bdy 1.23.8-master → 1.23.8

package/distTs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.23.8-master",
+  "version": "1.23.8",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",

package/distTs/src/logThrottle.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+class LogThrottle {
+    interval;
+    reports = new Map();
+    onFlush;
+    timer = null;
+    // onFlush(kind, suppressed) - optional. Without it the tail of a burst is lost, which is fine for
+    // a throttle whose caller reports the count some other way, and wrong for every current caller.
+    constructor(interval, onFlush) {
+        this.interval = interval;
+        this.onFlush = onFlush || null;
+        if (this.onFlush) {
+            // unref: this sweep must never be the reason the agent stays alive after its tunnel is gone.
+            this.timer = setInterval(() => this.flush(), interval);
+            if (this.timer.unref)
+                this.timer.unref();
+        }
+    }
+    hit(kind) {
+        const now = Date.now();
+        const last = this.reports.get(kind);
+        if (last && now - last.at < this.interval) {
+            last.suppressed += 1;
+            return -1;
+        }
+        const suppressed = last ? last.suppressed : 0;
+        this.reports.set(kind, { at: now, suppressed: 0 });
+        return suppressed;
+    }
+    // Only kinds whose window has fully elapsed: one still inside its window is not quiet yet, and
+    // the next hit will carry its count the normal way. Deleting while iterating a Map is safe.
+    flush() {
+        if (!this.onFlush)
+            return;
+        const now = Date.now();
+        for (const [kind, last] of this.reports) {
+            if (now - last.at < this.interval)
+                continue;
+            if (!last.suppressed) {
+                this.reports.delete(kind);
+                continue;
+            }
+            const { suppressed } = last;
+            last.suppressed = 0;
+            last.at = now;
+            this.onFlush(kind, suppressed);
+        }
+    }
+    stop() {
+        if (!this.timer)
+            return;
+        clearInterval(this.timer);
+        this.timer = null;
+    }
+}
+exports.default = LogThrottle;

package/distTs/src/tunnel/http/ip.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestIp = void 0;
+const utils_1 = require("../../utils");
+// The client address behind a request, from whichever place this channel carries it.
+//
+// Historically the address belonged to the CHANNEL: the worker put it in the 50-byte handshake and
+// the agent set it as the channel's remoteAddress, which was exact because a channel served one
+// client. Shared h2 channels break that - one channel now carries requests from many clients - so
+// on those the worker sends the address per request instead.
+//
+// Which source to trust is decided by the channel's handshake type (`sharedIp`), never by the
+// header being present. A worker old enough to open a non-shared channel is also old enough not to
+// strip a client-supplied copy of the header, so trusting presence alone would let any client on
+// such a tunnel dictate the address seen by the target app, the rate limiter, the request log and
+// the PAT audit trail. Tie it to the channel and that whole class of confusion cannot arise.
+const channelOf = (req) => req.httpVersion === '2.0' ? req.socket.stream : req.socket;
+const requestIp = (req) => {
+    const channel = channelOf(req);
+    if (channel && channel.sharedIp) {
+        const claimed = req.headers ? req.headers[utils_1.TUNNEL_CLIENT_IP_HEADER] : null;
+        // A shared channel with no header means a worker bug, not a client one. '::1' matches what the
+        // legacy path already reports when it cannot resolve an address, so callers need no new case.
+        return (Array.isArray(claimed) ? claimed[0] : claimed) || '::1';
+    }
+    if (req.httpVersion === '2.0') {
+        return channel ? channel.remoteAddress : '::1';
+    }
+    return req.socket.remoteAddress;
+};
+exports.requestIp = requestIp;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.23.8-master",
+  "version": "1.23.8",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",