bulltrackers-module 1.0.910 → 1.0.911

package/functions/api-v3/middleware/identity.js

@@ -22,9 +22,9 @@ function createIdentityMiddleware() {
             let targetUserId = null;
             let identitySource = null;
 
-            // Some routes (billing, computations) must always act as the authenticated user and
-            // should ignore X-Target-User / query overrides. For those, we skip explicit targets
-            // and derive identity solely from Firebase auth.
+            // Some routes (billing, computations, workspace) must always act as the authenticated
+            // user and should ignore X-Target-User / query overrides. SignedInUsers documents are
+            // keyed by CID (eToro internal ID from verification); we resolve to CID when available.
             const path = req.path || '';
             const selfOnly = /^\/(billing|computations|workspace)\b/.test(path);
 
@@ -50,38 +50,44 @@ function createIdentityMiddleware() {
 
                 if (!targetUserId) {
                     // No header/query: acting user is the authenticated user.
-                    // Prefer UID so we don't depend on email lookup (e.g. test has no email_to_cid).
-                    if (uid) {
-                        targetUserId = uid;
-                        identitySource = 'firebase';
-                    } else if (req.firebaseUser.email) {
+                    // SignedInUsers is keyed by CID; prefer CID from email lookup when available.
+                    if (req.firebaseUser.email) {
                         try {
                             const lookup = await authService.lookupCidByEmail(req.firebaseUser.email);
-                            if (lookup?.cid) {
-                                targetUserId = lookup.cid;
+                            if (lookup?.cid != null) {
+                                targetUserId = String(lookup.cid);
                                 identitySource = 'firebase';
                             }
                         } catch (lookupError) {
                             console.warn(`[Identity] Email lookup failed: ${lookupError.message}`);
                         }
                     }
+                    if (!targetUserId && uid) {
+                        targetUserId = uid;
+                        identitySource = 'firebase';
+                    }
                 } else {
-                    // Header/query set a target. Allow if: target is UID, or target is my CID, or target is a PI (viewing public PI profile), or requester is a developer.
+                    // Header/query set a target. SignedInUsers is keyed by CID; if client sent
+                    // Firebase UID (e.g. extension only has uid), resolve to CID for same user.
                     const targetStr = String(targetUserId);
                     const uidStr = uid != null && uid !== '' ? String(uid) : '';
                     const targetMatchesUid = uidStr && targetStr === uidStr;
-                    let targetMatchesMyCid = false;
-                    let targetIsPi = false;
-                    if (!targetMatchesUid && req.firebaseUser.email) {
+                    let myCid = null;
+                    if (req.firebaseUser.email) {
                         try {
                             const lookup = await authService.lookupCidByEmail(req.firebaseUser.email);
-                            if (lookup?.cid != null) {
-                                targetMatchesMyCid = targetStr === String(lookup.cid);
-                            }
-                        } catch (lookupError) {
-                            // ignore; will fall through to developer check
+                            if (lookup?.cid != null) myCid = String(lookup.cid);
+                        } catch {
+                            // ignore
                         }
                     }
+                    // If client sent UID and it's me, use my CID for SignedInUsers paths
+                    if (targetMatchesUid && myCid) {
+                        targetUserId = myCid;
+                        identitySource = 'header';
+                    }
+                    const targetMatchesMyCid = myCid && targetStr === myCid;
+                    let targetIsPi = false;
                     if (!targetMatchesUid && !targetMatchesMyCid) {
                         try {
                             targetIsPi = await userDataService.isPopularInvestor(targetStr);

package/functions/api-v3/middleware/upstashRateLimit.js

@@ -178,10 +178,14 @@ async function checkVerificationUserLimit(userId) {
 
 /**
  * Apply rate limit middleware: use Upstash when configured, otherwise use express-rate-limit.
+ * Skip rate limiting in development so the dev server is not impacted by API-V3 limits.
  * @param {Object} app - Express app
  * @param {Function} expressRateLimit - express-rate-limit function
  */
 function applyRateLimits(app, expressRateLimit) {
+    const devBypass = process.env.NODE_ENV === 'development' || process.env.API_RATE_LIMIT_DEV_BYPASS === 'true';
+    if (devBypass) return;
+
     if (isUpstashEnabled()) {
         app.use('/verification', verificationRateLimit);
         // Apply global API rate limit to all routes EXCEPT /verification to avoid double counting.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bulltrackers-module",
-  "version": "1.0.910",
+  "version": "1.0.911",
   "description": "Helper Functions for Bulltrackers.",
   "main": "index.js",
   "files": [