hazo_secure 0.5.0 → 1.1.0

package/dist/ratelimit/index.js

@@ -21,7 +21,7 @@ var MemoryRateLimitStore = class {
     }
     return { ...e.state };
   }
-  async increment(key, windowMs) {
+  async increment(key, windowMs, _max) {
     const t = this.now();
     const existing = this.map.get(key);
     if (!existing || existing.expiresAt <= t) {
@@ -57,6 +57,101 @@ function getDefaultMemoryStore() {
   return defaultStore;
 }
 
+// src/ratelimit/store-connect.ts
+import { HazoConfigError, HazoValidationError, optional_import } from "hazo_core";
+var ConnectRateLimitStore = class {
+  #getSvc;
+  #now;
+  constructor(opts) {
+    if (opts._svc) {
+      this.#getSvc = opts._svc;
+    } else if (opts.getAdapter) {
+      const getAdapter = opts.getAdapter;
+      this.#getSvc = async () => {
+        const mod = await optional_import(
+          "hazo_connect/server"
+        );
+        if (!mod) {
+          throw new HazoConfigError({
+            code: "HAZO_SECURE_RATELIMIT_CONNECT_MISSING",
+            pkg: "hazo_secure",
+            message: "ConnectRateLimitStore requires hazo_connect to be installed. Install it or pass `_svc` directly."
+          });
+        }
+        const adapter = await getAdapter();
+        return mod.createCrudService(adapter, "hazo_rl_buckets", {
+          autoId: { enabled: false, column: "id" }
+        });
+      };
+    } else {
+      throw new HazoConfigError({
+        code: "HAZO_SECURE_RATELIMIT_INVALID_STORE_OPTIONS",
+        pkg: "hazo_secure",
+        message: "ConnectRateLimitStore: provide getAdapter or _svc"
+      });
+    }
+    this.#now = opts.now ?? Date.now;
+  }
+  async svc() {
+    return this.#getSvc();
+  }
+  async get(key) {
+    const svc = await this.svc();
+    const row = await svc.findOneBy({ id: key });
+    if (!row) return null;
+    const now = this.#now();
+    const elapsedMs = now - new Date(row.last_refill_at).getTime();
+    const tokens = Math.min(row.max_tokens, row.tokens + elapsedMs * row.refill_rate_per_ms);
+    const storedTokens = Math.max(0, tokens);
+    const resetAt = now + Math.ceil(Math.max(0, 1 - storedTokens) / row.refill_rate_per_ms);
+    return { count: Math.max(0, row.max_tokens - tokens), resetAt };
+  }
+  async increment(key, windowMs, max) {
+    if (max === void 0) {
+      throw new HazoValidationError({
+        code: "HAZO_SECURE_RATELIMIT_MISSING_MAX",
+        pkg: "hazo_secure",
+        message: "ConnectRateLimitStore requires max in increment(). Ensure createRateLimiter / checkRateLimit receives { max }."
+      });
+    }
+    const svc = await this.svc();
+    const now = this.#now();
+    const refillRatePerMs = max / windowMs;
+    const row = await svc.findOneBy({ id: key });
+    let tokensAfter;
+    if (!row) {
+      tokensAfter = max - 1;
+      await svc.insert({
+        id: key,
+        tokens: Math.max(0, tokensAfter),
+        last_refill_at: new Date(now).toISOString(),
+        max_tokens: max,
+        refill_rate_per_ms: refillRatePerMs
+      });
+    } else {
+      const elapsedMs = now - new Date(row.last_refill_at).getTime();
+      const refilledTokens = Math.min(max, row.tokens + elapsedMs * refillRatePerMs);
+      tokensAfter = refilledTokens - 1;
+      await svc.updateById(key, {
+        tokens: Math.max(0, tokensAfter),
+        last_refill_at: new Date(now).toISOString(),
+        max_tokens: max,
+        refill_rate_per_ms: refillRatePerMs
+      });
+    }
+    const count = max - tokensAfter;
+    const storedTokens = Math.max(0, tokensAfter);
+    const refillNeeded = Math.max(0, 1 - storedTokens);
+    const resetAt = now + Math.ceil(refillNeeded / refillRatePerMs);
+    return { count, resetAt };
+  }
+  async reset(key) {
+    const svc = await this.svc();
+    const row = await svc.findOneBy({ id: key });
+    if (row) await svc.deleteById(key);
+  }
+};
+
 // src/ratelimit/index.ts
 function defaultKeyResolver(req) {
   const headers = req.headers;
@@ -73,7 +168,7 @@ function createRateLimiter(opts) {
   const keyResolver = opts.keyResolver ?? defaultKeyResolver;
   const now = opts.now ?? Date.now;
   async function checkKey(key) {
-    const state = await store.increment(key, opts.windowMs);
+    const state = await store.increment(key, opts.windowMs, opts.max);
     const allowed = state.count <= opts.max;
     const remaining = Math.max(0, opts.max - state.count);
     const retryAfterSeconds = Math.max(0, Math.ceil((state.resetAt - now()) / 1e3));
@@ -113,6 +208,7 @@ function withRateLimit(handler, opts) {
   return fn;
 }
 export {
+  ConnectRateLimitStore,
   MemoryRateLimitStore,
   checkRateLimit,
   createRateLimiter,

