@vorionsys/platform-core 0.1.0

package/dist/api/middleware/index.js

@@ -0,0 +1,43 @@
+/**
+ * API Middleware Barrel Export
+ *
+ * Exports all middleware components for API hardening:
+ * - Validation middleware (Zod-based input validation)
+ * - Rate limiting middleware (per-tenant and per-endpoint)
+ * - Security middleware (headers, request ID, logging)
+ * - API key enforcement middleware (API key auth with JWT integration)
+ * - DPoP enforcement middleware (sender-constrained tokens per RFC 9449)
+ *
+ * @packageDocumentation
+ */
+// Validation middleware
+export { validateBody, validateQuery, validateParams, validateRequest, registerValidationPlugin, } from './validation.js';
+// Rate limiting middleware
+export { rateLimit, rateLimitPerTenant, rateLimitByMethod, registerRateLimitPlugin, getRateLimitStore, resetRateLimitStore, getRateLimitStats, resetTenantRateLimit, } from './rateLimit.js';
+// Security middleware
+export { securityHeaders, requestIdInjection, requestLogging, combinedSecurityMiddleware, registerSecurityPlugin, maskSensitiveData, timingSafeEqual, } from './security.js';
+// Security headers middleware (CSP, SRI, etc.)
+export { securityHeadersMiddleware, swaggerSecurityHeaders, applySecurityHeaders, registerSecurityHeadersPlugin, generateNonce, generateSriHash, verifySriHash, buildCspHeader, getEnvironmentCsp, generateSriHashForFile, DEFAULT_SECURITY_HEADERS, DEFAULT_API_CSP, SWAGGER_UI_CSP, ENVIRONMENT_CSP_CONFIG, } from './security-headers.js';
+// API key enforcement middleware
+export { apiKeyEnforcementPlugin, createRouteAuth, requireApiKeyAuth, requireJwtOrApiKey, 
+// Re-exports from api-keys middleware
+apiKeyMiddleware, requireScopes, getApiKey, hasApiKey, getApiKeyTenantId, } from './api-key-enforcement.js';
+// DPoP enforcement middleware
+export { dpopEnforcementPlugin, dpopRequired, dpopOptional, dpopNone, requireDPoP, optionalDPoP, hasDPoPProof, getDPoPKeyThumbprint, getDPoPContext, dpopValidationFailed, 
+// Re-exports from DPoP service
+DPoPService, DPoPError, createDPoPService, } from './dpop-enforcement.js';
+// Redis-backed distributed rate limiting
+export { RedisRateLimiter, createRateLimiter, redisRateLimitPlugin, redisRateLimitPerUser, redisRateLimitPerIp, redisRateLimitPerTenant, getRedisRateLimiter, resetRedisRateLimiter, } from './redis-rate-limiter.js';
+// API metrics middleware
+export { metricsMiddleware, createApiTimer, } from './metrics.js';
+// Webhook signature verification middleware
+export { createWebhookVerifyMiddleware, webhookVerifyPlugin, verifyRequestSignature, getWebhookSecurityDocumentation, WEBHOOK_VERIFICATION_SAMPLE_CODE, SIGNATURE_HEADER, SIGNATURE_TIMESTAMP_HEADER, } from './webhook-verify.js';
+// Comprehensive rate limits
+export { rateLimitsPlugin, comprehensiveRateLimit, createEndpointRateLimit, getRateLimitStatus, getUserRateLimitStore, resetUserRateLimitStore, rateLimitConfig, defaultMultipliers, RATE_LIMIT_BYPASS_PERMISSION, } from './rate-limits.js';
+// Audit middleware
+export { 
+// Factory and plugin
+createAuditMiddleware, auditMiddlewarePlugin, 
+// Route decorators
+withAudit, captureBeforeState, recordAuditEvent, recordAccessDeniedEvent, MUTATION_METHODS, } from './audit.js';
+//# sourceMappingURL=index.js.map

