@tuturuuu/utils 0.8.0 → 0.10.0

package/src/__tests__/api-proxy-guard.test.ts

@@ -10,6 +10,7 @@ const mocks = vi.hoisted(() => ({
   isBlocked: vi.fn(),
   validateEmoji: vi.fn(),
   getTrustEntries: vi.fn(),
+  hasAppealRelief: vi.fn(),
 }));
 
 vi.mock('@upstash/ratelimit', () => {
@@ -53,6 +54,8 @@ vi.mock('../abuse-protection/edge', () => ({
 
 vi.mock('../abuse-protection/edge-trust', () => ({
   getCachedTrustEntries: (keys: string[]) => mocks.getTrustEntries(keys),
+  hasCachedIpBlockAppealRelief: (sessionKey: string, ipKey: string) =>
+    mocks.hasAppealRelief(sessionKey, ipKey),
 }));
 
 vi.mock('../request-emoji-limit', () => ({
@@ -104,8 +107,10 @@ describe('guardApiProxyRequest', () => {
     mocks.isBlocked.mockReset();
     mocks.validateEmoji.mockReset();
     mocks.getTrustEntries.mockReset();
+    mocks.hasAppealRelief.mockReset();
     // Default: no cached trust (untrusted). Tests opt in by overriding.
     mocks.getTrustEntries.mockResolvedValue(new Map<string, { m: number }>());
+    mocks.hasAppealRelief.mockResolvedValue(false);
   });
 
   afterEach(() => {
@@ -172,6 +177,147 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.limit).not.toHaveBeenCalled();
   });
 
+  it('allows a blocked IP to submit the rate-limit appeal endpoint only', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue({
+      expiresAt: new Date(Date.now() + 30_000),
+      reason: 'abuse',
+      blockLevel: 'temporary',
+    });
+    mocks.limit
+      .mockResolvedValueOnce({
+        success: true,
+        limit: 1,
+        remaining: 0,
+        reset: Date.now() + 15_000,
+      })
+      .mockResolvedValueOnce({
+        success: true,
+        limit: 3,
+        remaining: 2,
+        reset: Date.now() + 15_000,
+      })
+      .mockResolvedValueOnce({
+        success: true,
+        limit: 10,
+        remaining: 9,
+        reset: Date.now() + 15_000,
+      });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/rate-limit-appeals', 'POST', {
+        cookie: 'tuturuuu_app_session=session-value',
+      }),
+      {
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response).toBeNull();
+    expect(mocks.hasAppealRelief).not.toHaveBeenCalled();
+    expect(mocks.limit).toHaveBeenCalledTimes(3);
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 1,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:rate-limit-appeal:anonymous:mutate:minute'
+    );
+  });
+
+  it('allows a blocked IP through normal APIs only with matching temporary session relief', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue({
+      expiresAt: new Date(Date.now() + 30_000),
+      reason: 'abuse',
+      blockLevel: 'temporary',
+    });
+    mocks.hasAppealRelief.mockResolvedValueOnce(true);
+    mocks.limit
+      .mockResolvedValueOnce({
+        success: true,
+        limit: 30,
+        remaining: 29,
+        reset: Date.now() + 15_000,
+      })
+      .mockResolvedValueOnce({
+        success: true,
+        limit: 120,
+        remaining: 119,
+        reset: Date.now() + 15_000,
+      })
+      .mockResolvedValueOnce({
+        success: true,
+        limit: 600,
+        remaining: 599,
+        reset: Date.now() + 15_000,
+      });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'POST', {
+        cookie: 'tuturuuu_app_session=session-value',
+      }),
+      {
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response).toBeNull();
+    expect(mocks.hasAppealRelief).toHaveBeenCalledWith(
+      expect.stringMatching(/^session:/),
+      'ip:1.2.3.4'
+    );
+    expect(mocks.limit).toHaveBeenCalledTimes(3);
+  });
+
+  it('keeps unrelated blocked sessions without temporary relief blocked', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue({
+      expiresAt: new Date(Date.now() + 30_000),
+      reason: 'abuse',
+      blockLevel: 'temporary',
+    });
+    mocks.hasAppealRelief.mockResolvedValue(false);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'POST', {
+        cookie: 'tuturuuu_app_session=other-session',
+      }),
+      {
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-Proxy-Block-Reason')).toBe(
+      'ip-already-blocked'
+    );
+    expect(mocks.limit).not.toHaveBeenCalled();
+  });
+
   it('rate limits anonymous generic GET routes', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -601,6 +747,101 @@ describe('guardApiProxyRequest', () => {
     );
   });
 
