import { timingSafeEqual } from "node:crypto";import { Effect } from "effect";import type { MiddlewareHandler, Next } from "hono";import type { AppContext } from "../app-context";import { effectMiddleware } from "./effect-handler"; const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);const PUBLIC_PATHS = new Set<string>(["/health"]);const DEFAULT_RATE_LIMIT_WINDOW_MS = 60_000;const DEFAULT_RATE_LIMIT_MAX_REQUESTS = 120;const DEFAULT_READ_RATE_LIMIT_MAX_REQUESTS = 1200;const READ_RATE_LIMIT_EXEMPT_PATHS = new Set<string>([ "/health", "/status", "/metrics", "/events", "/api/docs", "/api/spec",]);const RATE_LIMIT_STORE_CAP = 10_000; type RateLimitEntry = { count: number; resetAt: number }; const mutatingRateLimitStore = new Map<string, RateLimitEntry>();const readRateLimitStore = new Map<string, RateLimitEntry>(); const isReadRateLimitExempt = (method: string, path: string): boolean => method.toUpperCase() === "OPTIONS" || READ_RATE_LIMIT_EXEMPT_PATHS.has(path) || path.endsWith("/stream") || path.endsWith("/events"); const isMutatingRequest = (method: string): boolean => MUTATING_METHODS.has(method.toUpperCase()); const isPublicRequest = (method: string, path: string): boolean => method.toUpperCase() === "OPTIONS" || PUBLIC_PATHS.has(path); const getClientIpFromRequestHeaders = (header: (name: string) => string | undefined): string => { const cf = header("cf-connecting-ip")?.trim(); if (cf) return cf; const real = header("x-real-ip")?.trim(); if (real) return real; const forwarded = header("x-forwarded-for") ?.split(",") .map((value) => value.trim()) .filter((value) => value.length > 0); if (forwarded && forwarded.length > 0) return forwarded[forwarded.length - 1]!; return "unknown";}; const pruneRateLimitStore = (store: Map<string, RateLimitEntry>, now: number): void => { if (store.size <= RATE_LIMIT_STORE_CAP) return; for (const [key, entry] of store) { if (entry.resetAt <= now) store.delete(key); } let toEvict = store.size - RATE_LIMIT_STORE_CAP; for (const key of store.keys()) { if (toEvict <= 0) break; store.delete(key); toEvict -= 1; }}; const extractAuthToken = (header: (name: string) => string | undefined): string | null => { const bearer = header("authorization"); if (bearer) { const match = bearer.match(/^Bearer\s+(.+)$/i); if (match?.[1]) return match[1].trim(); } const apiKeyHeader = header("x-api-key"); return apiKeyHeader?.trim() || null;}; const safeTokenEquals = (expected: string, provided: string): boolean => { const expectedBuffer = Buffer.from(expected); const providedBuffer = Buffer.from(provided); return ( expectedBuffer.length === providedBuffer.length && timingSafeEqual(expectedBuffer, providedBuffer) );}; const rateLimitKey = (path: string, method: string, clientIp: string): string => `${clientIp}:${method.toUpperCase()}:${path}`; const nextEffect = (next: Next): Effect.Effect<void, unknown> => Effect.tryPromise({ try: next, catch: (error) => error }); export function createAuthMiddleware(context: AppContext): MiddlewareHandler { return effectMiddleware((ctx, next) => Effect.suspend(() => { if (isPublicRequest(ctx.req.method, ctx.req.path)) return nextEffect(next); const expectedApiKey = context.config.api_key?.trim(); if (!expectedApiKey) return nextEffect(next); const providedToken = extractAuthToken((name) => ctx.req.header(name)); if (providedToken && safeTokenEquals(expectedApiKey, providedToken)) return nextEffect(next); ctx.header("WWW-Authenticate", 'Bearer realm="local-studio-controller"'); return Effect.succeed(ctx.json({ detail: "Unauthorized" }, { status: 401 })); }), );} export function createMutatingRateLimitMiddleware( _context: AppContext, options: { windowMs?: number; maxRequests?: number } = {},): MiddlewareHandler { const windowMs = options.