@vibesdotdev/kit 0.0.0-stage → 1.0.0-rc.4

package/dist/lib/server/middleware/rate-limiter.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Rate limiting middleware for vibeskit
+ *
+ * Uses the token bucket implementations from server/rate-limit.ts
+ * with Redis backing for distributed rate limiting.
+ *
+ * IMPORTANT — Cloudflare Workers isolation model:
+ * The rate limiter stores state in process-memory Maps. On CF Workers, each
+ * isolate has its own address space, so rate limits are per-isolate, NOT
+ * globally consistent. A determined attacker distributing requests across
+ * multiple edge locations will effectively get N × limit requests. For
+ * auth-sensitive endpoints (sign-in, sign-up, forgot-password), consider
+ * supplementing with Cloudflare's zone-level Rate Limiting product or
+ * Durable Objects for consistent per-user state.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import type { RequestEvent } from '@sveltejs/kit';
+import type { RateLimitConfig } from '../../types';
+/**
+ * Internal-identity rate-limit exemption.
+ *
+ * Vibes staff / superusers are exempt from rate limiting. This is the same
+ * "Vibes staff (cross-tenant)" tier that `admin-scope.ts` gates on: the
+ * `staff` / `isSuperuser` flags are set *exclusively* by auth-web's signed JWT
+ * `definePayload`, verified against the auth origin's JWKS by the session
+ * handle, so a client cannot forge them.
+ *
+ * The exemption only ever applies to an ALREADY-AUTHENTICATED principal —
+ * `event.locals.user` is populated by the session handle *after* JWKS verify,
+ * and worker-to-worker calls forward the user's JWT as `Authorization: Bearer`
+ * so the principal (including `staff`/`isSuperuser`) is preserved. Anonymous /
+ * pre-auth requests have `locals.user == null` and are never exempt, so
+ * brute-force protection on sign-in / password-reset endpoints is unaffected.
+ *
+ * Exported so callers with their own limiter path (e.g. an app hook that
+ * constructs `RateLimitError` directly) can honor the same policy.
+ */
+export declare function isRateLimitExemptIdentity(event: RequestEvent): boolean;
+/**
+ * Rate limit error with proper response format
+ */
+export declare class RateLimitError extends CapabilityError {
+    remaining: number;
+    resetTime: Date;
+    retryAfter: number;
+    constructor(remaining: number, resetTime: Date, retryAfter: number);
+    toResponse(): Response;
+}
+/** The verdict of a rate-limit check or consume. */
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    resetTime: Date;
+    retryAfter?: number;
+}
+/**
+ * Rate limiter class using token buckets with Redis storage
+ */
+export declare class VibesRateLimiter {
+    private perMinuteLimiters;
+    private perHourLimiters;
+    private lastCleanupAt;
+    /**
+     * Check if request is allowed under rate limits
+     */
+    check(key: string, config: RateLimitConfig): RateLimitResult;
+    /**
+     * Consume rate limit tokens
+     */
+    consume(key: string, config: RateLimitConfig, cost?: number): RateLimitResult;
+    /**
+     * Reset rate limits for a specific key
+     */
+    reset(key: string): void;
+    private maybeCleanup;
+    /**
+     * Get or create minute-based limiter
+     */
+    private getOrCreateMinuteLimiter;
+    /**
+     * Get or create hour-based limiter.
+     *
+     * Spread `rph` tokens evenly across the hour: one token every
+     * `ceil(3600 / rph)` seconds (floored to at least 1s). A prior bug used a
+     * fixed 36s interval (≈100 tokens/hour after the initial burst) and then
+     * reported `retryAfter: 3600` when empty — owners waiting an hour for a
+     * refill that arrives in seconds. Capacity remains `rph` for short bursts.
+     */
+    private getOrCreateHourLimiter;
+    /**
+     * Clean up old limiters to prevent memory leaks
+     */
+    private cleanup;
+}
+/**
+ * Shared rate limiter instance.
+ *
+ * This stays safe for Cloudflare Workers because construction is now side-effect free.