+  it('uses a dedicated users-admin read bucket for lightweight user reads', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 1200,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    for (const path of [
+      '/api/v1/workspaces/ws-1/users/database',
+      '/api/v1/workspaces/ws-1/users/groups',
+      '/api/v1/workspaces/ws-1/users/11111111-1111-4111-8111-111111111111/attendance',
+      '/api/v1/workspaces/ws-1/users/11111111-1111-4111-8111-111111111111/emails',
+      '/api/v1/workspaces/ws-1/users/11111111-1111-4111-8111-111111111111/referrals',
+      '/api/v1/workspaces/ws-1/users/feedbacks',
+      '/api/v1/workspaces/ws-1/user-groups/group-1',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/members',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/members/user-1/feedbacks',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/attendance',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/posts/post-1/status',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/linked-products',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/indicators/categories/category-1',
+    ]) {
+      const response = await guardApiProxyRequest(makeRequest(path, 'GET'), {
+        prefixBase: 'proxy:test:api',
+      });
+
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get('X-RateLimit-Limit')).toBe('1200');
+      expect(response?.headers.get('X-RateLimit-Policy')).toBe(
+        'users-admin-read'
+      );
+    }
+
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 1200,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 12_000,
+      window: '1 h',
+    });
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 80_000,
+      window: '1 d',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:users-admin-read:anonymous:get:minute'
+    );
+  });
+
+  it('keeps user admin mutations on mutation buckets', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 30,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    for (const path of [
+      '/api/v1/workspaces/ws-1/users/feedbacks',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/members',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/attendance',
+      '/api/v1/workspaces/ws-1/user-groups/group-1/linked-products',
+    ]) {
+      const response = await guardApiProxyRequest(makeRequest(path, 'POST'), {
+        prefixBase: 'proxy:test:api',
+      });
+
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
+      expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+    }
+  });
+
   it('keeps users mutations on the default mutation bucket', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -673,6 +914,110 @@ describe('guardApiProxyRequest', () => {
     );
   });
 
+  it('keys verified calendar event deletes by authenticated session', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number; verified: true }>();
+      const sessionKey = keys.find((key) => key.startsWith('session:'));
+      if (sessionKey) {
+        map.set(sessionKey, { m: 1, verified: true });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 60,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest(
+        '/api/v1/workspaces/071e0fc7-9aa8-42d8-92e5-cc9b3aeec2f1/calendar/events/68e18a3a-c527-421e-8ac3-f8b846175622',
+        'DELETE',
+        {
+          cookie:
+            'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+        }
+      ),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe(
+      'authenticated'
+    );
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('60');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 60,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:default:authenticated:mutate:minute'
+    );
+    expect(mocks.ratelimitPrefixes).not.toContain(
+      'proxy:test:api:default:authenticated:t1:mutate:minute'
+    );
+    const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
+    expect(limiterId.startsWith('session:')).toBe(true);
+  });
+
+  it('keeps unverified calendar event deletes on the anonymous IP bucket', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 30,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest(
+        '/api/v1/workspaces/071e0fc7-9aa8-42d8-92e5-cc9b3aeec2f1/calendar/events/68e18a3a-c527-421e-8ac3-f8b846175622',
+        'DELETE',
+        {
+          cookie:
+            'sb-resolved-kingfish-21146-auth-token.0=forged-value; theme=dark',
+        }
+      ),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 30,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:default:anonymous:mutate:minute'
+    );
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
   it('keeps unauthenticated cron reads on a strict proxy bucket', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -699,141 +1044,333 @@ describe('guardApiProxyRequest', () => {
     );
 
