daiso 1.0.10 → 1.1.0

package/dist/durableObjects/rateLimitMetricsStore.js

@@ -0,0 +1,144 @@
+/**
+ * 차단된 일일 호출 제한 이벤트를 정확히 집계하는 SQLite 저장소
+ */
+export const RATE_LIMIT_METRICS_RETENTION_DAYS = 30;
+export const RATE_LIMIT_METRICS_LEDGER_NAME = '__blocked-ledger-v1__';
+export const RATE_LIMIT_SERVICES = ['oliveyoung', 'cgv', 'cu', 'gs25', 'lottemart'];
+export class StaleRateLimitEventDayError extends Error {
+    constructor() {
+        super('차단 이벤트 날짜가 만료되었습니다.');
+        this.name = 'StaleRateLimitEventDayError';
+    }
+}
+const KST_OFFSET_MS = 9 * 60 * 60 * 1000;
+const ALARM_DELAY_MS = 5 * 60 * 1000;
+// 요청 경로의 SQLite 쓰기 증폭을 제한하고 나머지는 일일 alarm에 맡깁니다.
+const OPPORTUNISTIC_CLEANUP_LIMIT = 100;
+function toKstDay(nowMs) {
+    return new Date(nowMs + KST_OFFSET_MS).toISOString().slice(0, 10);
+}
+function retainedCutoffDay(asOfDay) {
+    const asOf = new Date(`${asOfDay}T00:00:00.000Z`);
+    return new Date(Date.UTC(asOf.getUTCFullYear(), asOf.getUTCMonth(), asOf.getUTCDate() - (RATE_LIMIT_METRICS_RETENTION_DAYS - 1)))
+        .toISOString()
+        .slice(0, 10);
+}
+function retentionCutoffDay(nowMs) {
+    return retainedCutoffDay(toKstDay(nowMs));
+}
+function nextAlarmTime(nowMs) {
+    const shifted = new Date(nowMs + KST_OFFSET_MS);
+    return (Date.UTC(shifted.getUTCFullYear(), shifted.getUTCMonth(), shifted.getUTCDate() + 1) -
+        KST_OFFSET_MS +
+        ALARM_DELAY_MS);
+}
+function isRateLimitService(service) {
+    return RATE_LIMIT_SERVICES.includes(service);
+}
+function toAggregate(row) {
+    return {
+        blockedRequests: row.blocked_requests,
+        uniqueIdentities: row.unique_identities,
+    };
+}
+export class RateLimitMetricsStore {
+    state;
+    sql;
+    constructor(state) {
+        this.state = state;
+        this.sql = state.storage.sql;
+        this.initializeSchema();
+    }
+    async record(event) {
+        if (event.day !== toKstDay(event.occurredAt)) {
+            throw new TypeError('이벤트 날짜가 KST 발생 날짜와 일치하지 않습니다.');
+        }
+        await this.ensureAlarm();
+        const commitNowMs = Date.now();
+        if (event.day !== toKstDay(commitNowMs)) {
+            throw new StaleRateLimitEventDayError();
+        }
+        this.cleanupExpiredBatch(commitNowMs);
+        this.sql.exec(`INSERT OR IGNORE INTO blocked_events
+        (event_id, occurred_at, day, service, identity_id)
+       VALUES (?, ?, ?, ?, ?)`, event.eventId, event.occurredAt, event.day, event.service, event.identityId);
+    }
+    async query(input) {
+        if (input.service !== undefined && !isRateLimitService(input.service)) {
+            throw new TypeError('지원하지 않는 서비스입니다.');
+        }
+        const cutoffDay = retainedCutoffDay(input.asOfDay);
+        const serviceClause = input.service === undefined ? '' : ' AND service = ?';
+        const bindings = input.service === undefined
+            ? [input.from, input.to, cutoffDay]
+            : [input.from, input.to, cutoffDay, input.service];
+        const whereClause = `day >= ? AND day <= ? AND day >= ?${serviceClause}`;
+        const totals = this.sql
+            .exec(`SELECT COUNT(*) AS blocked_requests,
+                COUNT(DISTINCT identity_id) AS unique_identities
+         FROM blocked_events
+         WHERE ${whereClause}`, ...bindings)
+            .one();
+        const daily = this.sql
+            .exec(`SELECT day,
+                COUNT(*) AS blocked_requests,
+                COUNT(DISTINCT identity_id) AS unique_identities
+         FROM blocked_events
+         WHERE ${whereClause}
+         GROUP BY day
+         ORDER BY day ASC`, ...bindings)
+            .toArray();
+        const services = this.sql
