mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-28 04:38:59 +00:00
Anso
8e1b9826cf
* fix(api): add tiered rate limiting to prevent polling lockouts Replace the single global rate limiter (100 req/min/IP) with a tiered system that separates high-frequency polling endpoints from standard API traffic: - Polling tier (300/min): /stats, /system/stats, /stacks/statuses, /metrics/historical, /health, /meta, /auth/status, /auth/sso/providers, /license. Exempt from the global limiter but governed by their own safety net to prevent resource exhaustion. - Standard tier (200/min): All other endpoints, raised from 100. - Webhook tier (500/min): POST /webhooks/:id/trigger, dedicated limiter for CI/CD platforms sharing datacenter IPs. - Auth tier: Unchanged (5-10 attempts / 15 min). Enterprise adaptations: - Authenticated requests keyed by user session (JWT sub/username) instead of IP, preventing shared NAT/VPN environments from pooling budgets. - Internal node-to-node traffic (node_proxy tokens) bypasses all rate limiters entirely. Includes comprehensive stress tests (21 cases) validating tier separation, node proxy bypass, and per-user keying. * chore(deps): bump axios to 1.15.0 to fix SSRF vulnerability Addresses GHSA-3p68-rc4w-qgx5 (NO_PROXY hostname normalization bypass).
70 lines
1.9 KiB
JSON
70 lines
1.9 KiB
JSON
{
|
|
"name": "backend",
|
|
"version": "1.0.0",
|
|
"description": "",
|
|
"main": "index.js",
|
|
"scripts": {
|
|
"postinstall": "test -f scripts/generate-version.js && node scripts/generate-version.js || true",
|
|
"prebuild": "node scripts/generate-version.js",
|
|
"build": "tsc",
|
|
"start": "node dist/index.js",
|
|
"predev": "node scripts/generate-version.js",
|
|
"dev": "nodemon --watch src --ext ts,json --exec ts-node src/index.ts",
|
|
"test": "vitest run",
|
|
"lint": "eslint src"
|
|
},
|
|
"keywords": [],
|
|
"author": "",
|
|
"license": "SEE LICENSE IN LICENSE",
|
|
"type": "commonjs",
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@types/bcrypt": "^6.0.0",
|
|
"@types/better-sqlite3": "^7.6.13",
|
|
"@types/cookie-parser": "^1.4.10",
|
|
"@types/http-proxy-middleware": "^1.0.0",
|
|
"@types/jsonwebtoken": "^9.0.10",
|
|
"@types/node": "^25.3.0",
|
|
"@types/supertest": "^7.2.0",
|
|
"@types/yaml": "^1.9.6",
|
|
"eslint": "^10.1.0",
|
|
"nodemon": "^3.1.13",
|
|
"supertest": "^7.2.2",
|
|
"ts-node": "^10.9.2",
|
|
"typescript": "^6.0.2",
|
|
"typescript-eslint": "^8.0.0",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-ecr": "^3.1019.0",
|
|
"@types/cors": "^2.8.19",
|
|
"@types/dockerode": "^4.0.1",
|
|
"@types/express": "^5.0.6",
|
|
"@types/http-proxy": "^1.17.17",
|
|
"@types/semver": "^7.7.1",
|
|
"@types/ws": "^8.18.1",
|
|
"axios": "^1.15.0",
|
|
"bcrypt": "^6.0.0",
|
|
"better-sqlite3": "^12.6.2",
|
|
"composerize": "^1.7.5",
|
|
"cookie-parser": "^1.4.7",
|
|
"cors": "^2.8.6",
|
|
"cron-parser": "^5.5.0",
|
|
"dockerode": "^4.0.9",
|
|
"express": "^5.2.1",
|
|
"express-rate-limit": "^8.3.1",
|
|
"helmet": "^8.1.0",
|
|
"http-proxy": "^1.18.1",
|
|
"http-proxy-middleware": "^3.0.5",
|
|
"jsonwebtoken": "^9.0.3",
|
|
"ldapts": "^8.1.7",
|
|
"node-pty": "^1.1.0",
|
|
"openid-client": "^5.7.1",
|
|
"semver": "^7.7.4",
|
|
"systeminformation": "^5.31.1",
|
|
"ws": "^8.19.0",
|
|
"yaml": "^2.8.2",
|
|
"zod": "^4.3.6"
|
|
}
|
|
}
|