@tuturuuu/utils 0.7.0 → 0.9.0

package/src/api-proxy-guard.ts

@@ -2,6 +2,10 @@ import { Ratelimit } from '@upstash/ratelimit';
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { extractIPFromRequest, isIPBlockedEdge } from './abuse-protection/edge';
+import {
+  type CachedTrustEntry,
+  getCachedTrustEntries,
+} from './abuse-protection/edge-trust';
 import { DEV_MODE, MAX_PAYLOAD_SIZE } from './constants';
 import { validateRequestEmojiLimit } from './request-emoji-limit';
 import {
@@ -11,6 +15,45 @@ import {
 
 const isDev = process.env.NODE_ENV !== 'production';
 
+// Quantized trust tiers — the cached multiplier is floored to one of these
+// before scaling read limits, so the limiter prefix (and therefore the Redis
+// sliding-window buckets) stays bounded and stable even as a subject's exact
+// multiplier drifts.
+const TRUST_MULTIPLIER_TIERS = [1, 1.5, 2, 3, 5, 10, 25, 100] as const;
+
+function isEnvFlagEnabled(name: string, defaultOn = true): boolean {
+  const raw = process.env[name];
+  if (raw == null || raw.trim() === '') {
+    return defaultOn;
+  }
+
+  return !/^(0|false|off|no)$/i.test(raw.trim());
+}
+
+/**
+ * Whether trusted accounts/locations get scaled read limits (and verified
+ * sessions get their own per-session bucket) at the edge. Default on; set
+ * `API_PROXY_EDGE_TRUST_ENABLED=0` to disable trust uplift and fall back to
+ * legacy per-IP keying without a deploy.
+ */
+function edgeTrustEnabled(): boolean {
+  return isEnvFlagEnabled('API_PROXY_EDGE_TRUST_ENABLED');
+}
+
+/**
+ * Floors a raw trust multiplier to the nearest quantized tier. Never reduces
+ * below 1 — trust uplift only ever raises read limits.
+ */
+function quantizeTrustMultiplier(multiplier: number): number {
+  let tier = 1;
+  for (const candidate of TRUST_MULTIPLIER_TIERS) {
+    if (multiplier >= candidate) {
+      tier = candidate;
+    }
+  }
+  return tier;
+}
+
 type CallerClass = 'anonymous' | 'authenticated';
 
 export type RateLimitWindow = 'minute' | 'hour' | 'day';
@@ -37,6 +80,7 @@ export type TrustedProxyBypassRule = {
 };
 
 export type GuardOptions = {
+  additionalRoutePolicies?: ProxyRoutePolicy[];
   prefixBase: string;
   routePolicies?: ProxyRoutePolicy[];
   trustedBypassRules?: TrustedProxyBypassRule[];
@@ -143,18 +187,39 @@ const DEFAULT_ANONYMOUS_MUTATE_RATE_LIMITS: RateLimitConfig[] = [
   createConfig('day', '1 d', 600, 'API_PROXY_ANON_MUTATE_LIMIT_DAY'),
 ];
 
+const DEFAULT_AUTHENTICATED_READ_RATE_LIMITS: RateLimitConfig[] = [
+  createConfig('minute', '1 m', 600, 'API_PROXY_AUTH_READ_LIMIT_MINUTE'),
+  createConfig('hour', '1 h', 6000, 'API_PROXY_AUTH_READ_LIMIT_HOUR'),
+  createConfig('day', '1 d', 40_000, 'API_PROXY_AUTH_READ_LIMIT_DAY'),
+];
+
 const DEFAULT_MUTATE_RATE_LIMITS: RateLimitConfig[] = [
   { window: 'minute', limit: 60, duration: '1 m' },
   { window: 'hour', limit: 300, duration: '1 h' },
   { window: 'day', limit: 2000, duration: '1 d' },
 ];
 
