vesper-memory 0.3.0

package/dist/security/rate-limit-middleware.js

@@ -0,0 +1,193 @@
+/**
+ * Rate Limit Middleware
+ *
+ * Integrates rate limiting into the MCP server.
+ * Implements SEC-HIGH-001 and SEC-HIGH-002 from security audit.
+ *
+ * Security Features:
+ * - Fail-closed behavior when Redis unavailable (SEC-HIGH-002)
+ * - Tier-based rate limits
+ * - Standard rate limit headers
+ * - 429 error responses with Retry-After
+ */
+import { createRateLimiter, } from "../utils/rate-limiter.js";
+import { getTierLimits, } from "../config/rate-limits.js";
+/**
+ * Rate limit error for 429 responses
+ */
+export class RateLimitError extends Error {
+    statusCode;
+    retryAfter;
+    constructor(message, statusCode, retryAfter) {
+        super(message);
+        this.name = "RateLimitError";
+        this.statusCode = statusCode;
+        this.retryAfter = retryAfter;
+        // Maintain proper stack trace for where our error was thrown
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, RateLimitError);
+        }
+    }
+}
+/**
+ * Rate Limit Middleware
+ *
+ * Wraps the RateLimiter class and provides:
+ * - Standard HTTP headers
+ * - Fail-closed behavior
+ * - Error handling for 429 responses
+ */
+export class RateLimitMiddleware {
+    redis;
+    rateLimiter = null;
+    options;
+    inMemoryLimits = new Map();
+    constructor(redis, options) {
+        this.redis = redis;
+        this.options = options;
+        // Build rate limit config from tier and custom limits
+        const config = this.buildConfig();
+        try {
+            this.rateLimiter = createRateLimiter(redis, config);
+        }
+        catch {
+            // Redis not available during construction - will handle in checkRateLimit
+            this.rateLimiter = null;
+        }
+    }
+    /**
+     * Build rate limit configuration from options
+     */
+    buildConfig() {
+        const tierLimits = getTierLimits(this.options.tier);
+        if (!this.options.customLimits) {
+            return tierLimits;
+        }
+        // Merge custom limits with tier defaults
+        const merged = { ...tierLimits };
+        for (const [operation, customConfig] of Object.entries(this.options.customLimits)) {
+            merged[operation] = customConfig;
+        }
+        return merged;
+    }
+    /**
+     * Check rate limit for a request
+     *
+     * @param userId - User identifier
+     * @param operation - MCP tool name
+     * @returns Rate limit check result
+     * @throws RateLimitError if rate limited or Redis unavailable (fail-closed)
+     */
+    async checkRateLimit(userId, operation) {
+        try {
+            // Try Redis-based rate limiting
+            return await this.checkRateLimitRedis(userId, operation);
+        }
+        catch (error) {
+            console.error("[WARN] Rate limiter Redis error:", error instanceof Error ? error.message : String(error));
+            if (this.options.failOpen) {
+                // FAIL OPEN: Allow request but log warning
+                console.warn("[SECURITY] Rate limiting bypassed due to Redis failure");
+                return this.createBypassResult();
+            }
+            else {
+                // FAIL CLOSED: Deny request (recommended for security)
+                console.error("[SECURITY] Rate limiting enforced - request denied");
+                throw new RateLimitError("Service temporarily unavailable. Please try again in a few minutes.", 503, 30);
+            }
+        }
+    }
+    /**
+     * Check rate limit using Redis
+     */
+    async checkRateLimitRedis(userId, operation) {
+        // Ensure Redis is connected
+        if (this.redis.status !== "ready") {
+            // Try to connect
+            try {
+                await this.redis.connect();
+            }
+            catch {
+                throw new Error("Redis connection failed");
+            }
+        }
+        if (!this.rateLimiter) {
+            // Reinitialize rate limiter
+            const config = this.buildConfig();
+            this.rateLimiter = createRateLimiter(this.redis, config);
+        }
+        // Check rate limit
+        const result = await this.rateLimiter.checkLimit(userId, operation);
+        // Calculate reset timestamp (Unix seconds)
+        const resetAt = Math.floor(Date.now() / 1000) + result.resetIn;
+        // Build headers
+        const headers = {
+            "X-RateLimit-Limit": String(result.limit),
+            "X-RateLimit-Remaining": String(result.remaining),
+            "X-RateLimit-Reset": String(resetAt),
+        };
+        // Add Retry-After header if rate limited
