fix: critical bugs, serverless stability, and security hardening

Bug Fixes:
- Fix rate limiter API mismatch: check() -> checkAsync() in index.ts, worker.ts, api/relay.ts
- Fix WebSocket SSRF silent drop: return error Response instead of undefined
- Fix isDevMode() default: changed from true to false (production-safe)
- Fix process.env -> env bindings in worker.ts requireAuth for Cloudflare Workers
- Fix Bun.file() crash in Workers: add try/catch with fallback
- Fix Bun.CryptoHasher -> Web Crypto API in mimo-auth.ts for Workers compat

Architecture:
- Add public methods to ProxyPool (getEntryAtIndex, getProxyUrlAtIndex, getCurrentIndex, setCurrentIndex) to remove all 'as any' casts in SessionProxyPool
- Add addProxy() method for manual proxy management
- Add loadAsync(), tryLoadAsync(), loadFromString() to ProxyPool

Serverless Stability:
- Add optional DNS rebinding protection via SSRF_DNS_CHECK env flag
- CORS cache now auto-invalidates when CORS_ORIGIN env changes
- Rate limiter max-size eviction (10k keys) prevents unbounded memory growth

Tests:
- Fix type assertions in test files (body as Record<string, unknown>)
- All 153 tests pass, typecheck clean

This commit is contained in:

MythEclipse

2026-06-19 18:10:49 +07:00

parent 6d61dcba8f

commit cb6191902e

13 changed files with 865 additions and 121 deletions

									
										src/middleware/body-limiter.test.ts
									
		+1
		-1
	
												View File
												
				@@ -80,7 +80,7 @@ describe("body-limiter", () => {

								headers: { "Content-Length": "200" },

							});

							const result = checkBodySize(request);

							const body = await result!.json();

							const body = await result!.json() as Record<string, unknown>;

							expect(body.error).toBe("Payload Too Large");

							expect(body.maxSizeBytes).toBe(100);

						});