+const USERS_ME_READ_RATE_LIMITS: RateLimitConfig[] = [
+  createConfig('minute', '1 m', 600, 'API_PROXY_USERS_ME_READ_LIMIT_MINUTE'),
+  createConfig('hour', '1 h', 6000, 'API_PROXY_USERS_ME_READ_LIMIT_HOUR'),
+  createConfig('day', '1 d', 40_000, 'API_PROXY_USERS_ME_READ_LIMIT_DAY'),
+];
+
 const USERS_ME_MUTATE_RATE_LIMITS: RateLimitConfig[] = [
   { window: 'minute', limit: 60, duration: '1 m' },
   { window: 'hour', limit: 200, duration: '1 h' },
   { window: 'day', limit: 1200, duration: '1 d' },
 ];
 
+const WORKSPACE_DASHBOARD_READ_RATE_LIMITS: RateLimitProfile = {
+  get: [
+    createConfig('minute', '1 m', 600, 'API_PROXY_WORKSPACE_READ_LIMIT_MINUTE'),
+    createConfig('hour', '1 h', 6000, 'API_PROXY_WORKSPACE_READ_LIMIT_HOUR'),
+    createConfig('day', '1 d', 40_000, 'API_PROXY_WORKSPACE_READ_LIMIT_DAY'),
+  ],
+  mutate: DEFAULT_MUTATE_RATE_LIMITS,
+};
+
 const AUTH_RATE_LIMITS: RateLimitProfile = {
   get: NO_READ_RATE_LIMITS,
   mutate: [
@@ -250,11 +315,11 @@ const TASK_BOARD_READ_RATE_LIMITS: RateLimitProfile = {
     createConfig(
       'minute',
       '1 m',
-      300,
+      600,
       'API_PROXY_TASK_BOARD_READ_LIMIT_MINUTE'
     ),
-    createConfig('hour', '1 h', 3000, 'API_PROXY_TASK_BOARD_READ_LIMIT_HOUR'),
-    createConfig('day', '1 d', 20_000, 'API_PROXY_TASK_BOARD_READ_LIMIT_DAY'),
+    createConfig('hour', '1 h', 12_000, 'API_PROXY_TASK_BOARD_READ_LIMIT_HOUR'),
+    createConfig('day', '1 d', 80_000, 'API_PROXY_TASK_BOARD_READ_LIMIT_DAY'),
   ],
   mutate: DEFAULT_MUTATE_RATE_LIMITS,
 };
@@ -268,6 +333,25 @@ const USERS_DATABASE_READ_OVER_POST_RATE_LIMITS: RateLimitProfile = {
   ],
 };
 
+const USERS_ADMIN_READ_RATE_LIMITS: RateLimitProfile = {
+  get: [
+    createConfig(
+      'minute',
+      '1 m',
+      1200,
+      'API_PROXY_USERS_ADMIN_READ_LIMIT_MINUTE'
+    ),
+    createConfig(
+      'hour',
+      '1 h',
+      12_000,
+      'API_PROXY_USERS_ADMIN_READ_LIMIT_HOUR'
+    ),
+    createConfig('day', '1 d', 80_000, 'API_PROXY_USERS_ADMIN_READ_LIMIT_DAY'),
+  ],
+  mutate: DEFAULT_MUTATE_RATE_LIMITS,
+};
+
 const FINANCE_READ_RATE_LIMITS: RateLimitProfile = {
   get: [
     createConfig('minute', '1 m', 1200, 'API_PROXY_FINANCE_READ_LIMIT_MINUTE', [
@@ -318,6 +402,33 @@ function isUsersDatabaseReadOverPost(req: NextRequest) {
   );
 }
 
