@xtr-dev/rondevu-server 0.5.7 → 0.5.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xtr-dev/rondevu-server",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "DNS-like WebRTC signaling server with credential-based authentication and service discovery",
   "main": "dist/index.js",
   "scripts": {

package/src/config.ts

@@ -1,5 +1,20 @@
 import { Storage } from './storage/types.ts';
 import { StorageType } from './storage/factory.ts';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+// Read version from package.json for standalone server
+function getPackageVersion(): string {
+  try {
+    const __dirname = dirname(fileURLToPath(import.meta.url));
+    const pkgPath = join(__dirname, '..', 'package.json');
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+    return pkg.version || 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
 
 /**
  * Application configuration
@@ -32,7 +47,7 @@ export interface Config {
   maxTotalOffers: number; // Max total offers in storage
   maxTotalCredentials: number; // Max total credentials in storage
   maxIceCandidatesPerOffer: number; // Max ICE candidates per offer
-  credentialsPerIpPerHour: number; // Rate limit: credentials per IP per hour
+  credentialsPerIpPerSecond: number; // Rate limit: credentials per IP per second
   requestsPerIpPerSecond: number; // Rate limit: requests per IP per second
 }
 
@@ -93,7 +108,7 @@ export function loadConfig(): Config {
     corsOrigins: process.env.CORS_ORIGINS
       ? process.env.CORS_ORIGINS.split(',').map(o => o.trim())
       : ['*'],
-    version: process.env.VERSION || 'unknown',
+    version: process.env.VERSION || getPackageVersion(),
     offerDefaultTtl: parsePositiveInt(process.env.OFFER_DEFAULT_TTL, '60000', 'OFFER_DEFAULT_TTL', 1000),
     offerMaxTtl: parsePositiveInt(process.env.OFFER_MAX_TTL, '86400000', 'OFFER_MAX_TTL', 1000),
     offerMinTtl: parsePositiveInt(process.env.OFFER_MIN_TTL, '60000', 'OFFER_MIN_TTL', 1000),
@@ -113,7 +128,7 @@ export function loadConfig(): Config {
     maxTotalOffers: parsePositiveInt(process.env.MAX_TOTAL_OFFERS, '10000', 'MAX_TOTAL_OFFERS', 1),
     maxTotalCredentials: parsePositiveInt(process.env.MAX_TOTAL_CREDENTIALS, '50000', 'MAX_TOTAL_CREDENTIALS', 1),
     maxIceCandidatesPerOffer: parsePositiveInt(process.env.MAX_ICE_CANDIDATES_PER_OFFER, '50', 'MAX_ICE_CANDIDATES_PER_OFFER', 1),
-    credentialsPerIpPerHour: parsePositiveInt(process.env.CREDENTIALS_PER_IP_PER_HOUR, '10', 'CREDENTIALS_PER_IP_PER_HOUR', 1),
+    credentialsPerIpPerSecond: parsePositiveInt(process.env.CREDENTIALS_PER_IP_PER_SECOND, '5', 'CREDENTIALS_PER_IP_PER_SECOND', 1),
     requestsPerIpPerSecond: parsePositiveInt(process.env.REQUESTS_PER_IP_PER_SECOND, '50', 'REQUESTS_PER_IP_PER_SECOND', 1),
   };
 
@@ -138,11 +153,11 @@ export const CONFIG_DEFAULTS = {
   timestampMaxAge: 60000,
   timestampMaxFuture: 60000,
   // Resource limits
-  maxOffersPerUser: 20,
-  maxTotalOffers: 10000,
+  maxOffersPerUser: 1000,
+  maxTotalOffers: 100000,
   maxTotalCredentials: 50000,
   maxIceCandidatesPerOffer: 50,
-  credentialsPerIpPerHour: 10,
+  credentialsPerIpPerSecond: 5,
   requestsPerIpPerSecond: 50,
 } as const;
 
@@ -186,7 +201,7 @@ export function buildWorkerConfig(env: {
     maxTotalOffers: CONFIG_DEFAULTS.maxTotalOffers,
     maxTotalCredentials: CONFIG_DEFAULTS.maxTotalCredentials,
     maxIceCandidatesPerOffer: CONFIG_DEFAULTS.maxIceCandidatesPerOffer,
-    credentialsPerIpPerHour: CONFIG_DEFAULTS.credentialsPerIpPerHour,
+    credentialsPerIpPerSecond: CONFIG_DEFAULTS.credentialsPerIpPerSecond,
     requestsPerIpPerSecond: CONFIG_DEFAULTS.requestsPerIpPerSecond,
   };
 }

package/src/rpc.ts

@@ -21,7 +21,7 @@ const MAX_PAGE_SIZE = 100;
 //   - Window starts on first request and expires after window duration
 //   - When window expires, counter resets to 0 and new window starts
 //   - This is simpler than sliding windows but may allow bursts at window boundaries
-const CREDENTIAL_RATE_WINDOW = 60 * 60 * 1000; // 1 hour in milliseconds
+const CREDENTIAL_RATE_WINDOW = 1000; // 1 second in milliseconds
 const REQUEST_RATE_WINDOW = 1000; // 1 second in milliseconds
 
 /**
@@ -298,10 +298,10 @@ const handlers: Record<string, RpcHandler> = {
       console.warn('⚠️  WARNING: Unable to determine client IP for credential generation. Using global rate limit.');
       // Use global rate limit with much stricter limit (prevents DoS while allowing basic function)
       rateLimitKey = 'cred_gen:global_unknown';
-      rateLimit = 2; // Only 2 credentials per hour globally for all unknown IPs combined
+      rateLimit = 2; // Only 2 credentials per second globally for all unknown IPs combined
     } else {
       rateLimitKey = `cred_gen:${request.clientIp}`;
-      rateLimit = config.credentialsPerIpPerHour;
+      rateLimit = config.credentialsPerIpPerSecond;
     }
 
     const allowed = await storage.checkRateLimit(
@@ -313,7 +313,7 @@ const handlers: Record<string, RpcHandler> = {
     if (!allowed) {
       throw new RpcError(
         ErrorCodes.RATE_LIMIT_EXCEEDED,
-        `Rate limit exceeded. Maximum ${rateLimit} credentials per hour${request.clientIp ? ' per IP' : ' (global limit for unidentified IPs)'}.`
+        `Rate limit exceeded. Maximum ${rateLimit} credentials per second${request.clientIp ? ' per IP' : ' (global limit for unidentified IPs)'}.`
       );
     }