+        if (!result.allowed) {
+            headers["Retry-After"] = String(result.resetIn);
+        }
+        return {
+            allowed: result.allowed,
+            remaining: result.remaining,
+            resetAt,
+            headers,
+        };
+    }
+    /**
+     * Create bypass result for fail-open mode
+     */
+    createBypassResult() {
+        return {
+            allowed: true,
+            remaining: -1,
+            resetAt: 0,
+            headers: {
+                "X-RateLimit-Limit": "-1",
+                "X-RateLimit-Remaining": "-1",
+                "X-RateLimit-Reset": "0",
+                "X-RateLimit-Bypass": "true",
+            },
+        };
+    }
+    /**
+     * Get current configuration
+     */
+    getConfig() {
+        return this.buildConfig();
+    }
+    /**
+     * Update tier
+     */
+    setTier(tier) {
+        this.options.tier = tier;
+        // Reinitialize rate limiter with new tier
+        const config = this.buildConfig();
+        if (this.redis.status === "ready") {
+            this.rateLimiter = createRateLimiter(this.redis, config);
+        }
+    }
+}
+/**
+ * Factory function to create rate limit middleware
+ *
+ * @param redis - Redis client
+ * @param options - Middleware options
+ */
+export function createRateLimitMiddleware(redis, options) {
+    return new RateLimitMiddleware(redis, options);
+}
+/**
+ * Format rate limit error for MCP response
+ */
+export function formatRateLimitError(error, operation) {
+    return {
+        error: error.message,
+        retryAfter: error.retryAfter,
+        operation,
+    };
+}
+//# sourceMappingURL=rate-limit-middleware.js.map

package/dist/security/rate-limit-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-middleware.js","sourceRoot":"","sources":["../../src/security/rate-limit-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAEL,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,aAAa,GACd,MAAM,0BAA0B,CAAC;AA2BlC;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvB,UAAU,CAAS;IACnB,UAAU,CAAS;IAEnC,YAAY,OAAe,EAAE,UAAkB,EAAE,UAAkB;QACjE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,6DAA6D;QAC7D,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;CACF;AAgBD;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACtB,KAAK,CAAQ;IACb,WAAW,GAAuB,IAAI,CAAC;IACvC,OAAO,CAA6B;IACpC,cAAc,GACpB,IAAI,GAAG,EAAE,CAAC;IAEZ,YAAY,KAAY,EAAE,OAAmC;QAC3D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,sDAAsD;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW;QACjB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAAoC,EAAE,GAAG,UAAU,EAAE,CAAC;QAElE,KAAK,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CACpD,IAAI,CAAC,OAAO,CAAC,YAAY,CAC1B,EAAE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,GAAG,YAAY,CAAC;QACnC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,SAAiB;QAEjB,IAAI,CAAC;YACH,gCAAgC;YAChC,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,kCAAkC,EAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YAEF,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC1B,2CAA2C;gBAC3C,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;gBACvE,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,uDAAuD;gBACvD,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACpE,MAAM,IAAI,cAAc,CACtB,qEAAqE,EACrE,GAAG,EACH,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,SAAiB;QAEjB,4BAA4B;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,iBAAiB;YACjB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,4BAA4B;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAEpE,2CAA2C;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/D,gBAAgB;QAChB,MAAM,OAAO,GAAqB;YAChC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YACzC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACjD,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC;SACrC,CAAC;QAEF,yCAAyC;QACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO;YACP,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,CAAC,CAAC;YACb,OAAO,EAAE,CAAC;YACV,OAAO,EAAE;gBACP,mBAAmB,EAAE,IAAI;gBACzB,uBAAuB,EAAE,IAAI;gBAC7B,mBAAmB,EAAE,GAAG;gBACxB,oBAAoB,EAAE,MAAM;aAC7B;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAc;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACzB,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAY,EACZ,OAAmC;IAEnC,OAAO,IAAI,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAqB,EACrB,SAAiB;IAEjB,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,OAAO;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/security 2/rate-limit-middleware.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Rate Limit Middleware
+ *
+ * Integrates rate limiting into the MCP server.
