express-rate-limit 8.5.1 → 8.6.0

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,12 +17,24 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // source/index.ts
 var index_exports = {};
 __export(index_exports, {
+  DAY: () => DAY,
+  HOUR: () => HOUR,
+  MINUTE: () => MINUTE,
   MemoryStore: () => MemoryStore,
+  SECOND: () => SECOND,
   default: () => rate_limit_default,
   ipKeyGenerator: () => ipKeyGenerator,
   rateLimit: () => rate_limit_default
@@ -36,7 +50,7 @@ function ipKeyGenerator(ip, ipv6Subnet = 56) {
     if (address.is4()) return address.to4().correctForm();
     if (ipv6Subnet) {
       const subnet = new import_ip_address.Address6(`${ip}/${ipv6Subnet}`);
-      return `${subnet.startAddress().correctForm()}/${ipv6Subnet}`;
+      return subnet.networkForm();
     }
   }
   return ip;
@@ -200,6 +214,7 @@ var MemoryStore = class {
 
 // source/rate-limit.ts
 var import_node_net3 = require("node:net");
+var import_debug = __toESM(require("debug"), 1);
 
 // source/console-logger.ts
 var ConsoleLogger = {
@@ -699,6 +714,7 @@ var getValidations = (_enabled, logger) => {
         if (!(enabled[name] ?? enabled.default)) {
           return;
         }
+        enabled[name] = false;
         try {
           ;
           validation.apply(
@@ -711,6 +727,9 @@ var getValidations = (_enabled, logger) => {
         }
       };
   }
+  const inspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+  if (inspect)
+    wrappedValidations[inspect] = () => wrappedValidations.enabled;
   return wrappedValidations;
 };
 
@@ -859,9 +878,14 @@ var handleAsyncErrors = (fn) => async (request, response, next) => {
 var rateLimit = (passedOptions) => {
   const config = parseOptions(passedOptions ?? {});
   const options = getOptionsFromConfig(config);
+  const debug = (0, import_debug.default)("express-rate-limit");
+  debug("creating new rate limiter with %o", config.store.constructor.name);
+  for (const [key, val] of Object.entries(config))
+    debug("set %s to %o", key, val);
   config.validations.creationStack(config.store);
   config.validations.unsharedStore(config.store);
   if (typeof config.store.init === "function") {
+    debug("executing init for store");
     try {
       const storeInit = config.store.init(options);
       if (storeInit instanceof Promise) {
@@ -884,13 +908,18 @@ var rateLimit = (passedOptions) => {
       const closePromise = config.skipFailedRequests && new Promise((resolve) => response.once("close", resolve));
       const finishPromise = (config.skipFailedRequests || config.skipSuccessfulRequests) && new Promise((resolve) => response.once("finish", resolve));
       const errorPromise = config.skipFailedRequests && new Promise((resolve) => response.once("error", resolve));
+      debug("requested %o", request.originalUrl);
+      debug("request from ip %o", request.ip);
       const skip = await config.skip(request, response);
       if (skip) {
+        debug("skipping request");
         next();
         return;
       }
       const augmentedRequest = request;
       const key = await config.keyGenerator(request, response);
+      debug("computed key %o", key);
+      debug("incrementing count");
       let totalHits = 0;
       let resetTime;
       try {
@@ -920,6 +949,13 @@ var rateLimit = (passedOptions) => {
         resetTime,
         key
       };
+      for (const [key2, val] of Object.entries(info))
+        debug(
+          "set request.%s.%s to be %o",
+          config.requestPropertyName,
+          key2,
+          val
+        );
       Object.defineProperty(info, "current", {
         configurable: false,
         enumerable: false,
@@ -927,15 +963,18 @@ var rateLimit = (passedOptions) => {
       });
       augmentedRequest[config.requestPropertyName] = info;
       if (config.legacyHeaders && !response.headersSent) {
+        debug("set legacy headers");
         setLegacyHeaders(response, info);
       }
       if (config.standardHeaders && !response.headersSent) {
         switch (config.standardHeaders) {
           case "draft-6": {
+            debug("set ietf draft 6 headers");
             setDraft6Headers(response, info, config.windowMs);
             break;
           }
           case "draft-7": {
+            debug("set ietf draft 7 headers");
             config.validations.headersResetTime(info.resetTime);
             setDraft7Headers(response, info, config.windowMs);
             break;
@@ -943,6 +982,8 @@ var rateLimit = (passedOptions) => {
           case "draft-8": {
             const retrieveName = typeof config.identifier === "function" ? config.identifier(request, response) : config.identifier;
             const name = await retrieveName;
+            debug("set ietf draft 8 headers");
+            debug("set name to %o", name);
             config.validations.headersResetTime(info.resetTime);
             setDraft8Headers(response, info, config.windowMs, name, key);
             break;
@@ -957,6 +998,10 @@ var rateLimit = (passedOptions) => {
         let decremented = false;
         const decrementKey = async () => {
           if (!decremented) {
+            if (resetTime && Date.now() >= resetTime.getTime()) {
+              return;
+            }
+            debug("decrementing count");
             await config.store.decrement(key);
             decremented = true;
           }
@@ -964,8 +1009,12 @@ var rateLimit = (passedOptions) => {
         if (config.skipFailedRequests) {
           if (finishPromise) {
             void finishPromise.then(async () => {
-              if (!await config.requestWasSuccessful(request, response))
-                await decrementKey();
+              const success = await config.requestWasSuccessful(
+                request,
+                response
+              );
+              debug("computed requestWasSuccessful as %o", success);
+              if (!success) await decrementKey();
             });
           }
           if (closePromise) {
@@ -982,15 +1031,20 @@ var rateLimit = (passedOptions) => {
         if (config.skipSuccessfulRequests) {
           if (finishPromise) {
             void finishPromise.then(async () => {
-              if (await config.requestWasSuccessful(request, response))
-                await decrementKey();
+              const success = await config.requestWasSuccessful(
+                request,
+                response
+              );
+              debug("computed requestWasSuccessful as %o", success);
+              if (success) await decrementKey();
             });
           }
         }
       }
-      config.validations.disable();
       if (totalHits > limit) {
+        debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
+          debug("set retry-after header");
           setRetryAfterHeader(response, info, config.windowMs);
         }
         config.handler(request, response, next, options);
@@ -1007,9 +1061,19 @@ var rateLimit = (passedOptions) => {
   return middleware;
 };
 var rate_limit_default = rateLimit;
+
+// source/time-constants.ts
+var SECOND = 1e3;
+var MINUTE = 60 * SECOND;
+var HOUR = 60 * MINUTE;
+var DAY = 24 * HOUR;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DAY,
+  HOUR,
+  MINUTE,
   MemoryStore,
+  SECOND,
   ipKeyGenerator,
   rateLimit
 });

