@vsaas/loopback 12.1.0 → 12.2.0

package/dist/lib/rate-limit/limiter.cjs

@@ -0,0 +1,368 @@
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_errors = require("./errors.cjs");
+const require_subject = require("./subject.cjs");
+const require_config = require("./config.cjs");
+//#region src/lib/rate-limit/limiter.ts
+var limiter_exports = /* @__PURE__ */ require_runtime.__exportAll({
+	RateLimiter: () => RateLimiter,
+	RegisteredRateLimiter: () => RegisteredRateLimiter
+});
+function operationId() {
+	return crypto.randomBytes(16).toString("hex");
+}
+function validateResolvedRule(rule) {
+	require_subject.validateSafeIdentifier(rule.ruleId, "rule.ruleId");
+	require_subject.validateSafeIdentifier(rule.store, "rule.store");
+	require_subject.validateSafeIdentifier(rule.subjectKeyring, "rule.subjectKeyring");
+	require_subject.validateSafeIdentifier(rule.bucket, "rule.bucket");
+	require_subject.validateSafeIdentifier(rule.subject.namespace, "rule.subject.namespace");
+	require_subject.validateSafeIdentifier(rule.subject.scope, "rule.subject.scope");
+	require_subject.validateSafeIdentifier(rule.subject.subjectType, "rule.subject.subjectType");
+	require_config.validateRateLimitCost(rule.cost, Number.MAX_SAFE_INTEGER);
+	if (!/^[a-f0-9]{64}$/.test(rule.policy?.policyFingerprint || "")) throw require_errors.rateLimitConfigurationError("Rate limit policy fingerprint is invalid");
+	if (rule.onStoreError !== "allow" && rule.onStoreError !== "deny") throw require_errors.rateLimitConfigurationError("Rate limit store error mode is invalid");
+}
+function stableRules(rules) {
+	const phaseRank = {
+		early: 0,
+		resolved: 1,
+		domain: 2
+	};
+	return rules.map((rule, index) => ({
+		rule,
+		index
+	})).sort((left, right) => phaseRank[left.rule.phase] - phaseRank[right.rule.phase] || left.rule.order - right.rule.order || left.index - right.index).map(({ rule }) => rule);
+}
+var crypto, RateLimiter, RegisteredRateLimiter;
+var init_limiter = require_runtime.__esmMin((() => {
+	require_subject.init_subject();
+	require_config.init_config();
+	require_errors.init_errors();
+	crypto = require("crypto");
+	RateLimiter = class {
+		registry;
+		constructor(registry) {
+			this.registry = registry;
+		}
+		async inspect(rule) {
+			return this.execute(rule, "inspect");
+		}
+		async consume(rule) {
+			return this.execute(rule, "consume");
+		}
+		async inspectAll(rules) {
+			return this.executeAll(rules, "inspect");
+		}
+		async consumeAll(rules) {
+			return this.executeAll(rules, "consume");
+		}
+		async reset(rule, expectedRevision) {
+			try {
+				const store = await this.registry.resolveStore(rule.store);
+				const subject = await this.selectSubject(rule, store);
+				return await store.reset({
+					subject,
+					policy: rule.policy,
+					expectedRevision,
+					operationId: operationId()
+				});
+			} catch (error) {
+				if (rule.onStoreError === "allow") return {
+					resultVersion: 1,
+					policyFingerprint: rule.policy.policyFingerprint,
+					outcome: "not-found",
+					allowed: true,
+					revision: expectedRevision,
+					blockedUntilMs: null
+				};
+				throw require_errors.rateLimitUnavailableError(error);
+			}
+		}
+		async delete(rules) {
+			const byStore = /* @__PURE__ */ new Map();
+			for (const rule of rules) {
+				const keyring = this.registry.getKeyring(rule.subjectKeyring);
+				for (const keyId of Object.keys(keyring.keys)) {
+					const subject = require_subject.withBucket(require_subject.hashRateLimitSubject(rule.subject, keyring, keyId), rule.bucket, rule.policy.policyId, rule.policy.policyVersion);
+					const current = byStore.get(rule.store) || [];
+					current.push(subject);
+					byStore.set(rule.store, current);
+				}
+			}
+			await Promise.all(Array.from(byStore, async ([storeName, subjects]) => {
+				await (await this.registry.resolveStore(storeName)).delete({ subjects });
+			}));
+		}
+		async subjectIdentity(rule) {
+			const keyring = this.registry.getKeyring(rule.subjectKeyring);
