nextly 0.0.1 → 0.0.2-alpha.0

package/dist/chunk-ERCNLX3V.mjs

@@ -0,0 +1,176 @@
+import {
+  getTrustedClientIp
+} from "./chunk-APKKRD2G.mjs";
+
+// src/middleware/rate-limit.ts
+var InMemoryRateLimitStore = class {
+  hits = /* @__PURE__ */ new Map();
+  cleanupInterval = null;
+  constructor() {
+    this.cleanupInterval = setInterval(() => {
+      this.cleanup();
+    }, 6e4);
+    if (this.cleanupInterval.unref) {
+      this.cleanupInterval.unref();
+    }
+  }
+  // eslint-disable-next-line @typescript-eslint/require-await
+  async increment(key, windowMs) {
+    const now = Date.now();
+    const record = this.hits.get(key);
+    if (!record || now > record.resetTime) {
+      const newRecord = { count: 1, resetTime: now + windowMs };
+      this.hits.set(key, newRecord);
+      return newRecord;
+    }
+    record.count++;
+    return record;
+  }
+  // eslint-disable-next-line @typescript-eslint/require-await
+  async reset(key) {
+    this.hits.delete(key);
+  }
+  /**
+   * Clean up expired records to prevent memory leaks.
+   */
+  cleanup() {
+    const now = Date.now();
+    for (const [key, record] of this.hits.entries()) {
+      if (now > record.resetTime) {
+        this.hits.delete(key);
+      }
+    }
+  }
+  /**
+   * Destroy the store and stop cleanup interval.
+   * Call this when shutting down the application.
+   */
+  destroy() {
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval);
+      this.cleanupInterval = null;
+    }
+    this.hits.clear();
+  }
+  /**
+   * Get the current size of the store (for testing/monitoring).
+   */
+  get size() {
+    return this.hits.size;
+  }
+};
+var DEFAULTS = {
+  readLimit: 600,
+  // 10 req/s burst — admin UI makes many parallel GETs on load
+  writeLimit: 120,
+  windowMs: 6e4
+  // 1 minute
+};
+function buildDefaultKeyGenerator(trustProxy, trustedProxyIps) {
+  return (request) => getTrustedClientIp(request, { trustProxy, trustedProxyIps }) ?? "unknown";
+}
+function isReadOperation(method) {
+  return method === "GET" || method === "HEAD" || method === "OPTIONS";
+}
+function defaultSkipAdminApi(request) {
+  const { pathname } = new URL(request.url);
+  return pathname.startsWith("/admin/api/");
+}
+function extractCollectionFromUrl(url) {
+  const match = url.match(/\/collections\/([^/]+)/);
+  return match ? match[1] : null;
+}
+function createRateLimiter(config) {
+  if (!config.enabled) {
+    return async (_request) => null;
+  }
+  const store = config.store ?? new InMemoryRateLimitStore();
+  const readLimit = config.readLimit ?? DEFAULTS.readLimit;
+  const writeLimit = config.writeLimit ?? DEFAULTS.writeLimit;
+  const windowMs = config.windowMs ?? DEFAULTS.windowMs;
+  const keyGenerator = config.keyGenerator ?? buildDefaultKeyGenerator(
+    config.trustProxy ?? false,
+    config.trustedProxyIps ?? []
+  );
+  const skip = config.skip ?? defaultSkipAdminApi;
+  const collections = config.collections ?? {};
+  const handler = config.handler;
+  console.log(
+    `[Nextly] Rate limiting enabled: ${readLimit} reads / ${writeLimit} writes per ${windowMs / 1e3}s window`
+  );
+  return async (request) => {
+    const url = new URL(request.url);
+    const isSystemEndpoint = url.pathname.endsWith("/auth/setup-status") || url.pathname.endsWith("/health");
+    if (isSystemEndpoint) {
+      return null;
+    }
+    const shouldSkip = await skip(request);
+    if (shouldSkip) {
+      return null;
+    }
+    const method = request.method;
+    const isRead = isReadOperation(method);
+    let limit = isRead ? readLimit : writeLimit;
+    const collection = extractCollectionFromUrl(request.url);
+    if (collection && collections[collection]) {
+      const collectionConfig = collections[collection];
+      if (isRead && collectionConfig.readLimit !== void 0) {
+        limit = collectionConfig.readLimit;
+      } else if (!isRead && collectionConfig.writeLimit !== void 0) {
+        limit = collectionConfig.writeLimit;
+      }
+    }
+    const baseKey = keyGenerator(request);
+    const operationType = isRead ? "read" : "write";
+    const key = collection ? `ratelimit:${baseKey}:${collection}:${operationType}` : `ratelimit:${baseKey}:${operationType}`;
+    const record = await store.increment(key, windowMs);
+    const remaining = Math.max(0, limit - record.count);
+    const allowed = record.count <= limit;
+    const result = {
+      allowed,
+      limit,
+      remaining,
+      resetTime: record.resetTime
+    };
+    if (allowed) {
+      return null;
+    }
+    if (handler) {
+      return handler(request, result);
+    }
+    const retryAfter = Math.ceil((record.resetTime - Date.now()) / 1e3);
+    return new Response(
+      JSON.stringify({
+        success: false,
+        error: {
+          code: "RATE_LIMIT_EXCEEDED",
+          message: "Too many requests. Please try again later.",
+          retryAfter
+        }
+      }),
+      {
+        status: 429,
+        headers: {
+          "Content-Type": "application/json",
+          "Retry-After": String(retryAfter),
+          "X-RateLimit-Limit": String(limit),
+          "X-RateLimit-Remaining": "0",
+          "X-RateLimit-Reset": String(record.resetTime)
+        }
+      }
+    );
+  };
+}
+function createRateLimitHeaders(result) {
+  return {
+    "X-RateLimit-Limit": String(result.limit),
+    "X-RateLimit-Remaining": String(result.remaining),
+    "X-RateLimit-Reset": String(result.resetTime)
+  };
+}
+
+export {
+  InMemoryRateLimitStore,
+  createRateLimiter,
+  createRateLimitHeaders
+};