@vorionsys/security 1.0.0

package/dist/api/middleware/webhook-verify.js

@@ -0,0 +1,366 @@
+/**
+ * Webhook Signature Verification Middleware
+ *
+ * Provides middleware for verifying inbound webhook signatures using HMAC-SHA256.
+ * Includes timestamp validation to prevent replay attacks.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../../common/logger.js';
+import { UnauthorizedError } from '../../common/errors.js';
+import { verifyWebhookSignature, SIGNATURE_HEADER, SIGNATURE_TIMESTAMP_HEADER, } from '../../intent/webhooks.js';
+const logger = createLogger({ component: 'webhook-verify-middleware' });
+/**
+ * Default timestamp tolerance in seconds (5 minutes)
+ */
+const DEFAULT_TIMESTAMP_TOLERANCE_SECONDS = 300;
+/**
+ * Extract raw body from request for signature verification.
+ *
+ * The signature is computed over the raw request body, so we need
+ * to preserve the exact bytes that were sent.
+ */
+function getRawBody(request) {
+    // Fastify stores raw body if configured with rawBody: true
+    // Otherwise, we stringify the parsed body
+    const rawBody = request.rawBody;
+    if (rawBody) {
+        return typeof rawBody === 'string'
+            ? rawBody
+            : rawBody.toString('utf8');
+    }
+    // Fallback: stringify the parsed body
+    // Note: This may not match the original if JSON formatting differs
+    if (request.body) {
+        return JSON.stringify(request.body);
+    }
+    return null;
+}
+/**
+ * Verify webhook signature from request headers.
+ *
+ * @param request - The Fastify request
+ * @param secret - The webhook secret
+ * @param toleranceSeconds - Maximum age of request in seconds
+ * @returns Verification result
+ */
+export function verifyRequestSignature(request, secret, toleranceSeconds = DEFAULT_TIMESTAMP_TOLERANCE_SECONDS) {
+    // Extract signature header
+    const signatureHeader = request.headers[SIGNATURE_HEADER.toLowerCase()];
+    const signature = Array.isArray(signatureHeader) ? signatureHeader[0] : signatureHeader;
+    if (!signature) {
+        return { valid: false, reason: 'Missing signature header' };
+    }
+    // Extract timestamp header
+    const timestampHeader = request.headers[SIGNATURE_TIMESTAMP_HEADER.toLowerCase()];
+    const timestampStr = Array.isArray(timestampHeader) ? timestampHeader[0] : timestampHeader;
+    if (!timestampStr) {
+        return { valid: false, reason: 'Missing timestamp header' };
+    }
+    const timestamp = parseInt(timestampStr, 10);
+    if (isNaN(timestamp)) {
+        return { valid: false, reason: 'Invalid timestamp format' };
+    }
+    // Get raw body for signature verification
+    const body = getRawBody(request);
+    if (!body) {
+        return { valid: false, reason: 'Missing request body' };
+    }
+    // Verify signature
+    const isValid = verifyWebhookSignature(body, signature, secret, timestamp, toleranceSeconds);
+    if (!isValid) {
+        // Check if timestamp is the issue (for better error messages)
+        const now = Math.floor(Date.now() / 1000);
+        if (Math.abs(now - timestamp) > toleranceSeconds) {
+            return {
+                valid: false,
+                reason: `Timestamp too old or in the future (tolerance: ${toleranceSeconds}s)`,
+                timestamp,
+            };
+        }
+        return { valid: false, reason: 'Invalid signature', timestamp };
+    }
+    return { valid: true, timestamp };
+}
+/**
+ * Create webhook signature verification middleware.
+ *
+ * This middleware verifies that incoming webhook requests have valid
+ * HMAC-SHA256 signatures and timestamps within tolerance.