+			const subject = require_subject.hashRateLimitSubject(rule.subject, keyring);
+			return crypto.createHash("sha256").update(JSON.stringify([
+				subject.namespace,
+				subject.scope,
+				subject.subjectType,
+				subject.subjectKeyId,
+				subject.subjectHash,
+				rule.bucket
+			])).digest("base64url");
+		}
+		async executeAll(rules, action) {
+			const decisions = [];
+			for (const rule of stableRules(rules)) {
+				const result = await this.execute(rule, action);
+				decisions.push(result);
+				if (!result.decision.allowed && rule.shortCircuitOnDeny) break;
+			}
+			const denied = decisions.filter(({ decision }) => !decision.allowed);
+			return {
+				allowed: denied.length === 0,
+				blockedUntilMs: denied.reduce((maximum, { decision }) => decision.blockedUntilMs == null ? maximum : Math.max(maximum || 0, decision.blockedUntilMs), null),
+				decisions
+			};
+		}
+		async execute(rule, action) {
+			validateResolvedRule(rule);
+			try {
+				const store = await this.registry.resolveStore(rule.store);
+				const subject = await this.selectSubject(rule, store);
+				const decision = action === "inspect" ? await store.inspect({
+					subject,
+					policy: rule.policy
+				}) : await store.consume({
+					subject,
+					policy: rule.policy,
+					cost: rule.cost,
+					operationId: operationId()
+				});
+				if (decision.policyFingerprint !== rule.policy.policyFingerprint) throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error("Rate limit decision policy mismatch"));
+				return {
+					ruleId: rule.ruleId,
+					decision
+				};
+			} catch (error) {
+				if (rule.onStoreError === "allow") return {
+					ruleId: rule.ruleId,
+					decision: {
+						resultVersion: 1,
+						policyFingerprint: rule.policy.policyFingerprint,
+						allowed: true,
+						revision: 0,
+						blockedUntilMs: null
+					}
+				};
+				throw require_errors.rateLimitUnavailableError(error);
+			}
+		}
+		async selectSubject(rule, store) {
+			const keyring = this.registry.getKeyring(rule.subjectKeyring);
+			const candidates = [];
+			for (const keyId of Object.keys(keyring.keys)) {
+				const subject = require_subject.withBucket(require_subject.hashRateLimitSubject(rule.subject, keyring, keyId), rule.bucket, rule.policy.policyId, rule.policy.policyVersion);
+				const decision = await store.inspect({
+					subject,
+					policy: rule.policy
+				});
+				if (decision.revision > 0) candidates.push({
+					subject,
+					decision
+				});
+			}
+			if (candidates.length > 1) throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error("Multiple subject-key candidates exist"));
+			if (candidates.length === 1) return candidates[0].subject;
+			return require_subject.withBucket(require_subject.hashRateLimitSubject(rule.subject, keyring), rule.bucket, rule.policy.policyId, rule.policy.policyVersion);
+		}
+	};
+	RegisteredRateLimiter = class {
+		limiter;
+		registry;
+		definitions = /* @__PURE__ */ new Map();
+		policyRevisions = /* @__PURE__ */ new Map();
+		maxBatchEntries = 1e3;
+		maxCostPerConsume = 1e5;
+		constructor(limiter, registry, options = {}) {
+			this.limiter = limiter;
+			this.registry = registry;
+			this.configureLimits(options);
+		}
+		configureLimits(options = {}) {
+			for (const [name, value] of Object.entries(options)) if (!Number.isSafeInteger(value) || Number(value) < 1) throw require_errors.rateLimitConfigurationError(`Rate limit ${name} must be a positive integer`);
+			if (options.maxBatchEntries != null) this.maxBatchEntries = options.maxBatchEntries;
+			if (options.maxCostPerConsume != null) this.maxCostPerConsume = options.maxCostPerConsume;
+		}
+		defineRule(definition) {
+			require_subject.validateSafeIdentifier(definition.id, "rule.id");
+			require_subject.validateSafeIdentifier(definition.bucket, "rule.bucket");
+			if (this.definitions.has(definition.id)) throw require_errors.rateLimitConfigurationError(`Rate limit rule ${definition.id} is already defined`);