+ * Implements SEC-HIGH-001 and SEC-HIGH-002 from security audit.
+ *
+ * Security Features:
+ * - Fail-closed behavior when Redis unavailable (SEC-HIGH-002)
+ * - Tier-based rate limits
+ * - Standard rate limit headers
+ * - 429 error responses with Retry-After
+ */
+import { Redis } from "ioredis";
+import { RateLimitConfig } from "../utils/rate-limiter.js";
+import { TierName } from "../config/rate-limits.js";
+/**
+ * Rate limit headers to include in responses
+ */
+export interface RateLimitHeaders {
+    "X-RateLimit-Limit": string;
+    "X-RateLimit-Remaining": string;
+    "X-RateLimit-Reset": string;
+    "Retry-After"?: string;
+    "X-RateLimit-Bypass"?: string;
+}
+/**
+ * Result from rate limit check
+ */
+export interface RateLimitCheckResult {
+    /** Whether the request is allowed */
+    allowed: boolean;
+    /** Remaining requests in current window */
+    remaining: number;
+    /** Unix timestamp when limit resets */
+    resetAt: number;
+    /** Rate limit headers to include in response */
+    headers: RateLimitHeaders;
+}
+/**
+ * Rate limit error for 429 responses
+ */
+export declare class RateLimitError extends Error {
+    readonly statusCode: number;
+    readonly retryAfter: number;
+    constructor(message: string, statusCode: number, retryAfter: number);
+}
+/**
+ * Middleware options
+ */
+export interface RateLimitMiddlewareOptions {
+    /** Whether to allow requests when Redis is unavailable */
+    failOpen: boolean;
+    /** Rate limit tier to apply */
+    tier: TierName;
+    /** Custom limits that override tier defaults */
+    customLimits?: Record<string, RateLimitConfig>;
+    /** Emergency limit for in-memory fallback */
+    emergencyLimit?: number;
+}
+/**
+ * Rate Limit Middleware
+ *
+ * Wraps the RateLimiter class and provides:
+ * - Standard HTTP headers
+ * - Fail-closed behavior
+ * - Error handling for 429 responses
+ */
+export declare class RateLimitMiddleware {
+    private redis;
+    private rateLimiter;
+    private options;
+    private inMemoryLimits;
+    constructor(redis: Redis, options: RateLimitMiddlewareOptions);
+    /**
+     * Build rate limit configuration from options
+     */
+    private buildConfig;
+    /**
+     * Check rate limit for a request
+     *
+     * @param userId - User identifier
+     * @param operation - MCP tool name
+     * @returns Rate limit check result
+     * @throws RateLimitError if rate limited or Redis unavailable (fail-closed)
+     */
+    checkRateLimit(userId: string, operation: string): Promise<RateLimitCheckResult>;
+    /**
+     * Check rate limit using Redis
+     */
+    private checkRateLimitRedis;
+    /**
+     * Create bypass result for fail-open mode
+     */
+    private createBypassResult;
+    /**
+     * Get current configuration
+     */
+    getConfig(): Record<string, RateLimitConfig>;
+    /**
+     * Update tier
+     */
+    setTier(tier: TierName): void;
+}
+/**
+ * Factory function to create rate limit middleware
+ *
+ * @param redis - Redis client
+ * @param options - Middleware options
+ */
+export declare function createRateLimitMiddleware(redis: Redis, options: RateLimitMiddlewareOptions): RateLimitMiddleware;
+/**
+ * Format rate limit error for MCP response
+ */
+export declare function formatRateLimitError(error: RateLimitError, operation: string): {
+    error: string;
+    retryAfter: number;
+    operation: string;
+};
+//# sourceMappingURL=rate-limit-middleware.d.ts.map

package/dist/security 2/rate-limit-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-middleware.d.ts","sourceRoot":"","sources":["../../src/security/rate-limit-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAGL,eAAe,EAEhB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,QAAQ,EAGT,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,UAAU,EAAE,MAAM,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAWpE;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,CAAC;IAClB,+BAA+B;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,cAAc,CACV;gBAEA,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B;IAe7D;;OAEG;IACH,OAAO,CAAC,WAAW;IAmBnB;;;;;;;OAOG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC;IA0BhC;;OAEG;YACW,mBAAmB;IA8CjC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAc1B;;OAEG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAI5C;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI;CAQ9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAErB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,cAAc,EACrB,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAM1D"}

package/dist/security 2/rate-limit-middleware.js

@@ -0,0 +1,193 @@
+/**
+ * Rate Limit Middleware
+ *
+ * Integrates rate limiting into the MCP server.