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS; const maxRequests = options.maxRequests ?? DEFAULT_RATE_LIMIT_MAX_REQUESTS; return effectMiddleware((ctx, next) => Effect.suspend(() => { if (!isMutatingRequest(ctx.req.method)) return nextEffect(next); const now = Date.now(); const clientIp = getClientIpFromRequestHeaders((name) => ctx.req.header(name)); const key = rateLimitKey(ctx.req.path, ctx.req.method, clientIp); const existing = mutatingRateLimitStore.get(key); const entry: RateLimitEntry = existing && existing.resetAt > now ? { count: existing.count + 1, resetAt: existing.resetAt } : { count: 1, resetAt: now + windowMs }; mutatingRateLimitStore.set(key, entry); ctx.header("X-RateLimit-Limit", String(maxRequests)); ctx.header("X-RateLimit-Remaining", String(Math.max(maxRequests - entry.count, 0))); ctx.header("X-RateLimit-Reset", String(Math.ceil(entry.resetAt / 1000))); if (entry.count > maxRequests) { ctx.header("Retry-After", String(Math.max(Math.ceil((entry.resetAt - now) / 1000), 1))); return Effect.succeed(ctx.json({ detail: "Rate limit exceeded" }, { status: 429 })); } pruneRateLimitStore(mutatingRateLimitStore, now); return nextEffect(next); }), );} export function createReadRateLimitMiddleware( _context: AppContext, options: { windowMs?: number; maxRequests?: number } = {},): MiddlewareHandler { const windowMs = options.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS; const maxRequests = options.maxRequests ?? DEFAULT_READ_RATE_LIMIT_MAX_REQUESTS; return effectMiddleware((ctx, next) => Effect.suspend(() => { if ( isMutatingRequest(ctx.req.method) || isReadRateLimitExempt(ctx.req.method, ctx.req.path) ) { return nextEffect(next); } const now = Date.now(); const clientIp = getClientIpFromRequestHeaders((name) => ctx.req.header(name)); const key = rateLimitKey(ctx.req.path, ctx.req.method, clientIp); const existing = readRateLimitStore.get(key); const entry: RateLimitEntry = existing && existing.resetAt > now ? { count: existing.count + 1, resetAt: existing.resetAt } : { count: 1, resetAt: now + windowMs }; readRateLimitStore.set(key, entry); if (entry.count > maxRequests) { ctx.header("Retry-After", String(Math.max(Math.ceil((entry.resetAt - now) / 1000), 1))); return Effect.succeed(ctx.json({ detail: "Rate limit exceeded" }, { status: 429 })); } pruneRateLimitStore(readRateLimitStore, now); return nextEffect(next); }), );}
import { timingSafeEqual } from "node:crypto";
import { Effect } from "effect";
import type { MiddlewareHandler, Next } from "hono";
import type { AppContext } from "../app-context";
import { effectMiddleware } from "./effect-handler";
const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
const PUBLIC_PATHS = new Set<string>(["/health"]);
const DEFAULT_RATE_LIMIT_WINDOW_MS = 60_000;
const DEFAULT_RATE_LIMIT_MAX_REQUESTS = 120;
const DEFAULT_READ_RATE_LIMIT_MAX_REQUESTS = 1200;
const READ_RATE_LIMIT_EXEMPT_PATHS = new Set<string>([
"/health",
"/status",
"/metrics",
"/events",
"/api/docs",
"/api/spec",
]);
const RATE_LIMIT_STORE_CAP = 10_000;
type RateLimitEntry = { count: number; resetAt: number };
const mutatingRateLimitStore = new Map<string, RateLimitEntry>();
const readRateLimitStore = new Map<string, RateLimitEntry>();
const isReadRateLimitExempt = (method: string, path: string): boolean =>
method.toUpperCase() === "OPTIONS" ||
READ_RATE_LIMIT_EXEMPT_PATHS.has(path) ||
path.endsWith("/stream") ||
path.endsWith("/events");
const isMutatingRequest = (method: string): boolean => MUTATING_METHODS.has(method.toUpperCase());
const isPublicRequest = (method: string, path: string): boolean =>
method.toUpperCase() === "OPTIONS" || PUBLIC_PATHS.has(path);
const getClientIpFromRequestHeaders = (header: (name: string) => string | undefined): string => {
const cf = header("cf-connecting-ip")?.trim();
if (cf) return cf;
const real = header("x-real-ip")?.trim();
if (real) return real;
const forwarded = header("x-forwarded-for")
?.split(",")
.map((value) => value.trim())
.filter((value) => value.length > 0);
if (forwarded && forwarded.length > 0) return forwarded[forwarded.length - 1]!;
return "unknown";
};
const pruneRateLimitStore = (store: Map<string, RateLimitEntry>, now: number): void => {
if (store.size <= RATE_LIMIT_STORE_CAP) return;
for (const [key, entry] of store) {
if (entry.resetAt <= now) store.delete(key);
}
let toEvict = store.size - RATE_LIMIT_STORE_CAP;
for (const key of store.keys()) {
if (toEvict <= 0) break;