+			if (definition.algorithm !== "fixed-window") throw require_errors.rateLimitConfigurationError("Registered rules currently support fixed-window");
+			if (typeof definition.subject !== "function") throw require_errors.rateLimitConfigurationError("Registered rule subject resolver is required");
+			const snapshot = {
+				...definition,
+				limit: typeof definition.limit === "function" ? definition.limit : Object.freeze({ ...definition.limit })
+			};
+			this.definitions.set(definition.id, Object.freeze(snapshot));
+		}
+		async inspect(ruleId, context) {
+			return this.executeOne(ruleId, context, "inspect");
+		}
+		async consume(ruleId, context) {
+			return this.executeOne(ruleId, context, "consume");
+		}
+		async enforce(ruleId, context) {
+			const result = await this.consume(ruleId, context);
+			if (!result.allowed) throw require_errors.rateLimitedError(result.blockedUntilMs);
+			return result;
+		}
+		async consumeBatch(ruleId, entries) {
+			if (!Array.isArray(entries)) throw require_errors.rateLimitConfigurationError("Rate limit batch entries must be an array");
+			if (!entries.length) return [];
+			if (entries.length > this.maxBatchEntries) throw require_errors.rateLimitConfigurationError("Rate limit batch exceeds maxBatchEntries");
+			const entryIds = /* @__PURE__ */ new Set();
+			for (const entry of entries) {
+				if (!entry || typeof entry.entryId !== "string" || entry.entryId.length < 1 || entry.entryId.length > 256 || entryIds.has(entry.entryId)) throw require_errors.rateLimitConfigurationError("Rate limit batch entryId is invalid or duplicated");
+				entryIds.add(entry.entryId);
+			}
+			const definition = this.getDefinition(ruleId);
+			const limitResults = await Promise.all(entries.map((entry) => this.resolveLimit(definition, entry.context)));
+			const resolutions = await Promise.all(entries.map(async (entry, index) => {
+				const limit = limitResults[index];
+				if (!limit) return { applied: false };
+				return this.resolveApplicable(definition, entry.context, limit);
+			}));
+			const groups = /* @__PURE__ */ new Map();
+			const subjectPolicies = /* @__PURE__ */ new Map();
+			for (let index = 0; index < resolutions.length; index++) {
+				const resolution = resolutions[index];
+				if (!resolution.applied) continue;
+				const rule = resolution.rule;
+				const identity = await this.limiter.subjectIdentity(rule);
+				const subjectIdentity = [
+					rule.store,
+					rule.subjectKeyring,
+					rule.subject.namespace,
+					rule.subject.scope,
+					rule.subject.subjectType,
+					rule.bucket,
+					identity
+				].join("|");
+				const previousFingerprint = subjectPolicies.get(subjectIdentity);
+				if (previousFingerprint && previousFingerprint !== rule.policy.policyFingerprint) throw require_errors.rateLimitConfigurationError("Same rate limit subject resolved incompatible policies in one batch");
+				subjectPolicies.set(subjectIdentity, rule.policy.policyFingerprint);
+				const groupKey = `${subjectIdentity}|${rule.policy.policyFingerprint}`;
+				const group = groups.get(groupKey);
+				if (group) {
+					group.cost = require_config.validateRateLimitCost(group.cost + rule.cost, this.maxCostPerConsume);
+					group.indexes.push(index);
+				} else groups.set(groupKey, {
+					rule: { ...rule },
+					indexes: [index],
+					cost: rule.cost
+				});
+			}
+			const decisions = /* @__PURE__ */ new Map();
+			await Promise.all(Array.from(groups.values(), async (group) => {
+				group.rule.cost = group.cost;
+				const result = await this.limiter.consume(group.rule);
+				for (const index of group.indexes) decisions.set(index, this.publicDecision(ruleId, result.decision));
+			}));
+			return entries.map((entry, index) => {
+				return {
+					...decisions.get(index) || {
+						ruleId,
+						applied: false,
+						allowed: true,
+						blockedUntilMs: null,
+						revision: 0
+					},
+					entryId: entry.entryId
+				};
+			});
+		}
+		async executeOne(ruleId, context, action) {