+ *
+ * ## Usage
+ *
+ * ```typescript
+ * // Static secret
+ * fastify.register(webhookVerifyPlugin, {
+ *   secret: process.env.WEBHOOK_SECRET,
+ * });
+ *
+ * // Dynamic secret lookup
+ * fastify.register(webhookVerifyPlugin, {
+ *   secret: async (request) => {
+ *     const webhookId = request.params.id;
+ *     const webhook = await getWebhook(webhookId);
+ *     return webhook?.secret ?? null;
+ *   },
+ * });
+ * ```
+ *
+ * @param config - Verification configuration
+ * @returns Fastify preHandler hook
+ */
+export function createWebhookVerifyMiddleware(config) {
+    const { secret, timestampToleranceSeconds = DEFAULT_TIMESTAMP_TOLERANCE_SECONDS, allowUnsigned = false, errorMessage = 'Invalid webhook signature', onVerificationFailed, } = config;
+    return async function verifyWebhookSignatureMiddleware(request, reply) {
+        // Check if signature headers are present
+        const hasSignature = !!request.headers[SIGNATURE_HEADER.toLowerCase()];
+        if (!hasSignature) {
+            if (allowUnsigned) {
+                logger.debug({ requestId: request.id }, 'Webhook request without signature allowed (allowUnsigned=true)');
+                return;
+            }
+            logger.warn({ requestId: request.id }, 'Webhook request rejected: missing signature');
+            onVerificationFailed?.(request, 'Missing signature');
+            throw new UnauthorizedError(errorMessage, {
+                code: 'WEBHOOK_SIGNATURE_MISSING',
+                hint: `Include ${SIGNATURE_HEADER} and ${SIGNATURE_TIMESTAMP_HEADER} headers`,
+            });
+        }
+        // Resolve secret
+        let resolvedSecret;
+        if (typeof secret === 'function') {
+            try {
+                resolvedSecret = await secret(request);
+            }
+            catch (error) {
+                logger.error({ requestId: request.id, error }, 'Failed to resolve webhook secret');
+                throw new UnauthorizedError(errorMessage, {
+                    code: 'WEBHOOK_SECRET_RESOLUTION_FAILED',
+                });
+            }
+        }
+        else {
+            resolvedSecret = secret;
+        }
+        if (!resolvedSecret) {
+            logger.warn({ requestId: request.id }, 'Webhook request rejected: no secret configured');
+            onVerificationFailed?.(request, 'No secret configured');
+            throw new UnauthorizedError(errorMessage, {
+                code: 'WEBHOOK_SECRET_NOT_CONFIGURED',
+            });
+        }
+        // Verify signature
+        const result = verifyRequestSignature(request, resolvedSecret, timestampToleranceSeconds);
+        if (!result.valid) {
+            logger.warn({
+                requestId: request.id,
+                reason: result.reason,
+                timestamp: result.timestamp,
+            }, 'Webhook signature verification failed');
+            onVerificationFailed?.(request, result.reason ?? 'Unknown');
+            throw new UnauthorizedError(errorMessage, {
+                code: 'WEBHOOK_SIGNATURE_INVALID',
+                reason: result.reason,
+            });
+        }
+        logger.debug({ requestId: request.id, timestamp: result.timestamp }, 'Webhook signature verified successfully');
+    };
+}
+/**
+ * Fastify plugin for webhook signature verification.
+ *
+ * Registers the webhook verification middleware as a preHandler hook.
+ * Can be scoped to specific routes using Fastify's encapsulation.
+ *
+ * @example
+ * ```typescript
+ * // Apply to all routes in a scope
+ * fastify.register(async (scope) => {
+ *   await scope.register(webhookVerifyPlugin, {
+ *     secret: process.env.WEBHOOK_SECRET,
+ *   });
+ *
+ *   scope.post('/webhook', async (request, reply) => {
+ *     // Signature already verified
+ *     return { received: true };
+ *   });
+ * });
+ * ```
+ */
+export const webhookVerifyPlugin = async (fastify, options) => {
+    const middleware = createWebhookVerifyMiddleware(options);
+    fastify.addHook('preHandler', middleware);
+};
+/**
+ * Sample code for webhook signature verification.
+ *
+ * This is returned in API responses to help webhook consumers
+ * implement signature verification.