+ */
+export declare const globalRateLimiter: VibesRateLimiter;
+/**
+ * Apply rate limiting middleware
+ */
+export declare function applyRateLimit(event: RequestEvent, config: RateLimitConfig): Promise<void>;
+/**
+ * Rate limiting utilities
+ */
+export declare const rateLimitUtils: {
+    /**
+     * Check rate limit without consuming
+     */
+    check(key: string, config: RateLimitConfig): RateLimitResult;
+    /**
+     * Reset rate limits for a key
+     */
+    reset(key: string): void;
+    /**
+     * Get rate limit status for debugging
+     */
+    getStatus(event: RequestEvent, config: RateLimitConfig): RateLimitResult;
+};

package/dist/lib/server/middleware/rate-limiter.js

@@ -0,0 +1,436 @@
+/**
+ * Rate limiting middleware for vibeskit
+ *
+ * Uses the token bucket implementations from server/rate-limit.ts
+ * with Redis backing for distributed rate limiting.
+ *
+ * IMPORTANT — Cloudflare Workers isolation model:
+ * The rate limiter stores state in process-memory Maps. On CF Workers, each
+ * isolate has its own address space, so rate limits are per-isolate, NOT
+ * globally consistent. A determined attacker distributing requests across
+ * multiple edge locations will effectively get N × limit requests. For
+ * auth-sensitive endpoints (sign-in, sign-up, forgot-password), consider
+ * supplementing with Cloudflare's zone-level Rate Limiting product or
+ * Durable Objects for consistent per-user state.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { settleNow } from '../../attempt.js';
+import { ExpiringTokenBucket, RefillingTokenBucket } from '../../utils/buckets';
+// Redis cache connection not used directly here
+import { getClientIp } from '../../utils/client-ip';
+import { getVibesKit } from '../../instance';
+import { kitLogger } from '../../kit-logger';
+import { asVibesKitLocals } from '../locals.js';
+import { DEV } from 'esm-env';
+const isDevelopmentEnvironment = () => DEV;
+const DEV_RATE_LIMIT_REMAINING = Number.MAX_SAFE_INTEGER.toString();
+const applyDevelopmentBypassHeaders = (event) => {
+    const kit = getVibesKit();
+    const logger = kit.config.services?.logger;
+    const reset = Math.floor(Date.now() / 1000).toString();
+    event.setHeaders({
+        'X-RateLimit-Limit': DEV_RATE_LIMIT_REMAINING,
+        'X-RateLimit-Remaining': DEV_RATE_LIMIT_REMAINING,
+        'X-RateLimit-Reset': reset
+    });
+    logger?.debug('Skipping rate limit enforcement in development', {
+        path: event.url.pathname,
+        category: 'rate-limiting'
+    });
+};
+/**
+ * Internal-identity rate-limit exemption.
+ *
+ * Vibes staff / superusers are exempt from rate limiting. This is the same
+ * "Vibes staff (cross-tenant)" tier that `admin-scope.ts` gates on: the
+ * `staff` / `isSuperuser` flags are set *exclusively* by auth-web's signed JWT
+ * `definePayload`, verified against the auth origin's JWKS by the session
+ * handle, so a client cannot forge them.
+ *
+ * The exemption only ever applies to an ALREADY-AUTHENTICATED principal —
+ * `event.locals.user` is populated by the session handle *after* JWKS verify,
+ * and worker-to-worker calls forward the user's JWT as `Authorization: Bearer`
+ * so the principal (including `staff`/`isSuperuser`) is preserved. Anonymous /
+ * pre-auth requests have `locals.user == null` and are never exempt, so
+ * brute-force protection on sign-in / password-reset endpoints is unaffected.
+ *
+ * Exported so callers with their own limiter path (e.g. an app hook that
+ * constructs `RateLimitError` directly) can honor the same policy.
