alepha 0.14.2 → 0.14.4

package/src/server/rate-limit/__tests__/ActionRateLimit.spec.ts

@@ -0,0 +1,211 @@
+import { Alepha } from "alepha";
+import { AlephaCache } from "alepha/cache";
+import { $action, AlephaServer, HttpError } from "alepha/server";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { $rateLimit, AlephaServerRateLimit } from "../index.ts";
+
+describe("Action Rate Limiting", () => {
+  let alepha: Alepha;
+
+  class TestApp {
+    // Action with rate limiting enabled via options
+    limitedAction = $action({
+      rateLimit: { max: 2, windowMs: 1000 },
+      handler: () => "success",
+    });
+
+    // Action with custom key generator
+    userBasedAction = $action({
+      rateLimit: {
+        max: 3,
+        windowMs: 2000,
+        keyGenerator: (req) => `user:${req.headers["user-id"] || "anonymous"}`,
+      },
+      handler: () => "user success",
+    });
+
+    // Action without rate limiting
+    unlimitedAction = $action({
+      handler: () => "unlimited success",
+    });
+
+    // Rate limit primitive usage
+    customRateLimit = $rateLimit({ max: 1, windowMs: 500 });
+
+    primitiveAction = $action({
+      handler: async (request) => {
+        const result = await this.customRateLimit.check(request, {
+          max: 1,
+          windowMs: 500,
+        });
+        if (!result.allowed) {
+          throw new HttpError({
+            status: 429,
+            message: `Rate limit exceeded. Reset in ${result.retryAfter}s`,
+          });
+        }
+        return "primitive success";
+      },
+    });
+  }
+
+  beforeEach(async () => {
+    alepha = Alepha.create()
+      .with(AlephaCache)
+      .with(AlephaServer)
+      .with(AlephaServerRateLimit)
+      .with(TestApp);
+
+    await alepha.start();
+  });
+
+  afterEach(async () => {
+    await alepha.stop();
+  });
+
+  describe("Action rateLimit option", () => {
+    it("should allow requests within rate limit", async () => {
+      const app = alepha.inject(TestApp);
+
+      const result1 = await app.limitedAction.run({});
+      expect(result1).toBe("success");
+
+      const result2 = await app.limitedAction.run({});
+      expect(result2).toBe("success");
+    });
+
+    it("should block requests exceeding rate limit", async () => {
+      const app = alepha.inject(TestApp);
+
+      // First two requests should succeed
+      await app.limitedAction.run({});
+      await app.limitedAction.run({});
+
+      // Third request should be rate limited
+      await expect(app.limitedAction.run({})).rejects.toThrow(
+        "Too Many Requests",
+      );
+    });
+
+    it("should use custom key generator", async () => {
+      const app = alepha.inject(TestApp);
+
+      // Test that the custom key generator allows more requests per user
+      // since each user gets their own rate limit bucket
+      const result1 = await app.userBasedAction.run({});
+      expect(result1).toBe("user success");
+
+      const result2 = await app.userBasedAction.run({});
+      expect(result2).toBe("user success");
+
+      const result3 = await app.userBasedAction.run({});
+      expect(result3).toBe("user success");
+
+      // Fourth request should be blocked (limit is 3)
+      await expect(app.userBasedAction.run({})).rejects.toThrow(
+        "Too Many Requests",
+      );
+    });
+
+    it("should not affect unlimited actions", async () => {
+      const app = alepha.inject(TestApp);
+
+      // Should be able to make many requests to unlimited action
+      for (let i = 0; i < 10; i++) {
+        const result = await app.unlimitedAction.run({});
+        expect(result).toBe("unlimited success");
+      }
+    });
+
+    it("should reset rate limit after window expires", async () => {
+      const app = alepha.inject(TestApp);
+
+      // Use up the rate limit
+      await app.limitedAction.run({});
+      await app.limitedAction.run({});
+
+      // Should be blocked
+      await expect(app.limitedAction.run({})).rejects.toThrow(
+        "Too Many Requests",
+      );
+
+      // Wait for the window to expire (1000ms + buffer)
+      await new Promise((resolve) => setTimeout(resolve, 1100));
+
+      // Should be allowed again
+      const result = await app.limitedAction.run({});
