@warlock.js/core 4.0.174 → 4.1.3

package/esm/http/middleware/concurrency-limit.middleware.d.mts

@@ -0,0 +1,53 @@
+import { Request } from "../request.mjs";
+import { Middleware } from "../../router/types.mjs";
+//#region ../../@warlock.js/core/src/http/middleware/concurrency-limit.middleware.d.ts
+/**
+ * Options for the concurrency limit middleware.
+ */
+type ConcurrencyLimitOptions = {
+  /**
+   * Group key generator. Defaults to `request.route.path` — i.e. the cap
+   * applies across all callers of that route. Override to scope per-user
+   * or per-tenant.
+   *
+   * @example
+   * keyGenerator: (request) => `${request.route.path}:${request.user?.id ?? request.ip}`,
+   */
+  keyGenerator?: (request: Request) => string;
+  /**
+   * Override the default error message.
+   */
+  errorMessage?: string;
+};
+/**
+ * Cap the number of in-flight requests against a route. Above the cap, new
+ * requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.
+ *
+ * Use for endpoints whose cost is unbounded per-request: report generation,
+ * AI completions, image processing, expensive aggregations. Different from
+ * `rateLimit()` — rate-limit caps requests-per-time, concurrency caps
+ * in-flight requests at any instant.
+ *
+ * The counter is process-local. With `N` replicas the effective cap is
+ * `N × max`. Document this in the route's behavior; if you need shared
+ * concurrency across replicas, reach for a `@warlock.js/cache` lock instead.
+ *
+ * @example
+ * import { middleware } from "@warlock.js/core";
+ *
+ * router.post("/reports/generate", reportController, {
+ *   middleware: [middleware.concurrencyLimit(3)],
+ * });
+ *
+ * router.post("/ai/summarize", summarizeController, {
+ *   middleware: [
+ *     middleware.concurrencyLimit(10, {
+ *       keyGenerator: (request) => `ai:${request.user?.id ?? request.ip}`,
+ *     }),
+ *   ],
+ * });
+ */
+declare function concurrencyLimitMiddleware(max: number, options?: ConcurrencyLimitOptions): Middleware;
+//#endregion
+export { ConcurrencyLimitOptions, concurrencyLimitMiddleware };
+//# sourceMappingURL=concurrency-limit.middleware.d.mts.map

package/esm/http/middleware/concurrency-limit.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency-limit.middleware.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/concurrency-limit.middleware.ts"],"mappings":";;;;;;KASY,uBAAA;EAAuB;;;;;;;;EASjC,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDlB;;;EA7Cd,YAAA;AAAA;;;;;AAgDW;;;;;;;;;;;;;;;;;;;;;;;;iBAHG,0BAAA,CACd,GAAA,UACA,OAAA,GAAS,uBAAA,GACR,UAAU"}

package/esm/http/middleware/concurrency-limit.middleware.mjs

@@ -0,0 +1,67 @@
+import { t } from "./inject-request-context.mjs";
+import { HttpErrorCodes } from "../error-codes.mjs";
+
+//#region ../../@warlock.js/core/src/http/middleware/concurrency-limit.middleware.ts
+const counters = /* @__PURE__ */ new Map();
+function release(key) {
+	const after = (counters.get(key) || 1) - 1;
+	if (after <= 0) {
+		counters.delete(key);
+		return;
+	}
+	counters.set(key, after);
+}
+/**
+* Cap the number of in-flight requests against a route. Above the cap, new
+* requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.
+*
+* Use for endpoints whose cost is unbounded per-request: report generation,
+* AI completions, image processing, expensive aggregations. Different from
+* `rateLimit()` — rate-limit caps requests-per-time, concurrency caps
+* in-flight requests at any instant.
+*
+* The counter is process-local. With `N` replicas the effective cap is
+* `N × max`. Document this in the route's behavior; if you need shared
+* concurrency across replicas, reach for a `@warlock.js/cache` lock instead.
+*
+* @example
+* import { middleware } from "@warlock.js/core";
+*
+* router.post("/reports/generate", reportController, {
+*   middleware: [middleware.concurrencyLimit(3)],
+* });
+*
+* router.post("/ai/summarize", summarizeController, {
+*   middleware: [
+*     middleware.concurrencyLimit(10, {
+*       keyGenerator: (request) => `ai:${request.user?.id ?? request.ip}`,
+*     }),
+*   ],
+* });
+*/
+function concurrencyLimitMiddleware(max, options = {}) {
+	return (request, response) => {
+		const key = options.keyGenerator?.(request) || request.route.path;
+		const current = counters.get(key) || 0;
+		if (current >= max) {
+			response.header("Retry-After", 1);
+			return response.tooManyRequests({
+				error: options.errorMessage || t("http.concurrencyLimitReached"),
+				errorCode: "EC103",
+				limit: max
+			});
+		}
+		counters.set(key, current + 1);
+		let released = false;
+		const releaseOnce = () => {
+			if (released) return;
+			released = true;
+			release(key);
+		};
+		response.onSent((_sentResponse) => releaseOnce());
+	};
+}
+
+//#endregion
+export { concurrencyLimitMiddleware };
+//# sourceMappingURL=concurrency-limit.middleware.mjs.map