+ */
+export function isRateLimitExemptIdentity(event) {
+    const user = asVibesKitLocals(event.locals).user;
+    if (!user)
+        return false;
+    return user.staff === true || user.isSuperuser === true;
+}
+const applyExemptIdentityHeaders = (event) => {
+    const kit = getVibesKit();
+    const logger = kit.config.services?.logger;
+    const reset = Math.floor(Date.now() / 1000).toString();
+    event.setHeaders({
+        'X-RateLimit-Limit': DEV_RATE_LIMIT_REMAINING,
+        'X-RateLimit-Remaining': DEV_RATE_LIMIT_REMAINING,
+        'X-RateLimit-Reset': reset
+    });
+    logger?.debug('Skipping rate limit enforcement for internal identity', {
+        path: event.url.pathname,
+        userId: asVibesKitLocals(event.locals).user?.id,
+        category: 'rate-limiting'
+    });
+};
+/**
+ * Rate limit error with proper response format
+ */
+export class RateLimitError extends CapabilityError {
+    remaining;
+    resetTime;
+    retryAfter;
+    constructor(remaining, resetTime, retryAfter) {
+        super(`Rate limit exceeded. Try again in ${retryAfter} seconds.`, 'RATE_LIMITED', {
+            reason: 'rate-limit-exceeded',
+            details: { retryAfterSeconds: retryAfter }
+        });
+        this.remaining = remaining;
+        this.resetTime = resetTime;
+        this.retryAfter = retryAfter;
+        this.name = 'RateLimitError';
+    }
+    toResponse() {
+        return new Response(JSON.stringify({
+            error: 'Rate limit exceeded',
+            message: this.message,
+            retryAfter: this.retryAfter
+        }), {
+            status: 429,
+            headers: {
+                'Content-Type': 'application/json',
+                'Retry-After': this.retryAfter.toString(),
+                'X-RateLimit-Limit': '0',
+                'X-RateLimit-Remaining': this.remaining.toString(),
+                'X-RateLimit-Reset': Math.floor(this.resetTime.getTime() / 1000).toString()
+            }
+        });
+    }
+}
+/**
+ * Rate limiter class using token buckets with Redis storage
+ */
+export class VibesRateLimiter {
+    perMinuteLimiters = new Map();
+    perHourLimiters = new Map();
+    lastCleanupAt = 0;
+    /**
+     * Check if request is allowed under rate limits
+     */
+    check(key, config) {
+        this.maybeCleanup();
+        const { rpm, rph } = config;
+        let minRemaining = Infinity;
+        let earliestReset = new Date(Date.now() + 60000); // Default 1 minute
+        // Check per-minute limit
+        if (rpm) {
+            const minuteLimiter = this.getOrCreateMinuteLimiter(key, rpm);
+            const minuteAllowed = minuteLimiter.check(key, 1);
+            if (!minuteAllowed) {
+                return {
+                    allowed: false,
+                    remaining: 0,
+                    resetTime: new Date(Date.now() + 60000),
+                    retryAfter: 60
+                };
+            }
+            // Calculate remaining for this limiter
+            const bucket = minuteLimiter['storage'].get(key);
+            if (bucket) {
+                minRemaining = Math.min(minRemaining, bucket.count);
+            }
+        }
+        // Check per-hour limit
+        if (rph) {
+            const hourLimiter = this.getOrCreateHourLimiter(key, rph);
+            const hourAllowed = hourLimiter.check(key, 1);
+            if (!hourAllowed) {
+                const refillSeconds = hourLimiter.refillIntervalSeconds;
+                return {
+                    allowed: false,
+                    remaining: 0,
+                    resetTime: new Date(Date.now() + refillSeconds * 1000),
+                    // Wait for the next token, not a full calendar hour.
+                    retryAfter: refillSeconds
+                };
+            }
+            // Calculate remaining for this limiter
+            const bucket = hourLimiter['storage'].get(key);
+            if (bucket) {
+                minRemaining = Math.min(minRemaining, bucket.count);
+                // Calculate reset time based on refill rate
+                const refillSeconds = hourLimiter.refillIntervalSeconds;
+                const nextRefill = new Date(bucket.refilledAt + refillSeconds * 1000);
+                if (nextRefill < earliestReset) {
+                    earliestReset = nextRefill;
+                }
+            }
+        }
+        return {
+            allowed: true,
+            remaining: minRemaining === Infinity ? 1000 : Math.floor(minRemaining),
+            resetTime: earliestReset
+        };
+    }
+    /**
+     * Consume rate limit tokens
+     */
+    consume(key, config, cost = 1) {
+        this.maybeCleanup();
+        const { rpm, rph } = config;
+        let minRemaining = Infinity;
+        let earliestReset = new Date(Date.now() + 60000);
+        // Consume from per-minute limit
+        if (rpm) {
+            const minuteLimiter = this.getOrCreateMinuteLimiter(key, rpm);
