fix: AssetPacks router

[cyaiox]

This PR fixes the upserting of assets' parent IDs to another parent.

Additionally, adds auth to the assets endpoint.

In general, the fix is to introduce a rate-limiting middleware (for example, using express-rate-limit) and apply it to the sensitive routes that perform authentication/authorization and database access. This middleware should be placed in the route definition before server.handleRequest(...) so that obviously abusive traffic is rejected early, without hitting the application logic or database.

In this file, the best approach without changing existing functionality is:

• Import a rate-limiting middleware implementation (e.g., express-rate-limit).
• Define a limiter instance configured for these asset routes (for example, allowing a reasonable number of requests per 15-minute window).
• Apply this limiter to the /assets/:id and /assets GET routes by inserting it into the middleware chain after withCors and withAuthentication but before withAssetExists / server.handleRequest(...).
  This preserves existing behavior, adds only rejection in case of too many requests, and ensures that authenticated users are each rate-limited according to the configuration (or, if using IP-based default, at least globally throttled).

Concretely, within src/Asset/Asset.router.ts:

• Add import rateLimit from 'express-rate-limit' to the import section.
• Inside mount(), define a const assetRateLimiter = rateLimit({...}).
• Update the two this.router.get(...) blocks for /assets/:id and /assets to include assetRateLimiter in their middleware lists.

In general, to fix missing rate limiting on an Express route, you add a rate-limiting middleware (for example using express-rate-limit) and plug it into the handler chain before the expensive operation. This limits how many requests a client can make to that endpoint in a given time window, mitigating denial-of-service risks.

For this specific code, the minimal, non-breaking fix is to (1) import express-rate-limit, (2) define a rate limiter instance suitable for the /assets listing endpoint, and (3) insert that limiter middleware into the /assets route before server.handleRequest(this.getAssets). To avoid altering other routes’ behavior, we will only apply the limiter to the /assets route, not globally. Concretely: at the top of src/Asset/Asset.router.ts we add an import for express-rate-limit. Inside mount(), before defining the routes, we create a const assetsRateLimiter = rateLimit({ ... }) with reasonable defaults, e.g., limiting requests per IP for that route. Then, in the .get('/assets', ...) handler chain, we add assetsRateLimiter between withAuthentication and server.handleRequest(this.getAssets). No existing functions need to change their signatures or logic; we just enrich the middleware chain.

[coveralls]

Pull Request Test Coverage Report for Build 22962474366

Details

• 11 of 16 (68.75%) changed or added relevant lines in 3 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.4%) to 71.907%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/Asset/Asset.model.ts	0	5	0.0%

Totals
Change from base Build 22682665195:	0.4%
Covered Lines:	3243
Relevant Lines:	4321

---

💛 - Coveralls

[LautaroPetaccio]

What if, instead of rewriting the assets with the asset pack id from the request, we return a 400 if one of them does not have the correct id?

[cyaiox]

good idea!

[LautaroPetaccio]

Why do we need the is_deleted condition here and not in the original query?

[cyaiox]

good catch, will add it to the original query, as we don't want to show deleted assets even using the id.