package/dist/api/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,wBAAwB;AACxB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,eAAe,EACf,wBAAwB,GAKzB,MAAM,iBAAiB,CAAC;AAEzB,2BAA2B;AAC3B,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,GAIrB,MAAM,gBAAgB,CAAC;AAExB,sBAAsB;AACtB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,GAMhB,MAAM,eAAe,CAAC;AAEvB,+CAA+C;AAC/C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,6BAA6B,EAC7B,aAAa,EACb,eAAe,EACf,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,sBAAsB,GAKvB,MAAM,uBAAuB,CAAC;AAE/B,iCAAiC;AACjC,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,kBAAkB;AAClB,sCAAsC;AACtC,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,SAAS,EACT,iBAAiB,GAKlB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,oBAAoB;AACpB,+BAA+B;AAC/B,WAAW,EACX,SAAS,EACT,iBAAiB,GAUlB,MAAM,uBAAuB,CAAC;AAE/B,yCAAyC;AACzC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GAQtB,MAAM,yBAAyB,CAAC;AAEjC,yBAAyB;AACzB,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,cAAc,CAAC;AAEtB,4CAA4C;AAC5C,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,+BAA+B,EAC/B,gCAAgC,EAChC,gBAAgB,EAChB,0BAA0B,GAG3B,MAAM,qBAAqB,CAAC;AAE7B,4BAA4B;AAC5B,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,4BAA4B,GAM7B,MAAM,kBAAkB,CAAC;AAE1B,mBAAmB;AACnB,OAAO;AACL,qBAAqB;AACrB,qBAAqB,EACrB,qBAAqB;AAErB,mBAAmB;AACnB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EAMvB,gBAAgB,GAEjB,MAAM,YAAY,CAAC"}

package/dist/api/middleware/metrics.d.ts

@@ -0,0 +1,41 @@
+/**
+ * API Metrics Middleware
+ *
+ * Fastify plugin for collecting API request metrics including:
+ * - Request duration
+ * - Request/response sizes
+ * - Error rates
+ * - Active requests tracking
+ *
+ * @packageDocumentation
+ */
+import { FastifyInstance, FastifyRequest } from 'fastify';
+/**
+ * Configuration options for the metrics middleware
+ */
+export interface MetricsMiddlewareOptions {
+    /** Routes to exclude from metrics collection (e.g., /health, /metrics) */
+    excludeRoutes?: string[];
+    /** Whether to collect request body size metrics */
+    collectRequestSize?: boolean;
+    /** Whether to collect response body size metrics */
+    collectResponseSize?: boolean;
+    /** Custom route normalizer function to reduce cardinality */
+    normalizeRoute?: (request: FastifyRequest) => string;
+}
+/**
+ * Fastify plugin for API metrics collection
+ */
+declare function metricsMiddlewarePlugin(fastify: FastifyInstance, options: MetricsMiddlewareOptions): Promise<void>;
+/**
+ * Export as Fastify plugin
+ */
+export declare const metricsMiddleware: typeof metricsMiddlewarePlugin;
+/**
+ * Create metrics tracking timer for manual instrumentation
+ */
+export declare function createApiTimer(method: string, route: string): {
+    stop: (statusCode: number) => void;
+};
+export {};
+//# sourceMappingURL=metrics.d.ts.map

package/dist/api/middleware/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAgB,MAAM,SAAS,CAAC;AAgBxE;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,mDAAmD;IACnD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CACtD;AA8BD;;GAEG;AACH,iBAAe,uBAAuB,CACpC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CAiHf;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,gCAG5B,CAAC;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ;IAAE,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,CAcxC"}

