nucleus-core-ts 0.9.748 → 0.9.749

package/dist/src/ElysiaPlugin/authRouteClassifier.d.ts

@@ -8,11 +8,18 @@ import type { AuthRouteType } from '../Services/RateLimiter';
  * protection is silently off), and (b) never classified /auth/invite at all.
  *
  * This resolves the route from the SAME config the auth routes register, and
- * matches on a path boundary: `pathname === route` OR `pathname.endsWith(route)`.
- * Because every route begins with '/', endsWith only matches at a segment
- * boundary — so a multi-tenant basePath prefix ('/t1/auth/login') matches while a
- * mid-path substring ('/xauth/login', '/auth/login/extra') does NOT (the old
- * includes() false-positived on both).
+ * matches on a path boundary: `pathname === route`, OR `pathname.endsWith(route)`
+ * (a multi-tenant basePath prefix like '/t1/auth/login'), OR `pathname` contains
+ * `route + '/'` (a SUB-path of the route). The last clause is what makes the
+ * strict budget reach routes whose real endpoints are sub-paths of the configured
+ * base — passwordReset registers at `${route}/request` + `${route}/confirm`, and
+ * magic-link verification at `${route}/verify`; without it those endpoints fell
+ * through to the lax private/public limit (SECURITY — the documented brute-force
+ * lockout was silently OFF on password-reset). Because every `route` begins with
+ * '/' and the sub-path needle ends with '/', both ends sit on a segment boundary,
+ * so '/xauth/login' and '/products/auth-login-helper' still do NOT match, while
+ * '/auth/password-reset/confirm' and '/t1/auth/magic-link/verify' do. Classifying
+ * a sub-path as its parent auth type is the SAFE direction (stricter limit).
  */
 export type AuthRouteConfigSubset = {
     login?: {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.748",
+	"version": "0.9.749",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",