@usequark/quark-core 2.6.3 → 2.7.0

package/README.md

@@ -34,7 +34,10 @@ import {
 } from "@usequark/quark-core";
 ```
 
-All modules are re-exported from the package root. See JSDoc comments on each function for options and usage details.
+Most modules are re-exported from the package root, but not all: `locale`,
+`stripe`, `storage/s3`, `csrf-client`, and `testing` are **subpath-only** —
+import them from their subpath. See JSDoc comments on each function for options
+and usage details.
 
 ### Subpath exports
 
@@ -44,22 +47,26 @@ Every subpath in `packages/core/package.json` `exports`, verified against the fi
 
 | Subpath | Contents |
 |---|---|
-| `@usequark/quark-core` | everything below, re-exported from the root |
+| `@usequark/quark-core` | most modules re-exported from the root (exceptions listed below) |
 | `@usequark/quark-core/core` | errors, logger, validation, utils, pagination, csrf, rate limiter, file validation, db |
 | `@usequark/quark-core/auth` | auth config helpers + session guards |
 | `@usequark/quark-core/auth/middleware` | session guards only |
+| `@usequark/quark-core/csrf-client` | browser-side CSRF token helper (subpath-only) |
 | `@usequark/quark-core/db` | `createPrismaClient`, connection string, pool config, `pingDatabase()` |
 | `@usequark/quark-core/queue` | BullMQ queue and worker helpers |
 | `@usequark/quark-core/email` | `EmailProvider`, `registerEmailProvider`, `createEmailService` |
+| `@usequark/quark-core/email-templates` | `welcomeEmail`, `passwordResetEmail` templates |
 | `@usequark/quark-core/errors` | error classes only |
 | `@usequark/quark-core/health` | health check runners and default probes |
 | `@usequark/quark-core/metrics` | metrics registry and default instruments |
+| `@usequark/quark-core/multipart` | multipart form parsing |
+| `@usequark/quark-core/redis` | `resolveRedisConnection` and Redis helpers |
 | `@usequark/quark-core/storage` | local adapter, storage factory, key/URL helpers, `createS3Storage` |
-| `@usequark/quark-core/storage/s3` | S3 adapter only |
+| `@usequark/quark-core/storage/s3` | S3 adapter only (subpath-only) |
 | `@usequark/quark-core/sms` | SMS provider |
-| `@usequark/quark-core/stripe` | Stripe client + webhook helpers |
+| `@usequark/quark-core/stripe` | Stripe client + webhook helpers (subpath-only) |
 | `@usequark/quark-core/admin` | Prisma schema introspection helpers |
-| `@usequark/quark-core/locale` | locale helpers |
+| `@usequark/quark-core/locale` | locale helpers (subpath-only) |
 | `@usequark/quark-core/logger` | browser-safe logger |
 | `@usequark/quark-core/testing` | test factories, mocks, helpers |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-core",
-  "version": "2.6.3",
+  "version": "2.7.0",
   "description": "Core utilities for Quark apps: auth, BullMQ queues, Redis, email, storage, rate limiting, logging, and error handling",
   "keywords": [
     "quark",

package/src/csrf.test.js

@@ -153,7 +153,7 @@ test("CSRF Module", async (t) => {
 	await t.test("requireCsrfToken skips Bearer-authenticated requests", () => {
 		const request = mockRequest({
 			method: "POST",
-			url: "http://localhost/api/device/register",
+			url: "http://localhost/api/files",
 			headers: { authorization: "Bearer some-jwt-token" },
 		});
 

package/src/rate-limiter.js

@@ -99,7 +99,13 @@ class MemoryRateLimiter {
 class RedisRateLimiter {
 	constructor(redisClient, options = {}) {
 		this.redis = redisClient;
-		this.failOpen = options.failOpen ?? true;
+		// Fails CLOSED by default: if Redis errors mid-request, the request is
+		// treated as rate-limited rather than allowed through. A limiter that
+		// disables itself precisely when it is being hammered (the classic
+		// fail-open) is worst exactly when it matters. Opt back in with
+		// `failOpen: true` only if an outage-driven 429 is worse for you than
+		// an attacker-driven flood.
+		this.failOpen = options.failOpen ?? false;
 	}
 
 	/**

package/src/rate-limiter.test.js

@@ -127,4 +127,48 @@ test("Rate Limiter Module", async (t) => {
 		limiter.stopCleanup();
 		assert(limiter.cleanupInterval === null);
 	});
+
+	// A Redis-backed limiter that fails OPEN disables itself precisely when it
+	// is being hammered — Redis erroring under load is the moment an attacker
+	// most needs the limiter to hold. Default must be fail-CLOSED.
+	await t.test(
+		"Redis limiter fails CLOSED by default when Redis errors",
+		async () => {
+			const limiter = createRateLimiter({
+				type: "redis",
+				redisClient: {
+					eval: async () => {
+						throw new Error("redis down");
+					},
+				},
+			});
+
+			const result = await limiter.checkLimit("k", 100, 60000);
+			assert.strictEqual(
+				result.limited,
+				true,
+				"must block, not allow, on error",
+			);
+			assert.strictEqual(result.remaining, 0);
+		},
+	);
+
+	await t.test(
+		"Redis limiter can opt back into fail-open explicitly",
+		async () => {
+			const limiter = createRateLimiter({
+				type: "redis",
+				failOpen: true,
+				redisClient: {
+					eval: async () => {
+						throw new Error("redis down");
+					},
+				},
+			});
+
+			const result = await limiter.checkLimit("k", 100, 60000);
+			assert.strictEqual(result.limited, false);
+			assert.strictEqual(result.remaining, 100);
+		},
+	);
 });