package/dist/index.d.cts

@@ -664,6 +664,24 @@ export declare class MemoryStore implements Store {
  * @public
  */
 export declare const rateLimit: (passedOptions?: Partial<Options>) => RateLimitRequestHandler;
+/**
+ * Time constants in milliseconds
+ *
+ * Use these with rate limit window calculations:
+ * @example
+ * // 5 minute window
+ * windowMs: 5 * MINUTE
+ *
+ * // 2 hour window
+ * windowMs: 2 * HOUR
+ *
+ * // 1 day window
+ * windowMs: 1 * DAY
+ */
+export declare const SECOND: number;
+export declare const MINUTE: number;
+export declare const HOUR: number;
+export declare const DAY: number;
 
 export {
 	rateLimit as default,

package/dist/index.d.mts

@@ -664,6 +664,24 @@ export declare class MemoryStore implements Store {
  * @public
  */
 export declare const rateLimit: (passedOptions?: Partial<Options>) => RateLimitRequestHandler;
+/**
+ * Time constants in milliseconds
+ *
+ * Use these with rate limit window calculations:
+ * @example
+ * // 5 minute window
+ * windowMs: 5 * MINUTE
+ *
+ * // 2 hour window
+ * windowMs: 2 * HOUR
+ *
+ * // 1 day window
+ * windowMs: 1 * DAY
+ */
+export declare const SECOND: number;
+export declare const MINUTE: number;
+export declare const HOUR: number;
+export declare const DAY: number;
 
 export {
 	rateLimit as default,

package/dist/index.d.ts

@@ -664,6 +664,24 @@ export declare class MemoryStore implements Store {
  * @public
  */
 export declare const rateLimit: (passedOptions?: Partial<Options>) => RateLimitRequestHandler;
+/**
+ * Time constants in milliseconds
+ *
+ * Use these with rate limit window calculations:
+ * @example
+ * // 5 minute window
+ * windowMs: 5 * MINUTE
+ *
+ * // 2 hour window
+ * windowMs: 2 * HOUR
+ *
+ * // 1 day window
+ * windowMs: 1 * DAY
+ */
+export declare const SECOND: number;
+export declare const MINUTE: number;
+export declare const HOUR: number;
+export declare const DAY: number;
 
 export {
 	rateLimit as default,

package/dist/index.mjs

@@ -7,7 +7,7 @@ function ipKeyGenerator(ip, ipv6Subnet = 56) {
     if (address.is4()) return address.to4().correctForm();
     if (ipv6Subnet) {
       const subnet = new Address6(`${ip}/${ipv6Subnet}`);
-      return `${subnet.startAddress().correctForm()}/${ipv6Subnet}`;
+      return subnet.networkForm();
     }
   }
   return ip;
@@ -171,6 +171,7 @@ var MemoryStore = class {
 