+			const resolution = await this.resolve(ruleId, context);
+			if (!resolution.applied) return {
+				ruleId,
+				applied: false,
+				allowed: true,
+				blockedUntilMs: null,
+				revision: 0
+			};
+			const result = action === "inspect" ? await this.limiter.inspect(resolution.rule) : await this.limiter.consume(resolution.rule);
+			return this.publicDecision(ruleId, result.decision);
+		}
+		async resolve(ruleId, context) {
+			const definition = this.getDefinition(ruleId);
+			const limit = await this.resolveLimit(definition, context);
+			if (!limit) return { applied: false };
+			return this.resolveApplicable(definition, context, limit);
+		}
+		async resolveApplicable(definition, context, limit) {
+			const subject = await definition.subject(context);
+			const rawCost = typeof definition.cost === "function" ? await definition.cost(context) : definition.cost || 1;
+			const cost = require_config.validateRateLimitCost(rawCost, this.maxCostPerConsume);
+			const stateTtlMs = limit.stateTtlMs || Math.min(31536e6, Math.max(limit.windowMs, limit.blockDurationMs || limit.windowMs) * 2);
+			const policy = require_config.normalizeFixedWindowPolicy({
+				policyId: definition.id,
+				policyVersion: String(limit.revision),
+				maxAttempts: limit.limit,
+				observationWindowMs: limit.windowMs,
+				blockDurationMs: limit.blockDurationMs || limit.windowMs,
+				stateTtlMs
+			});
+			const revisionKey = `${definition.id}\u0000${limit.revision}`;
+			const previousFingerprint = this.policyRevisions.get(revisionKey);
+			if (previousFingerprint && previousFingerprint !== policy.policyFingerprint) throw require_errors.rateLimitConfigurationError(`Rate limit rule ${definition.id} changed policy without changing revision`);
+			this.policyRevisions.set(revisionKey, policy.policyFingerprint);
+			return {
+				applied: true,
+				rule: {
+					ruleId: definition.id,
+					store: definition.store,
+					subjectKeyring: definition.subjectKeyring,
+					subject,
+					bucket: definition.bucket,
+					policy,
+					cost,
+					onStoreError: definition.onStoreError,
+					phase: definition.phase || "domain",
+					order: definition.order || 0,
+					shortCircuitOnDeny: definition.shortCircuitOnDeny === true
+				}
+			};
+		}
+		async resolveLimit(definition, context) {
+			const result = typeof definition.limit === "function" ? await definition.limit(context) : definition.limit;
+			if (result == null) return null;
+			if (typeof result !== "object" || typeof result.revision !== "string" || !result.revision) throw require_errors.rateLimitConfigurationError("Rate limit resolver returned an invalid limit");
+			return result;
+		}
+		getDefinition(ruleId) {
+			const definition = this.definitions.get(ruleId);
+			if (!definition) throw require_errors.rateLimitConfigurationError(`Rate limit rule ${ruleId} was not found`);
+			return definition;
+		}
+		publicDecision(ruleId, decision) {
+			return {
+				ruleId,
+				applied: true,
+				allowed: decision.allowed,
+				blockedUntilMs: decision.blockedUntilMs,
+				revision: decision.revision
+			};
+		}
+	};
+}));
+//#endregion
+init_limiter();
+exports.RateLimiter = RateLimiter;
+exports.RegisteredRateLimiter = RegisteredRateLimiter;
+Object.defineProperty(exports, "init_limiter", {
+	enumerable: true,
+	get: function() {
+		return init_limiter;
+	}
+});
+Object.defineProperty(exports, "limiter_exports", {
+	enumerable: true,
+	get: function() {
+		return limiter_exports;
+	}
+});

package/dist/lib/rate-limit/registry.cjs

@@ -0,0 +1,92 @@
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_errors = require("./errors.cjs");
+const require_subject = require("./subject.cjs");
+const require_persisted_model = require("./stores/persisted-model.cjs");
+//#region src/lib/rate-limit/registry.ts
+var registry_exports = /* @__PURE__ */ require_runtime.__exportAll({ RateLimitRegistry: () => RateLimitRegistry });
+var RateLimitRegistry;
