roster-server 2.4.8 → 2.4.10

package/README.md

@@ -126,11 +126,6 @@ import { createScannerBlocker } from 'roster-server/plugins/scanner-blocker.js';
 const roster = new Roster(options);
 
 roster.use(createScannerBlocker({
-    windowMs: 60_000,
-    strikeThreshold: 3,
-    banDurationMs: 15 * 60_000,
-    maxTrackedClients: 10_000,
-    trustProxy: false,
     onBlock(event) {
         // Send event to the application's existing logger if desired.
     }
@@ -139,7 +134,7 @@ roster.use(createScannerBlocker({
 roster.start();
 ```
 
-All operational values are required. Keep `trustProxy: false` when RosterServer receives traffic directly. Set it to `true` only when a trusted reverse proxy overwrites `X-Forwarded-For`; otherwise clients can spoof the address used for bans.
+By default, the plugin uses a 60-second strike window, 3 strikes, a 15-minute ban, tracks up to 10,000 clients, and does not trust proxy headers. Pass only the values you need to override. Keep `trustProxy: false` when RosterServer receives traffic directly. Set it to `true` only when a trusted reverse proxy overwrites `X-Forwarded-For`; otherwise clients can spoof the address used for bans.
 
 The in-memory strike and ban state is bounded by `maxTrackedClients`, belongs to one RosterServer process, and is cleared on restart. Use the optional `onBlock(event)` callback to feed a shared firewall or Fail2ban when bans must persist or span multiple workers. Routes such as `/atom` and `/articles/config` are not classified as scanner probes.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roster-server",
-  "version": "2.4.8",
+  "version": "2.4.10",
   "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
   "main": "index.js",
   "repository": {

package/plugins/scanner-blocker.js

@@ -61,28 +61,36 @@ function rejectRequest(req, res) {
     res.end(req.method === 'HEAD' ? undefined : body);
 }
 
-function createScannerBlocker(options) {
+function createScannerBlocker(options = {}) {
     if (!options || typeof options !== 'object') {
-        throw new Error('scanner-blocker options are required');
+        throw new Error('scanner-blocker options must be an object');
     }
 
-    const windowMs = requirePositiveInteger(options, 'windowMs');
-    const strikeThreshold = requirePositiveInteger(options, 'strikeThreshold');
-    const banDurationMs = requirePositiveInteger(options, 'banDurationMs');
-    const maxTrackedClients = requirePositiveInteger(options, 'maxTrackedClients');
-    if (typeof options.trustProxy !== 'boolean') {
+    const {
+        windowMs = 60_000,
+        strikeThreshold = 3,
+        banDurationMs = 15 * 60_000,
+        maxTrackedClients = 10_000,
+        trustProxy = false,
+        onBlock,
+        now
+    } = options;
+    const normalizedOptions = { windowMs, strikeThreshold, banDurationMs, maxTrackedClients };
+    requirePositiveInteger(normalizedOptions, 'windowMs');
+    requirePositiveInteger(normalizedOptions, 'strikeThreshold');
+    requirePositiveInteger(normalizedOptions, 'banDurationMs');
+    requirePositiveInteger(normalizedOptions, 'maxTrackedClients');
+    if (typeof trustProxy !== 'boolean') {
         throw new Error('trustProxy must be a boolean');
     }
-    if (options.onBlock !== undefined && typeof options.onBlock !== 'function') {
+    if (onBlock !== undefined && typeof onBlock !== 'function') {
         throw new Error('onBlock must be a function');
     }
-    if (options.now !== undefined && typeof options.now !== 'function') {
+    if (now !== undefined && typeof now !== 'function') {
         throw new Error('now must be a function');
     }
 
-    const trustProxy = options.trustProxy;
-    const onBlock = options.onBlock;
-    const now = options.now || Date.now;
+    const clock = now || Date.now;
     const clients = new Map();
 
     function removeExpiredClients(timestamp) {
@@ -109,7 +117,7 @@ function createScannerBlocker(options) {
     }
 
     return function scannerBlocker(req, res, context = {}) {
-        const timestamp = now();
+        const timestamp = clock();
         const ip = clientIp(req, trustProxy);
         let state = ip ? clients.get(ip) : null;
 

package/skills/roster-server/SKILL.md

@@ -178,17 +178,11 @@ const Roster = require('roster-server');
 const { createScannerBlocker } = require('roster-server/plugins/scanner-blocker.js');
 
 const roster = new Roster({ local: true, wwwPath: './www' });
-roster.use(createScannerBlocker({
-    windowMs: 60_000,
-    strikeThreshold: 3,
-    banDurationMs: 15 * 60_000,
-    maxTrackedClients: 10_000,
-    trustProxy: false
-}));
+roster.use(createScannerBlocker());
 roster.start();
 ```
 
-The plugin blocks common PHP, WordPress, repository, and sensitive-file probes before site handlers. All operational values are required. Set `trustProxy: true` only behind a trusted reverse proxy that overwrites `X-Forwarded-For`. Ban state is per process and in memory; use `onBlock` to integrate a shared firewall or Fail2ban.
+The plugin blocks common PHP, WordPress, repository, and sensitive-file probes before site handlers. Defaults are a 60-second window, 3 strikes, a 15-minute ban, 10,000 tracked clients, and `trustProxy: false`; pass only the values to override. Set `trustProxy: true` only behind a trusted reverse proxy that overwrites `X-Forwarded-For`. Ban state is per process and in memory; use `onBlock` to integrate a shared firewall or Fail2ban.
 
 ## Key Configuration Options
 

package/test/scanner-blocker.test.js

@@ -40,10 +40,20 @@ function blocker(overrides = {}) {
 }
 
 describe('scanner-blocker plugin', () => {
-    it('requires every operational option explicitly', () => {
-        assert.throws(() => createScannerBlocker(), /options are required/);
-        assert.throws(() => createScannerBlocker({}), /windowMs/);
-        assert.throws(() => blocker({ trustProxy: undefined }), /trustProxy/);
+    it('uses documented defaults and permits individual overrides', () => {
+        const plugin = createScannerBlocker();
+        invoke(plugin, { url: '/wp-login.php' });
+        invoke(plugin, { url: '/xmlrpc.php' });
+        assert.strictEqual(invoke(plugin, { url: '/ordinary' }).handled, false);
+        invoke(plugin, { url: '/install.php' });
+        assert.strictEqual(invoke(plugin, { url: '/ordinary' }).handled, true);
+
+        const overriddenPlugin = createScannerBlocker({ strikeThreshold: 1 });
+        invoke(overriddenPlugin, { url: '/wp-login.php' });
+        assert.strictEqual(invoke(overriddenPlugin, { url: '/ordinary' }).handled, true);
+
+        assert.throws(() => createScannerBlocker(null), /options must be an object/);
+        assert.throws(() => blocker({ trustProxy: 'false' }), /trustProxy/);
         assert.throws(() => blocker({ maxTrackedClients: 0 }), /maxTrackedClients/);
     });