+            const consumed = minuteLimiter.consume(key, cost);
+            if (!consumed) {
+                return {
+                    allowed: false,
+                    remaining: 0,
+                    resetTime: new Date(Date.now() + 60000),
+                    retryAfter: 60
+                };
+            }
+            // Get remaining count
+            const bucket = minuteLimiter['storage'].get(key);
+            if (bucket) {
+                minRemaining = Math.min(minRemaining, bucket.count);
+            }
+        }
+        // Consume from per-hour limit
+        if (rph) {
+            const hourLimiter = this.getOrCreateHourLimiter(key, rph);
+            const consumed = hourLimiter.consume(key, cost);
+            if (!consumed) {
+                // Refund the minute limiter if hour limit failed
+                if (rpm) {
+                    const minuteLimiter = this.getOrCreateMinuteLimiter(key, rpm);
+                    const bucket = minuteLimiter['storage'].get(key);
+                    if (bucket) {
+                        bucket.count += cost; // Refund
+                    }
+                }
+                const refillSeconds = hourLimiter.refillIntervalSeconds;
+                return {
+                    allowed: false,
+                    remaining: 0,
+                    resetTime: new Date(Date.now() + refillSeconds * 1000),
+                    retryAfter: refillSeconds
+                };
+            }
+            // Get remaining count
+            const bucket = hourLimiter['storage'].get(key);
+            if (bucket) {
+                minRemaining = Math.min(minRemaining, bucket.count);
+                const refillSeconds = hourLimiter.refillIntervalSeconds;
+                const nextRefill = new Date(bucket.refilledAt + refillSeconds * 1000);
+                if (nextRefill < earliestReset) {
+                    earliestReset = nextRefill;
+                }
+            }
+        }
+        return {
+            allowed: true,
+            remaining: minRemaining === Infinity ? 1000 : Math.floor(minRemaining),
+            resetTime: earliestReset
+        };
+    }
+    /**
+     * Reset rate limits for a specific key
+     */
+    reset(key) {
+        this.maybeCleanup();
+        // Reset across all limiters
+        for (const limiter of this.perMinuteLimiters.values()) {
+            limiter.reset(key);
+        }
+        for (const limiter of this.perHourLimiters.values()) {
+            limiter.reset(key);
+        }
+    }
+    maybeCleanup(now = Date.now()) {
+        const cleanupIntervalMs = 5 * 60 * 1000;
+        if (now - this.lastCleanupAt < cleanupIntervalMs) {
+            return;
+        }
+        this.lastCleanupAt = now;
+        this.cleanup();
+    }
+    /**
+     * Get or create minute-based limiter
+     */
+    getOrCreateMinuteLimiter(key, rpm) {
+        const limiterKey = `rpm_${rpm}`;
+        let limiter = this.perMinuteLimiters.get(limiterKey);
+        if (!limiter) {
+            limiter = new ExpiringTokenBucket(rpm, 60); // 60 seconds
+            this.perMinuteLimiters.set(limiterKey, limiter);
+        }
+        return limiter;
+    }
+    /**
+     * Get or create hour-based limiter.
+     *
+     * Spread `rph` tokens evenly across the hour: one token every
+     * `ceil(3600 / rph)` seconds (floored to at least 1s). A prior bug used a
+     * fixed 36s interval (≈100 tokens/hour after the initial burst) and then
+     * reported `retryAfter: 3600` when empty — owners waiting an hour for a
+     * refill that arrives in seconds. Capacity remains `rph` for short bursts.
+     */
+    getOrCreateHourLimiter(_key, rph) {
+        const safeRph = Math.max(1, Math.floor(rph));
+        const refillIntervalSeconds = Math.max(1, Math.ceil(3600 / safeRph));
+        const limiterKey = `rph_${safeRph}_${refillIntervalSeconds}`;
+        let limiter = this.perHourLimiters.get(limiterKey);
+        if (!limiter) {
+            limiter = new RefillingTokenBucket(safeRph, refillIntervalSeconds);
+            this.perHourLimiters.set(limiterKey, limiter);
+        }
+        return limiter;
+    }
+    /**
+     * Clean up old limiters to prevent memory leaks
+     */
+    cleanup() {
+        // This is a simple cleanup - in production you'd want more sophisticated logic
+        // For now, we keep limiters alive since they're shared across requests
+        // kitLogger is a null-safe no-op until the kit is initialized
+        kitLogger('rate-limiter').debug('Rate limiter cleanup completed', {
+            perMinuteLimiters: this.perMinuteLimiters.size,
+            perHourLimiters: this.perHourLimiters.size,
+            category: 'rate-limiting'
+        });
+    }
+}
+/**
+ * Shared rate limiter instance.
+ *
+ * This stays safe for Cloudflare Workers because construction is now side-effect free.