+ */
+export const WEBHOOK_VERIFICATION_SAMPLE_CODE = {
+    nodejs: `
+const crypto = require('crypto');
+
+function verifyWebhookSignature(payload, signature, secret, timestamp, toleranceSeconds = 300) {
+  // Check timestamp is within tolerance
+  const now = Math.floor(Date.now() / 1000);
+  if (Math.abs(now - timestamp) > toleranceSeconds) {
+    return false;
+  }
+
+  // Compute expected signature
+  const signedPayload = \`\${timestamp}.\${payload}\`;
+  const expectedSignature = 'v1=' + crypto
+    .createHmac('sha256', secret)
+    .update(signedPayload)
+    .digest('hex');
+
+  // Timing-safe comparison
+  try {
+    return crypto.timingSafeEqual(
+      Buffer.from(signature),
+      Buffer.from(expectedSignature)
+    );
+  } catch {
+    return false;
+  }
+}
+
+// Usage in Express/Node.js
+app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
+  const signature = req.headers['x-vorion-signature'];
+  const timestamp = parseInt(req.headers['x-vorion-timestamp'], 10);
+  const payload = req.body.toString();
+
+  if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET, timestamp)) {
+    return res.status(401).json({ error: 'Invalid signature' });
+  }
+
+  // Process webhook...
+  const event = JSON.parse(payload);
+  console.log('Received event:', event.eventType);
+
+  res.json({ received: true });
+});
+`.trim(),
+    python: `
+import hmac
+import hashlib
+import time
+
+def verify_webhook_signature(payload: str, signature: str, secret: str, timestamp: int, tolerance_seconds: int = 300) -> bool:
+    # Check timestamp is within tolerance
+    now = int(time.time())
+    if abs(now - timestamp) > tolerance_seconds:
+        return False
+
+    # Compute expected signature
+    signed_payload = f"{timestamp}.{payload}"
+    expected_signature = "v1=" + hmac.new(
+        secret.encode(),
+        signed_payload.encode(),
+        hashlib.sha256
+    ).hexdigest()
+
+    # Timing-safe comparison
+    return hmac.compare_digest(signature, expected_signature)
+
+# Usage in Flask
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+@app.route('/webhook', methods=['POST'])
+def handle_webhook():
+    signature = request.headers.get('X-Vorion-Signature')
+    timestamp = int(request.headers.get('X-Vorion-Timestamp', 0))
+    payload = request.get_data(as_text=True)
+
+    if not verify_webhook_signature(payload, signature, os.environ['WEBHOOK_SECRET'], timestamp):
+        return jsonify({'error': 'Invalid signature'}), 401
+
+    # Process webhook...
+    event = request.json
+    print(f"Received event: {event['eventType']}")
+
+    return jsonify({'received': True})
+`.trim(),
+    go: `
+package main
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"time"
+)
+
+func verifyWebhookSignature(payload, signature, secret string, timestamp int64, toleranceSeconds int64) bool {
+	// Check timestamp is within tolerance
+	now := time.Now().Unix()
+	if abs(now-timestamp) > toleranceSeconds {
+		return false
+	}
+
+	// Compute expected signature
+	signedPayload := fmt.Sprintf("%d.%s", timestamp, payload)
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write([]byte(signedPayload))
+	expectedSignature := "v1=" + hex.EncodeToString(mac.Sum(nil))
+
+	// Timing-safe comparison
+	return hmac.Equal([]byte(signature), []byte(expectedSignature))
+}
+
+func webhookHandler(w http.ResponseWriter, r *http.Request) {
+	signature := r.Header.Get("X-Vorion-Signature")
+	timestampStr := r.Header.Get("X-Vorion-Timestamp")
+	timestamp, _ := strconv.ParseInt(timestampStr, 10, 64)
+
+	body, _ := io.ReadAll(r.Body)
+	payload := string(body)
+
+	if !verifyWebhookSignature(payload, signature, os.Getenv("WEBHOOK_SECRET"), timestamp, 300) {
+		http.Error(w, "Invalid signature", http.StatusUnauthorized)
+		return
+	}
+
+	// Process webhook...
+	w.Header().Set("Content-Type", "application/json")
+	w.Write([]byte(\`{"received": true}\`))
+}
+`.trim(),
+};
+/**
+ * Get verification documentation for webhook responses.
