Merge remote-tracking branch 'upstream/main' into i18n-spanish

src/data/dataCredits.js

@@ -304,7 +304,8 @@ export const DATA_CREDITS = [
     key: 'gbfs',
     html:
       'Bikeshare availability: GBFS operator feeds ' +
-      '(e.g. Austin BCycle; Bike Share Toronto, operated by the Toronto Parking Authority; Bike Itaú, operated by Tembici)',
+      '(e.g. Austin BCycle; Bike Share Toronto, operated by the Toronto Parking Authority; Bike Itaú and Tembici Bogotá, operated by Tembici; ' +
+      'Bicing, Barcelona City Council (B:SM); AMBici, Àrea Metropolitana de Barcelona, operated by nextbike)',
   },
   {
     key: 'urbansharing-gbfs',

src/data/gbfsProxyRateLimit.test.mjs

@@ -0,0 +1,152 @@
+// GBFS PROXY — the frequency the allowlist never bounded.
+//
+// `/api/gbfs` already says WHERE it may go: an https allowlisted host, a
+// station_information/station_status path, a 12 s timeout, a 5 MB body cap and
+// no redirects. Nothing said HOW OFTEN, so the dev server would relay an
+// unbounded stream of requests at a third-party bikeshare operator on any
+// caller's behalf — one outbound fetch and one timeout timer each.
+//
+// These cases drive the real mounted middleware. `fetch` is stubbed per test
+// and restored afterwards, so a case that reaches the network fails loudly,
+// and the stub's call count is what proves a refused request costs nothing.
+//
+// Run with: npm test
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { gbfsProxy, GBFS_RATE_PER_MIN } from '../../server/providers/gbfs.js';
+
+const STATUS_URL = 'https://gbfs.lyft.com/gbfs/2.3/bay/en/station_status.json';
+const STATION_BODY = '{"data":{"stations":[]}}';
+
+/** Mount the proxy the way the dev server does; returns its route handler. */
+function mount(options) {
+  const routes = new Map();
+  gbfsProxy(options).configureServer({
+    middlewares: {
+      use(route, handler) {
+        routes.set(route, handler);
+      },
+    },
+  });
+  return routes.get('/api/gbfs');
+}
+
+function request(handler, { target = STATUS_URL, remoteAddress, method } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = {
+      method: method || 'GET',
+      // connect strips the mount prefix before the handler sees the URL.
+      url: '/' + encodeURIComponent(target),
+      headers: {},
+      socket: remoteAddress ? { remoteAddress } : undefined,
+    };
+    let status = 200;
+    let headers = {};
+    const res = {
+      writeHead(code, sent) {
+        status = code;
+        headers = sent || {};
+        return res;
+      },
+      end(body = '') {
+        let parsed = null;
+        try {
+          parsed = body ? JSON.parse(String(body)) : null;
+        } catch {
+          parsed = String(body);
+        }
+        resolve({ status, headers, body: parsed });
+      },
+    };
+    Promise.resolve(handler(req, res)).catch(reject);
+  });
+}
+
+/** Answer every allowlisted upstream, counting the calls that got through. */
+function stubUpstream(t) {
+  const asked = [];
+  const original = globalThis.fetch;
+  globalThis.fetch = async (url) => {
+    asked.push(String(url));
+    return new Response(STATION_BODY, {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  };
+  t.after(() => {
+    globalThis.fetch = original;
+  });
+  return asked;
+}
+
+test('a maximal real session is never throttled', async (t) => {
+  const asked = stubUpstream(t);
+  const handler = mount();
+
+  // The bikeshare layer catalogues 15 systems and refreshes each one's status
+  // once every 60 s, so a minute of the busiest possible session is ~15
+  // requests. Run eight times that and expect every one of them served.
+  let served = 0;
+  for (let i = 0; i < 120; i += 1) {
+    const res = await request(handler);
+    if (res.status === 200) served += 1;
+  }
+  assert.equal(served, 120, 'the shipped ceiling leaves a real session alone');
+  assert.equal(asked.length, 120);
+  assert.equal(GBFS_RATE_PER_MIN, 120, 'the ceiling this case relies on');
+});
+
+test('an unbounded relay is refused, and refusal costs no outbound fetch', async (t) => {
+  const asked = stubUpstream(t);
+  const handler = mount({ ratePerMinute: 5 });
+
+  const responses = [];
+  for (let i = 0; i < 12; i += 1) responses.push(await request(handler));
+
+  const served = responses.filter((r) => r.status === 200);
+  const refused = responses.filter((r) => r.status === 429);
+  assert.equal(served.length, 5, 'exactly the admitted budget is served');
+  assert.equal(refused.length, 7);
+  assert.equal(refused[0].body.error, 'Rate limit exceeded');
+  assert.equal(refused[0].headers['Retry-After'], '10');
+  assert.equal(refused[0].headers['Cache-Control'], 'no-store');
+  assert.equal(
+    asked.length,
+    5,
+    'a refused request never reaches the GBFS operator',
+  );
+});
+
+test('a different client keeps its own budget', async (t) => {
+  stubUpstream(t);
+  const handler = mount({ ratePerMinute: 3 });
+
+  for (let i = 0; i < 6; i += 1)
+    await request(handler, { remoteAddress: '10.0.0.1' });
+  const noisy = await request(handler, { remoteAddress: '10.0.0.1' });
+  assert.equal(noisy.status, 429, 'the noisy client spent its own budget');
+
+  const quiet = await request(handler, { remoteAddress: '10.0.0.2' });
+  assert.equal(quiet.status, 200, 'a quiet client is not collateral');
+});
+
+test('the limiter does not displace the existing guards', async (t) => {
+  const asked = stubUpstream(t);
+  const handler = mount({ ratePerMinute: 10 });
+
+  const wrongMethod = await request(handler, { method: 'POST' });
+  assert.equal(wrongMethod.status, 405);
+
+  const offAllowlist = await request(handler, {
+    target: 'https://example.com/gbfs/station_status.json',
+  });
+  assert.equal(offAllowlist.status, 403);
+  assert.equal(offAllowlist.body.error, 'GBFS host not allowed');
+
+  const wrongPath = await request(handler, {
+    target: 'https://gbfs.lyft.com/gbfs/2.3/bay/en/system_regions.json',
+  });
+  assert.equal(wrongPath.status, 400);
+
+  assert.equal(asked.length, 0, 'none of those reached upstream');
+});

src/data/gbfsSource.js

@@ -8,6 +8,7 @@ const GBFS_ALLOWED_HOSTS = new Set([
   'austin.publicbikesystem.net',
   'hon.publicbikesystem.net',
   'chat.publicbikesystem.net',
+  'gbfs.nextbike.net',
   'gbfs.urbansharing.com',
   'api.entur.io',
   'api.cyclocity.fr',