+ */
+export const globalRateLimiter = new VibesRateLimiter();
+/**
+ * Authenticated principals own this platform. Hour buckets falsely locked owners
+ * (retryAfter: 3600 with a refill that arrives in seconds) and blocked forge
+ * land. For any already-authenticated user, drop the hour dimension and keep
+ * only the per-minute burst guard when one is configured. Pre-auth / anonymous
+ * traffic still sees full rpm+rph (sign-in brute-force protection).
+ */
+function effectiveConfigForEvent(event, config) {
+    const user = asVibesKitLocals(event.locals).user;
+    if (!user?.id)
+        return config;
+    if (!config.rph)
+        return config;
+    const { rph: _drop, ...rest } = config;
+    // Authed without rpm: no residual limit (session/JWT already gates abuse).
+    if (!rest.rpm) {
+        return { rpm: undefined, rph: undefined, key: config.key };
+    }
+    return rest;
+}
+/**
+ * Apply rate limiting middleware
+ */
+export async function applyRateLimit(event, config) {
+    const effective = effectiveConfigForEvent(event, config);
+    if (!effective.rpm && !effective.rph) {
+        return; // No rate limiting configured (or fully waived for authed)
+    }
+    if (isDevelopmentEnvironment()) {
+        applyDevelopmentBypassHeaders(event);
+        return;
+    }
+    // Internal identities (Vibes staff / superusers) bypass rate limiting.
+    // See isRateLimitExemptIdentity: authenticated-only, JWT-signed flags,
+    // so this never weakens pre-auth brute-force protection.
+    if (isRateLimitExemptIdentity(event)) {
+        applyExemptIdentityHeaders(event);
+        return;
+    }
+    // Generate rate limit key
+    const key = effective.key ? effective.key(event) : generateDefaultKey(event, effective);
+    const kit = getVibesKit();
+    const logger = kit.config.services?.logger;
+    // The limiter's verdict: a refusal to throw, or null to proceed.
+    const outcome = settleNow(() => {
+        const result = globalRateLimiter.consume(key, effective);
+        if (!result.allowed) {
+            logger?.warn('Rate limit exceeded', {
+                key,
+                rpm: effective.rpm,
+                rph: effective.rph,
+                path: event.url.pathname,
+                category: 'rate-limiting'
+            });
+            return new RateLimitError(result.remaining, result.resetTime, result.retryAfter || 60);
+        }
+        // Add rate limit headers to response
+        event.setHeaders({
+            'X-RateLimit-Limit': String(effective.rpm ?? effective.rph ?? 0),
+            'X-RateLimit-Remaining': result.remaining.toString(),
+            'X-RateLimit-Reset': Math.floor(result.resetTime.getTime() / 1000).toString()
+        });
+        logger?.debug('Rate limit check passed', {
+            key,
+            remaining: result.remaining,
+            resetTime: result.resetTime.toISOString(),
+            category: 'rate-limiting'
+        });
+        return null;
+    });
+    if (!outcome.ok) {
+        logger?.error('Rate limiting error', outcome.error instanceof Error ? outcome.error : new Error(String(outcome.error)), {
+            key,
+            config: { rpm: effective.rpm, rph: effective.rph, identifier: effective.identifier },
+            category: 'rate-limiting'
+        });
+        // Don't fail open for rate limiting - that defeats the purpose
+        throw new RateLimitError(0, new Date(Date.now() + 60000), 60);
+    }
+    if (outcome.value) {
+        throw outcome.value;
+    }
+}
+/**
+ * Generate default rate limit key
+ */
+function generateDefaultKey(event, _config) {
+    // Priority order: user ID > IP address
+    const userId = asVibesKitLocals(event.locals).user?.id;
+    if (userId) {
+        return `user:${userId}`;
+    }
+    const ip = getClientIp(event);
+    return `ip:${ip}`;
+}
+/**
+ * Rate limiting utilities
+ */
+export const rateLimitUtils = {
+    /**
+     * Check rate limit without consuming
+     */
+    check(key, config) {
+        return globalRateLimiter.check(key, config);
+    },
+    /**
+     * Reset rate limits for a key
+     */
+    reset(key) {
+        return globalRateLimiter.reset(key);
+    },
+    /**
+     * Get rate limit status for debugging
+     */
+    getStatus(event, config) {
+        const effective = effectiveConfigForEvent(event, config);
+        const key = effective.key ? effective.key(event) : generateDefaultKey(event, effective);
+        return globalRateLimiter.check(key, effective);
+    }
+};