package/migrations/001_hazo_rl_buckets.sql

@@ -0,0 +1,26 @@
+-- hazo_secure rate-limit token bucket table
+-- Supports both PostgreSQL and SQLite
+--
+-- Column: id           — rate-limit key (e.g. "1.2.3.4:/api/auth/login")
+-- Column: tokens       — current token count (REAL so partial tokens are tracked)
+-- Column: last_refill_at — when tokens was last updated
+-- Column: max_tokens   — cap configured for this key (stored for introspection)
+-- Column: refill_rate_per_ms — tokens added per millisecond
+--
+-- SQLite version (use this for local dev):
+-- CREATE TABLE IF NOT EXISTS hazo_rl_buckets (
+--   id                  TEXT NOT NULL PRIMARY KEY,
+--   tokens              REAL NOT NULL,
+--   last_refill_at      TEXT NOT NULL,
+--   max_tokens          REAL NOT NULL,
+--   refill_rate_per_ms  REAL NOT NULL
+-- );
+--
+-- PostgreSQL version (active):
+CREATE TABLE IF NOT EXISTS hazo_rl_buckets (
+  id                  TEXT NOT NULL PRIMARY KEY,
+  tokens              DOUBLE PRECISION NOT NULL,
+  last_refill_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  max_tokens          DOUBLE PRECISION NOT NULL,
+  refill_rate_per_ms  DOUBLE PRECISION NOT NULL
+);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hazo_secure",
-  "version": "0.5.0",
-  "description": "Security & compliance primitives — SSRF-safe fetch, rate limiting, field-level encryption, GDPR orchestration. Four subpath modules, pick the ones you need.",
+  "version": "1.1.0",
+  "description": "Security & compliance primitives — SSRF-safe fetch, rate limiting, field-level encryption, GDPR orchestration, CSRF. Five subpath modules, pick the ones you need.",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -40,8 +40,14 @@
   },
   "files": [
     "dist",
+    "config/hazo_secure_config.ini.sample",
+    "db_setup_postgres.sql",
+    "db_setup_sqlite.sql",
+    "migrations",
     "LICENSE",
-    "README.md"
+    "README.md",
+    "SETUP_CHECKLIST.md",
+    "CHANGE_LOG.md"
   ],
   "scripts": {
     "build": "tsup",
@@ -54,25 +60,48 @@
     "install:test-app": "cd test-app && npm install",
     "prepublishOnly": "npm run build"
   },
+  "dependencies": {
+    "undici": "^7.3.0"
+  },
   "peerDependencies": {
-    "hazo_logs": "^1.1.0",
-    "hazo_jobs": "^0.7.0",
-    "hazo_files": "^1.4.7"
+    "hazo_core": "^1.0.0",
+    "hazo_logs": "^2.0.0",
+    "hazo_connect": "^3.0.0",
+    "hazo_jobs": "^0.12.0",
+    "hazo_files": "^3.0.0",
+    "hazo_ui": "^3.1.0"
   },
   "peerDependenciesMeta": {
-    "hazo_jobs": { "optional": true },
-    "hazo_files": { "optional": true }
+    "hazo_logs": {
+      "optional": true
+    },
+    "hazo_connect": {
+      "optional": true
+    },
+    "hazo_jobs": {
+      "optional": true
+    },
+    "hazo_files": {
+      "optional": true
+    },
+    "hazo_ui": {
+      "optional": true
+    }
   },
   "devDependencies": {
-    "@types/jest": "^29.0.0",
-    "@types/node": "^22.0.0",
-    "jest": "^29.0.0",
-    "ts-jest": "^29.0.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^22.10.0",
+    "hazo_core": "^1.0.0",
+    "hazo_logs": "^2.0.1",
+    "hazo_connect": "^3.0.0",
+    "hazo_jobs": "^0.12.0",
+    "hazo_files": "^3.0.0",
+    "hazo_ui": "^3.1.0",
+    "jest": "^30.2.0",
+    "ts-jest": "^29.4.5",
     "tsup": "^8.5.1",
-    "typescript": "^5.7.2"
-  },
-  "engines": {
-    "node": ">=18.0.0"
+    "typescript": "^5.7.2",
+    "zod": "^3.23.8"
   },
   "author": "Pubs Abayasiri",
   "license": "MIT"