+var init_registry = require_runtime.__esmMin((() => {
+	require_subject.init_subject();
+	require_errors.init_errors();
+	require_persisted_model.init_persisted_model();
+	RateLimitRegistry = class {
+		app;
+		factories = /* @__PURE__ */ new Map();
+		stores = /* @__PURE__ */ new Map();
+		keyrings = /* @__PURE__ */ new Map();
+		frozen = false;
+		constructor(app) {
+			this.app = app;
+			this.registerProvider("persisted-model", (config, currentApp) => {
+				const model = currentApp.models && currentApp.models[config.model];
+				if (!model) throw require_errors.rateLimitConfigurationError(`Rate limit state model ${config.model || "(missing)"} was not found`);
+				return new require_persisted_model.PersistedModelRateLimitStore({
+					model,
+					allowMemory: config.allowMemory === true,
+					maxRetries: config.maxRetries
+				});
+			});
+		}
+		registerProvider(name, factory) {
+			if (this.frozen) throw require_errors.rateLimitConfigurationError("Rate limit registry is frozen");
+			if (!name || typeof factory !== "function") throw require_errors.rateLimitConfigurationError("Invalid rate limit provider registration");
+			if (this.factories.has(name)) throw require_errors.rateLimitConfigurationError(`Rate limit provider ${name} is already registered`);
+			this.factories.set(name, factory);
+		}
+		registerStore(name, store) {
+			if (this.frozen) throw require_errors.rateLimitConfigurationError("Rate limit registry is frozen");
+			if (this.stores.has(name)) throw require_errors.rateLimitConfigurationError(`Rate limit store ${name} is already registered`);
+			this.stores.set(name, Promise.resolve(store).then(async (value) => {
+				await value.initialize();
+				return value;
+			}));
+		}
+		registerKeyring(name, keyring) {
+			if (this.frozen) throw require_errors.rateLimitConfigurationError("Rate limit registry is frozen");
+			if (this.keyrings.has(name)) throw require_errors.rateLimitConfigurationError(`Rate limit subject keyring ${name} is already registered`);
+			this.keyrings.set(name, require_subject.normalizeKeyring(keyring, `subjectKeyrings.${name}`));
+		}
+		configure(config = {}) {
+			if (this.frozen) throw require_errors.rateLimitConfigurationError("Rate limit registry is frozen");
+			for (const [name, keyring] of Object.entries(config.subjectKeyrings || {})) this.registerKeyring(name, keyring);
+		}
+		getKeyring(name) {
+			const keyring = this.keyrings.get(name);
+			if (!keyring) throw require_errors.rateLimitConfigurationError(`Rate limit subject keyring ${name} was not found`);
+			return keyring;
+		}
+		async resolveStore(name) {
+			const existing = this.stores.get(name);
+			if (existing) return existing;
+			const config = (this.app.get("rateLimit") || {}).stores?.[name];
+			if (!config) throw require_errors.rateLimitConfigurationError(`Rate limit store ${name} was not found`);
+			const factory = this.factories.get(config.provider);
+			if (!factory) throw require_errors.rateLimitConfigurationError(`Rate limit provider ${config.provider || "(missing)"} is not registered`);
+			const promise = Promise.resolve().then(async () => {
+				const store = factory(config, this.app);
+				await store.initialize();
+				return store;
+			});
+			this.stores.set(name, promise);
+			return promise;
+		}
+		freeze() {
+			this.frozen = true;
+		}
+	};
+}));
+//#endregion
+init_registry();
+exports.RateLimitRegistry = RateLimitRegistry;
+Object.defineProperty(exports, "init_registry", {
+	enumerable: true,
+	get: function() {
+		return init_registry;
+	}
+});
+Object.defineProperty(exports, "registry_exports", {
+	enumerable: true,
+	get: function() {
+		return registry_exports;
+	}
+});

package/dist/lib/rate-limit/remote.cjs

@@ -0,0 +1,180 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_errors = require("./errors.cjs");
+const require_subject = require("./subject.cjs");
+const require_config = require("./config.cjs");
+//#region src/lib/rate-limit/remote.ts
+var remote_exports = /* @__PURE__ */ require_runtime.__exportAll({