package/dist/api/middleware/metrics.js

@@ -0,0 +1,150 @@
+/**
+ * API Metrics Middleware
+ *
+ * Fastify plugin for collecting API request metrics including:
+ * - Request duration
+ * - Request/response sizes
+ * - Error rates
+ * - Active requests tracking
+ *
+ * @packageDocumentation
+ */
+import fp from 'fastify-plugin';
+import { apiRequestDurationSeconds, apiRequestsTotal, apiRequestSizeBytes, apiResponseSizeBytes, apiActiveRequestsGauge, apiErrorsTotal, requestLatencyPercentiles, recordApiRequestMetric, } from '../../common/metrics.js';
+import { createLogger } from '../../common/logger.js';
+const logger = createLogger({ component: 'api-metrics' });
+const DEFAULT_EXCLUDE_ROUTES = ['/health', '/ready', '/live', '/metrics'];
+/**
+ * Normalize a route URL to reduce metric cardinality
+ * Replaces UUID and numeric path parameters with placeholders
+ */
+function defaultNormalizeRoute(request) {
+    // Use the route schema URL if available (pre-defined route pattern)
+    const routeSchema = request.routeOptions?.url;
+    if (routeSchema) {
+        return routeSchema;
+    }
+    // Fallback: normalize the actual URL
+    let url = request.url.split('?')[0] || request.url;
+    // Replace UUIDs with :id placeholder
+    url = url.replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, ':id');
+    // Replace numeric IDs with :id placeholder
+    url = url.replace(/\/\d+(?=\/|$)/g, '/:id');
+    return url;
+}
+/**
+ * Fastify plugin for API metrics collection
+ */
+async function metricsMiddlewarePlugin(fastify, options) {
+    const excludeRoutes = new Set([
+        ...DEFAULT_EXCLUDE_ROUTES,
+        ...(options.excludeRoutes ?? []),
+    ]);
+    const collectRequestSize = options.collectRequestSize ?? true;
+    const collectResponseSize = options.collectResponseSize ?? true;
+    const normalizeRoute = options.normalizeRoute ?? defaultNormalizeRoute;
+    // Track request start time and active requests
+    fastify.addHook('onRequest', async (request) => {
+        const route = normalizeRoute(request);
+        // Skip excluded routes
+        if (excludeRoutes.has(route)) {
+            return;
+        }
+        // Store start time for duration calculation
+        request.metricsStartTime = process.hrtime.bigint();
+        // Increment active requests
+        apiActiveRequestsGauge.inc({ method: request.method, route });
+        // Record request size if available and enabled
+        if (collectRequestSize && request.headers['content-length']) {
+            const requestSize = parseInt(request.headers['content-length'], 10);
+            if (!isNaN(requestSize)) {
+                apiRequestSizeBytes.observe({ method: request.method, route }, requestSize);
+            }
+        }
+    });
+    // Record metrics on response
+    fastify.addHook('onResponse', async (request, reply) => {
+        const route = normalizeRoute(request);
+        // Skip excluded routes
+        if (excludeRoutes.has(route)) {
+            return;
+        }
+        const startTime = request.metricsStartTime;
+        if (!startTime) {
+            return;
+        }
+        // Calculate duration in seconds
+        const endTime = process.hrtime.bigint();
+        const durationNs = Number(endTime - startTime);
+        const durationSeconds = durationNs / 1e9;
+        const method = request.method;
+        const statusCode = reply.statusCode.toString();
+        // Record request metrics
+        const labels = { method, route, status_code: statusCode };
+        apiRequestsTotal.inc(labels);
+        apiRequestDurationSeconds.observe(labels, durationSeconds);
+        requestLatencyPercentiles.observe({ service: 'api' }, durationSeconds);
+        // Decrement active requests
+        apiActiveRequestsGauge.dec({ method, route });
+        // Record response size if available and enabled
+        if (collectResponseSize) {
+            const responseSize = reply.getHeader('content-length');
+            if (responseSize) {
+                const size = typeof responseSize === 'string' ? parseInt(responseSize, 10) : responseSize;
+                if (typeof size === 'number' && !isNaN(size)) {
+                    apiResponseSizeBytes.observe(labels, size);
+                }
+            }
+        }
+        // Log slow requests for debugging
+        if (durationSeconds > 5) {
+            logger.warn({
+                method,
+                route,
+                statusCode,
+                durationMs: Math.round(durationSeconds * 1000),
+            }, 'Slow API request detected');
+        }
+    });
+    // Record errors
+    fastify.addHook('onError', async (request, reply, error) => {
+        const route = normalizeRoute(request);
+        // Skip excluded routes
+        if (excludeRoutes.has(route)) {
+            return;
+        }
+        const errorCode = error.code ?? 'UNKNOWN';
+        const errorType = error.name ?? 'Error';
+        apiErrorsTotal.inc({
+            method: request.method,
+            route,
+            error_code: errorCode,
+            error_type: errorType,
+        });
+    });
+    logger.info({ excludeRoutes: Array.from(excludeRoutes) }, 'API metrics middleware initialized');
+}
+/**
+ * Export as Fastify plugin
+ */
+export const metricsMiddleware = fp(metricsMiddlewarePlugin, {
+    name: 'vorion-api-metrics',
+    fastify: '>=4.x',
+});
+/**
+ * Create metrics tracking timer for manual instrumentation
+ */
+export function createApiTimer(method, route) {
+    const startTime = process.hrtime.bigint();
+    apiActiveRequestsGauge.inc({ method, route });
+    return {
+        stop: (statusCode) => {
+            const endTime = process.hrtime.bigint();
+            const durationNs = Number(endTime - startTime);
+            const durationSeconds = durationNs / 1e9;
+            recordApiRequestMetric(method, route, statusCode, durationSeconds);
+            apiActiveRequestsGauge.dec({ method, route });
+        },
+    };
+}
+//# sourceMappingURL=metrics.js.map