+ */
+export function getWebhookSecurityDocumentation() {
+    return {
+        headers: [
+            {
+                name: SIGNATURE_HEADER,
+                description: 'HMAC-SHA256 signature in format "v1=<hex-signature>"',
+            },
+            {
+                name: SIGNATURE_TIMESTAMP_HEADER,
+                description: 'Unix timestamp (seconds) when the request was generated',
+            },
+        ],
+        algorithm: 'HMAC-SHA256',
+        signatureFormat: 'v1=<hex-encoded-hmac>',
+        verificationSteps: [
+            '1. Extract timestamp from X-Vorion-Timestamp header',
+            '2. Verify timestamp is within 5 minutes of current time',
+            '3. Construct signed payload: "{timestamp}.{raw-body}"',
+            '4. Compute HMAC-SHA256 of signed payload using your webhook secret',
+            '5. Compare computed signature with X-Vorion-Signature header (use timing-safe comparison)',
+        ],
+        sampleCode: WEBHOOK_VERIFICATION_SAMPLE_CODE,
+    };
+}
+export { SIGNATURE_HEADER, SIGNATURE_TIMESTAMP_HEADER, } from '../../intent/webhooks.js';
+//# sourceMappingURL=webhook-verify.js.map

package/dist/api/middleware/webhook-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verify.js","sourceRoot":"","sources":["../../../src/api/middleware/webhook-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EAEtB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;AAExE;;GAEG;AACH,MAAM,mCAAmC,GAAG,GAAG,CAAC;AA4ChD;;;;;GAKG;AACH,SAAS,UAAU,CAAC,OAAuB;IACzC,2DAA2D;IAC3D,0CAA0C;IAC1C,MAAM,OAAO,GAAI,OAAoD,CAAC,OAAO,CAAC;IAC9E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,OAAO,KAAK,QAAQ;YAChC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,sCAAsC;IACtC,mEAAmE;IACnE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAuB,EACvB,MAAc,EACd,mBAA2B,mCAAmC;IAE9D,2BAA2B;IAC3B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAExF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IAED,2BAA2B;IAC3B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,WAAW,EAAE,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAE3F,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IAED,0CAA0C;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1D,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAE7F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,8DAA8D;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,gBAAgB,EAAE,CAAC;YACjD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kDAAkD,gBAAgB,IAAI;gBAC9E,SAAS;aACV,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA2B;IACvE,MAAM,EACJ,MAAM,EACN,yBAAyB,GAAG,mCAAmC,EAC/D,aAAa,GAAG,KAAK,EACrB,YAAY,GAAG,2BAA2B,EAC1C,oBAAoB,GACrB,GAAG,MAAM,CAAC;IAEX,OAAO,KAAK,UAAU,gCAAgC,CACpD,OAAuB,EACvB,KAAmB;QAEnB,yCAAyC;QACzC,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EACzB,gEAAgE,CACjE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EACzB,6CAA6C,CAC9C,CAAC;YAEF,oBAAoB,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAErD,MAAM,IAAI,iBAAiB,CAAC,YAAY,EAAE;gBACxC,IAAI,EAAE,2BAA2B;gBACjC,IAAI,EAAE,WAAW,gBAAgB,QAAQ,0BAA0B,UAAU;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,IAAI,cAA6B,CAAC;QAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,EAChC,kCAAkC,CACnC,CAAC;gBACF,MAAM,IAAI,iBAAiB,CAAC,YAAY,EAAE;oBACxC,IAAI,EAAE,kCAAkC;iBACzC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,MAAM,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EACzB,gDAAgD,CACjD,CAAC;YACF,oBAAoB,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YACxD,MAAM,IAAI,iBAAiB,CAAC,YAAY,EAAE;gBACxC,IAAI,EAAE,+BAA+B;aACtC,CAAC,CAAC;QACL,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC;QAE1F,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CACT;gBACE,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,EACD,uCAAuC,CACxC,CAAC;YAEF,oBAAoB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;YAE5D,MAAM,IAAI,iBAAiB,CAAC,YAAY,EAAE;gBACxC,IAAI,EAAE,2BAA2B;gBACjC,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EACtD,yCAAyC,CAC1C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA4C,KAAK,EAC/E,OAAO,EACP,OAAO,EACP,EAAE;IACF,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CT,CAAC,IAAI,EAAE;IAEN,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCT,CAAC,IAAI,EAAE;IAEN,EAAE,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDL,CAAC,IAAI,EAAE;CACP,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,+BAA+B;IAO7C,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,sDAAsD;aACpE;YACD;gBACE,IAAI,EAAE,0BAA0B;gBAChC,WAAW,EAAE,yDAAyD;aACvE;SACF;QACD,SAAS,EAAE,aAAa;QACxB,eAAe,EAAE,uBAAuB;QACxC,iBAAiB,EAAE;YACjB,qDAAqD;YACrD,yDAAyD;YACzD,uDAAuD;YACvD,oEAAoE;YACpE,2FAA2F;SAC5F;QACD,UAAU,EAAE,gCAAgC;KAC7C,CAAC;AACJ,CAAC;AAED,OAAO,EACL,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC"}

package/dist/api/rate-limit.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Per-Tenant Rate Limiting
+ *
+ * Provides tenant-scoped rate limiting with configurable limits per tier.