package/esm/http/middleware/concurrency-limit.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency-limit.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/concurrency-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the concurrency limit middleware.\n */\nexport type ConcurrencyLimitOptions = {\n  /**\n   * Group key generator. Defaults to `request.route.path` — i.e. the cap\n   * applies across all callers of that route. Override to scope per-user\n   * or per-tenant.\n   *\n   * @example\n   * keyGenerator: (request) => `${request.route.path}:${request.user?.id ?? request.ip}`,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nconst counters = new Map<string, number>();\n\nfunction release(key: string) {\n  const after = (counters.get(key) || 1) - 1;\n\n  if (after <= 0) {\n    counters.delete(key);\n\n    return;\n  }\n\n  counters.set(key, after);\n}\n\n/**\n * Cap the number of in-flight requests against a route. Above the cap, new\n * requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.\n *\n * Use for endpoints whose cost is unbounded per-request: report generation,\n * AI completions, image processing, expensive aggregations. Different from\n * `rateLimit()` — rate-limit caps requests-per-time, concurrency caps\n * in-flight requests at any instant.\n *\n * The counter is process-local. With `N` replicas the effective cap is\n * `N × max`. Document this in the route's behavior; if you need shared\n * concurrency across replicas, reach for a `@warlock.js/cache` lock instead.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/reports/generate\", reportController, {\n *   middleware: [middleware.concurrencyLimit(3)],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     middleware.concurrencyLimit(10, {\n *       keyGenerator: (request) => `ai:${request.user?.id ?? request.ip}`,\n *     }),\n *   ],\n * });\n */\nexport function concurrencyLimitMiddleware(\n  max: number,\n  options: ConcurrencyLimitOptions = {},\n): Middleware {\n  return (request, response) => {\n    const key = options.keyGenerator?.(request) || request.route.path;\n    const current = counters.get(key) || 0;\n\n    if (current >= max) {\n      response.header(\"Retry-After\", 1);\n\n      return response.tooManyRequests({\n          error: options.errorMessage || t(\"http.concurrencyLimitReached\"),\n          errorCode: HttpErrorCodes.ConcurrencyLimitReached,\n          limit: max,\n        },\n      );\n    }\n\n    counters.set(key, current + 1);\n\n    let released = false;\n\n    const releaseOnce = () => {\n      if (released) return;\n\n      released = true;\n      release(key);\n    };\n\n    response.onSent((_sentResponse: Response) => releaseOnce());\n  };\n}\n"],"mappings":";;;;AAyBA,MAAM,2BAAW,IAAI,IAAoB;AAEzC,SAAS,QAAQ,KAAa;CAC5B,MAAM,SAAS,SAAS,IAAI,GAAG,KAAK,KAAK;CAEzC,IAAI,SAAS,GAAG;EACd,SAAS,OAAO,GAAG;EAEnB;CACF;CAEA,SAAS,IAAI,KAAK,KAAK;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,2BACd,KACA,UAAmC,CAAC,GACxB;CACZ,QAAQ,SAAS,aAAa;EAC5B,MAAM,MAAM,QAAQ,eAAe,OAAO,KAAK,QAAQ,MAAM;EAC7D,MAAM,UAAU,SAAS,IAAI,GAAG,KAAK;EAErC,IAAI,WAAW,KAAK;GAClB,SAAS,OAAO,eAAe,CAAC;GAEhC,OAAO,SAAS,gBAAgB;IAC5B,OAAO,QAAQ,gBAAgB,EAAE,8BAA8B;IAC/D;IACA,OAAO;GACT,CACF;EACF;EAEA,SAAS,IAAI,KAAK,UAAU,CAAC;EAE7B,IAAI,WAAW;EAEf,MAAM,oBAAoB;GACxB,IAAI,UAAU;GAEd,WAAW;GACX,QAAQ,GAAG;EACb;EAEA,SAAS,QAAQ,kBAA4B,YAAY,CAAC;CAC5D;AACF"}