package/dist/api/middleware/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../../src/api/middleware/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;AAgB1D,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAE1E;;;GAGG;AACH,SAAS,qBAAqB,CAAC,OAAuB;IACpD,oEAAoE;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;IAC9C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC;IAEnD,qCAAqC;IACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,gEAAgE,EAChE,KAAK,CACN,CAAC;IAEF,2CAA2C;IAC3C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAE5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAAwB,EACxB,OAAiC;IAEjC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,GAAG,sBAAsB;QACzB,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAC9D,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAChE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;IAEvE,+CAA+C;IAC/C,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAEtC,uBAAuB;QACvB,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,4CAA4C;QAC3C,OAAmD,CAAC,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAEhG,4BAA4B;QAC5B,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9D,+CAA+C;QAC/C,IAAI,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxB,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACnF,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAEtC,uBAAuB;QACvB,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAI,OAAoD,CAAC,gBAAgB,CAAC;QACzF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,UAAU,GAAG,GAAG,CAAC;QAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAE/C,yBAAyB;QACzB,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QAC1D,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC3D,yBAAyB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;QAEvE,4BAA4B;QAC5B,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9C,gDAAgD;QAChD,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACvD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;gBAC1F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM;gBACN,KAAK;gBACL,UAAU;gBACV,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;aAC/C,EACD,2BAA2B,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAChB,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,KAAY,EAAE,EAAE;QAC9F,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAEtC,uBAAuB;QACvB,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAI,KAA2B,CAAC,IAAI,IAAI,SAAS,CAAC;QACjE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;QAExC,cAAc,CAAC,GAAG,CAAC;YACjB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK;YACL,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACT,EAAE,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAC5C,oCAAoC,CACrC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC,uBAAuB,EAAE;IAC3D,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,KAAa;IAEb,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1C,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9C,OAAO;QACL,IAAI,EAAE,CAAC,UAAkB,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;YAC/C,MAAM,eAAe,GAAG,UAAU,GAAG,GAAG,CAAC;YAEzC,sBAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;YACnE,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/api/middleware/rate-limits.d.ts

