Julien Gautier
6695909db2
express-rate-limit v8 raises ERR_ERL_KEY_GEN_IPV6 at boot because the custom keyGenerator returned req.ip verbatim. For IPv6, that lets an attacker rotate through the host bits of their own subnet (~2^72 keys on a typical /56 residential allocation) and escape per-IP rate limiting entirely — useful as a brute-force protection it isn't, then. Wrap req.ip through the library's ipKeyGenerator helper before keying, which truncates IPv6 addresses to their /56 prefix and is a no-op for IPv4. Test coverage for IPv4 / session / SKIP_PATHS unchanged; new case asserts two addresses in the same /56 share a bucket and that distinct /56s remain isolated. Surfaced by the ADR-0030 dockerised dev mode validation. The BFF kept booting (v8's default error handler logs and continues for this validation), so the bypass was live in dev until now.
Documentation index
This is the entry point to all project documentation. It is maintained automatically: any addition, rename, or removal of a .md file under docs/ must be reflected here in the same change.
Conventions
- Documentation is written in English.
- One topic per file. Group related files into a folder when there are three or more.
- Cross-reference with relative links so they keep working in GitHub, IDEs, and exported sites.
- For architectural decisions, do not add them here — they belong in decisions/ as MADR 4.0.0 ADRs.
Sections
Daily development
- development.md — repo layout, prerequisites, initial setup, daily commands, observability dev-loop (Jaeger UI, log ↔ trace correlation), dependency updates (Renovate), conventional commit cycle. Day-to-day reference for working on the project.
Architecture
- architecture.md — cross-cutting Mermaid diagrams: C4 system context, C4 containers, Nx module boundaries, CI/CD pipeline. Single-decision diagrams (auth sequence, ERD, etc.) live inline in their ADR.
Onboarding & environment
Setup guides for new contributors:
- setup/01-wsl-terminal-setup.md — modern WSL terminal (Zsh + Powerlevel10k + CLI tools)
- setup/02-dev-web-stack.md — Node via nvm, pnpm via corepack, Docker
- setup/03-angular-nx-monorepo.md — Angular + Nx monorepo bootstrap
Operations & runbooks
Empty — to be populated when we deploy.
Security, performance, accessibility
Empty — placeholders to be filled with rationale docs alongside their corresponding ADRs.