Blog
News, releases and articles about @imqueue. Page 1 of 9.
Rate limiting a Node.js API across many instances, without letting a forged header ban your customers
A per-process rate limiter stops counting the moment you run a second copy of your API. Moving the counter into Redis fixes that, and exposes the question that matters more: who is the client? Here is how @imqueue/http-protect counts and bans across every instance, what the counter really measures, why trusting X-Forwarded-For lets anyone get your customers banned, and how to set it up so it can't. Every behaviour is measured.
read →Request IDs and user context across Node.js services, without adding a parameter to every method
A log line in your billing service says a charge failed. Which user? Which request? Billing cannot tell you, because nobody told it. Here is how to carry a request ID, the user and the tenant from the edge of your system through every service call it causes, read them anywhere in a handler, and pass them on automatically, plus the one place where that context must never decide the answer. Every behaviour is measured.
read →When Redis restarts: persistence, eviction and reconnects for a Node.js service fleet
Sooner or later the Redis under your services restarts: an upgrade, a moved node, a process killed for memory. Whether your queued messages are still there afterwards depends on three Redis settings most teams never chose, and what your services do in the meantime depends on how the framework reconnects. Here is what we measured on a real Redis, the five lines of configuration that decide it, and what to do in code for the seconds the broker is gone.
read →Soft delete and tenant scoping in Prisma, written once instead of in every query
Every team that soft-deletes rows ends up with a deletedAt filter in a hundred places, and the one that gets forgotten is usually inside an include. Tenant filters fail the same way, only worse. Here is how to move both below your queries with @imqueue/pg-prisma on Prisma Next, so a delete becomes a stamp and every read, relations included, sees only live rows the caller may see. Every behaviour is measured on a real Postgres.
read →Least privilege for your Redis broker: the ACL a Node.js service fleet actually needs
TLS decides who can listen to your broker. It says nothing about what a connected process may do after it is in — and on a Redis left at its defaults the answer is everything, including FLUSHALL. Here is the exact rule set an @imqueue fleet needs, the permissions that look optional and quietly are not, and how to rotate the password without a restart storm. Every behaviour is measured.
read →