@@ -0,0 +1,224 @@
+/**
+ * Comprehensive Rate Limit Configuration
+ *
+ * Provides route-specific rate limiting for sensitive endpoints with:
+ * - Per-user rate limiting (tracks by user ID, not just IP)
+ * - Different limits for authenticated vs anonymous users
+ * - Higher limits for admin users
+ * - Internal service bypass capability
+ * - Standard rate limit headers (X-RateLimit-*)
+ * - Audit logging for bypass usage
+ *
+ * @packageDocumentation
+ */
+import type { FastifyRequest, FastifyReply, FastifyPluginAsync } from 'fastify';
+/**
+ * Rate limit configuration for an endpoint
+ */
+export interface EndpointRateLimitConfig {
+    /** Maximum requests allowed in the window */
+    max: number;
+    /** Time window in seconds */
+    windowSeconds: number;
+}
+/**
+ * User type for rate limiting multipliers
+ */
+export type UserType = 'anonymous' | 'authenticated' | 'admin' | 'service';
+/**
+ * Multipliers for different user types
+ */
+export interface RateLimitMultipliers {
+    anonymous: number;
+    authenticated: number;
+    admin: number;
+    service: number;
+}
+/**
+ * Rate limit check result
+ */
+export interface RateLimitStatus {
+    /** Route pattern */
+    route: string;
+    /** Maximum requests allowed */
+    limit: number;
+    /** Remaining requests in window */
+    remaining: number;
+    /** Unix timestamp when window resets */
+    resetAt: number;
+    /** Seconds until reset */
+    resetInSeconds: number;
+    /** User type applied */
+    userType: UserType;
+    /** Whether rate limit was bypassed */
+    bypassed: boolean;
+}
+/**
+ * Rate limit window entry
+ */
+interface WindowEntry {
+    count: number;
+    resetAt: number;
+}
+/**
+ * Rate limit configuration for sensitive endpoints.
+ *
+ * Format: 'METHOD /path' -> { max, windowSeconds }
+ *
+ * These limits are for authenticated users. Anonymous users get 50% of these limits.
+ * Admin users get 200% of these limits. Service accounts can bypass if authorized.
+ */
+export declare const rateLimitConfig: Record<string, EndpointRateLimitConfig>;
+/**
+ * Default rate limit multipliers for different user types
+ */
+export declare const defaultMultipliers: RateLimitMultipliers;
+/**
+ * Permission required to bypass rate limits
+ */
+export declare const RATE_LIMIT_BYPASS_PERMISSION = "rate_limit:bypass";
+/**
+ * In-memory rate limit store for per-user tracking
+ */
+declare class UserRateLimitStore {
+    private windows;
+    private cleanupInterval;
+    private readonly maxSize;
+    constructor();
+    /**
+     * Generate a unique key for user + route
+     */
+    private generateKey;
+    /**
+     * Check rate limit for a user on a specific route
+     */
+    check(userId: string, route: string, limit: number, windowSeconds: number): {
+        allowed: boolean;
+        current: number;
+        limit: number;
+        remaining: number;
+        resetAt: number;
+        resetInSeconds: number;
+    };
+    /**
+     * Peek at current state without incrementing
+     */
+    peek(userId: string, route: string, limit: number): {
+        current: number;
+        limit: number;
+        remaining: number;
+        resetAt: number;
+        resetInSeconds: number;
+    } | null;
+    /**
+     * Get all rate limit statuses for a user
+     */
+    getUserStatuses(userId: string): Map<string, WindowEntry>;
+    /**
+     * Evict oldest entries (LRU-style)
+     */
+    private evictOldestEntries;
+    /**
+     * Cleanup expired entries
+     */
+    private cleanup;
+    /**
+     * Get statistics
+     */
+    getStats(): {
+        activeKeys: number;
+        maxSize: number;
+    };
+    /**
+     * Stop cleanup timer
+     */
+    stop(): void;
+}
+/**
+ * Get the global user rate limit store
+ */
+export declare function getUserRateLimitStore(): UserRateLimitStore;
+/**
+ * Reset the global store (for testing)
+ */
+export declare function resetUserRateLimitStore(): void;
+/**
+ * Create comprehensive rate limiting middleware
+ *
+ * This middleware:
+ * 1. Looks up route-specific rate limits from configuration
+ * 2. Applies user-type multipliers (anonymous, authenticated, admin)
+ * 3. Checks for bypass permissions (service accounts)
+ * 4. Sets standard rate limit headers
+ * 5. Returns 429 with Retry-After on limit exceeded
+ *
+ * @example
+ * ```typescript
+ * server.post('/api/v1/intents', {
+ *   preHandler: comprehensiveRateLimit(),
+ * }, handler);
+ * ```
+ */
+export declare function comprehensiveRateLimit(options?: {
+    /** Custom rate limit config (overrides default) */
+    config?: Record<string, EndpointRateLimitConfig>;
+    /** Custom multipliers (overrides default) */
+    multipliers?: Partial<RateLimitMultipliers>;
+    /** Skip rate limiting for certain conditions */
+    skip?: (request: FastifyRequest) => boolean;
+}): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Create rate limit preHandler for a specific endpoint configuration
+ *
+ * @example
+ * ```typescript
+ * server.post('/custom-endpoint', {
+ *   preHandler: createEndpointRateLimit({ max: 10, windowSeconds: 60 }),
+ * }, handler);
+ * ```
+ */
+export declare function createEndpointRateLimit(config: EndpointRateLimitConfig, options?: {
+    /** Custom multipliers */
+    multipliers?: Partial<RateLimitMultipliers>;
+    /** Route pattern for tracking (defaults to request URL) */
+    routePattern?: string;
+}): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Get current user's rate limit status across all configured endpoints
+ */
+export declare function getRateLimitStatus(request: FastifyRequest): Promise<{
+    user: {
+        id: string;
+        type: UserType;
+        canBypass: boolean;
+    };
+    limits: RateLimitStatus[];
+    storeStats: {
+        activeKeys: number;
+        maxSize: number;
+    };
+}>;
+/**
+ * Plugin options
+ */
+export interface RateLimitsPluginOptions {
+    /** Skip rate limiting for certain paths */
+    skipPaths?: string[];
+    /** Custom rate limit config */
+    config?: Record<string, EndpointRateLimitConfig>;
+    /** Custom multipliers */
+    multipliers?: Partial<RateLimitMultipliers>;
+}
+/**
+ * Comprehensive Rate Limits Plugin
+ */
+export declare const rateLimitsPlugin: FastifyPluginAsync<RateLimitsPluginOptions>;
+declare module 'fastify' {
+    interface FastifyInstance {
+        vorionComprehensiveRateLimit: ReturnType<typeof comprehensiveRateLimit>;
+        vorionCreateEndpointRateLimit: typeof createEndpointRateLimit;
+        vorionGetRateLimitStatus: typeof getRateLimitStatus;
+    }
+}
+export default rateLimitsPlugin;
+//# sourceMappingURL=rate-limits.d.ts.map

