feat: enhance configuration and rate limiting

- Added new configuration options: trustProxy, uploadConcurrency, batchMaxItems, batchMaxSizeBytes, and maxRequestBodyBytes to AppConfig.
- Implemented utility functions for parsing environment variables and masking sensitive data.
- Updated rate limiting logic to use configurable window size and maximum requests per window.
- Introduced a middleware for rate limiting on specific routes.
- Refactored file handling routes to support streaming downloads instead of redirects.
- Improved error handling and response formatting in file routes.
- Added support for oversized request rejection based on Content-Length header.
- Updated Swagger documentation to reflect changes in API behavior and responses.
- Enhanced tests to cover new features and ensure proper functionality.

test/swagger.test.ts

@@ -11,7 +11,7 @@ describe('Swagger Documentation Endpoints', () => {
     const body = (await res.json()) as {
       openapi: string;
       info: { title: string };
-      paths: Record<string, { post?: { requestBody: { content: Record<string, unknown> } } }>;
+      paths: Record<string, { get?: object; post?: object }>;
     };
     expect(body.openapi).toBe('3.0.0');
     expect(body.info.title).toBe('TeleUploader API');
@@ -19,10 +19,21 @@ describe('Swagger Documentation Endpoints', () => {
     expect(body.paths).toHaveProperty('/api/upload');
     expect(body.paths).toHaveProperty('/f/{public_id}');
     expect(body.paths).toHaveProperty('/file/{public_id}/info');
-    expect(body.paths['/api/upload'].post.requestBody.content).toHaveProperty(
-      'multipart/form-data',
-    );
-    expect(body.paths['/api/upload'].post.requestBody.content).toHaveProperty('application/json');
+
+    const uploadPath = body.paths['/api/upload'] as any;
+    const downloadPath = body.paths['/f/{public_id}'] as any;
+
+    expect(uploadPath.post.requestBody.content).toHaveProperty('multipart/form-data');
+    expect(uploadPath.post.requestBody.content).toHaveProperty('application/json');
+
+    // Verify 429 response documented
+    const uploadResponses = uploadPath.post.responses;
+    expect(uploadResponses).toHaveProperty('429');
+
+    // Verify download is no longer documented as 302 redirect
+    const downloadResponses = downloadPath.get.responses;
+    expect(downloadResponses['200'].description).toContain('stream');
+    expect(downloadResponses).not.toHaveProperty('302');
   });
 
   it('returns Swagger UI HTML page', async () => {
@@ -37,4 +48,9 @@ describe('Swagger Documentation Endpoints', () => {
     expect(html).toContain('/swagger.json');
     expect(html).toContain('swagger-ui-bundle.js');
   });
+
+  it('should not expose CORS * header', async () => {
+    const res = await handleSwaggerJson();
+    expect(res.headers.get('access-control-allow-origin')).toBeNull();
+  });
 });