     expect(response?.status).toBe(429);
-    expect(response?.headers.get('X-RateLimit-Limit')).toBe('10');
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('10');
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('cron');
+  });
+
+  it('does not grant elevated proxy budgets from authenticated-looking headers alone', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 30,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'POST', {
+        authorization: 'Bearer ttr_fake',
+      }),
+      {
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+    expect(mocks.isBlocked).toHaveBeenCalledWith('1.2.3.4');
+    expect(mocks.limit).toHaveBeenCalledTimes(1);
+    expect(mocks.validateEmoji).not.toHaveBeenCalled();
+  });
+
+  it('uses local rate limits when the Redis rate limiter is unreachable', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv(
+      'UPSTASH_REDIS_REST_URL',
+      'https://resolved-kingfish-21146.upstash.io'
+    );
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockRejectedValueOnce(new TypeError('fetch failed'));
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const options = {
+      prefixBase: 'proxy:test:api',
+      routePolicies: singleReadRoutePolicies(),
+    };
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'GET'),
+      options
+    );
+
+    expect(response).toBeNull();
+    expect(mocks.limit).toHaveBeenCalledTimes(1);
+
+    const blockedResponse = await guardApiProxyRequest(
+      makeRequest('/api/test', 'GET'),
+      options
+    );
+
+    expect(blockedResponse?.status).toBe(429);
+    expect(blockedResponse?.headers.get('X-Proxy-Block-Reason')).toBe(
+      'route-rate-limit'
+    );
+    expect(blockedResponse?.headers.get('X-RateLimit-Policy')).toBe(
+      'redis-fallback-test'
+    );
+    expect(mocks.limit).toHaveBeenCalledTimes(1);
+  });
+
+  it('uses local rate limits when Redis client initialization fails', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockImplementation(() => {
+      throw new TypeError('Redis unavailable');
+    });
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const options = {
+      prefixBase: 'proxy:test:api',
+      routePolicies: singleReadRoutePolicies(),
+    };
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'GET'),
+      options
+    );
+
+    expect(response).toBeNull();
+
+    const blockedResponse = await guardApiProxyRequest(
+      makeRequest('/api/test', 'GET'),
+      options
+    );
+
+    expect(blockedResponse?.status).toBe(429);
+    expect(blockedResponse?.headers.get('X-Proxy-Block-Reason')).toBe(
+      'route-rate-limit'
+    );
+    expect(mocks.limit).not.toHaveBeenCalled();
+  });
+
+  it('rate limits anonymous users/me reads', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 20,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/users/me/configs/demo', 'GET'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('20');
     expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
-    expect(response?.headers.get('X-RateLimit-Policy')).toBe('cron');
   });
 
-  it('does not grant elevated proxy budgets from authenticated-looking headers alone', async () => {
+  it('keys verified users/me reads by session without applying a trust uplift', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
     mocks.redis.mockReturnValue({});
     mocks.extractIp.mockReturnValue('1.2.3.4');
     mocks.isBlocked.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number; verified: true }>();
+      const sessionKey = keys.find((key) => key.startsWith('session:'));
+      if (sessionKey) {
+        map.set(sessionKey, { m: 1, verified: true });
+      }
+      return Promise.resolve(map);
+    });
     mocks.limit.mockResolvedValueOnce({
       success: false,
-      limit: 30,
+      limit: 600,
       remaining: 0,
       reset: Date.now() + 15_000,
     });
-    mocks.validateEmoji.mockResolvedValue(null);
 
     const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
       await import('../api-proxy-guard.js');
     clearApiProxyGuardLimiterCache();
 
     const response = await guardApiProxyRequest(
-      makeRequest('/api/test', 'POST', {
-        authorization: 'Bearer ttr_fake',
+      makeRequest('/api/v1/users/me/profile', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
       }),
-      {
-        prefixBase: 'proxy:test:api',
-      }
+      { prefixBase: 'proxy:test:api' }
     );
 
     expect(response?.status).toBe(429);
-    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
-    expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
-    expect(mocks.isBlocked).toHaveBeenCalledWith('1.2.3.4');
-    expect(mocks.limit).toHaveBeenCalledTimes(1);
-    expect(mocks.validateEmoji).not.toHaveBeenCalled();
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe(
+      'authenticated'
+    );
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('600');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('users-me');
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 600,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:users-me:authenticated:get:minute'
+    );
+    expect(mocks.ratelimitPrefixes).not.toContain(
+      'proxy:test:api:users-me:authenticated:t1:get:minute'
+    );
+    const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
+    expect(limiterId.startsWith('session:')).toBe(true);
   });
 
