lambder 12.0.1 → 14.0.1

package/dist/stores/LambderMemoryRateLimiter.js

@@ -3,10 +3,15 @@ import { LambderExpiringMap } from "../shared/util/LambderExpiringMap.js";
 import { joinKeyFields } from "../shared/util/joinKeyFields.js";
 /**
  * Fixed-window rate limiter held in memory: the same windows, the same
- * attempts-count semantics and the same evaluation order as
- * LambderDdbRateLimiter, with a Map in place of the table. For tests and
- * for the mock runtime; a single-process server could use it too, with the
- * caveat that its counters are per process and vanish with it.
+ * attempts-count semantics and the same refusals as LambderDdbRateLimiter,
+ * with a Map in place of the table. For tests and for the mock runtime; a
+ * single-process server could use it too, with the caveat that its counters
+ * are per process and vanish with it.
+ *
+ * Every counter is in hand, so an attempt a window refuses is counted in no
+ * window: what the DynamoDB limiter reaches once it remembers the refusing
+ * window, which the first refused attempt in each of its processes still
+ * counts in the others.
  *
  * `now` is injectable so a test can move time forward and watch a window
  * reset without waiting for it.
@@ -31,24 +36,24 @@ export class LambderMemoryRateLimiter {
     }
     async isRateLimited(trackerKey, policy) {
         const nowSeconds = Math.floor(this.now() / 1000);
-        for (const { key, seconds } of RATE_LIMIT_WINDOWS) {
-            const limit = policy[key];
-            if (!limit)
-                continue;
+        const windows = RATE_LIMIT_WINDOWS.filter(({ key }) => policy[key]).map(({ key, seconds }) => {
             const windowStart = Math.floor(nowSeconds / seconds) * seconds;
             // The table keeps the tracker key and the window in separate
             // attributes; one string has to keep them as distinct, hence the
             // escaping join.
             const counterKey = joinKeyFields(trackerKey, key, String(windowStart));
-            const counter = this.counters.get(counterKey) ?? { count: 0 };
-            // The DynamoDB limiter's conditional ADD: allowed while the count
-            // before this attempt is under the limit, and the refused attempt
-            // leaves the counter where it was.
-            if (counter.count >= limit)
-                return { window: key, limit, resetAt: windowStart + seconds };
+            return { key, limit: policy[key], resetAt: windowStart + seconds, counterKey, counter: this.counters.get(counterKey) ?? { count: 0 } };
+        });
+        // The DynamoDB limiter's conditional ADD: allowed while the count
+        // before this attempt is under the limit, and the smallest window at
+        // its limit names the refusal.
+        const refusing = windows.find(({ counter, limit }) => counter.count >= limit);
+        if (refusing)
+            return { window: refusing.key, limit: refusing.limit, resetAt: refusing.resetAt };
+        for (const { counterKey, counter, resetAt } of windows) {
             counter.count += 1;
             // The counter dies with its window, which is also the table's TTL.
-            this.counters.set(counterKey, counter, windowStart + seconds);
+            this.counters.set(counterKey, counter, resetAt);
         }
         return false;
     }