package/esm/http/middleware/idempotency.middleware.d.mts

@@ -0,0 +1,61 @@
+import { Middleware } from "../../router/types.mjs";
+//#region ../../@warlock.js/core/src/http/middleware/idempotency.middleware.d.ts
+/**
+ * Options for the idempotency middleware.
+ */
+type IdempotencyOptions = {
+  /**
+   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).
+   */
+  ttl?: number;
+  /**
+   * Header name carrying the client's key. Falls back to
+   * `http.idempotency.headerName`, then `"Idempotency-Key"`.
+   */
+  headerName?: string;
+  /**
+   * HTTP methods eligible for idempotency. Falls back to
+   * `http.idempotency.methods`, then `["POST","PUT","PATCH","DELETE"]`.
+   * Safe methods (GET/HEAD) are skipped regardless.
+   */
+  methods?: string[];
+  /**
+   * Cache driver name. Falls back to `http.idempotency.driver`, then the
+   * default driver of the cache manager.
+   */
+  driver?: string;
+};
+/**
+ * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,
+ * same body, within TTL → cached replay; same key, different body → 422
+ * `IdempotencyKeyConflict`.
+ *
+ * **Must run after `authMiddleware`** — the cache key is scoped per-user
+ * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.
+ * Anonymous requests fall back to IP scope.
+ *
+ * The replay sets `Idempotent-Replay: true` on the response for easy
+ * client-side / observability detection.
+ *
+ * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through
+ * even with the header set (RFC: safe methods are already idempotent).
+ *
+ * @example
+ * import { authMiddleware } from "@warlock.js/auth";
+ * import { middleware } from "@warlock.js/core";
+ *
+ * router.post("/orders", createOrderController, {
+ *   middleware: [authMiddleware("client"), middleware.idempotency()],
+ * });
+ *
+ * router.post("/ai/summarize", summarizeController, {
+ *   middleware: [
+ *     authMiddleware("client"),
+ *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries
+ *   ],
+ * });
+ */
+declare function idempotencyMiddleware(options?: IdempotencyOptions): Middleware;
+//#endregion
+export { IdempotencyOptions, idempotencyMiddleware };
+//# sourceMappingURL=idempotency.middleware.d.mts.map

package/esm/http/middleware/idempotency.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.middleware.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/idempotency.middleware.ts"],"mappings":";;;;;KAeY,kBAAA;EAAkB;;;EAI5B,GAAA;EAKA;;;;EAAA,UAAA;EAqDc;;;;;EA/Cd,OAAA;EA+CuE;;AAAU;;EA1CjF,MAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0Cc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}

