domma-cms 0.109.2 → 0.109.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/server/services/rate-limit.js +3 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "domma-cms",
3
- "version": "0.109.2",
3
+ "version": "0.109.3",
4
4
  "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
5
5
  "type": "module",
6
6
  "main": "server/server.js",
package/server/services/rate-limit.js CHANGED
@@ -16,6 +16,9 @@ export function rateLimitOptions({publicMax = 500, authenticatedMax = 3000} = {}
16
16
  global: true,
17
17
  timeWindow: '1 minute',
18
18
  async keyGenerator(request) {
19
+ // Explicit route limits retain their original IP-based buckets,
20
+ // even when the caller also holds a valid access token.
21
+ if (request.routeOptions.config.rateLimit) return request.ip;
19
22
  if (request.url.startsWith('/api/') && request.headers.authorization) {
20
23
  try {
21
24
  const user = await request.jwtVerify();