package/dist/api/middleware/rate-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limits.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/rate-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAmB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAgBjG;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,QAAQ,EAAE,QAAQ,CAAC;IACnB,sCAAsC;IACtC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,UAAU,WAAW;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CA6DnE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,oBAKhC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,4BAA4B,sBAAsB,CAAC;AAMhE;;GAEG;AACH,cAAM,kBAAkB;IACtB,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;;IAO1C;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,KAAK,CACH,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB;QACD,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;KACxB;IAwCD;;OAEG;IACH,IAAI,CACF,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ;QACD,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI;IAyBR;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC;IAczD;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,OAAO;IASf;;OAEG;IACH,QAAQ,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAOnD;;OAEG;IACH,IAAI,IAAI,IAAI;CAOb;AAKD;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,kBAAkB,CAK1D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAK9C;AA4PD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAC/C,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACjD,6CAA6C;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5C,gDAAgD;IAChD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;CAC7C,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CA6IlE;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE;IACR,yBAAyB;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5C,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CA8CjE;AAMD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IACT,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,UAAU,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,CAAC,CA6CD;AAMD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACjD,yBAAyB;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC7C;AAmFD;;GAEG;AACH,eAAO,MAAM,gBAAgB,6CAG3B,CAAC;AAGH,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,4BAA4B,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;QACxE,6BAA6B,EAAE,OAAO,uBAAuB,CAAC;QAC9D,wBAAwB,EAAE,OAAO,kBAAkB,CAAC;KACrD;CACF;AAED,eAAe,gBAAgB,CAAC"}