+function isUsersAdminRead(req: NextRequest) {
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    return false;
+  }
+
+  const pathname = req.nextUrl.pathname;
+
+  return (
+    /^\/api\/v1\/workspaces\/[^/]+\/users(?:\/(?:database|groups|feedbacks|attendance\/export|[^/]+\/(?:attendance|emails|referrals|linked-promotions|referral-discounts|user-groups)))?\/?$/u.test(
+      pathname
+    ) ||
+    /^\/api\/v1\/workspaces\/[^/]+\/user-groups\/[^/]+(?:\/(?:attendance|members(?:\/[^/]+(?:\/feedbacks)?)?|posts(?:\/[^/]+(?:\/status)?)?|linked-products|storage|indicators(?:\/.*)?))?\/?$/u.test(
+      pathname
+    )
+  );
+}
+
+function isWorkspaceDashboardRead(req: NextRequest) {
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    return false;
+  }
+
+  return /^\/api(?:\/v1)?\/workspaces\/[^/]+(?:\/|$)/u.test(
+    req.nextUrl.pathname
+  );
+}
+
 const DEFAULT_ROUTE_POLICIES: ProxyRoutePolicy[] = [
   {
     key: 'cron',
@@ -397,6 +508,16 @@ const DEFAULT_ROUTE_POLICIES: ProxyRoutePolicy[] = [
     matches: isFinanceInvoiceCreateSupportRead,
     rateLimits: FINANCE_READ_RATE_LIMITS,
   },
+  {
+    key: 'users-admin-read',
+    matches: isUsersAdminRead,
+    rateLimits: USERS_ADMIN_READ_RATE_LIMITS,
+  },
+  {
+    key: 'workspace-dashboard-read',
+    matches: isWorkspaceDashboardRead,
+    rateLimits: WORKSPACE_DASHBOARD_READ_RATE_LIMITS,
+  },
   {
     key: 'high-fanout',
     matches: (req) =>
@@ -423,7 +544,7 @@ const DEFAULT_ROUTE_POLICIES: ProxyRoutePolicy[] = [
     key: 'users-me',
     matches: (req) => req.nextUrl.pathname.startsWith('/api/v1/users/me'),
     rateLimits: {
-      get: NO_READ_RATE_LIMITS,
+      get: USERS_ME_READ_RATE_LIMITS,
       mutate: USERS_ME_MUTATE_RATE_LIMITS,
     },
   },
@@ -766,15 +887,254 @@ export function hasAuthenticatedApiSession(req: NextRequest): boolean {
 }
 
 function getCallerClass(req: NextRequest): CallerClass {
+  // Intentionally always 'anonymous'. Auth headers/cookies are forgeable at the
+  // edge (we can't verify signatures cheaply here), so presence alone must never
+  // grant an elevated proxy budget — real per-user enforcement happens
+  // downstream. Per-session proxy buckets and higher read throughput for
+  // genuinely trusted accounts/locations are granted instead via the
+  // server-written trust cache (see resolveProxyIdentity +
+  // getCachedTrustEntries), which cannot be forged.
   void req;
   return 'anonymous';
 }
 