store.delete(key);
toEvict -= 1;
}
};
const extractAuthToken = (header: (name: string) => string | undefined): string | null => {
const bearer = header("authorization");
if (bearer) {
const match = bearer.match(/^Bearer\s+(.+)$/i);
if (match?.[1]) return match[1].trim();
}
const apiKeyHeader = header("x-api-key");
return apiKeyHeader?.trim() || null;
};
const safeTokenEquals = (expected: string, provided: string): boolean => {
const expectedBuffer = Buffer.from(expected);
const providedBuffer = Buffer.from(provided);
return (
expectedBuffer.length === providedBuffer.length &&
timingSafeEqual(expectedBuffer, providedBuffer)
);
};
const rateLimitKey = (path: string, method: string, clientIp: string): string =>
`${clientIp}:${method.toUpperCase()}:${path}`;
const nextEffect = (next: Next): Effect.Effect<void, unknown> =>
Effect.tryPromise({ try: next, catch: (error) => error });
export function createAuthMiddleware(context: AppContext): MiddlewareHandler {
return effectMiddleware((ctx, next) =>
Effect.suspend(() => {
if (isPublicRequest(ctx.req.method, ctx.req.path)) return nextEffect(next);
const expectedApiKey = context.config.api_key?.trim();
if (!expectedApiKey) return nextEffect(next);
const providedToken = extractAuthToken((name) => ctx.req.header(name));
if (providedToken && safeTokenEquals(expectedApiKey, providedToken)) return nextEffect(next);
ctx.header("WWW-Authenticate", 'Bearer realm="local-studio-controller"');
return Effect.succeed(ctx.json({ detail: "Unauthorized" }, { status: 401 }));
}),
);
}
export function createMutatingRateLimitMiddleware(
_context: AppContext,
options: { windowMs?: number; maxRequests?: number } = {},
): MiddlewareHandler {
const windowMs = options.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS;
const maxRequests = options.maxRequests ?? DEFAULT_RATE_LIMIT_MAX_REQUESTS;
return effectMiddleware((ctx, next) =>
Effect.suspend(() => {
if (!isMutatingRequest(ctx.req.method)) return nextEffect(next);
const now = Date.now();
const clientIp = getClientIpFromRequestHeaders((name) => ctx.req.header(name));
const key = rateLimitKey(ctx.req.path, ctx.req.method, clientIp);
const existing = mutatingRateLimitStore.get(key);
const entry: RateLimitEntry =
existing && existing.resetAt > now
? { count: existing.count + 1, resetAt: existing.resetAt }
: { count: 1, resetAt: now + windowMs };
mutatingRateLimitStore.set(key, entry);
ctx.header("X-RateLimit-Limit", String(maxRequests));
ctx.header("X-RateLimit-Remaining", String(Math.max(maxRequests - entry.count, 0)));
ctx.header("X-RateLimit-Reset", String(Math.ceil(entry.resetAt / 1000)));
if (entry.count > maxRequests) {
ctx.header("Retry-After", String(Math.max(Math.ceil((entry.resetAt - now) / 1000), 1)));
return Effect.succeed(ctx.json({ detail: "Rate limit exceeded" }, { status: 429 }));
}
pruneRateLimitStore(mutatingRateLimitStore, now);
return nextEffect(next);
}),
);
}
export function createReadRateLimitMiddleware(
_context: AppContext,
options: { windowMs?: number; maxRequests?: number } = {},
): MiddlewareHandler {
const windowMs = options.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS;
const maxRequests = options.maxRequests ?? DEFAULT_READ_RATE_LIMIT_MAX_REQUESTS;
return effectMiddleware((ctx, next) =>
Effect.suspend(() => {
if (
isMutatingRequest(ctx.req.method) ||
isReadRateLimitExempt(ctx.req.method, ctx.req.path)
) {
return nextEffect(next);
}
const now = Date.now();
const clientIp = getClientIpFromRequestHeaders((name) => ctx.req.header(name));
const key = rateLimitKey(ctx.req.path, ctx.req.method, clientIp);
const existing = readRateLimitStore.get(key);
const entry: RateLimitEntry =
existing && existing.resetAt > now
? { count: existing.count + 1, resetAt: existing.resetAt }
: { count: 1, resetAt: now + windowMs };
readRateLimitStore.set(key, entry);
if (entry.count > maxRequests) {
ctx.header("Retry-After", String(Math.max(Math.ceil((entry.resetAt - now) / 1000), 1)));
return Effect.succeed(ctx.json({ detail: "Rate limit exceeded" }, { status: 429 }));
}
pruneRateLimitStore(readRateLimitStore, now);
return nextEffect(next);
}),
);
}