+ * Uses in-memory sliding window with Redis support for distributed deployments.
+ *
+ * @packageDocumentation
+ */
+import { FastifyRequest, FastifyReply } from 'fastify';
+/**
+ * Rate limit configuration per tier
+ */
+export interface TierLimits {
+    requestsPerMinute: number;
+    requestsPerHour: number;
+    burstLimit: number;
+}
+/**
+ * Default tier configurations
+ */
+export declare const DEFAULT_TIER_LIMITS: Record<string, TierLimits>;
+/**
+ * Rate limit result
+ */
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: {
+        minute: number;
+        hour: number;
+        burst: number;
+    };
+    resetAt: {
+        minute: number;
+        hour: number;
+        burst: number;
+    };
+    retryAfter?: number;
+}
+/**
+ * Per-Tenant Rate Limiter
+ */
+export declare class TenantRateLimiter {
+    private state;
+    private tierLimits;
+    private cleanupInterval;
+    constructor(tierLimits?: Record<string, TierLimits>);
+    /**
+     * Check and consume rate limit for a tenant
+     */
+    check(tenantId: string, tier?: string): RateLimitResult;
+    /**
+     * Get current state for a tenant (for monitoring)
+     */
+    getState(tenantId: string): {
+        tier: string;
+        usage: {
+            second: number;
+            minute: number;
+            hour: number;
+        };
+        limits: TierLimits;
+    } | null;
+    /**
+     * Reset rate limit for a tenant
+     */
+    reset(tenantId: string): void;
+    /**
+     * Update tier limits
+     */
+    setTierLimits(tier: string, limits: TierLimits): void;
+    /**
+     * Create initial state for a tenant
+     */
+    private createInitialState;
+    /**
+     * Reset expired windows
+     */
+    private resetExpiredWindows;
+    /**
+     * Start periodic cleanup of stale entries
+     */
+    private startCleanup;
+    /**
+     * Stop the rate limiter
+     */
+    stop(): void;
+    /**
+     * Get statistics
+     */
+    getStats(): {
+        activeTenants: number;
+        byTier: Record<string, number>;
+    };
+}
+/**
+ * Get the rate limiter singleton
+ */
+export declare function getRateLimiter(): TenantRateLimiter;
+/**
+ * Create rate limit middleware for Fastify
+ */
+export declare function createRateLimitMiddleware(options?: {
+    tierLimits?: Record<string, TierLimits>;
+    getTier?: (request: FastifyRequest) => string;
+    skip?: (request: FastifyRequest) => boolean;
+}): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Rate limit decorator for specific routes
+ */
+export declare function withRateLimit(customLimits?: Partial<TierLimits>): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Stop the rate limiter singleton and cleanup route-specific limiters
+ */
+export declare function stopRateLimiter(): void;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/api/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/api/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAqB1D,CAAC;AAoBF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,eAAe,CAA+B;gBAE1C,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAuB;IAKxE;;OAEG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,MAAe,GAAG,eAAe;IAwE/D;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QACxD,MAAM,EAAE,UAAU,CAAC;KACpB,GAAG,IAAI;IAiBR;;OAEG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAK7B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IAKrD;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAsBpB;;OAEG;IACH,IAAI,IAAI,IAAI;IAOZ;;OAEG;IACH,QAAQ,IAAI;QACV,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC;CAYF;AAKD;;GAEG;AACH,wBAAgB,cAAc,IAAI,iBAAiB,CAKlD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;CAC7C,IAae,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAwC3E;AAMD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,YAAY,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,IAEpB,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CA4D3E;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAWtC"}