feat(core): standalone checkRateLimitByIp primitive (matrix gap 12)

[rennf93]

Summary

Closes matrix gap 12 (A8 check_rate_limit_by_ip) - the TRAILING flag comes off. The full subsystem is ported, not a wrapper over the tiered check:

• handlers/rate-limit-by-ip.ts: the dedicated LRU-capped sliding-window stores (byIpRequestTimestamps, byIpAutobanCounts exported like the reference module globals, evict-oldest with touch-refresh), the _lru_pop_or_create twin, _hash_identity_segment (sha256 hex endpoint suffix so raw path text never reaches Redis and distinct budgets cannot collide), the _redis_request_count twin (sha-less pipeline path: zadd/zremrangebyscore/zcard/expire), the _resolve_redis_rate_limit_failure twin (fail-closed raises GuardRedisError(503, 'Redis rate limiting unavailable'); fail-open warns once and falls back to the in-memory window), and _feed_rate_limit_autoban (dedicated counter, never merged with the pipeline's suspicious counts; resolved through the same pure resolveThresholdBan helper the middleware path uses; passive-mode suppression; already-banned short-circuit before the counter increments; rate_limit_exceeded reason; threatBanConfig rate_limit first, then the flat threshold).
• Validation before any side effect: a rejected ip or an endpointPath containing : records no hit and feeds no ban; the rejection message redacts the path. To make the reference redaction contract real, the URL splitter now parses scheme-without-// inputs as scheme + path (the urlsplit semantics) and the path gets the pair-redaction pass (_redact_sensitive_path twin) - redactEndpointForDisplay('a:password=x') now answers a:password=[REDACTED] like the reference.
• The default empty endpoint path shares the pipeline's global bucket bidirectionally (corpus-verified against live Redis); a non-empty path is a disjoint budget. Exported from the package root like the reference guard_core.utils surface.

Matrix rows flipped

• A8 check_rate_limit_by_ip: MISSING -> FULL

Tests

38 tests in tests/test-handlers/rate-limit-by-ip.test.ts mirroring tests/test_core/test_check_rate_limit_by_ip.py and test_check_rate_limit_by_ip_autoban.py (live-Redis window enforcement, bidirectional bucket sharing, hashed-key isolation, redacted rejection message, LRU eviction arms, all autoban knob arms, counter isolation from the middleware, eviction arms).

Gates

• turbo lint/build/test 10/10; coverage gates hold (100% statements/functions/lines, 97.04% branches); pnpm audit 0 unignored

Stacked on #111 (#109 -> #110 -> #111 -> this); merge in order.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b1519a44-c9d3-4d87-b787-6606cce11034

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}