+            .exec(`SELECT day,
+                service,
+                COUNT(*) AS blocked_requests,
+                COUNT(DISTINCT identity_id) AS unique_identities
+         FROM blocked_events
+         WHERE ${whereClause}
+         GROUP BY day, service
+         ORDER BY day ASC, service ASC`, ...bindings)
+            .toArray();
+        const stats = {
+            totals: toAggregate(totals),
+            daily: daily.map((row) => ({ day: row.day, ...toAggregate(row) })),
+            services: services.map((row) => ({
+                day: row.day,
+                service: row.service,
+                ...toAggregate(row),
+            })),
+        };
+        this.cleanupExpiredBatch(Date.now());
+        return stats;
+    }
+    async cleanup(nowMs = Date.now()) {
+        this.sql.exec('DELETE FROM blocked_events WHERE day < ?', retentionCutoffDay(nowMs));
+    }
+    async ensureAlarm(nowMs = Date.now()) {
+        if ((await this.state.storage.getAlarm()) !== null) {
+            return;
+        }
+        await this.state.storage.setAlarm(nextAlarmTime(nowMs));
+    }
+    initializeSchema() {
+        this.sql.exec(`CREATE TABLE IF NOT EXISTS blocked_events (
+      event_id TEXT PRIMARY KEY,
+      occurred_at INTEGER NOT NULL,
+      day TEXT NOT NULL,
+      service TEXT NOT NULL,
+      identity_id TEXT NOT NULL
+    )`);
+        this.sql.exec('CREATE INDEX IF NOT EXISTS idx_blocked_events_day_service ON blocked_events(day, service)');
+        this.sql.exec('CREATE INDEX IF NOT EXISTS idx_blocked_events_day_identity ON blocked_events(day, identity_id)');
+        this.sql.exec('CREATE INDEX IF NOT EXISTS idx_blocked_events_day_service_identity ON blocked_events(day, service, identity_id)');
+    }
+    cleanupExpiredBatch(nowMs) {
+        this.sql.exec(`DELETE FROM blocked_events
+       WHERE event_id IN (
+         SELECT event_id
+         FROM blocked_events
+         WHERE day < ?
+         ORDER BY day ASC, event_id ASC
+         LIMIT ?
+       )`, retentionCutoffDay(nowMs), OPPORTUNISTIC_CLEANUP_LIMIT);
+    }
+}

package/dist/index.js

@@ -11,6 +11,7 @@ import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/
 import { ServiceRegistry } from './core/registry.js';
 import { createDaisoService } from './services/daiso/index.js';
 import { createOliveyoungService } from './services/oliveyoung/index.js';
+import { createDtryxService } from './services/dtryx/index.js';
 import { createMegaboxService } from './services/megabox/index.js';
 import { createCgvService } from './services/cgv/index.js';
 import { createLotteCinemaService } from './services/lottecinema/index.js';
@@ -27,22 +28,12 @@ import { createPromptResponse } from './pages/prompt.js';
 import { createFullOpenApiJsonResponse, createFullOpenApiYamlResponse, createOpenApiJsonResponse, createOpenApiYamlResponse, } from './pages/openapi.js';
 import { createPrivacyResponse } from './pages/privacy.js';
 import { buildActionQueryTargetUrl } from './api/actionsProxy.js';
-import { registerDaisoRoutes } from './api/routes/daisoRoutes.js';
-import { registerOliveyoungRoutes } from './api/routes/oliveyoungRoutes.js';
-import { registerMegaboxRoutes } from './api/routes/megaboxRoutes.js';
-import { registerCgvRoutes } from './api/routes/cgvRoutes.js';
-import { registerLotteCinemaRoutes } from './api/routes/lottecinemaRoutes.js';
-import { registerLotteMartRoutes } from './api/routes/lottemartRoutes.js';
-import { registerCuRoutes } from './api/routes/cuRoutes.js';
-import { registerEmart24Routes } from './api/routes/emart24Routes.js';
-import { registerGs25Routes } from './api/routes/gs25Routes.js';
-import { registerSevenElevenRoutes } from './api/routes/sevenelevenRoutes.js';
