Address review feedback: strengthen rate limiter safety and validation

[ib823]

Motivation

• Harden the previously generated in-memory rate limiter to avoid edge-case misbehaviour (falsy option coercion, blank keys, negative retry values) and to be production-safer.
• Add explicit validation and predictable semantics for constructor options so invalid configuration fails fast.

Description

• Use nullish defaults (??) and add maxKeys option, and require windowMs, maxRequests, and maxKeys to be positive integers (throw on invalid values).
• Normalize keys consistently by trimming string keys and mapping null/undefined/blank values to 'unknown', and apply normalization in middleware(), check(), and reset().
• Add bounded key capacity with _ensureCapacity() that evicts the key with the oldest recent activity when maxKeys is reached, and clamp Retry-After to never be negative.
• Add/extend tests to cover whitespace-only key normalization, nullish-default semantics, and constructor validation failures, and tidy up minor lint issues.

Testing

• Ran linter: npx eslint lib/security/rate-limiter.js test/lib/security/rate-limiter.test.js and it completed successfully.
• Ran unit tests: npx vitest run test/lib/security/rate-limiter.test.js with 12 tests passing (all tests passed).
• All automated checks referenced above are green.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sapconnect-web	Error		Feb 19, 2026 0:21am