+	installRemoteRateLimiting: () => installRemoteRateLimiting,
+	normalizeNamedPolicy: () => normalizeNamedPolicy
+});
+function normalizeNamedPolicy(name, input) {
+	if (!input || typeof input !== "object") throw require_errors.rateLimitConfigurationError(`Rate limit policy ${name} was not found`);
+	const common = {
+		policyId: input.policyId || name,
+		policyVersion: String(input.policyVersion || ""),
+		stateTtlMs: Number(input.stateTtl) * 1e3
+	};
+	if (input.algorithm === "fixed-window") return require_config.normalizeFixedWindowPolicy({
+		...common,
+		maxAttempts: input.maxAttempts,
+		observationWindowMs: Number(input.observationWindow) * 1e3,
+		blockDurationMs: Number(input.blockDuration) * 1e3
+	});
+	if (input.algorithm === "failure-lockout") return require_config.normalizeFailureLockoutPolicy({
+		...common,
+		maxFailedAttempts: input.maxFailedAttempts,
+		observationWindowMs: Number(input.observationWindow) * 1e3,
+		blockDurationMs: Number(input.blockDuration) * 1e3,
+		strategy: input.strategy,
+		multiplier: input.multiplier,
+		maxBlockDurationMs: Number(input.maxBlockDuration) * 1e3,
+		backoffResetAfterMs: Number(input.backoffResetAfter) * 1e3
+	});
+	throw require_errors.rateLimitConfigurationError(`Rate limit policy ${name} has an invalid algorithm`);
+}
+function installRemoteRateLimiting(app) {
+	const resolvers = /* @__PURE__ */ new Map();
+	const installed = /* @__PURE__ */ new WeakSet();
+	const staticRules = /* @__PURE__ */ new WeakMap();
+	app.registerRateLimitResolver = function(name, resolver) {
+		if (!name || typeof resolver !== "function" || resolvers.has(name)) throw require_errors.rateLimitConfigurationError(`Rate limit resolver ${name || "(missing)"} is invalid`);
+		resolvers.set(name, resolver);
+		return app;
+	};
+	function staticRuleFor(Model, method) {
+		const cached = staticRules.get(method);
+		if (cached) return cached;
+		const metadata = method.rateLimit;
+		const policies = app.get("rateLimitPolicies") || {};
+		if (!((app.get("rateLimit") || {}).stores?.[metadata.store])?.namespace) throw require_errors.rateLimitConfigurationError(`Rate limit store ${metadata.store || "(missing)"} has no namespace`);
+		const onStoreError = metadata.onStoreError || "deny";
+		if (onStoreError !== "allow" && onStoreError !== "deny") throw require_errors.rateLimitConfigurationError("Rate limit store error mode is invalid");
+		const phase = metadata.phase || "resolved";
+		if (![
+			"early",
+			"resolved",
+			"domain"
+		].includes(phase)) throw require_errors.rateLimitConfigurationError("Rate limit phase is invalid");
+		const order = metadata.order == null ? 0 : Number(metadata.order);
+		if (!Number.isSafeInteger(order)) throw require_errors.rateLimitConfigurationError("Rate limit order is invalid");
+		const bucket = metadata.bucket || `${Model.modelName}.${method.name}`;
+		const subjectKeyring = metadata.subjectKeyring || "default";
+		require_subject.validateSafeIdentifier(metadata.store, "rateLimit.store");
+		require_subject.validateSafeIdentifier(subjectKeyring, "rateLimit.subjectKeyring");
+		require_subject.validateSafeIdentifier(bucket, "rateLimit.bucket");
+		const rule = Object.freeze({
+			ruleId: `${Model.modelName}.${method.name}`,
+			store: metadata.store,
+			subjectKeyring,
+			bucket,
+			policy: Object.freeze(normalizeNamedPolicy(metadata.policy, policies[metadata.policy])),
+			cost: require_config.validateRateLimitCost(Number(metadata.cost || 1), (app.get("rateLimit") || {}).limits?.maxCostPerConsume || 1e5),
+			onStoreError,
+			phase,
+			order,
+			shortCircuitOnDeny: metadata.shortCircuitOnDeny === true
+		});
+		staticRules.set(method, rule);
+		return rule;
+	}
+	app.validateRemoteRateLimits = async function() {
+		for (const Model of app.models()) {
+			if (!Model?.sharedClass?.methods) continue;
+			for (const method of Model.sharedClass.methods()) {
+				const metadata = method.rateLimit;
+				if (!metadata) continue;