+/**
+ * Edge-safe stable subject hash. MUST stay byte-identical to
+ * `reputation.ts hashStableSubject` (sha256 hex, sliced to 24 chars) so that
+ * the edge `session:<hash>` subject key matches the DB-side key used by the
+ * trust cache.
+ */
+async function hashStableSubjectEdge(value: string): Promise<string> {
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    new TextEncoder().encode(value)
+  );
+  return Array.from(new Uint8Array(digest))
+    .map((byte) => byte.toString(16).padStart(2, '0'))
+    .join('')
+    .slice(0, 24);
+}
+
+function parseCookieHeaderEdge(
+  cookieHeader: string | null
+): Array<{ name: string; value: string }> {
+  if (!cookieHeader) {
+    return [];
+  }
+
+  return cookieHeader
+    .split(';')
+    .map((entry) => {
+      const separatorIndex = entry.indexOf('=');
+      if (separatorIndex < 0) {
+        return null;
+      }
+
+      return {
+        name: entry.slice(0, separatorIndex).trim(),
+        value: entry.slice(separatorIndex + 1).trim(),
+      };
+    })
+    .filter(
+      (entry): entry is { name: string; value: string } =>
+        !!entry?.name && !!entry.value
+    );
+}
+
+function getSessionAuthCookie(
+  req: NextRequest
+): { name: string; value: string } | null {
+  const cookies = parseCookieHeaderEdge(req.headers.get('cookie'));
+  return (
+    cookies.find(
+      (cookie) =>
+        cookie.name === 'tuturuuu_app_session' ||
+        GENERIC_SUPABASE_AUTH_COOKIE_NAME_PATTERN.test(cookie.name)
+    ) ?? null
+  );
+}
+
+/**
+ * Mirrors `reputation.ts getCidrSubjectKey` so the edge cidr subject key matches
+ * the DB-side trusted-location key.
+ */
+function getCidrSubjectKeyEdge(ipAddress: string | null): string | null {
+  if (!ipAddress) {
+    return null;
+  }
+
+  const ipv4Parts = ipAddress.split('.');
+  if (
+    ipv4Parts.length === 4 &&
+    ipv4Parts.every((part) => /^\d{1,3}$/.test(part))
+  ) {
+    return `cidr:${ipv4Parts.slice(0, 3).join('.')}.0/24`;
+  }
+
+  const ipv6Parts = ipAddress.split(':').filter(Boolean);
+  if (ipv6Parts.length >= 4) {
+    return `cidr:${ipv6Parts.slice(0, 4).join(':')}::/64`;
+  }
+
+  return null;
+}
+
+export type ProxyIdentity = {
+  /** `ip:<ip>` subject key, or null when the IP is unknown. */
+  ipKey: string | null;
+  /** `cidr:<network>` subject key for trusted-location lookups, or null. */
+  cidrKey: string | null;
+  /** `session:<hash>` subject key for cookie sessions, or null. Matches the
+   * DB-side session subject key so trusted sessions resolve from the cache. */
+  sessionKey: string | null;
+  /** `workspace:<wsId>` subject key parsed from a workspace-scoped API path, or
+   * null. Lets an admin workspace rule uplift reads for the whole workspace. */
+  workspaceKey: string | null;
+};
+
+const WORKSPACE_PATH_PATTERN =
+  /^\/api(?:\/v1)?\/workspaces\/([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})(?:\/|$)/u;
+
+function getWorkspaceSubjectKey(pathname: string): string | null {
+  const match = WORKSPACE_PATH_PATTERN.exec(pathname);
+  return match ? `workspace:${match[1]!.toLowerCase()}` : null;
+}
+
+/**
+ * Resolves the trust/keying subject keys for a request. Limited to
+ * session/cidr/ip (keys an attacker would have to actually possess or share a
+ * network with) plus a workspace key parsed from the path — so trust uplift and
+ * per-session keying can never be granted by a forged credential.
+ */
+async function resolveProxyIdentity(
+  req: NextRequest,
+  ip: string
+): Promise<ProxyIdentity> {
+  const normalizedIp = ip && ip !== 'unknown' ? ip : null;
+  const sessionCookie = getSessionAuthCookie(req);
+  const sessionKey = sessionCookie
+    ? `session:${await hashStableSubjectEdge(`${sessionCookie.name}:${sessionCookie.value}`)}`
+    : null;
+
+  return {
+    cidrKey: getCidrSubjectKeyEdge(normalizedIp),
+    ipKey: normalizedIp ? `ip:${normalizedIp}` : null,
+    sessionKey,
+    workspaceKey: getWorkspaceSubjectKey(req.nextUrl.pathname),
+  };
+}
+
+/**
+ * Scales the read (`get`) limits of a profile by a trust multiplier. Mutation
+ * limits are left flat — those are already trust-scaled at the DB and in the
+ * downstream session/API wrappers, so scaling them here would double-apply.
+ */
+function scaleReadLimits(
+  profile: RateLimitProfile,
+  multiplier: number
+): RateLimitProfile {
+  if (multiplier <= 1) {
+    return profile;
+  }
+
+  return {
+    ...profile,
+    get: profile.get.map((config) => ({
+      ...config,
+      limit: Math.max(config.limit, Math.floor(config.limit * multiplier)),
+    })),
+  };
+}
+
+function entryReadFloor(abs: NonNullable<CachedTrustEntry['abs']>): number {
+  return abs.minute ?? abs.hour ?? abs.day ?? 0;
+}
+
+/**
+ * Combines all applicable cached entries (session + location/workspace) into a
+ * single effective read decision. Most-permissive wins: unlimited beats
+ * absolute beats the highest multiplier.
+ */
+function combineTrustEntries(
+  entries: Array<CachedTrustEntry | null | undefined>
+): CachedTrustEntry | null {
+  const active = entries.filter((entry): entry is CachedTrustEntry => !!entry);
+  if (active.length === 0) {
+    return null;
+  }
+
+  if (active.some((entry) => entry.mode === 'unlimited')) {
+    return { m: 1, mode: 'unlimited' };
+  }
+
+  const absolutes = active.filter(
+    (
+      entry
+    ): entry is CachedTrustEntry & {
+      abs: NonNullable<CachedTrustEntry['abs']>;
+    } => entry.mode === 'absolute' && !!entry.abs
+  );
+  if (absolutes.length > 0) {
+    const best = absolutes.reduce((winner, candidate) =>
+      entryReadFloor(candidate.abs) > entryReadFloor(winner.abs)
+        ? candidate
+        : winner
+    );
+    return { abs: best.abs, m: best.m, mode: 'absolute' };
+  }
+
+  return { m: Math.max(...active.map((entry) => entry.m)) };
+}
+
+/**
+ * Applies a combined trust entry to a route profile's READ limits and returns
+ * the scaled profile plus a bucket-prefix suffix that uniquely encodes the
+ * effective limit (so distinct limits never share a Redis sliding window).
+ */
+function applyTrustEntryToReads(
+  profile: RateLimitProfile,
+  entry: CachedTrustEntry | null
+): { profile: RateLimitProfile; suffix: string } {
+  if (!entry) {
+    return { profile, suffix: '' };
+  }
+
+  if (entry.mode === 'unlimited') {
+    // Drop the read cap entirely (no read limiter is constructed for [] get).
+    return { profile: { ...profile, get: [] }, suffix: ':unl' };
+  }
+
+  if (entry.mode === 'absolute' && entry.abs) {
+    const get = profile.get.map((config) => {
+      const absolute = entry.abs?.[config.window];
+      return absolute != null ? { ...config, limit: absolute } : config;
+    });
+    const { minute, hour, day } = entry.abs;
+    return {
+      profile: { ...profile, get },
+      suffix: `:abs-${minute ?? 'x'}-${hour ?? 'x'}-${day ?? 'x'}`,
+    };
+  }
+
+  const tier = quantizeTrustMultiplier(entry.m);
+  if (tier <= 1) {
+    return { profile, suffix: '' };
+  }
+  return { profile: scaleReadLimits(profile, tier), suffix: `:t${tier}` };
+}
+
 function getEffectiveRateLimits(
   routePolicy: ProxyRoutePolicy,
   callerClass: CallerClass
 ): RateLimitProfile {
   if (callerClass === 'authenticated') {
+    if (routePolicy.key === 'default') {
+      return {
+        get: DEFAULT_AUTHENTICATED_READ_RATE_LIMITS,
+        mutate: DEFAULT_MUTATE_RATE_LIMITS,
+      };
+    }
+
     return routePolicy.rateLimits;
   }
 