 // source/rate-limit.ts
 import { isIPv6 as isIPv62 } from "node:net";
+import createDebugLogger from "debug";
 
 // source/console-logger.ts
 var ConsoleLogger = {
@@ -670,6 +671,7 @@ var getValidations = (_enabled, logger) => {
         if (!(enabled[name] ?? enabled.default)) {
           return;
         }
+        enabled[name] = false;
         try {
           ;
           validation.apply(
@@ -682,6 +684,9 @@ var getValidations = (_enabled, logger) => {
         }
       };
   }
+  const inspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+  if (inspect)
+    wrappedValidations[inspect] = () => wrappedValidations.enabled;
   return wrappedValidations;
 };
 
@@ -830,9 +835,14 @@ var handleAsyncErrors = (fn) => async (request, response, next) => {
 var rateLimit = (passedOptions) => {
   const config = parseOptions(passedOptions ?? {});
   const options = getOptionsFromConfig(config);
+  const debug = createDebugLogger("express-rate-limit");
+  debug("creating new rate limiter with %o", config.store.constructor.name);
+  for (const [key, val] of Object.entries(config))
+    debug("set %s to %o", key, val);
   config.validations.creationStack(config.store);
   config.validations.unsharedStore(config.store);
   if (typeof config.store.init === "function") {
+    debug("executing init for store");
     try {
       const storeInit = config.store.init(options);
       if (storeInit instanceof Promise) {
@@ -855,13 +865,18 @@ var rateLimit = (passedOptions) => {
       const closePromise = config.skipFailedRequests && new Promise((resolve) => response.once("close", resolve));
       const finishPromise = (config.skipFailedRequests || config.skipSuccessfulRequests) && new Promise((resolve) => response.once("finish", resolve));
       const errorPromise = config.skipFailedRequests && new Promise((resolve) => response.once("error", resolve));
+      debug("requested %o", request.originalUrl);
+      debug("request from ip %o", request.ip);
       const skip = await config.skip(request, response);
       if (skip) {
+        debug("skipping request");
         next();
         return;
       }
       const augmentedRequest = request;
       const key = await config.keyGenerator(request, response);
+      debug("computed key %o", key);
+      debug("incrementing count");
       let totalHits = 0;
       let resetTime;
       try {
@@ -891,6 +906,13 @@ var rateLimit = (passedOptions) => {
         resetTime,
         key
       };
+      for (const [key2, val] of Object.entries(info))
+        debug(
+          "set request.%s.%s to be %o",
+          config.requestPropertyName,
+          key2,
+          val
+        );
       Object.defineProperty(info, "current", {
         configurable: false,
         enumerable: false,
@@ -898,15 +920,18 @@ var rateLimit = (passedOptions) => {
       });
       augmentedRequest[config.requestPropertyName] = info;
       if (config.legacyHeaders && !response.headersSent) {
+        debug("set legacy headers");
         setLegacyHeaders(response, info);
       }
       if (config.standardHeaders && !response.headersSent) {
         switch (config.standardHeaders) {
           case "draft-6": {
+            debug("set ietf draft 6 headers");
             setDraft6Headers(response, info, config.windowMs);
             break;
           }
           case "draft-7": {
+            debug("set ietf draft 7 headers");
             config.validations.headersResetTime(info.resetTime);
             setDraft7Headers(response, info, config.windowMs);
             break;
@@ -914,6 +939,8 @@ var rateLimit = (passedOptions) => {
           case "draft-8": {
             const retrieveName = typeof config.identifier === "function" ? config.identifier(request, response) : config.identifier;
             const name = await retrieveName;
+            debug("set ietf draft 8 headers");
+            debug("set name to %o", name);
             config.validations.headersResetTime(info.resetTime);
             setDraft8Headers(response, info, config.windowMs, name, key);
             break;
@@ -928,6 +955,10 @@ var rateLimit = (passedOptions) => {
         let decremented = false;
         const decrementKey = async () => {
           if (!decremented) {
+            if (resetTime && Date.now() >= resetTime.getTime()) {
+              return;
+            }
+            debug("decrementing count");
             await config.store.decrement(key);
             decremented = true;
           }
@@ -935,8 +966,12 @@ var rateLimit = (passedOptions) => {
         if (config.skipFailedRequests) {
           if (finishPromise) {
             void finishPromise.then(async () => {
-              if (!await config.requestWasSuccessful(request, response))
-                await decrementKey();
+              const success = await config.requestWasSuccessful(
+                request,
+                response
+              );
+              debug("computed requestWasSuccessful as %o", success);
+              if (!success) await decrementKey();
             });
           }
           if (closePromise) {
@@ -953,15 +988,20 @@ var rateLimit = (passedOptions) => {
         if (config.skipSuccessfulRequests) {
           if (finishPromise) {
             void finishPromise.then(async () => {
-              if (await config.requestWasSuccessful(request, response))
-                await decrementKey();
+              const success = await config.requestWasSuccessful(
+                request,
+                response
+              );
+              debug("computed requestWasSuccessful as %o", success);
+              if (success) await decrementKey();
             });
           }
         }
       }
-      config.validations.disable();
       if (totalHits > limit) {
+        debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
+          debug("set retry-after header");
           setRetryAfterHeader(response, info, config.windowMs);
         }
         config.handler(request, response, next, options);
@@ -978,8 +1018,18 @@ var rateLimit = (passedOptions) => {
   return middleware;
 };
 var rate_limit_default = rateLimit;
+
+// source/time-constants.ts
+var SECOND = 1e3;
+var MINUTE = 60 * SECOND;
+var HOUR = 60 * MINUTE;
+var DAY = 24 * HOUR;
 export {
+  DAY,
+  HOUR,
+  MINUTE,
   MemoryStore,
+  SECOND,
   rate_limit_default as default,
   ipKeyGenerator,
   rate_limit_default as rateLimit