+      expect(result).toBe("success");
+    });
+  });
+
+  describe("$rateLimit primitive", () => {
+    it("should create rate limit primitive with options", () => {
+      const app = alepha.inject(TestApp);
+
+      expect(app.customRateLimit).toBeDefined();
+      expect(app.customRateLimit.name).toBe("customRateLimit");
+      expect(app.customRateLimit.options.max).toBe(1);
+      expect(app.customRateLimit.options.windowMs).toBe(500);
+    });
+
+    it("should handle rate limiting in custom action logic", async () => {
+      const app = alepha.inject(TestApp);
+
+      // First request should succeed
+      const result1 = await app.primitiveAction.run({});
+      expect(result1).toBe("primitive success");
+
+      // Second request should be blocked by custom logic
+      await expect(app.primitiveAction.run({})).rejects.toThrow(
+        "Rate limit exceeded",
+      );
+    });
+  });
+
+  describe("Integration", () => {
+    it("should integrate rate limiting with action hooks", async () => {
+      const app = alepha.inject(TestApp);
+
+      // Just verify that the hook is working by checking that rate limiting is applied
+      await app.limitedAction.run({});
+      await app.limitedAction.run({});
+
+      // Third request should trigger rate limiting
+      await expect(app.limitedAction.run({})).rejects.toThrow(
+        "Too Many Requests",
+      );
+    });
+  });
+
+  describe("Performance and edge cases", () => {
+    it("should handle concurrent requests correctly", async () => {
+      const app = alepha.inject(TestApp);
+
+      // Test sequential requests to avoid race conditions in testing
+      let successCount = 0;
+      let rateLimitedCount = 0;
+
+      for (let i = 0; i < 5; i++) {
+        try {
+          await app.limitedAction.run({});
+          successCount++;
+        } catch (e: any) {
+          if (e.message === "Too Many Requests") {
+            rateLimitedCount++;
+          }
+        }
+      }
+
+      expect(successCount).toBe(2);
+      expect(rateLimitedCount).toBe(3);
+    });
+
+    it("should handle missing IP gracefully", async () => {
+      const app = alepha.inject(TestApp);
+
+      // Should still work with default IP handling
+      const result = await app.limitedAction.run({});
+      expect(result).toBe("success");
+    });
+  });
+});

package/src/server/rate-limit/providers/ServerRateLimitProvider.spec.ts

@@ -0,0 +1,344 @@
+import { Alepha } from "alepha";
+import { AlephaCache } from "alepha/cache";
+import {
+  $action,
+  AlephaServer,
+  ServerProvider,
+  type ServerRequest,
+} from "alepha/server";
+import { afterEach, beforeEach, describe, expect, it, test } from "vitest";
+import {
+  $rateLimit,
+  AlephaServerRateLimit,
+  rateLimitOptions,
+  ServerRateLimitProvider,
+} from "../index.ts";
+
+describe("ServerRateLimitProvider", () => {
+  let alepha: Alepha;
+  let provider: ServerRateLimitProvider;
+
+  beforeEach(async () => {
+    alepha = Alepha.create().with(AlephaCache);
+    provider = alepha.inject(ServerRateLimitProvider);
+    await alepha.start();
+  });
+
+  afterEach(async () => {
+    await alepha.stop();
+  });
+
+  const createMockRequest = (ip: string = "127.0.0.1"): ServerRequest =>
+    ({
+      ip,
+      headers: {},
+      method: "GET",
+      url: "/test",
+      path: "/test",
+      query: {},
+      params: {},
+      body: undefined,
+    }) as any;
+
+  it("should allow requests within limit", async () => {
+    const req = createMockRequest();
+    const result = await provider.checkLimit(req, { max: 5, windowMs: 60000 });
+
+    expect(result.allowed).toBe(true);
+    expect(result.limit).toBe(5);
+    expect(result.remaining).toBe(4);
+  });
+
+  it("should block requests exceeding limit", async () => {
+    const req = createMockRequest();
+    const options = { max: 2, windowMs: 60000 };
+
+    // First request should be allowed
+    const result1 = await provider.checkLimit(req, options);
+    expect(result1.allowed).toBe(true);
+    expect(result1.remaining).toBe(1);
+
+    // Second request should be allowed
+    const result2 = await provider.checkLimit(req, options);
+    expect(result2.allowed).toBe(true);