@@ -788,21 +1148,17 @@ function getEffectiveRateLimits(
   return routePolicy.rateLimits;
 }
 
-function shouldScopeRateLimitByPath(routePolicy: ProxyRoutePolicy): boolean {
-  return routePolicy.key === 'default' || routePolicy.key === 'users-me';
-}
-
-function getPathScopedRateLimitPrefix(
+function getRateLimitPrefix(
   prefixBase: string,
   routePolicy: ProxyRoutePolicy,
   callerClass: CallerClass,
-  pathname: string
+  trustSuffix = ''
 ): string {
-  const scopeSuffix = shouldScopeRateLimitByPath(routePolicy)
-    ? `:${pathname.replaceAll('/', ':') || ':root'}`
-    : '';
-
-  return `${prefixBase}:${routePolicy.key}:${callerClass}${scopeSuffix}`;
+  // Only trusted/uplifted traffic gets a suffixed bucket; untrusted traffic
+  // keeps the original prefix so its sliding windows are unaffected. The suffix
+  // must uniquely encode the effective limit (tier or absolute values) so two
+  // different effective limits never share a Redis sliding-window prefix.
+  return `${prefixBase}:${routePolicy.key}:${callerClass}${trustSuffix}`;
 }
 
 export function isTrustedProxyBypassRequest(
@@ -870,7 +1226,10 @@ export async function guardApiProxyRequest(
     );
   }
 
