@usequark/quark-core 2.6.4 → 2.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-core",
-  "version": "2.6.4",
+  "version": "2.7.0",
   "description": "Core utilities for Quark apps: auth, BullMQ queues, Redis, email, storage, rate limiting, logging, and error handling",
   "keywords": [
     "quark",

package/src/rate-limiter.js

@@ -99,7 +99,13 @@ class MemoryRateLimiter {
 class RedisRateLimiter {
 	constructor(redisClient, options = {}) {
 		this.redis = redisClient;
-		this.failOpen = options.failOpen ?? true;
+		// Fails CLOSED by default: if Redis errors mid-request, the request is
+		// treated as rate-limited rather than allowed through. A limiter that
+		// disables itself precisely when it is being hammered (the classic
+		// fail-open) is worst exactly when it matters. Opt back in with
+		// `failOpen: true` only if an outage-driven 429 is worse for you than
+		// an attacker-driven flood.
+		this.failOpen = options.failOpen ?? false;
 	}
 
 	/**

package/src/rate-limiter.test.js

@@ -127,4 +127,48 @@ test("Rate Limiter Module", async (t) => {
 		limiter.stopCleanup();
 		assert(limiter.cleanupInterval === null);
 	});
+
+	// A Redis-backed limiter that fails OPEN disables itself precisely when it
+	// is being hammered — Redis erroring under load is the moment an attacker
+	// most needs the limiter to hold. Default must be fail-CLOSED.
+	await t.test(
+		"Redis limiter fails CLOSED by default when Redis errors",
+		async () => {
+			const limiter = createRateLimiter({
+				type: "redis",
+				redisClient: {
+					eval: async () => {
+						throw new Error("redis down");
+					},
+				},
+			});
+
+			const result = await limiter.checkLimit("k", 100, 60000);
+			assert.strictEqual(
+				result.limited,
+				true,
+				"must block, not allow, on error",
+			);
+			assert.strictEqual(result.remaining, 0);
+		},
+	);
+
+	await t.test(
+		"Redis limiter can opt back into fail-open explicitly",
+		async () => {
+			const limiter = createRateLimiter({
+				type: "redis",
+				failOpen: true,
+				redisClient: {
+					eval: async () => {
+						throw new Error("redis down");
+					},
+				},
+			});
+
+			const result = await limiter.checkLimit("k", 100, 60000);
+			assert.strictEqual(result.limited, false);
+			assert.strictEqual(result.remaining, 100);
+		},
+	);
 });