+				if (metadata.resolver) {
+					if (!resolvers.has(metadata.resolver)) throw require_errors.rateLimitConfigurationError(`Rate limit resolver ${metadata.resolver} was not found`);
+					continue;
+				}
+				const rule = staticRuleFor(Model, method);
+				await app.rateLimit.registry.resolveStore(rule.store);
+				app.rateLimit.registry.getKeyring(rule.subjectKeyring);
+			}
+		}
+		return app;
+	};
+	function installForModel(Model) {
+		if (!Model?.sharedClass?.methods) return;
+		for (const method of Model.sharedClass.methods()) {
+			const metadata = method.rateLimit;
+			if (!metadata || installed.has(method)) continue;
+			installed.add(method);
+			const methodName = method.isStatic ? method.name : `prototype.${method.name}`;
+			Model.beforeRemote(methodName, function(ctx, unused, next) {
+				Promise.resolve().then(async () => {
+					if (!app.rateLimitReadiness.ready) throw require_errors.rateLimitConfigurationError("Rate limiting is not initialized");
+					const request = ctx.req;
+					const source = request && typeof Model.getRateLimitSource === "function" ? await Model.getRateLimitSource(request) : request?.ip || null;
+					const remoteContext = Object.freeze({
+						app,
+						model: Model,
+						methodName: `${Model.modelName}.${method.name}`,
+						args: Object.freeze({ ...ctx.args }),
+						request,
+						accessToken: request?.accessToken,
+						source
+					});
+					let rules;
+					if (metadata.resolver) {
+						const resolver = resolvers.get(metadata.resolver);
+						if (!resolver) throw require_errors.rateLimitConfigurationError(`Rate limit resolver ${metadata.resolver} was not found`);
+						const resolved = await resolver(remoteContext);
+						rules = resolved == null ? [] : Array.isArray(resolved) ? resolved : [resolved];
+					} else {
+						const storeConfig = (app.get("rateLimit") || {}).stores?.[metadata.store];
+						rules = [{
+							...staticRuleFor(Model, method),
+							subject: {
+								namespace: storeConfig.namespace,
+								scope: "remote-method",
+								subjectType: "endpoint",
+								canonicalValue: `${Model.modelName}.${method.name}`
+							}
+						}];
+					}
+					if (!rules.length) return;
+					const result = await app.rateLimit.limiter.consumeAll(rules);
+					if (!result.allowed) throw require_errors.rateLimitedError(result.blockedUntilMs);
+				}).then(() => next(), (error) => next(error));
+			});
+			Model.afterRemoteError(methodName, function(ctx, next) {
+				const error = ctx.error;
+				if (error?.code === "RATE_LIMITED" || error?.code === "RATE_LIMIT_UNAVAILABLE") {
+					ctx.res.setHeader("Cache-Control", "no-store");
+					if (error.retryAfter) ctx.res.setHeader("Retry-After", String(error.retryAfter));
+				}
+				next();
+			});
+		}
+	}
+	app.on("modelRemoted", function() {
+		app.models().forEach(installForModel);
+	});
+	app.installRemoteRateLimits = function() {
+		app.models().forEach(installForModel);
+		return app;
+	};
+}
+var init_remote = require_runtime.__esmMin((() => {
+	require_config.init_config();
+	require_errors.init_errors();
+	require_subject.init_subject();
+}));
+//#endregion
+init_remote();
+Object.defineProperty(exports, "init_remote", {
+	enumerable: true,
+	get: function() {
+		return init_remote;
+	}
+});
+exports.installRemoteRateLimiting = installRemoteRateLimiting;
+exports.normalizeNamedPolicy = normalizeNamedPolicy;
+Object.defineProperty(exports, "remote_exports", {
+	enumerable: true,
+	get: function() {
+		return remote_exports;
+	}
+});

package/dist/lib/rate-limit/remote.d.cts

@@ -0,0 +1,6 @@
+import { FailureLockoutRateLimitPolicy, FixedWindowRateLimitPolicy } from "./types.cjs";
+//#region src/lib/rate-limit/remote.d.ts
+declare function normalizeNamedPolicy(name: string, input: any): FixedWindowRateLimitPolicy | FailureLockoutRateLimitPolicy;
+declare function installRemoteRateLimiting(app: any): void;
+//#endregion
+export { installRemoteRateLimiting, normalizeNamedPolicy };