Mike Cao d2b4aa174e Rate limit dynamic client registration per source address ...

Replace the process-wide registration counter used without Redis with a
shared per-key fixed-window limiter, so one requester can no longer
exhaust the registration budget for every other client on the process.
The in-memory fallback is bounded (expired windows are swept, then the
oldest keys are shed) so memory stays constant under key churn.

Also fixes checkMcpRateLimit inverting redis.rateLimit's result: it
resolves true once the counter reaches its threshold, so with Redis the
MCP endpoint was denying requests below the limit and allowing those
above it. Both call sites now share the same limiter and semantics.

2026-09-05 17:57:20 -07:00

..

mcp

Rate limit dynamic client registration per source address

2026-09-05 17:57:20 -07:00

oauth

Harden OAuth metadata fetching and make token rotation transactional

2026-09-05 14:09:33 -07:00

two-factor

Harden 2FA APi routes and UI when 2FA env var missing. Closes #4443.

2026-08-14 10:32:09 -07:00

annotations.ts

Add website annotations with chart markers and CRUD management

2026-08-27 00:09:03 -07:00

api-key.test.ts

Add account API key management

2026-09-01 21:50:07 -07:00

api-key.ts

Add OAuth-protected MCP server with generated API client packages

2026-09-03 16:58:47 -07:00

api-url.test.ts

Merge branch 'analytics' into dev

2026-06-04 19:56:02 -07:00

api-url.ts

Merge branch 'analytics' into dev

2026-06-04 19:56:02 -07:00

auth.test.ts

Add account API key management

2026-09-01 21:50:07 -07:00

auth.ts

Add OAuth-protected MCP server with generated API client packages

2026-09-03 16:58:47 -07:00

boardComponentCompatibility.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

boardComponentCompatibility.ts

Board component, security, test updates

2026-06-29 18:17:57 -07:00

boards.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

boards.ts

Lint format files. Updated rng function.

2026-06-02 22:35:07 -07:00

charts.test.ts

Migrate tests to Vitest

2026-05-14 22:05:34 -07:00

charts.ts

…

clickhouse.test.ts

fix: support ClickHouse 22 date formats

2026-07-18 03:23:54 +08:00

clickhouse.ts

Fix excludeBounce query, simplify bounce definition for SPA websites, query routing for performance, add tests

2026-07-30 09:34:35 -07:00

client.ts

…

colors.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

colors.ts

…

constants.ts

Fix excludeBounce query, simplify bounce definition for SPA websites, query routing for performance, add tests

2026-07-30 09:34:35 -07:00

cors.ts

recorder.js CORS header implementation. Closes #4426

2026-08-04 15:34:36 -07:00

crypto.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

crypto.ts

…

csp.ts

Resolve ALLOWED_FRAME_URLS from the runtime environment in Docker

2026-06-26 13:31:37 +02:00

data.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

data.ts

fix: harden analytics writes and hide internal server errors from client

2026-06-22 22:07:07 -07:00

date.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

date.ts

Add Property filters for booleans, dates, arrays

2026-04-27 13:31:47 -07:00

db.test.ts

add session delete feature to relational only. add test, share conditions, and permissions. Closes #2940

2026-07-24 15:47:01 -07:00

db.ts

add session delete feature to relational only. add test, share conditions, and permissions. Closes #2940

2026-07-24 15:47:01 -07:00

detect.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

detect.ts

Handle invalid IPs and localhost lookup failures in location detection

2026-06-11 19:01:04 -07:00

entity.ts

Add board share management UI

2026-03-08 22:24:24 -07:00

fetch.ts

…

filters.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

filters.ts

…

format.test.ts

fix(format): divide by 1e9 in formatLongNumber billions branch

2026-07-21 17:52:40 +05:30

format.ts

fix(format): divide by 1e9 in formatLongNumber billions branch

2026-07-21 17:52:40 +05:30

generate.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

generate.ts

Lint format files. Updated rng function.

