thatcher 1.0.65 → 1.0.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.65",
+  "version": "1.0.66",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/rate-limiter.js

@@ -0,0 +1,37 @@
+// Fixed-window per-key rate limiter, in-memory. Keyed by authenticated user id
+// when available, otherwise by remote IP, so one anonymous IP hammering the
+// API can't exhaust a budget shared with real users behind the same NAT --
+// each authenticated user gets their own independent window.
+const WINDOW_MS = 60 * 1000;
+const DEFAULT_LIMIT = 300;
+const buckets = new Map();
+
+let sweepHandle = null;
+function ensureSweep() {
+  if (sweepHandle) return;
+  sweepHandle = setInterval(() => {
+    const now = Date.now();
+    for (const [key, bucket] of buckets) {
+      if (now - bucket.windowStart > WINDOW_MS) buckets.delete(key);
+    }
+  }, WINDOW_MS);
+  if (sweepHandle.unref) sweepHandle.unref();
+}
+
+export function checkRateLimit(key, limit = DEFAULT_LIMIT) {
+  ensureSweep();
+  const now = Date.now();
+  let bucket = buckets.get(key);
+  if (!bucket || now - bucket.windowStart >= WINDOW_MS) {
+    bucket = { windowStart: now, count: 0 };
+    buckets.set(key, bucket);
+  }
+  bucket.count += 1;
+  const remaining = Math.max(0, limit - bucket.count);
+  const resetMs = bucket.windowStart + WINDOW_MS - now;
+  return { allowed: bucket.count <= limit, remaining, resetMs, limit };
+}
+
+export function resetRateLimiter() {
+  buckets.clear();
+}

package/src/server/server.js

@@ -93,6 +93,20 @@ export function createServer(options) {
       // API routes
       if (pathname.startsWith('/api/')) {
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
+
+        const { checkRateLimit } = await import('../lib/rate-limiter.js');
+        const rateUser = await resolveRequestUser(req);
+        const rateKey = rateUser ? `user:${rateUser.id}` : `ip:${req.socket?.remoteAddress || 'unknown'}`;
+        const rate = checkRateLimit(rateKey);
+        res.setHeader('X-RateLimit-Limit', String(rate.limit));
+        res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(rate.resetMs / 1000)));
+        if (!rate.allowed) {
+          res.setHeader('Retry-After', String(Math.ceil(rate.resetMs / 1000)));
+          res.writeHead(429);
+          res.end(JSON.stringify({ error: 'Rate limit exceeded, try again later' }));
+          return;
+        }
         const parts = pathname.slice(5).split('/').filter(Boolean); // remove /api/
 
         if (parts.length === 0) {

package/src/ui/dashboard-renderer.js

@@ -89,12 +89,12 @@ export function renderAuditDashboard(user, auditData = {}) {
   const { summary = {}, recentActivity = [] } = auditData;
   const actRows = recentActivity.slice(0, 20).map(a =>
     `<tr data-row>
-      <td data-col="time">${new Date((a.timestamp||a.created_at)*1000).toLocaleString('en-ZA')}</td>
-      <td data-col="action"><span class="pill pill-info">${a.action||'-'}</span></td>
-      <td data-col="entity">${a.entity_type||'-'}</td>
-      <td data-col="id" style="font-size:12px">${a.entity_id||'-'}</td>
-      <td data-col="user">${a.user_name||a.user_id||'-'}</td>
-      <td data-col="reason" style="font-size:12px;color:var(--color-text-muted)">${a.reason||'-'}</td>
+      <td data-col="time">${esc(new Date((a.timestamp||a.created_at)*1000).toLocaleString('en-ZA'))}</td>
+      <td data-col="action"><span class="pill pill-info">${esc(a.action||'-')}</span></td>
+      <td data-col="entity">${esc(a.entity_type||'-')}</td>
+      <td data-col="id" style="font-size:12px">${esc(a.entity_id||'-')}</td>
+      <td data-col="user">${esc(a.user_name||a.user_id||'-')}</td>
+      <td data-col="reason" style="font-size:12px;color:var(--color-text-muted)">${esc(a.reason||'-')}</td>
     </tr>`
    ).join('') || emptyRow(6, 'No audit records found');
 
@@ -124,7 +124,7 @@ export function renderAuditDashboard(user, auditData = {}) {
 export function renderSystemHealth(user, healthData = {}) {
   const { database = {}, server: srv = {}, entities = {} } = healthData;
   const entRows = Object.entries(entities).map(([n, c]) =>
-    `<tr data-row><td data-col="entity">${n}</td><td data-col="count" style="text-align:right">${c}</td></tr>`
+    `<tr data-row><td data-col="entity">${esc(n)}</td><td data-col="count" style="text-align:right">${esc(String(c))}</td></tr>`
    ).join('') || emptyRow(2, 'No data');
 
   const statsHtml = `<div class="stats-row">${[