package/esm/http/middleware/idempotency.middleware.mjs

@@ -0,0 +1,88 @@
+import { t } from "./inject-request-context.mjs";
+import { HttpErrorCodes } from "../error-codes.mjs";
+import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./utils/idempotency-key.mjs";
+import config from "@mongez/config";
+import { cache } from "@warlock.js/cache";
+
+//#region ../../@warlock.js/core/src/http/middleware/idempotency.middleware.ts
+const DEFAULT_METHODS = [
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+];
+/**
+* Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,
+* same body, within TTL → cached replay; same key, different body → 422
+* `IdempotencyKeyConflict`.
+*
+* **Must run after `authMiddleware`** — the cache key is scoped per-user
+* (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.
+* Anonymous requests fall back to IP scope.
+*
+* The replay sets `Idempotent-Replay: true` on the response for easy
+* client-side / observability detection.
+*
+* Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through
+* even with the header set (RFC: safe methods are already idempotent).
+*
+* @example
+* import { authMiddleware } from "@warlock.js/auth";
+* import { middleware } from "@warlock.js/core";
+*
+* router.post("/orders", createOrderController, {
+*   middleware: [authMiddleware("client"), middleware.idempotency()],
+* });
+*
+* router.post("/ai/summarize", summarizeController, {
+*   middleware: [
+*     authMiddleware("client"),
+*     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries
+*   ],
+* });
+*/
+function idempotencyMiddleware(options = {}) {
+	return async (request, response) => {
+		const headerName = options.headerName || config.get("http.idempotency.headerName", "Idempotency-Key");
+		const methods = options.methods || config.get("http.idempotency.methods", DEFAULT_METHODS);
+		const ttl = options.ttl || config.get("http.idempotency.ttl", 86400);
+		const driverName = options.driver || config.get("http.idempotency.driver");
+		if (!methods.includes(request.method.toUpperCase())) return;
+		const idempotencyKey = request.header(headerName.toLowerCase());
+		if (!idempotencyKey) return;
+		if (!isValidIdempotencyKey(idempotencyKey)) return response.badRequest({
+			error: t("http.idempotencyKeyInvalid"),
+			errorCode: "EC101"
+		});
+		const cacheDriver = driverName ? await cache.use(driverName) : cache;
+		const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);
+		const bodyHash = hashBody(request.body);
+		const cached = await cacheDriver.get(cacheKey);
+		if (cached) {
+			if (cached.bodyHash !== bodyHash) return response.unprocessableEntity({
+				error: t("http.idempotencyKeyConflict"),
+				errorCode: "EC100"
+			});
+			response.header("Idempotent-Replay", "true");
+			return response.replay({
+				status: cached.status,
+				body: cached.body,
+				contentType: cached.contentType
+			});
+		}
+		response.onSent((sentResponse) => {
+			if (sentResponse.statusCode >= 500) return;
+			const sentContentType = sentResponse.contentType;
+			cacheDriver.set(cacheKey, {
+				status: sentResponse.statusCode,
+				body: sentResponse.parsedBody,
+				bodyHash,
+				contentType: typeof sentContentType === "string" ? sentContentType : void 0
+			}, ttl);
+		});
+	};
+}
+
+//#endregion
+export { idempotencyMiddleware };
+//# sourceMappingURL=idempotency.middleware.mjs.map

package/esm/http/middleware/idempotency.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport {\n  buildIdempotencyCacheKey,\n  hashBody,\n  isValidIdempotencyKey,\n} from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async (request, response) => {\n    const headerName =\n      options.headerName ||\n      config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods =\n      options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const cached = (await cacheDriver.get(cacheKey)) as CachedResponse | null;\n\n    if (cached) {\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      if (sentResponse.statusCode >= 500) return;\n\n      const sentContentType = sentResponse.contentType;\n\n      cacheDriver.set(\n        cacheKey,\n        {\n          status: sentResponse.statusCode,\n          body: sentResponse.parsedBody,\n          bodyHash,\n          contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n        },\n        ttl,\n      );\n    });\n  };\n}\n"],"mappings":";;;;;;;AA6CA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,SAAS,aAAa;EAClC,MAAM,aACJ,QAAQ,cACR,OAAO,IAAI,+BAA+B,iBAAiB;EAC7D,MAAM,UACJ,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EAC3E,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,SAAU,MAAM,YAAY,IAAI,QAAQ;EAE9C,IAAI,QAAQ;GACV,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAEA,SAAS,QAAQ,iBAA2B;GAG1C,IAAI,aAAa,cAAc,KAAK;GAEpC,MAAM,kBAAkB,aAAa;GAErC,YAAY,IACV,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF;EACF,CAAC;CACH;AACF"}

package/esm/http/middleware/index.d.mts

@@ -0,0 +1,11 @@
+import { CacheMiddlewareOptions } from "./cache-response-middleware.mjs";
+import { ConcurrencyLimitOptions } from "./concurrency-limit.middleware.mjs";
+import { IdempotencyOptions } from "./idempotency.middleware.mjs";
+import { IpFilterOptions } from "./ip-filter.middleware.mjs";
+import { MaintenanceOptions } from "./maintenance.middleware.mjs";
+import { RateLimitOptions } from "./rate-limit.middleware.mjs";
+import { middleware } from "./middleware-list.mjs";
+import { createRequestStore, fromRequest, t } from "./inject-request-context.mjs";
+import { anyMatch, ipMatches } from "./utils/cidr-match.mjs";
+import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./utils/idempotency-key.mjs";
+import { parseSize } from "./utils/parse-size.mjs";