+    expect(result2.remaining).toBe(0);
+
+    // Third request should be blocked
+    const result3 = await provider.checkLimit(req, options);
+    expect(result3.allowed).toBe(false);
+    expect(result3.remaining).toBe(0);
+    expect(result3.retryAfter).toBeGreaterThan(0);
+  });
+
+  it("should handle different IPs separately", async () => {
+    const req1 = createMockRequest("192.168.1.1");
+    const req2 = createMockRequest("192.168.1.2");
+    const options = { max: 1, windowMs: 60000 };
+
+    // Both requests should be allowed as they come from different IPs
+    const result1 = await provider.checkLimit(req1, options);
+    const result2 = await provider.checkLimit(req2, options);
+
+    expect(result1.allowed).toBe(true);
+    expect(result2.allowed).toBe(true);
+  });
+
+  it("should extract IP from x-forwarded-for header", async () => {
+    const options = { max: 1, windowMs: 60000 };
+
+    // First request with x-forwarded-for: 203.0.113.1
+    const req1 = createMockRequest("127.0.0.1");
+    req1.headers["x-forwarded-for"] = "203.0.113.1, 192.168.1.1";
+
+    const result1 = await provider.checkLimit(req1, options);
+    expect(result1.allowed).toBe(true);
+
+    // Second request with same x-forwarded-for should be blocked
+    const req2 = createMockRequest("127.0.0.1");
+    req2.headers["x-forwarded-for"] = "203.0.113.1, 192.168.1.1";
+
+    const result2 = await provider.checkLimit(req2, options);
+    expect(result2.allowed).toBe(false);
+
+    // Request with different x-forwarded-for should be allowed
+    const req3 = createMockRequest("127.0.0.1");
+    req3.headers["x-forwarded-for"] = "198.51.100.1, 192.168.1.1";
+
+    const result3 = await provider.checkLimit(req3, options);
+    expect(result3.allowed).toBe(true);
+  });
+});
+
+describe("ServerRateLimitProvider Module Integration", () => {
+  let alepha: Alepha;
+  let provider: ServerRateLimitProvider;
+
+  class TestApp {
+    test = $action({
+      handler: () => "success",
+    });
+  }
+
+  beforeEach(async () => {
+    alepha = Alepha.create()
+      .with(AlephaCache)
+      .with(AlephaServer)
+      .with(AlephaServerRateLimit)
+      .with(TestApp);
+    provider = alepha.inject(ServerRateLimitProvider);
+    await alepha.start();
+  });
+
+  afterEach(async () => {
+    await alepha.stop();
+  });
+
+  it("should integrate with Alepha framework successfully", async () => {
+    expect(provider).toBeDefined();
+    expect(provider).toBeInstanceOf(ServerRateLimitProvider);
+    expect(typeof provider.checkLimit).toBe("function");
+  });
+
+  it("should work with real action requests", async () => {
+    // Configure rate limit for testing
+    alepha.store.mut(rateLimitOptions, () => ({
+      max: 10,
+      windowMs: 60000,
+    }));
+
+    const app = alepha.inject(TestApp);
+
+    // First request should succeed
+    const result = await app.test.run({});
+    expect(result).toBe("success");
+
+    // Multiple requests should still work within limit
+    for (let i = 0; i < 5; i++) {
+      const result = await app.test.run({});
+      expect(result).toBe("success");
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------------------------------------------------
+
+describe("$rateLimit primitive", () => {
+  let alepha: Alepha;
+  let server: ServerProvider;
+
+  afterEach(async () => {
+    if (alepha) {
+      await alepha.stop();
+    }
+  });
+
+  test("should apply path-specific rate limit to matching routes", async () => {
+    class AppWithRateLimit {
+      // Path-specific rate limit for /api/v1/* routes
+      apiRateLimit = $rateLimit({
+        paths: ["/api/v1/*"],
+        max: 2,
+        windowMs: 60000,
+      });
+
+      // $action with path "/v1/data" creates route at "/api/v1/data"
+      apiAction = $action({
+        path: "/v1/data",
+        method: "POST",
+        handler: () => "success",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaCache)
+      .with(AlephaServer)
+      .with(AlephaServerRateLimit)
+      .with(AppWithRateLimit);
+
+    server = alepha.inject(ServerProvider);
+    await alepha.start();
+
+    // First two requests should succeed
+    const response1 = await fetch(`${server.hostname}/api/v1/data`, {