+ * Implements SEC-HIGH-001 and SEC-HIGH-002 from security audit.
+ *
+ * Security Features:
+ * - Fail-closed behavior when Redis unavailable (SEC-HIGH-002)
+ * - Tier-based rate limits
+ * - Standard rate limit headers
+ * - 429 error responses with Retry-After
+ */
+import { createRateLimiter, } from "../utils/rate-limiter.js";
+import { getTierLimits, } from "../config/rate-limits.js";
+/**
+ * Rate limit error for 429 responses
+ */
+export class RateLimitError extends Error {
+    statusCode;
+    retryAfter;
+    constructor(message, statusCode, retryAfter) {
+        super(message);
+        this.name = "RateLimitError";
+        this.statusCode = statusCode;
+        this.retryAfter = retryAfter;
+        // Maintain proper stack trace for where our error was thrown
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, RateLimitError);
+        }
+    }
+}
+/**
+ * Rate Limit Middleware
+ *
+ * Wraps the RateLimiter class and provides:
+ * - Standard HTTP headers
+ * - Fail-closed behavior
+ * - Error handling for 429 responses
+ */
+export class RateLimitMiddleware {
+    redis;
+    rateLimiter = null;
+    options;
+    inMemoryLimits = new Map();
+    constructor(redis, options) {
+        this.redis = redis;
+        this.options = options;
+        // Build rate limit config from tier and custom limits
+        const config = this.buildConfig();
+        try {
+            this.rateLimiter = createRateLimiter(redis, config);
+        }
+        catch {
+            // Redis not available during construction - will handle in checkRateLimit
+            this.rateLimiter = null;
+        }
+    }
+    /**
+     * Build rate limit configuration from options
+     */
+    buildConfig() {
+        const tierLimits = getTierLimits(this.options.tier);
+        if (!this.options.customLimits) {
+            return tierLimits;
+        }
+        // Merge custom limits with tier defaults
+        const merged = { ...tierLimits };
+        for (const [operation, customConfig] of Object.entries(this.options.customLimits)) {
+            merged[operation] = customConfig;
+        }
+        return merged;
+    }
+    /**
+     * Check rate limit for a request
+     *
+     * @param userId - User identifier
+     * @param operation - MCP tool name
+     * @returns Rate limit check result
+     * @throws RateLimitError if rate limited or Redis unavailable (fail-closed)
+     */
+    async checkRateLimit(userId, operation) {
+        try {
+            // Try Redis-based rate limiting
+            return await this.checkRateLimitRedis(userId, operation);
+        }
+        catch (error) {
+            console.error("[WARN] Rate limiter Redis error:", error instanceof Error ? error.message : String(error));
+            if (this.options.failOpen) {
+                // FAIL OPEN: Allow request but log warning
+                console.warn("[SECURITY] Rate limiting bypassed due to Redis failure");
+                return this.createBypassResult();
+            }
+            else {
+                // FAIL CLOSED: Deny request (recommended for security)
+                console.error("[SECURITY] Rate limiting enforced - request denied");
+                throw new RateLimitError("Service temporarily unavailable. Please try again in a few minutes.", 503, 30);
+            }
+        }
+    }
+    /**
+     * Check rate limit using Redis
+     */
+    async checkRateLimitRedis(userId, operation) {
+        // Ensure Redis is connected
+        if (this.redis.status !== "ready") {
+            // Try to connect
+            try {
+                await this.redis.connect();
+            }
+            catch {
+                throw new Error("Redis connection failed");
+            }
+        }
+        if (!this.rateLimiter) {
+            // Reinitialize rate limiter
+            const config = this.buildConfig();
+            this.rateLimiter = createRateLimiter(this.redis, config);
+        }
+        // Check rate limit
+        const result = await this.rateLimiter.checkLimit(userId, operation);
+        // Calculate reset timestamp (Unix seconds)
+        const resetAt = Math.floor(Date.now() / 1000) + result.resetIn;
+        // Build headers
+        const headers = {
+            "X-RateLimit-Limit": String(result.limit),
+            "X-RateLimit-Remaining": String(result.remaining),
+            "X-RateLimit-Reset": String(resetAt),
+        };
+        // Add Retry-After header if rate limited
+        if (!result.allowed) {