package/esm/http/middleware/index.mjs

@@ -0,0 +1,7 @@
+import { createRequestStore, fromRequest, t } from "./inject-request-context.mjs";
+import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./utils/idempotency-key.mjs";
+import { anyMatch, ipMatches } from "./utils/cidr-match.mjs";
+import { parseSize } from "./utils/parse-size.mjs";
+import { middleware } from "./middleware-list.mjs";
+
+export {  };

package/esm/http/middleware/inject-request-context.d.mts

@@ -0,0 +1,25 @@
+import { Request } from "../request.mjs";
+import { Response } from "../response.mjs";
+import { ReturnedResponse } from "../types.mjs";
+
+//#region ../../@warlock.js/core/src/http/middleware/inject-request-context.d.ts
+/**
+ * Create request store and execute middleware + handler
+ *
+ * Runs all registered contexts together using ContextManager.
+ */
+declare function createRequestStore(request: Request<any>, response: Response): Promise<ReturnedResponse>;
+/**
+ * Translate a keyword (uses request context for locale)
+ */
+declare function t(keyword: string, placeholders?: any): any;
+/**
+ * Get or compute a value from the request cache
+ *
+ * If the value exists in request, return it.
+ * Otherwise, execute callback, store result in request, and return it.
+ */
+declare function fromRequest<T>(key: string, callback: (request?: Request) => Promise<T>): Promise<T>;
+//#endregion
+export { createRequestStore, fromRequest, t };
+//# sourceMappingURL=inject-request-context.d.mts.map

package/esm/http/middleware/inject-request-context.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AAoDA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBA8GK,CAAA,CAAE,OAAA,UAAiB,YAAkB;;;;;;;iBAa/B,WAAA,GAAA,CACpB,GAAA,UACA,QAAA,GAAW,OAAA,GAAU,OAAA,KAAY,OAAA,CAAQ,CAAA,IACxC,OAAA,CAAQ,CAAA"}

package/esm/http/middleware/inject-request-context.mjs

@@ -0,0 +1,118 @@
+import { environment } from "../../utils/environment.mjs";
+import { requestContext, useRequestStore } from "../context/request-context.mjs";
+import "../../utils/index.mjs";
+import { BadRequestError, ForbiddenError, HttpError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "../errors/errors.mjs";
+import config from "@mongez/config";
+import { trans } from "@mongez/localization";
+import { DatabaseWriterValidationError } from "@warlock.js/cascade";
+import { contextManager } from "@warlock.js/context";
+
+//#region ../../@warlock.js/core/src/http/middleware/inject-request-context.ts
+/**
+* Request Context Middleware
+*
+* Creates a unified context for each request using the ContextManager.
+* All framework contexts (request, storage, database) are available throughout the request lifecycle.
+*/
+/**
+* Echo `request.id` back as a response header so the FE / proxies / log
+* aggregators can correlate by the same value the server logs against.
+*
+* Reads the header name from `http.requestId.header` (default `X-Request-Id`).
+* Skip when `http.requestId.enabled` is explicitly false.
+*/
+function stampRequestIdHeader(request, response) {
+	const requestIdConfig = config.get("http.requestId", {});
+	if (requestIdConfig.enabled === false) return;
+	const headerName = requestIdConfig.header || "X-Request-Id";
+	response.header(headerName, request.id);
+}
+/**
+* Create request store and execute middleware + handler
+*
+* Runs all registered contexts together using ContextManager.
+*/
+function createRequestStore(request, response) {
+	stampRequestIdHeader(request, response);
+	const httpContextStore = contextManager.buildStores({
+		request,
+		response
+	});
+	return contextManager.runAll(httpContextStore, async () => {
+		try {
+			const result = await request.runMiddleware();
+			if (result) return result;
+			request.trigger("executingAction", request.route);
+			const handler = request.getHandler();
+			request.log("Executing Handler", "info");
+			const output = await handler(request, response);
+			request.log("Handler Executed Successfully", "success");
+			request.trigger("executedAction", request.route);
+			return output;
+		} catch (error) {
+			request.log(`${error.constructor.name}: Request failed: ${error.message}`, "error");
+			return handleRequestError(error, response);
+		}
+	});
+}
+/**
+* Handle request errors
+* @internal
+*/
+function handleRequestError(error, response) {
+	if (error instanceof HttpError) {
+		const payload = { error: error.message };
+		if (error.payload) payload.payload = error.payload;
+		if (environment() === "development") payload.stack = error.stack;
+		return response.setStatusCode(error.status).send(payload);
+	}
+	if (error instanceof ResourceNotFoundError) return response.notFound({
+		error: error.message,
+		...error.payload
+	});
+	if (error instanceof UnAuthorizedError) return response.unauthorized({
+		error: error.message,
+		...error.payload
+	});
+	if (error instanceof ForbiddenError) return response.forbidden({
+		error: error.message,
+		...error.payload
+	});
+	if (error instanceof BadRequestError) return response.badRequest({
+		error: error.message,
+		...error.payload
+	});
+	if (error instanceof DatabaseWriterValidationError) return response.badRequest({ errors: error.errors });
+	if (error instanceof ServerError) return response.serverError({
+		error: error.message,
+		...error.payload
+	});
+	console.log(error);
+	return response.badRequest({
+		error: error.message,
+		...error.payload
+	});
+}
+/**
+* Translate a keyword (uses request context for locale)
+*/
+function t(keyword, placeholders) {
+	return requestContext.getRequest()?.trans(keyword, placeholders) || trans(keyword, placeholders);
+}
+/**
+* Get or compute a value from the request cache
+*
+* If the value exists in request, return it.
+* Otherwise, execute callback, store result in request, and return it.
+*/
+async function fromRequest(key, callback) {
+	const { request } = useRequestStore();
+	if (!request) return await callback();
+	if (request[key]) return request[key];
+	request[key] = await callback(request);
+	return request[key];
+}
+
+//#endregion
+export { createRequestStore, fromRequest, t };
+//# sourceMappingURL=inject-request-context.mjs.map