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.5.1",
+	"version": "8.6.0",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -75,33 +75,36 @@
 		"prepare": "run-s compile && husky"
 	},
 	"dependencies": {
+		"debug": "^4.4.3",
 		"ip-address": "^10.2.0"
 	},
 	"peerDependencies": {
 		"express": ">= 4.11"
 	},
 	"devDependencies": {
+		"@asyncapi/specs": "6.8.1",
 		"@biomejs/biome": "2.4.6",
 		"@express-rate-limit/prettier": "1.1.1",
-		"@express-rate-limit/tsconfig": "1.0.2",
-		"@jest/globals": "30.3.0",
+		"@express-rate-limit/tsconfig": "1.0.5",
+		"@jest/globals": "30.4.1",
+		"@types/debug": "4.1.13",
 		"@types/express": "5.0.6",
 		"@types/jest": "30.0.0",
-		"@types/node": "25.5.0",
+		"@types/node": "26.1.1",
 		"@types/supertest": "7.2.0",
 		"del-cli": "7.0.0",
 		"dts-bundle-generator": "8.1.2",
-		"esbuild": "0.27.4",
+		"esbuild": "0.28.1",
 		"express": "5.2.1",
 		"husky": "9.1.7",
-		"jest": "30.3.0",
-		"lint-staged": "16.4.0",
-		"mintlify": "4.2.446",
+		"jest": "30.4.2",
+		"lint-staged": "17.0.8",
+		"mintlify": "4.2.688",
 		"npm-run-all": "4.1.5",
-		"prettier": "3.8.1",
+		"prettier": "3.9.5",
 		"ratelimit-header-parser": "0.1.0",
 		"supertest": "7.2.2",
-		"ts-jest": "29.4.6",
+		"ts-jest": "29.4.11",
 		"ts-node": "10.9.2",
 		"typescript": "5.9.3"
 	},

package/readme.md

@@ -21,10 +21,10 @@ The [full documentation](https://express-rate-limit.mintlify.app/overview) is
 available on-line.
 
 ```ts
-import { rateLimit } from 'express-rate-limit'
+import { rateLimit, MINUTE } from 'express-rate-limit'
 
 const limiter = rateLimit({
-	windowMs: 15 * 60 * 1000, // 15 minutes
+	windowMs: 15 * MINUTE, // SECOND, MINUTE, HOUR, and DAY constants are available, or a use bare number for milliseconds
 	limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes).
 	standardHeaders: 'draft-8', // draft-6: `RateLimit-*` headers; draft-7 & draft-8: combined `RateLimit` header
 	legacyHeaders: false, // Disable the `X-RateLimit-*` headers.