-  it('uses local rate limits when the Redis rate limiter is unreachable', async () => {
+  it('uses the authenticated workspace read policy for verified dashboard reads', async () => {
     vi.stubEnv('NODE_ENV', 'production');
-    vi.stubEnv(
-      'UPSTASH_REDIS_REST_URL',
-      'https://resolved-kingfish-21146.upstash.io'
-    );
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
     mocks.redis.mockReturnValue({});
     mocks.extractIp.mockReturnValue('1.2.3.4');
     mocks.isBlocked.mockResolvedValue(null);
-    mocks.limit.mockRejectedValueOnce(new TypeError('fetch failed'));
-    mocks.validateEmoji.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number; verified: true }>();
+      const sessionKey = keys.find((key) => key.startsWith('session:'));
+      if (sessionKey) {
+        map.set(sessionKey, { m: 1, verified: true });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 600,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
 
     const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
       await import('../api-proxy-guard.js');
     clearApiProxyGuardLimiterCache();
 
-    const options = {
-      prefixBase: 'proxy:test:api',
-      routePolicies: singleReadRoutePolicies(),
-    };
-
     const response = await guardApiProxyRequest(
-      makeRequest('/api/test', 'GET'),
-      options
+      makeRequest('/api/v1/workspaces/ws-1/dashboard/bootstrap', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+      }),
+      { prefixBase: 'proxy:test:api' }
     );
 
-    expect(response).toBeNull();
-    expect(mocks.limit).toHaveBeenCalledTimes(1);
-
-    const blockedResponse = await guardApiProxyRequest(
-      makeRequest('/api/test', 'GET'),
-      options
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe(
+      'authenticated'
     );
-
-    expect(blockedResponse?.status).toBe(429);
-    expect(blockedResponse?.headers.get('X-Proxy-Block-Reason')).toBe(
-      'route-rate-limit'
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe(
+      'workspace-dashboard-read'
     );
-    expect(blockedResponse?.headers.get('X-RateLimit-Policy')).toBe(
-      'redis-fallback-test'
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:workspace-dashboard-read:authenticated:get:minute'
     );
-    expect(mocks.limit).toHaveBeenCalledTimes(1);
+    const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
+    expect(limiterId.startsWith('session:')).toBe(true);
   });
 
-  it('uses local rate limits when Redis client initialization fails', async () => {
+  it('uses authenticated default read limits for verified sessions on generic reads', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
-    mocks.redis.mockImplementation(() => {
-      throw new TypeError('Redis unavailable');
-    });
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
     mocks.extractIp.mockReturnValue('1.2.3.4');
     mocks.isBlocked.mockResolvedValue(null);
-    mocks.validateEmoji.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number; verified: true }>();
+      const sessionKey = keys.find((key) => key.startsWith('session:'));
+      if (sessionKey) {
+        map.set(sessionKey, { m: 1, verified: true });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 600,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
 
     const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
       await import('../api-proxy-guard.js');
     clearApiProxyGuardLimiterCache();
 
-    const options = {
-      prefixBase: 'proxy:test:api',
-      routePolicies: singleReadRoutePolicies(),
-    };
-
     const response = await guardApiProxyRequest(
-      makeRequest('/api/test', 'GET'),
-      options
+      makeRequest('/api/v1/unknown/read-only-dashboard-fragment', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+      }),
+      { prefixBase: 'proxy:test:api' }
     );
 
-    expect(response).toBeNull();
-
-    const blockedResponse = await guardApiProxyRequest(
-      makeRequest('/api/test', 'GET'),
-      options
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe(
+      'authenticated'
     );
-
-    expect(blockedResponse?.status).toBe(429);
-    expect(blockedResponse?.headers.get('X-Proxy-Block-Reason')).toBe(
-      'route-rate-limit'
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('600');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:default:authenticated:get:minute'
     );
-    expect(mocks.limit).not.toHaveBeenCalled();
+    expect(mocks.ratelimitPrefixes).not.toContain(
+      'proxy:test:api:default:authenticated:t1:get:minute'
+    );
+    const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
+    expect(limiterId.startsWith('session:')).toBe(true);
   });
 