package/esm/http/middleware/inject-request-context.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\r\n * Request Context Middleware\r\n *\r\n * Creates a unified context for each request using the ContextManager.\r\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\r\n */\r\nimport { trans } from \"@mongez/localization\";\r\nimport { GenericObject } from \"@mongez/reinforcements\";\r\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\r\nimport { contextManager } from \"@warlock.js/context\";\r\nimport config from \"@mongez/config\";\r\nimport { environment } from \"../../utils\";\r\nimport {\r\n  requestContext as requestContextInstance,\r\n  useRequestStore,\r\n} from \"../context/request-context\";\r\nimport {\r\n  BadRequestError,\r\n  ForbiddenError,\r\n  HttpError,\r\n  ResourceNotFoundError,\r\n  ServerError,\r\n  UnAuthorizedError,\r\n} from \"../errors\";\r\nimport { type Request } from \"../request\";\r\nimport { type Response } from \"../response\";\r\nimport { type ReturnedResponse } from \"./../types\";\r\n\r\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\r\n\r\n/**\r\n * Echo `request.id` back as a response header so the FE / proxies / log\r\n * aggregators can correlate by the same value the server logs against.\r\n *\r\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\r\n * Skip when `http.requestId.enabled` is explicitly false.\r\n */\r\nfunction stampRequestIdHeader(request: Request, response: Response) {\r\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\r\n\r\n  if (requestIdConfig.enabled === false) return;\r\n\r\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\r\n\r\n  response.header(headerName, request.id);\r\n}\r\n\r\n/**\r\n * Create request store and execute middleware + handler\r\n *\r\n * Runs all registered contexts together using ContextManager.\r\n */\r\nexport function createRequestStore(\r\n  request: Request<any>,\r\n  response: Response,\r\n): Promise<ReturnedResponse> {\r\n  stampRequestIdHeader(request, response);\r\n\r\n  // Build all context stores using the immutable API\r\n  // Each context defines its own store initialization via buildStore()\r\n  const httpContextStore = contextManager.buildStores({ request, response });\r\n\r\n  // Run all contexts together!\r\n  return contextManager.runAll(httpContextStore, async () => {\r\n    try {\r\n      // Run middleware chain\r\n      const result = await request.runMiddleware();\r\n\r\n      if (result) {\r\n        return result as ReturnedResponse;\r\n      }\r\n\r\n      // Execute route handler\r\n      request.trigger(\"executingAction\", request.route);\r\n\r\n      const handler = request.getHandler();\r\n\r\n      request.log(\"Executing Handler\", \"info\");\r\n\r\n      const output = await handler(request, response);\r\n\r\n      request.log(\"Handler Executed Successfully\", \"success\");\r\n\r\n      request.trigger(\"executedAction\", request.route);\r\n\r\n      return output as ReturnedResponse;\r\n    } catch (error: any) {\r\n      request.log(`${error.constructor.name}: Request failed: ${error.message}`, \"error\");\r\n      return handleRequestError(error, response);\r\n    }\r\n  });\r\n}\r\n\r\n/**\r\n * Handle request errors\r\n * @internal\r\n */\r\nfunction handleRequestError(error: any, response: Response): ReturnedResponse {\r\n  if (error instanceof HttpError) {\r\n    const payload: GenericObject = {\r\n      error: error.message,\r\n    };\r\n    if (error.payload) {\r\n      payload.payload = error.payload;\r\n    }\r\n\r\n    if (environment() === \"development\") {\r\n      payload.stack = error.stack;\r\n    }\r\n\r\n    return response.setStatusCode(error.status).send(payload);\r\n  }\r\n\r\n  if (error instanceof ResourceNotFoundError) {\r\n    return response.notFound({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof UnAuthorizedError) {\r\n    return response.unauthorized({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ForbiddenError) {\r\n    return response.forbidden({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof BadRequestError) {\r\n    return response.badRequest({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof DatabaseWriterValidationError) {\r\n    return response.badRequest({\r\n      errors: error.errors,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ServerError) {\r\n    return response.serverError({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  console.log(error);\r\n\r\n  return response.badRequest({\r\n    error: error.message,\r\n    ...error.payload,\r\n  });\r\n}\r\n\r\n/**\r\n * Translate a keyword (uses request context for locale)\r\n */\r\nexport function t(keyword: string, placeholders?: any) {\r\n  return (\r\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\r\n    trans(keyword, placeholders)\r\n  );\r\n}\r\n\r\n/**\r\n * Get or compute a value from the request cache\r\n *\r\n * If the value exists in request, return it.\r\n * Otherwise, execute callback, store result in request, and return it.\r\n */\r\nexport async function fromRequest<T>(\r\n  key: string,\r\n  callback: (request?: Request) => Promise<T>,\r\n): Promise<T> {\r\n  const { request } = useRequestStore();\r\n\r\n  if (!request) return await callback();\r\n\r\n  if (request[key]) return request[key];\r\n\r\n  request[key] = await callback(request);\r\n\r\n  return request[key];\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAItC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,SAAS,MAAM,QAAQ,SAAS,QAAQ;GAE9C,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAY;GACnB,QAAQ,IAAI,GAAG,MAAM,YAAY,KAAK,oBAAoB,MAAM,WAAW,OAAO;GAClF,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAY,UAAsC;CAC5E,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,EAAE,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,uBACnB,OAAO,SAAS,SAAS;EACvB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,mBACnB,OAAO,SAAS,aAAa;EAC3B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,gBACnB,OAAO,SAAS,UAAU;EACxB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,iBACnB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAGH,IAAI,iBAAiB,aACnB,OAAO,SAAS,YAAY;EAC1B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,QAAQ,IAAI,KAAK;CAEjB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,GAAG,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B;;;;;;;AAQA,eAAsB,YACpB,KACA,UACY;CACZ,MAAM,EAAE,YAAY,gBAAgB;CAEpC,IAAI,CAAC,SAAS,OAAO,MAAM,SAAS;CAEpC,IAAI,QAAQ,MAAM,OAAO,QAAQ;CAEjC,QAAQ,OAAO,MAAM,SAAS,OAAO;CAErC,OAAO,QAAQ;AACjB"}

