 1200,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+      }),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    // An untrusted session must not escape the per-IP bucket.
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
+  it('keeps untrusted reads on the legacy per-IP bucket without trust suffix', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    // Default mock: empty trust map (forged or simply untrusted).
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 600,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=forged-value; theme=dark',
+      }),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 600,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:get:minute'
+    );
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
+  it('applies an absolute read limit from a location rule', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, unknown>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { abs: { minute: 50 }, m: 1, mode: 'absolute' });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 50,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    // Absolute exactly sets the minute window (even below the base 600).
+    expect(mocks.ratelimitConfigs).toContainEqual({ limit: 50, window: '1 m' });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:abs-50-x-x:get:minute'
+    );
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
+  it('removes the read cap for an unlimited rule', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, unknown>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { m: 1, mode: 'unlimited' });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    // No read limiter is constructed → request passes the rate-limit stage.
+    expect(response).toBeNull();
+    expect(mocks.limit).not.toHaveBeenCalled();
+  });
+
+  it('uplifts reads for a trusted workspace parsed from the path', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    const receivedKeys: string[] = [];
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      receivedKeys.push(...keys);
+      const map = new Map<string, unknown>();
+      const workspaceKey = keys.find((key) => key.startsWith('workspace:'));
+      if (workspaceKey) {
+        map.set(workspaceKey, { m: 5 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 3000,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const wsId = '33333333-3333-4333-8333-333333333333';
+    const response = await guardApiProxyRequest(
+      makeRequest(`/api/v1/workspaces/${wsId}/tasks?boardId=board-1`, 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(receivedKeys).toContain(`workspace:${wsId}`);
+    // Base task-board minute (600) scaled by the workspace tier (5).
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 3000,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:task-board-read:anonymous:t5:get:minute'
+    );
+  });
+
+  it('derives the session subject key the same way as server-side reputation', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    const receivedKeys: string[] = [];
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      receivedKeys.push(...keys);
+      return Promise.resolve(new Map<string, { m: number }>());
+    });
+    mocks.limit.mockResolvedValue({
+      success: true,
+      limit: 600,
+      remaining: 599,
+      reset: Date.now() + 15_000,
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const cookieName = 'sb-resolved-kingfish-21146-auth-token.0';
+    const cookieValue = 'base64-validvalue';
+    await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks?boardId=board-1', 'GET', {
+        cookie: `${cookieName}=${cookieValue}; theme=dark`,
+      }),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    const { createHash } = await import('node:crypto');
+    const expected = `session:${createHash('sha256')
+      .update(`${cookieName}:${cookieValue}`)
+      .digest('hex')
+      .slice(0, 24)}`;
+
+    expect(receivedKeys).toContain(expected);
+  });
+
   it('skips text-bomb validation for whiteboard snapshots on the whiteboard save route', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');

package/src/__tests__/app-url.test.ts

@@ -110,11 +110,31 @@ describe('resolveInternalAppUrl', () => {
       kind: 'internal',
       name: 'tasks',
     });
+    expect(
+      getAppDomainByUrl(
+        'https://zalo-qr-chat-setup.tasks.tuturuuu.localhost:1355/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toMatchObject({
+      canonicalUrl:
+        'https://zalo-qr-chat-setup.tasks.tuturuuu.localhost/verify-token?nextUrl=%2Fpersonal',
+      kind: 'internal',
+      name: 'tasks',
+    });
     expect(
       getAppDomainByUrl(
         'https://tuturuuu.localhost.evil.test:1355/verify-token?nextUrl=%2F'
       )
     ).toBeNull();
+    expect(
+      getAppDomainByUrl(
+        'https://tasks.tuturuuu.localhost:4444/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toBeNull();
+    expect(
+      getAppDomainByUrl(
+        'https://attacker.tasks.tuturuuu.localhost:4444/verify-token?nextUrl=%2Fpersonal'
+      )
+    ).toBeNull();
   });
 
   it('canonicalizes production internal app URLs to their registered HTTPS origins', () => {

package/src/__tests__/upstash-rest.test.ts

@@ -30,12 +30,15 @@ describe('upstash-rest', () => {
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
     const client = {
+      decr: vi.fn(),
       del: vi.fn(),
       eval: vi.fn(),
       evalsha: vi.fn(),
       expire: vi.fn(),
       get: vi.fn(),
       incr: vi.fn(),
+      mget: vi.fn(),
+      scan: vi.fn(),
       set: vi.fn(),
       ttl: vi.fn(),
     };