@wenbin_wb/dsh-bridge 2.7.1 → 2.8.0

package/lib/security/rate-limiter.js

@@ -0,0 +1,93 @@
+// 滑动窗口请求速率限制器 (Rate Limiter)
+// 防范暴力破解、高频遍历与 DoS 攻击
+
+export class RateLimiter {
+  /**
+   * @param {object} options
+   * @param {number} options.maxRequests 窗口期内允许的最大请求数（默认 30）
+   * @param {number} options.windowMs 时间窗口毫秒数（默认 60000ms = 1分钟）
+   */
+  constructor({ maxRequests = 30, windowMs = 60000 } = {}) {
+    this.maxRequests = maxRequests;
+    this.windowMs = windowMs;
+    /** @type {Map<string, number[]>} key -> timestamp[] */
+    this.records = new Map();
+
+    // 定期清理过期记录（每 5 分钟清理一次）
+    this.cleanupTimer = setInterval(() => this.cleanup(), 5 * 60 * 1000);
+    if (this.cleanupTimer.unref) this.cleanupTimer.unref();
+  }
+
+  /**
+   * 检查指定 Key（如 IP / 用户 / Session）是否允许本次请求
+   * @param {string} key 限制标识
+   * @param {number} [customMax] 单次自定义最大请求数
+   * @returns {{ allowed: boolean, remaining: number, retryAfterSec: number }}
+   */
+  check(key = 'default', customMax) {
+    const limit = customMax || this.maxRequests;
+    const now = Date.now();
+    const windowStart = now - this.windowMs;
+
+    let timestamps = this.records.get(key);
+    if (!timestamps) {
+      timestamps = [];
+      this.records.set(key, timestamps);
+    }
+
+    // 过滤掉当前窗口期之前的记录
+    const valid = timestamps.filter(t => t > windowStart);
+    this.records.set(key, valid);
+
+    if (valid.length >= limit) {
+      const oldestInWindow = valid[0];
+      const resetTime = oldestInWindow + this.windowMs;
+      const retryAfterSec = Math.max(1, Math.ceil((resetTime - now) / 1000));
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfterSec,
+      };
+    }
+
+    valid.push(now);
+    return {
+      allowed: true,
+      remaining: limit - valid.length,
+      retryAfterSec: 0,
+    };
+  }
+
+  /**
+   * 重置指定 key 或全部记录
+   * @param {string} [key]
+   */
+  reset(key) {
+    if (key) this.records.delete(key);
+    else this.records.clear();
+  }
+
+  /**
+   * 清理所有过期记录
+   */
+  cleanup() {
+    const now = Date.now();
+    const windowStart = now - this.windowMs;
+    for (const [key, list] of this.records.entries()) {
+      const valid = list.filter(t => t > windowStart);
+      if (valid.length === 0) {
+        this.records.delete(key);
+      } else {
+        this.records.set(key, valid);
+      }
+    }
+  }
+
+  dispose() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+    this.records.clear();
+  }
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.7.1",
+  "version": "2.8.0",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
-  "releaseNotes": "【v2.7.1 Windows 一键升级与自建协议修复】\n• 🛠️ 修复 Windows 平台下一键升级触发 `spawn EINVAL` 的问题\n• 🌐 修复自建隧道 WebSocket (ws/wss) 协议诊断报错的问题\n• 🛡️ 强化 Gateway 启动并发锁与会话恢复防抖",
+  "releaseNotes": "【v2.8.0 移动端体验革新、远程工作区管理与全面安全加固】\n• 🗂️ 远程工作区网页选择器：移动端/远程点击添加工作区自动呼出网页端目录浏览器，本机电脑智能无感分流原生系统选择器\n• 📱 移动端视觉与布局体验深度优化：顶部导航栏居中动态标题、第二行徽标与极简下载图标两端排布、底部工具栏防重叠自适应\n• 🔐 全方位安全加固：RPC 端点鉴权、路径穿越与系统核心目录防御、滑动窗口限流与 IM 权限拦截",
   "type": "module",
   "main": "lib/index.js",
   "exports": {