package/esm/http/middleware/ip-filter.middleware.d.mts

@@ -0,0 +1,52 @@
+import { Middleware } from "../../router/types.mjs";
+//#region ../../@warlock.js/core/src/http/middleware/ip-filter.middleware.d.ts
+/**
+ * Options for the IP filter middleware. Use at least one of `allow` / `deny`.
+ *
+ * Precedence: `deny` wins. If a request matches both lists it is denied.
+ */
+type IpFilterOptions = {
+  /**
+   * Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,
+   * only IPs matching the list pass through.
+   */
+  allow?: string[];
+  /**
+   * Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs
+   * are rejected regardless of the allowlist.
+   */
+  deny?: string[];
+  /**
+   * Override the default error message.
+   */
+  errorMessage?: string;
+};
+/**
+ * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,
+ * the request is rejected with 403.
+ *
+ * Reads the client IP via `request.detectIp()`, which honors `X-Real-IP` and
+ * `X-Forwarded-For` (Fastify is started with `trustProxy: true`). Make sure
+ * your upstream proxy is trustworthy — `X-Forwarded-For` is client-settable.
+ *
+ * @example
+ * import { middleware } from "@warlock.js/core";
+ *
+ * router.group(
+ *   {
+ *     prefix: "/admin",
+ *     middleware: [middleware.ipFilter({ allow: ["10.0.0.0/8", "203.0.113.42"] })],
+ *   },
+ *   () => {
+ *     router.get("/dashboard", dashboardController);
+ *   },
+ * );
+ *
+ * router.post("/webhooks/provider", webhookController, {
+ *   middleware: [middleware.ipFilter({ allow: ["198.51.100.0/24"] })],
+ * });
+ */
+declare function ipFilterMiddleware(options: IpFilterOptions): Middleware;
+//#endregion
+export { IpFilterOptions, ipFilterMiddleware };
+//# sourceMappingURL=ip-filter.middleware.d.mts.map