-import { registerPlacesRoutes } from './api/routes/placesRoutes.js';
-import { registerOpinetRoutes } from './api/routes/opinetRoutes.js';
-import { registerCompareRoutes } from './api/routes/compareRoutes.js';
-import { registerFeedbackRoutes } from './api/routes/feedbackRoutes.js';
 import { registerHealthRoutes } from './api/routes/healthRoutes.js';
+import { registerServiceRoutes } from './api/routes/registerServiceRoutes.js';
+import { registerRateLimitStatsRoutes } from './api/routes/rateLimitStatsRoutes.js';
 import { buildConfigStatus } from './api/configStatus.js';
+import { createDailyRateLimitMiddleware } from './middleware/dailyRateLimit.js';
+export { DailyRateLimiter } from './durableObjects/dailyRateLimiter.js';
 // 서버 메타데이터
 const SERVER_NAME = 'multi-service-mcp';
 const SERVER_VERSION = '1.0.0';
@@ -59,8 +50,9 @@ const createRegistry = (bindings) => {
         () => createGs25Service({
             googleMapsApiKey: bindings?.GOOGLE_MAPS_API_KEY,
             zyteApiKey: bindings?.ZYTE_API_KEY,
+            apiKey: bindings?.GS25_API_KEY,
         }),
-        createSevenElevenService,
+        () => createSevenElevenService({ zyteApiKey: bindings?.ZYTE_API_KEY }),
         createCompareService,
         () => createFeedbackService({
             supabaseUrl: bindings?.SUPABASE_URL,
@@ -74,13 +66,17 @@ const createRegistry = (bindings) => {
             apiKey: bindings?.OPINET_API_KEY,
             googleMapsApiKey: bindings?.GOOGLE_MAPS_API_KEY,
         }),
-        createCuService,
+        () => createCuService({
+            zyteApiKey: bindings?.ZYTE_API_KEY,
+            googleMapsApiKey: bindings?.GOOGLE_MAPS_API_KEY,
+        }),
         createEmart24Service,
         () => createLotteMartService({
             googleMapsApiKey: bindings?.GOOGLE_MAPS_API_KEY,
             zyteApiKey: bindings?.ZYTE_API_KEY,
         }),
         createMegaboxService,
+        createDtryxService,
         () => createLotteCinemaService({
             googleMapsApiKey: bindings?.GOOGLE_MAPS_API_KEY,
         }),
@@ -259,6 +255,8 @@ app.use('*', cors({
     ],
     exposeHeaders: ['mcp-session-id', 'mcp-protocol-version'],
 }));
+// Zyte 연동 공개 GET API의 일일 호출량을 IP별로 제한합니다.
+app.use('/api/*', createDailyRateLimitMiddleware());
 // 기본 정보 엔드포인트 (GET 요청만)
 app.get('/', (c) => {
     return c.body(ROOT_INFO_JSON, 200, ROOT_INFO_HEADERS);
@@ -268,6 +266,8 @@ app.on(['POST', 'DELETE'], '/', handleRootMcpRequest);
 // 헬스 체크 엔드포인트
 app.get('/health', (c) => c.json({ status: 'ok', config: buildConfigStatus(c.env) }));
 registerHealthRoutes(app);
+registerRateLimitStatsRoutes(app);
+registerServiceRoutes(app);
 // 프롬프트 페이지 (MCP 미지원 에이전트용)
 app.get('/prompt', (c) => {
     const baseUrl = new URL(c.req.url).origin;
@@ -296,20 +296,6 @@ app.get('/privacy', (c) => {
     return createPrivacyResponse(baseUrl);
 });
 // GET API 엔드포인트 (MCP 미지원 에이전트용)
-registerDaisoRoutes(app);
-registerGs25Routes(app);
-registerSevenElevenRoutes(app);
-registerCompareRoutes(app);
-registerFeedbackRoutes(app);
-registerPlacesRoutes(app);
-registerOpinetRoutes(app);
-registerCuRoutes(app);
-registerEmart24Routes(app);
-registerLotteMartRoutes(app);
-registerOliveyoungRoutes(app);
-registerMegaboxRoutes(app);
-registerLotteCinemaRoutes(app);
-registerCgvRoutes(app);
 app.get('/api/actions/query', async (c) => {
     try {
         const targetUrl = buildActionQueryTargetUrl(c.req.url);

package/dist/middleware/dailyRateLimit.js

@@ -0,0 +1,176 @@
+/**
+ * Zyte 연동 공개 GET API의 클라이언트별 일일 호출 제한 미들웨어
+ */
+import { errorResponse } from '../api/response.js';
+import { DAILY_RATE_LIMIT, nextKstMidnightEpochSeconds, toKstDay, } from '../durableObjects/dailyRateLimiter.js';