2026-06-02 22:35:07 -07:00

get-base-url.test.ts

Migrate tests to Vitest

2026-05-14 22:05:34 -07:00

get-base-url.ts

Fix metadata base URL generation

2026-03-09 19:51:20 +00:00

ip.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

ip.ts

Fix custom CLIENT_IP_HEADER not parsing x-forwarded-for/forwarded chains

2026-07-17 16:31:06 +02:00

jwt.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

jwt.ts

…

kafka.ts

verify Kafka broker TLS certificate by default

2026-07-04 18:45:45 +07:00

lang.test.ts

Mark Hebrew locale as RTL

2026-07-24 14:36:54 -07:00

lang.ts

Mark Hebrew locale as RTL

2026-07-24 14:36:54 -07:00

load.ts

use team redis keys to resolve team gated features

2026-03-21 11:21:07 -07:00

match-configured-path.test.ts

Migrate tests to Vitest

2026-05-14 22:05:34 -07:00

match-configured-path.ts

Fix tracker script name route matching

2026-03-09 19:56:41 +00:00

params.test.ts

Session and event property filtering. Closes #2945. Closes #4008.

2026-07-23 11:50:35 -07:00

params.ts

Session and event property filtering. Closes #2945. Closes #4008.

2026-07-23 11:50:35 -07:00

password.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

password.ts

…

prisma.test.ts

keep createSession raw writes on primary when replicas are enabled

2026-07-01 09:53:08 -07:00

prisma.ts

harden eventData delete. Add translations. Closes #4435.

2026-08-10 12:41:41 -07:00

rate-limit.test.ts

Rate limit dynamic client registration per source address

2026-09-05 17:57:20 -07:00

rate-limit.ts

Rate limit dynamic client registration per source address

2026-09-05 17:57:20 -07:00

react.ts

typescript fixes, replayer close error, show page toggle fix.

2026-06-17 10:02:12 -07:00

recorder.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

recorder.ts

implement sepearte replay/heatmap enabled routes and collection

2026-05-19 15:46:01 -07:00

redis.ts

Merge branch 'dev' of https://github.com/umami-software/umami into dev

2026-02-22 23:28:12 -08:00

replay.test.ts

Normalize replay events for rrweb-player playback

2026-06-15 20:08:53 -07:00

replay.ts

Normalize replay events for rrweb-player playback

2026-06-15 20:08:53 -07:00

request.ts

Session and event property filtering. Closes #2945. Closes #4008.

2026-07-23 11:50:35 -07:00

response.test.ts

fix: harden analytics writes and hide internal server errors from client

2026-06-22 22:07:07 -07:00

response.ts

fix(2fa): gate two-factor auth when the encryption key is missing

2026-08-13 22:39:31 +05:30

return-url.ts

Add OAuth-protected MCP server with generated API client packages

2026-09-03 16:58:47 -07:00

schema.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

schema.ts

Add website annotations with chart markers and CRUD management

2026-08-27 00:09:03 -07:00

session.test.ts

remove session recalculate and related queries

2026-07-21 12:33:41 -07:00

share.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

share.ts

add share page options enable filtering and enforce theme

2026-05-07 13:24:45 -07:00

sort.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

sort.ts

implement datatable sorting on non-analytics tables. (website/board/link/pixel/team/admin)

2026-05-07 10:46:03 -07:00

sql.ts

…

storage.ts

…

subscription.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

subscription.ts

Load subscription data from API before rendering replay and heatmap views

2026-07-28 14:07:09 -07:00

types.ts

Add OAuth-protected MCP server with generated API client packages

2026-09-03 16:58:47 -07:00

url.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

url.ts

fix: prevent NaN timestamps from breaking event charts in Firefox

2026-04-07 21:24:11 +02:00

utils.test.ts

Add coverage for core utility behavior

2026-07-24 13:52:37 -07:00

utils.ts

…