+            headers["Retry-After"] = String(result.resetIn);
+        }
+        return {
+            allowed: result.allowed,
+            remaining: result.remaining,
+            resetAt,
+            headers,
+        };
+    }
+    /**
+     * Create bypass result for fail-open mode
+     */
+    createBypassResult() {
+        return {
+            allowed: true,
+            remaining: -1,
+            resetAt: 0,
+            headers: {
+                "X-RateLimit-Limit": "-1",
+                "X-RateLimit-Remaining": "-1",
+                "X-RateLimit-Reset": "0",
+                "X-RateLimit-Bypass": "true",
+            },
+        };
+    }
+    /**
+     * Get current configuration
+     */
+    getConfig() {
+        return this.buildConfig();
+    }
+    /**
+     * Update tier
+     */
+    setTier(tier) {
+        this.options.tier = tier;
+        // Reinitialize rate limiter with new tier
+        const config = this.buildConfig();
+        if (this.redis.status === "ready") {
+            this.rateLimiter = createRateLimiter(this.redis, config);
+        }
+    }
+}
+/**
+ * Factory function to create rate limit middleware
+ *
+ * @param redis - Redis client
+ * @param options - Middleware options
+ */
+export function createRateLimitMiddleware(redis, options) {
+    return new RateLimitMiddleware(redis, options);
+}
+/**
+ * Format rate limit error for MCP response
+ */
+export function formatRateLimitError(error, operation) {
+    return {
+        error: error.message,
+        retryAfter: error.retryAfter,
+        operation,
+    };
+}
+//# sourceMappingURL=rate-limit-middleware.js.map

package/dist/security 2/rate-limit-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-middleware.js","sourceRoot":"","sources":["../../src/security/rate-limit-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAEL,iBAAiB,GAGlB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,aAAa,GAEd,MAAM,0BAA0B,CAAC;AA2BlC;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvB,UAAU,CAAS;IACnB,UAAU,CAAS;IAEnC,YAAY,OAAe,EAAE,UAAkB,EAAE,UAAkB;QACjE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,6DAA6D;QAC7D,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;CACF;AAgBD;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACtB,KAAK,CAAQ;IACb,WAAW,GAAuB,IAAI,CAAC;IACvC,OAAO,CAA6B;IACpC,cAAc,GACpB,IAAI,GAAG,EAAE,CAAC;IAEZ,YAAY,KAAY,EAAE,OAAmC;QAC3D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,sDAAsD;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW;QACjB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAAoC,EAAE,GAAG,UAAU,EAAE,CAAC;QAElE,KAAK,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CACpD,IAAI,CAAC,OAAO,CAAC,YAAY,CAC1B,EAAE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,GAAG,YAAY,CAAC;QACnC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,SAAiB;QAEjB,IAAI,CAAC;YACH,gCAAgC;YAChC,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,kCAAkC,EAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YAEF,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC1B,2CAA2C;gBAC3C,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;gBACvE,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,uDAAuD;gBACvD,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACpE,MAAM,IAAI,cAAc,CACtB,qEAAqE,EACrE,GAAG,EACH,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,SAAiB;QAEjB,4BAA4B;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,iBAAiB;YACjB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,4BAA4B;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAEpE,2CAA2C;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/D,gBAAgB;QAChB,MAAM,OAAO,GAAqB;YAChC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YACzC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACjD,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC;SACrC,CAAC;QAEF,yCAAyC;QACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO;YACP,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,CAAC,CAAC;YACb,OAAO,EAAE,CAAC;YACV,OAAO,EAAE;gBACP,mBAAmB,EAAE,IAAI;gBACzB,uBAAuB,EAAE,IAAI;gBAC7B,mBAAmB,EAAE,GAAG;gBACxB,oBAAoB,EAAE,MAAM;aAC7B;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAc;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACzB,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAY,EACZ,OAAmC;IAEnC,OAAO,IAAI,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAqB,EACrB,SAAiB;IAEjB,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,OAAO;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS;KACV,CAAC;AACJ,CAAC"}