+import { RATE_LIMIT_METRICS_LEDGER_NAME, } from '../durableObjects/rateLimitMetricsStore.js';
+const PROTECTED_SERVICES = [
+    { prefix: '/api/oliveyoung/', service: 'oliveyoung' },
+    { prefix: '/api/cgv/', service: 'cgv' },
+    { prefix: '/api/cu/', service: 'cu' },
+    { prefix: '/api/gs25/', service: 'gs25' },
+    { prefix: '/api/lottemart/', service: 'lottemart' },
+];
+const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+// Cloudflare가 교차 존 Worker subrequest에 사용하는 공통 client IP
+const CROSS_ZONE_WORKER_CLIENT_IP = '2a06:98c0:3600::103';
+function resolveRateLimitService(request) {
+    if (request.method !== 'GET') {
+        return null;
+    }
+    const pathname = new URL(request.url).pathname;
+    return PROTECTED_SERVICES.find(({ prefix }) => pathname.startsWith(prefix))?.service ?? null;
+}
+export function isDailyRateLimitedRequest(request) {
+    return resolveRateLimitService(request) !== null;
+}
+function isHealthCheckBypass(request, env) {
+    const secret = env?.HEALTH_CHECK_SECRET?.trim();
+    if (!secret) {
+        return false;
+    }
+    return request.headers.get('x-health-check-key')?.trim() === secret;
+}
+export async function hashRateLimitIdentity(ip) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(ip));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+function resolveRateLimitIdentity(request) {
+    const ip = request.headers.get('CF-Connecting-IP')?.trim();
+    if (!ip || ip !== CROSS_ZONE_WORKER_CLIENT_IP) {
+        return ip || null;
+    }
+    const workerZone = request.headers.get('CF-Worker')?.trim().toLowerCase();
+    return workerZone ? `worker-zone:${workerZone}` : ip;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isExactDate(value) {
+    if (typeof value !== 'string' || !DATE_PATTERN.test(value)) {
+        return false;
+    }
+    const timestamp = Date.parse(`${value}T00:00:00.000Z`);
+    return Number.isFinite(timestamp) && new Date(timestamp).toISOString().slice(0, 10) === value;
+}
+function isSafeIntegerInRange(value, minimum, maximum) {
+    return (typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum && value <= maximum);
+}
+function isDailyRateLimitResult(value) {
+    if (!isRecord(value) || typeof value.allowed !== 'boolean') {
+        return false;
+    }
+    const { allowed, count, remaining, resetAt, day } = value;
+    if (!isSafeIntegerInRange(count, 0, DAILY_RATE_LIMIT) ||
+        !isSafeIntegerInRange(remaining, 0, DAILY_RATE_LIMIT) ||
+        !isSafeIntegerInRange(resetAt, 1, Number.MAX_SAFE_INTEGER) ||
+        !isExactDate(day)) {
+        return false;
+    }
+    const countersMatch = count + remaining === DAILY_RATE_LIMIT;
+    return allowed ? countersMatch && count > 0 : count === DAILY_RATE_LIMIT && remaining === 0;
+}
+async function consumeDailyRateLimitDecision(request, env) {
+    const service = resolveRateLimitService(request);
+    if (!service || isHealthCheckBypass(request, env)) {
+        return null;
+    }
+    const identity = resolveRateLimitIdentity(request);
+    const namespace = env?.DAILY_RATE_LIMITER;
+    if (!identity || !namespace) {
+        return null;
+    }
+    try {
+        const identityId = namespace.idFromName(await hashRateLimitIdentity(identity));
+        const stub = namespace.get(identityId);
+        const response = await stub.fetch('https://daily-rate-limit/consume', { method: 'POST' });
+        if (!response.ok) {
+            console.error('일일 호출 제한 확인 실패', `Durable Object HTTP ${response.status}`);
+            return null;
+        }
+        const result = await response.json();
+        if (!isDailyRateLimitResult(result)) {
+            console.error('일일 호출 제한 응답 검증 실패');