+      method: "POST",
+    });
+    expect(response1.status).toBe(200);
+    expect(response1.headers.get("x-ratelimit-limit")).toBe("2");
+    expect(response1.headers.get("x-ratelimit-remaining")).toBe("1");
+
+    const response2 = await fetch(`${server.hostname}/api/v1/data`, {
+      method: "POST",
+    });
+    expect(response2.status).toBe(200);
+    expect(response2.headers.get("x-ratelimit-remaining")).toBe("0");
+
+    // Third request should be rate limited
+    const response3 = await fetch(`${server.hostname}/api/v1/data`, {
+      method: "POST",
+    });
+    expect(response3.status).toBe(429);
+    expect(response3.headers.get("retry-after")).toBeDefined();
+  });
+
+  test("should register rate limit configs with provider", async () => {
+    class RegistrationApp {
+      limit1 = $rateLimit({
+        name: "api-limit",
+        paths: ["/api/*"],
+        max: 100,
+      });
+
+      limit2 = $rateLimit({
+        name: "admin-limit",
+        paths: ["/admin/*"],
+        max: 10,
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaCache)
+      .with(AlephaServer)
+      .with(AlephaServerRateLimit)
+      .with(RegistrationApp);
+
+    const rateLimitProvider = alepha.inject(ServerRateLimitProvider);
+    await alepha.start();
+
+    expect(rateLimitProvider.registeredConfigs).toHaveLength(2);
+    expect(rateLimitProvider.registeredConfigs[0].name).toBe("api-limit");
+    expect(rateLimitProvider.registeredConfigs[1].name).toBe("admin-limit");
+  });
+
+  test("should apply different rate limits to different paths", async () => {
+    class MultiRateLimitApp {
+      // Strict limit for admin routes
+      adminLimit = $rateLimit({
+        paths: ["/api/admin/*"],
+        max: 1,
+        windowMs: 60000,
+      });
+
+      // Lenient limit for public routes
+      publicLimit = $rateLimit({
+        paths: ["/api/public/*"],
+        max: 10,
+        windowMs: 60000,
+      });
+
+      adminAction = $action({
+        path: "/admin/users",
+        method: "GET",
+        handler: () => "admin",
+      });
+
+      publicAction = $action({
+        path: "/public/status",
+        method: "GET",
+        handler: () => "public",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaCache)
+      .with(AlephaServer)
+      .with(AlephaServerRateLimit)
+      .with(MultiRateLimitApp);
+
+    server = alepha.inject(ServerProvider);
+    await alepha.start();
+
+    // Admin route should have max: 1
+    const adminResponse1 = await fetch(`${server.hostname}/api/admin/users`);
+    expect(adminResponse1.status).toBe(200);
+    expect(adminResponse1.headers.get("x-ratelimit-limit")).toBe("1");
+
+    // Second admin request should be rate limited
+    const adminResponse2 = await fetch(`${server.hostname}/api/admin/users`);
+    expect(adminResponse2.status).toBe(429);
+
+    // Public route should have max: 10
+    const publicResponse = await fetch(`${server.hostname}/api/public/status`);
+    expect(publicResponse.status).toBe(200);
+    expect(publicResponse.headers.get("x-ratelimit-limit")).toBe("10");
+  });
+
+  test("should handle multiple paths in single $rateLimit primitive", async () => {
+    class MultiPathApp {
+      apiLimit = $rateLimit({
+        paths: ["/api/v1/*", "/api/v2/*"],
+        max: 5,
+        windowMs: 60000,
+      });
+
+      action1 = $action({
+        path: "/v1/data",
+        method: "GET",
+        handler: () => "v1",
+      });
+
+      action2 = $action({
+        path: "/v2/data",
+        method: "GET",
+        handler: () => "v2",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaCache)
+      .with(AlephaServer)
+      .with(AlephaServerRateLimit)
+      .with(MultiPathApp);
+
+    server = alepha.inject(ServerProvider);
+    await alepha.start();
+
+    // Both paths should have max: 5
+    const v1Response = await fetch(`${server.hostname}/api/v1/data`);
+    expect(v1Response.status).toBe(200);
+    expect(v1Response.headers.get("x-ratelimit-limit")).toBe("5");
+
+    const v2Response = await fetch(`${server.hostname}/api/v2/data`);
+    expect(v2Response.status).toBe(200);
+    expect(v2Response.headers.get("x-ratelimit-limit")).toBe("5");
+  });
+});