package/esm/http/middleware/ip-filter.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA4Bd;;;EAhCE,IAAA;EAgC0C;;;EA5B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}

package/esm/http/middleware/ip-filter.middleware.mjs

@@ -0,0 +1,51 @@
+import { t } from "./inject-request-context.mjs";
+import { HttpErrorCodes } from "../error-codes.mjs";
+import { anyMatch } from "./utils/cidr-match.mjs";
+
+//#region ../../@warlock.js/core/src/http/middleware/ip-filter.middleware.ts
+/**
+* Allow / deny requests by client IP. Fail-closed: if the IP can't be read,
+* the request is rejected with 403.
+*
+* Reads the client IP via `request.detectIp()`, which honors `X-Real-IP` and
+* `X-Forwarded-For` (Fastify is started with `trustProxy: true`). Make sure
+* your upstream proxy is trustworthy — `X-Forwarded-For` is client-settable.
+*
+* @example
+* import { middleware } from "@warlock.js/core";
+*
+* router.group(
+*   {
+*     prefix: "/admin",
+*     middleware: [middleware.ipFilter({ allow: ["10.0.0.0/8", "203.0.113.42"] })],
+*   },
+*   () => {
+*     router.get("/dashboard", dashboardController);
+*   },
+* );
+*
+* router.post("/webhooks/provider", webhookController, {
+*   middleware: [middleware.ipFilter({ allow: ["198.51.100.0/24"] })],
+* });
+*/
+function ipFilterMiddleware(options) {
+	return (request, response) => {
+		const ip = request.detectIp();
+		if (!ip || typeof ip !== "string") return response.forbidden({
+			error: options.errorMessage || t("http.ipForbidden"),
+			errorCode: "EC105"
+		});
+		if (options.deny && anyMatch(ip, options.deny)) return response.forbidden({
+			error: options.errorMessage || t("http.ipForbidden"),
+			errorCode: "EC105"
+		});
+		if (options.allow && !anyMatch(ip, options.allow)) return response.forbidden({
+			error: options.errorMessage || t("http.ipForbidden"),
+			errorCode: "EC105"
+		});
+	};
+}
+
+//#endregion
+export { ipFilterMiddleware };
+//# sourceMappingURL=ip-filter.middleware.mjs.map

package/esm/http/middleware/ip-filter.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/**\n * Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n *\n * Precedence: `deny` wins. If a request matches both lists it is denied.\n */\nexport type IpFilterOptions = {\n  /**\n   * Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n   * only IPs matching the list pass through.\n   */\n  allow?: string[];\n  /**\n   * Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n   * are rejected regardless of the allowlist.\n   */\n  deny?: string[];\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\n/**\n * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n *\n * Reads the client IP via `request.detectIp()`, which honors `X-Real-IP` and\n * `X-Forwarded-For` (Fastify is started with `trustProxy: true`). Make sure\n * your upstream proxy is trustworthy — `X-Forwarded-For` is client-settable.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.group(\n *   {\n *     prefix: \"/admin\",\n *     middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n *   },\n *   () => {\n *     router.get(\"/dashboard\", dashboardController);\n *   },\n * );\n *\n * router.post(\"/webhooks/provider\", webhookController, {\n *   middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n  return (request, response) => {\n    const ip = request.detectIp();\n\n    if (!ip || typeof ip !== \"string\") {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.deny && anyMatch(ip, options.deny)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.allow && !anyMatch(ip, options.allow)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,SAAS,aAAa;EAC5B,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}