-  const routePolicies = options.routePolicies ?? DEFAULT_ROUTE_POLICIES;
+  const routePolicies = [
+    ...(options.additionalRoutePolicies ?? []),
+    ...(options.routePolicies ?? DEFAULT_ROUTE_POLICIES),
+  ];
   const trustedBypassRules = [
     ...DEFAULT_TRUSTED_BYPASS_RULES,
     ...(options.trustedBypassRules ?? []),
@@ -886,8 +1245,9 @@ export async function guardApiProxyRequest(
   ) {
     const callerClass = getCallerClass(req);
     const ip = extractIPFromRequest(req.headers);
+    const identity = await resolveProxyIdentity(req, ip);
 
-    if (ip !== 'unknown' && callerClass === 'anonymous') {
+    if (ip !== 'unknown') {
       const blockInfo = await isIPBlockedEdge(ip);
       if (blockInfo) {
         const retryAfter = Math.max(
@@ -899,15 +1259,76 @@ export async function guardApiProxyRequest(
           'X-Proxy-Block-Reason': 'ip-already-blocked',
         });
       }
+    }
+
+    const routePolicy = getRoutePolicy(req, routePolicies);
+    const isRead = req.method === 'GET' || req.method === 'HEAD';
+
+    // Resolve server-verified session keying for reads and mutations, but apply
+    // trust uplift to read limits only. Account trust (session key) and location
+    // trust (cidr/ip keys) are distinguished so that:
+    //   * a server-verified SESSION (cache entry keyed on the real cookie's
+    //     hash — unforgeable) gets its OWN per-session bucket, so signed-in
+    //     teammates behind one NAT no longer collide; and
+    //   * a trusted LOCATION (office cidr/ip) uplifts the shared per-IP bucket
+    //     for the whole team without any per-request credential.
+    // Untrusted traffic keeps legacy per-IP keying, preserving single-IP abuse
+    // caps. A forged cookie hashes to a key with no cache entry, so it cannot
+    // escape the shared IP bucket.
+    let trustEntry: CachedTrustEntry | null = null;
+    let sessionScoped = false;
+    if (edgeTrustEnabled()) {
+      const lookupKeys = [
+        identity.sessionKey,
+        ...(isRead
+          ? [identity.cidrKey, identity.ipKey, identity.workspaceKey]
+          : []),
+      ].filter((key): key is string => key != null);
+      const entries = await getCachedTrustEntries(lookupKeys);
+
+      const sessionEntry = identity.sessionKey
+        ? entries.get(identity.sessionKey)
+        : undefined;
+      sessionScoped = !!identity.sessionKey && !!sessionEntry;
+
+      if (isRead) {
+        // Location/workspace trust applies to the shared per-IP bucket for the
+        // whole team; session trust applies to the per-session bucket.
+        const locationEntry = combineTrustEntries([
+          identity.cidrKey ? entries.get(identity.cidrKey) : undefined,
+          identity.ipKey ? entries.get(identity.ipKey) : undefined,
+          identity.workspaceKey
+            ? entries.get(identity.workspaceKey)
+            : undefined,
+        ]);
+
+        trustEntry = combineTrustEntries([sessionEntry, locationEntry]);
+      }
+    }
 
-      const routePolicy = getRoutePolicy(req, routePolicies);
-      const isRead = req.method === 'GET' || req.method === 'HEAD';
-      const rateLimits = getEffectiveRateLimits(routePolicy, callerClass);
-      const limiterPrefix = getPathScopedRateLimitPrefix(
+    // Server-verified sessions key per-session; everyone else keys per-IP.
+    const limiterId =
+      sessionScoped && identity.sessionKey
+        ? identity.sessionKey
+        : identity.ipKey;
+
+    if (limiterId) {
+      const effectiveCallerClass: CallerClass = sessionScoped
+        ? 'authenticated'
+        : callerClass;
+      const baseRateLimits = getEffectiveRateLimits(
+        routePolicy,
+        effectiveCallerClass
+      );
+      const { profile: rateLimits, suffix: trustSuffix } = isRead
+        ? applyTrustEntryToReads(baseRateLimits, trustEntry)
+        : { profile: baseRateLimits, suffix: '' };
+
+      const limiterPrefix = getRateLimitPrefix(
         options.prefixBase,
         routePolicy,
-        callerClass,
-        req.nextUrl.pathname
+        effectiveCallerClass,
+        trustSuffix
       );
       const limiterCacheKey = `${limiterPrefix}:${JSON.stringify(rateLimits)}`;
       const limiters = await getRateLimiters(limiterPrefix, rateLimits);
@@ -918,7 +1339,7 @@ export async function guardApiProxyRequest(
         let result: RateLimitResult;
 
         try {
-          result = await limiter.limit(ip);
+          result = await limiter.limit(limiterId);
         } catch {
           const fallbackLimiters = replaceWithLocalRateLimiters(
             limiterCacheKey,
@@ -936,7 +1357,7 @@ export async function guardApiProxyRequest(
             continue;
           }
 
-          result = await fallbackBucket.limiter.limit(ip);
+          result = await fallbackBucket.limiter.limit(limiterId);
         }
 
         const { success, limit, remaining, reset } = result;
@@ -945,7 +1366,7 @@ export async function guardApiProxyRequest(
           const consumed = limit - remaining;
           const kind = isRead ? 'read' : 'mutate';
           console.log(
-            `[ProxyGuard] ${routePolicy.key}:${kind}:${window} ${consumed}/${limit} | IP: ${ip} | path: ${req.nextUrl.pathname}`
+            `[ProxyGuard] ${routePolicy.key}:${kind}:${window} ${consumed}/${limit} | id: ${limiterId} | path: ${req.nextUrl.pathname}`
           );
         }
 
@@ -960,7 +1381,7 @@ export async function guardApiProxyRequest(
             'X-RateLimit-Limit': `${limit}`,
             'X-RateLimit-Remaining': `${remaining}`,
             'X-RateLimit-Reset': `${Math.ceil(reset / 1000)}`,
-            'X-RateLimit-Caller-Class': callerClass,
+            'X-RateLimit-Caller-Class': effectiveCallerClass,
             'X-RateLimit-Window': window,
             'X-RateLimit-Policy': routePolicy.key,
           });

package/src/currencies.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest';
+import {
+  getCurrencyConfig,
+  getCurrencyLocale,
+  isSupportedCurrency,
+  resolveSupportedCurrency,
+} from './currencies';
+
+describe('resolveSupportedCurrency', () => {
+  it('normalizes supported currency codes', () => {
+    expect(resolveSupportedCurrency(' sgd ')).toBe('SGD');
+    expect(resolveSupportedCurrency('eur')).toBe('EUR');
+  });
+
+  it('uses a supported fallback for missing or unsupported values', () => {
+    expect(resolveSupportedCurrency(undefined, 'VND')).toBe('VND');
+    expect(resolveSupportedCurrency(null, 'EUR')).toBe('EUR');
+    expect(resolveSupportedCurrency('XYZ', 'SGD')).toBe('SGD');
+  });
+
+  it('falls back to USD when the fallback is unsupported', () => {
+    expect(resolveSupportedCurrency('', 'XYZ')).toBe('USD');
+    expect(resolveSupportedCurrency('ZZZ', 'XYZ')).toBe('USD');
+  });
+});
+
+describe('currency lookup normalization', () => {
+  it('trims currency codes before support and locale checks', () => {
+    expect(isSupportedCurrency(' vnd ')).toBe(true);
+    expect(getCurrencyLocale(' php ')).toBe('en-PH');
+    expect(getCurrencyConfig(' eur ')?.code).toBe('EUR');
+  });
+});