+            return null;
+        }
+        const nowMs = Date.now();
+        if (result.day !== toKstDay(nowMs)) {
+            console.error('일일 호출 제한 날짜 전환 감지');
+            return null;
+        }
+        if (result.resetAt !== nextKstMidnightEpochSeconds(nowMs)) {
+            console.error('일일 호출 제한 초기화 시각 검증 실패');
+            return null;
+        }
+        return {
+            result,
+            service,
+            identityId,
+            namespace,
+            nowMs,
+        };
+    }
+    catch {
+        console.error('일일 호출 제한 확인 실패');
+        return null;
+    }
+}
+export async function consumeDailyRateLimit(request, env) {
+    return (await consumeDailyRateLimitDecision(request, env))?.result ?? null;
+}
+async function recordBlockedRateLimitEvent(decision) {
+    const event = {
+        eventId: crypto.randomUUID(),
+        occurredAt: decision.nowMs,
+        day: decision.result.day,
+        service: decision.service,
+        identityId: decision.identityId.toString(),
+    };
+    try {
+        const ledgerId = decision.namespace.idFromName(RATE_LIMIT_METRICS_LEDGER_NAME);
+        const ledger = decision.namespace.get(ledgerId);
+        const response = await ledger.fetch('https://daily-rate-limit/blocked-events', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(event),
+        });
+        if (!(response instanceof Response)) {
+            console.error('일일 호출 제한 원장 기록 실패', '응답 형식 오류');
+            return false;
+        }
+        if (response.status !== 204) {
+            console.error('일일 호출 제한 원장 기록 실패', `Durable Object HTTP ${response.status}`);
+            return false;
+        }
+        return true;
+    }
+    catch {
+        console.error('일일 호출 제한 원장 기록 실패');
+        return false;
+    }
+}
+export function setRateLimitHeaders(headers, result) {
+    headers.set('X-RateLimit-Limit', String(DAILY_RATE_LIMIT));
+    headers.set('X-RateLimit-Remaining', String(result.remaining));
+    headers.set('X-RateLimit-Reset', String(result.resetAt));
+}
+export function createDailyRateLimitMiddleware() {
+    return async (c, next) => {
+        const decision = await consumeDailyRateLimitDecision(c.req.raw, c.env);
+        if (!decision) {
+            return next();
+        }
+        const { result } = decision;
+        if (!result.allowed) {
+            if (!(await recordBlockedRateLimitEvent(decision))) {
+                return next();
+            }
+            const response = errorResponse(c, 'DAILY_RATE_LIMIT_EXCEEDED', '이 IP의 일일 호출 한도 3,000회를 초과했습니다.', 429);
+            setRateLimitHeaders(response.headers, result);
+            response.headers.set('Retry-After', String(Math.max(1, result.resetAt - Math.floor(decision.nowMs / 1000))));
+            return response;
+        }
+        await next();
+        setRateLimitHeaders(c.res.headers, result);
+    };
+}

package/dist/pages/openapiFullSpec.js

@@ -14,6 +14,7 @@ import { OPENAPI_PATHS_PLACES } from './openapiSpecPathsPlaces.js';
 import { OPENAPI_PATHS_OPINET } from './openapiSpecPathsOpinet.js';
 import { OPENAPI_PATHS_COMPARE } from './openapiSpecPathsCompare.js';
 import { OPENAPI_PATHS_FEEDBACK } from './openapiSpecPathsFeedback.js';
+import { OPENAPI_PATHS_DTRYX } from './openapiSpecPathsDtryx.js';
 import { OPENAPI_COMPONENTS } from './openapiSpecComponents.js';
 export function generateFullOpenApiSpec(baseUrl) {
     return {
@@ -63,6 +64,7 @@ export function generateFullOpenApiSpec(baseUrl) {
             ...OPENAPI_PATHS_MEGABOX,
             ...OPENAPI_PATHS_LOTTECINEMA,
             ...OPENAPI_PATHS_CGV,
+            ...OPENAPI_PATHS_DTRYX,
         },
         components: OPENAPI_COMPONENTS,
     };