-  it('rate limits anonymous users/me reads', async () => {
+  it('covers legacy workspace reads with the verified workspace dashboard policy', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
     mocks.redis.mockReturnValue({});
     mocks.extractIp.mockReturnValue('1.2.3.4');
     mocks.isBlocked.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number; verified: true }>();
+      const sessionKey = keys.find((key) => key.startsWith('session:'));
+      if (sessionKey) {
+        map.set(sessionKey, { m: 1, verified: true });
+      }
+      return Promise.resolve(map);
+    });
     mocks.limit.mockResolvedValueOnce({
       success: false,
-      limit: 20,
+      limit: 600,
       remaining: 0,
       reset: Date.now() + 15_000,
     });
@@ -843,13 +1380,25 @@ describe('guardApiProxyRequest', () => {
     clearApiProxyGuardLimiterCache();
 
     const response = await guardApiProxyRequest(
-      makeRequest('/api/v1/users/me/configs/demo', 'GET'),
+      makeRequest('/api/workspaces/ws-1/settings', 'GET', {
+        cookie:
+          'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+      }),
       { prefixBase: 'proxy:test:api' }
     );
 
     expect(response?.status).toBe(429);
-    expect(response?.headers.get('X-RateLimit-Limit')).toBe('20');
-    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe(
+      'authenticated'
+    );
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe(
+      'workspace-dashboard-read'
+    );
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:workspace-dashboard-read:authenticated:get:minute'
+    );
+    const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
+    expect(limiterId.startsWith('session:')).toBe(true);
   });
 
   it('rate limits API client-looking bearer reads until route auth validates them', async () => {
@@ -1603,15 +2152,73 @@ describe('guardApiProxyRequest', () => {
       limit: 1800,
       window: '1 m',
     });
-    // Trusted traffic gets a tier-suffixed bucket.
+    // Trusted traffic gets an authenticated, tier-suffixed bucket.
     expect(mocks.ratelimitPrefixes).toContain(
-      'proxy:test:api:task-board-read:anonymous:t3:get:minute'
+      'proxy:test:api:task-board-read:authenticated:t3:get:minute'
     );
     // The limiter is keyed by the per-session subject key, not the shared IP.
     const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
     expect(limiterId.startsWith('session:')).toBe(true);
   });
 
+  it('keeps trusted-session mutation limits flat while using the session bucket', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      const map = new Map<string, { m: number }>();
+      const sessionKey = keys.find((key) => key.startsWith('session:'));
+      if (sessionKey) {
+        map.set(sessionKey, { m: 3 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 60,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest(
+        '/api/v1/workspaces/071e0fc7-9aa8-42d8-92e5-cc9b3aeec2f1/calendar/events/68e18a3a-c527-421e-8ac3-f8b846175622',
+        'DELETE',
+        {
+          cookie:
+            'sb-resolved-kingfish-21146-auth-token.0=base64-validvalue; theme=dark',
+        }
+      ),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe(
+      'authenticated'
+    );
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('60');
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 60,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:default:authenticated:mutate:minute'
+    );
+    expect(mocks.ratelimitPrefixes).not.toContain(
+      'proxy:test:api:default:authenticated:t3:mutate:minute'
+    );
+    const limiterId = mocks.limit.mock.calls[0]?.[0] as string;
+    expect(limiterId.startsWith('session:')).toBe(true);
+  });
+
   it('uplifts a trusted location per-IP without per-session keying', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -1656,6 +2263,56 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
   });
 
+  it('does not apply trusted-location read uplift to mutations', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    const receivedKeys: string[] = [];
+    mocks.getTrustEntries.mockImplementation((keys: string[]) => {
+      receivedKeys.push(...keys);
+      const map = new Map<string, { m: number }>();
+      const cidrKey = keys.find((key) => key.startsWith('cidr:'));
+      if (cidrKey) {
+        map.set(cidrKey, { m: 2 });
+      }
+      return Promise.resolve(map);
+    });
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 30,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/workspaces/ws-1/tasks', 'POST'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 30,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:default:anonymous:mutate:minute'
+    );
+    expect(mocks.ratelimitPrefixes).not.toContain(
+      'proxy:test:api:default:anonymous:t2:mutate:minute'
+    );
+    expect(receivedKeys.some((key) => key.startsWith('cidr:'))).toBe(false);
+    expect(mocks.limit).toHaveBeenCalledWith('ip:1.2.3.4');
+  });
+
   it('keeps a trusted location on per-IP keying even with an untrusted session cookie', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');