package/dist/testing/LambderTestApp.d.ts

@@ -9,6 +9,7 @@ import type { LambderRateLimiter } from "../shared/contracts/LambderRateLimiter.
 import type { LambderSessionStore } from "../shared/contracts/LambderSessionStore.js";
 import { LAMBDER_BACKEND_SWAP, LAMBDER_CRASH_WATCH } from "../shared/util/LambderTestingDoors.js";
 import type { LambderApiContractShape } from "../shared/wire/LambderApiContract.js";
+import type { LambderCallSummary } from "../core/LambderCallSummary.js";
 import { LambderTestVisitor, type LambderTestVisitorArgs, type LambderTestVisitorOptions } from "./LambderTestVisitor.js";
 /**
  * What a test app may be told. Nothing is required: `lambderTestApp(lambder)`
@@ -100,6 +101,8 @@ export declare class LambderTestApp<TContract extends LambderApiContractShape =
     private visitorCount;
     private resetCount;
     private readonly crashList;
+    /** Every call summary the app wrote since the last reset; see callSummaries. */
+    private readonly callSummaryList;
     /**
      * The call a crash happened under. The app's 500 says nothing about the
      * crash, so the error travels beside the answer, and with concurrent
@@ -117,6 +120,12 @@ export declare class LambderTestApp<TContract extends LambderApiContractShape =
      * error an `event()` rejects with, which the test already holds.
      */
     get crashes(): readonly Error[];
+    /**
+     * The summary of every API call the app answered since the last reset,
+     * in order (see LambderCallSummary): what its callSummary option would
+     * have been handed, collected here instead of written to stdout.
+     */
+    get callSummaries(): readonly LambderCallSummary[];
     /** The session manager, for tests that inspect or manipulate sessions directly. Throws when the app has no sessions. */
     get sessionManager(): LambderSessionManager<TSessionData>;
     /**
@@ -159,10 +168,10 @@ export declare class LambderTestApp<TContract extends LambderApiContractShape =
     event(event: unknown, context?: Partial<Context>): Promise<unknown>;
     /**
      * Rewinds what accumulated: sessions, rate-limit counters and replay
-     * records in the stores this test app made, the crashes it recorded, and
-     * the cookies of every visitor it created (each empties its jar the next
-     * time it is used). For a beforeEach. The app's own data (its database)
-     * is the app's to rewind.
+     * records in the stores this test app made, the crashes and call
+     * summaries it recorded, and the cookies of every visitor it created
+     * (each empties its jar the next time it is used). For a beforeEach. The
+     * app's own data (its database) is the app's to rewind.
      */
     reset(): void;
 }

package/dist/testing/LambderTestApp.js

@@ -49,6 +49,8 @@ export class LambderTestApp {
     visitorCount = 0;
     resetCount = 0;
     crashList = [];
+    /** Every call summary the app wrote since the last reset; see callSummaries. */
+    callSummaryList = [];
     /**
      * The call a crash happened under. The app's 500 says nothing about the
      * crash, so the error travels beside the answer, and with concurrent
@@ -66,7 +68,12 @@ export class LambderTestApp {
         const sessionStore = options.session?.store ?? own(new LambderMemorySessionStore());
         const rateLimiter = options.rateLimits?.limiter ?? own(new LambderMemoryRateLimiter());
         const idempotencyStore = options.idempotency?.store ?? own(new LambderMemoryIdempotencyStore());
-        const swap = lambder[LAMBDER_BACKEND_SWAP]({ sessionStore, rateLimiter, idempotencyStore, fileSource: options.files });
+        // The summaries are collected rather than written, so a suite's
+        // output stays its own and a test can read what a call recorded.
+        const swap = lambder[LAMBDER_BACKEND_SWAP]({
+            sessionStore, rateLimiter, idempotencyStore, fileSource: options.files,
+            callSummary: (summary) => { this.callSummaryList.push(summary); },
+        });
         if (options.files && !swap.files) {
             throw new Error("lambderTestApp: the files option was given, but the app was created without one, so nothing reads files to put a source under.");
         }
@@ -116,6 +123,14 @@ export class LambderTestApp {
     get crashes() {
         return this.crashList;
     }
+    /**
+     * The summary of every API call the app answered since the last reset,
+     * in order (see LambderCallSummary): what its callSummary option would
+     * have been handed, collected here instead of written to stdout.
+     */
+    get callSummaries() {
+        return this.callSummaryList;
+    }
     /** The session manager, for tests that inspect or manipulate sessions directly. Throws when the app has no sessions. */
     get sessionManager() {
         return this.lambder.getSessionManager();
@@ -178,15 +193,16 @@ export class LambderTestApp {
     }
     /**
      * Rewinds what accumulated: sessions, rate-limit counters and replay
-     * records in the stores this test app made, the crashes it recorded, and
-     * the cookies of every visitor it created (each empties its jar the next
-     * time it is used). For a beforeEach. The app's own data (its database)
-     * is the app's to rewind.
+     * records in the stores this test app made, the crashes and call
+     * summaries it recorded, and the cookies of every visitor it created
+     * (each empties its jar the next time it is used). For a beforeEach. The
+     * app's own data (its database) is the app's to rewind.
      */
     reset() {
         for (const store of this.ownStores)
             store.reset();
         this.crashList.length = 0;
+        this.callSummaryList.length = 0;
         this.resetCount += 1;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "12.0.1",
+  "version": "14.0.1",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [