connectrpc 0.1.0

data/lib/connectrpc/grpc_web_cors.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module ConnectRPC
+  # One immutable policy per mount. Authentication, CSRF and outer middleware
+  # remain application-owned.
+  class GRPCWebCORS
+    BASE_REQUEST = %w[content-type x-grpc-web x-user-agent grpc-timeout accept].freeze
+    BASE_EXPOSE = %w[grpc-status grpc-message grpc-status-details-bin].freeze
+    TOKEN = /\A[!#$%&'*+.^_`|~0-9A-Za-z-]+\z/
+    private_constant :BASE_REQUEST, :BASE_EXPOSE, :TOKEN
+
+    attr_reader :origins, :credentials, :request_headers, :expose_headers
+
+    def initialize(origins:, credentials: false, request_headers: [], expose_headers: []) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity
+      unless [true, false].include?(credentials) && origins.is_a?(Array) && origins.size <= 32 &&
+             origins.all? { |origin| valid_origin?(origin) } && origins.uniq.size == origins.size
+        raise ArgumentError, "CORS requires distinct exact HTTP(S) origins and boolean credentials"
+      end
+
+      @origins = origins.map { |origin| origin.dup.freeze }.freeze
+      @credentials = credentials
+      @request_headers = (BASE_REQUEST + names(request_headers)).uniq.freeze
+      @expose_headers = (BASE_EXPOSE + names(expose_headers)).uniq.freeze
+      freeze
+    end
+
+    private
+
+    def valid_origin?(origin) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      return false unless origin.is_a?(String) && origin.ascii_only? && origin.bytesize <= 2048
+      return false unless %r{\Ahttps?://[^/?#\s]+\z}.match?(origin)
+
+      uri = URI.parse(origin)
+      host = uri.host
+      port = ":#{uri.port}" unless uri.port == uri.default_port
+      !!(uri.is_a?(URI::HTTP) && host && !uri.userinfo && uri.to_s == origin &&
+        host == host.downcase && origin == "#{uri.scheme}://#{host}#{port}")
+    rescue URI::InvalidURIError
+      false
+    end
+
+    def names(values) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      unless values.is_a?(Array) && values.size <= 32 && values.all? do |value|
+               value.is_a?(String) && value.bytesize <= 128 && TOKEN.match?(value)
+             end
+        raise ArgumentError, "CORS header lists require at most 32 HTTP tokens of at most 128 bytes"
+      end
+
+      normalized = values.map { |value| value.downcase.freeze }
+      raise ArgumentError, "CORS header names must be distinct" unless normalized.uniq.size == normalized.size
+
+      normalized
+    end
+  end
+
+  class Server
+    def cors_response(path:, http_method:, headers:, response: nil) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+      policy = @cors
+      return response unless policy && @protocol.include?(:grpc_web) && handles?(path)
+
+      return response if http_method != "OPTIONS" && request_protocol(headers, http_method) != :grpc_web
+
+      values = Protocol.headers(headers)
+      preflight = http_method == "OPTIONS" &&
+                  (values.key?("origin") || values.key?("access-control-request-method"))
+      return response unless preflight || GRPCWeb.intent?(values)
+
+      origin = Protocol.single(values, "origin")
+      allowed = origin && policy.origins.include?(origin)
+      if preflight
+        evaluated = cors_preflight(values, policy, origin, allowed)
+        return evaluated unless response && evaluated.status == 204
+
+        decorated = merge_cors_fields(response.headers, evaluated.headers.except("vary"))
+        GRPCWeb.vary(decorated, *evaluated.headers.fetch("vary"))
+        return TransportResponse.new(status: response.status, headers: decorated, body: response.body)
+      end
+
+      if values.key?("origin") && !allowed
+        return TransportResponse.new(status: 403, headers: { "vary" => %w[Origin Accept] }, body: "")
+      end
+      return unless response
+
+      # @type var fields: headers
+      fields = allowed && origin ? cors_fields(policy, origin) : {}
+      merged = merge_cors_fields(response.headers, fields)
+      GRPCWeb.vary(merged, "Origin", "Accept")
+      TransportResponse.new(status: response.status, headers: merged, body: response.body)
+    end
+
+    private
+
+    def cors_fields(policy, origin)
+      fields = { "access-control-allow-origin" => [origin],
+                 "access-control-expose-headers" => [policy.expose_headers.join(", ")] }
+      fields["access-control-allow-credentials"] = ["true"] if policy.credentials
+      fields
+    end
+
+    def merge_cors_fields(headers, fields)
+      normalized = Protocol.headers(headers)
+      if normalized.any? { |key, values| key.start_with?("access-control-") && fields[key] != values }
+        raise Error.new(:internal, "Conflicting application CORS policy"), cause: nil
+      end
+
+      normalized.merge(fields)
+    end
+
+    def cors_preflight(headers, policy, origin, allowed) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+      controls = headers.select { |key, _| key == "origin" || key.start_with?("access-control-request-") }
+      if GRPCProtocol.field_size(controls) > 8192
+        return TransportResponse.new(status: 403, body: "", headers: {
+                                       "vary" => %w[Origin Access-Control-Request-Method Access-Control-Request-Headers]
+                                     })
+      end
+      requested = headers.fetch("access-control-request-headers", []).flat_map do |value|
+        value.split(",", -1).map(&:strip)
+      end
+      valid = GRPCProtocol.field_size(controls) <= 8192 && requested.size <= 32 &&
+              requested.all? { |value| /\A[!#$%&'*+.^_`|~0-9A-Za-z-]+\z/.match?(value) }
+      permitted = valid && allowed && Protocol.single(headers, "access-control-request-method") == "POST" &&
+                  requested.all? { |value| policy.request_headers.include?(value.downcase) }
+      fields = { "vary" => %w[Origin Access-Control-Request-Method Access-Control-Request-Headers] }
+      if permitted && origin
+        fields.merge!(cors_fields(policy, origin))
+        fields["access-control-allow-methods"] = ["POST"]
+        fields["access-control-allow-headers"] = [policy.request_headers.join(", ")]
+        fields["access-control-max-age"] = ["0"]
+      end
+      TransportResponse.new(status: permitted ? 204 : 403, headers: fields, body: "")
+    end
+  end
+end

data/lib/connectrpc/grpc_web_io.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+module ConnectRPC
+  module GRPCWeb
+    # Decode each complete quartet independently: padding is permitted at every
+    # flush boundary, including inside a frame prefix or protobuf message.
+    class Input
+      def initialize(input, representation:, wire_limit:, headers:) # rubocop:disable Metrics/MethodLength
+        @input = input
+        @text = representation == :text
+        @encoded_limit = (@text ? 4 : 1) * (5 + wire_limit)
+        @decoded_limit = 5 + wire_limit
+        length = @length = Protocol.content_length!(headers["content-length"], invalid_code: :invalid_argument)
+        if length && length > @encoded_limit
+          raise Error.new(:resource_exhausted,
+                          "Encoded request exceeds byte limit")
+        end
+
+        @encoded = @decoded = 0
+        @carry = +"".b
+        @remainder = +"".b
+        @eof = false
+      end
+
+      def read(length, timeout: nil) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+        while @remainder.empty? && !@eof
+          amount = @text ? [((length + 2) / 3) * 4, 16_384].min : [length, 16_384].min
+          bytes = @input&.read([amount, @encoded_limit - @encoded + 1].min, timeout: timeout)
+          if bytes.nil? || bytes.empty?
+            finish_input
+          else
+            @encoded += bytes.bytesize
+            Protocol.check_size!(bytes, amount)
+            if @encoded > @encoded_limit
+              raise Error.new(:resource_exhausted, "Encoded request exceeds byte limit"), cause: nil
+            end
+
+            @remainder = @text ? decode(bytes) : bytes
+            @decoded += @remainder.bytesize
+            if @decoded > @decoded_limit
+              raise Error.new(:resource_exhausted, "Framed request exceeds byte limit"), cause: nil
+            end
+          end
+        end
+        return if @remainder.empty?
+
+        result = @remainder.byteslice(0, length) #: String
+        @remainder = @remainder.byteslice(result.bytesize..) #: String
+        result
+      end
+
+      private
+
+      def decode(bytes) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        bytes = @carry + bytes
+        count = bytes.bytesize - (bytes.bytesize % 4)
+        @carry = bytes.byteslice(count..) #: String
+        decoded = +"".b
+        offset = 0
+        while offset < count
+          group = bytes.byteslice(offset, 4) #: String
+          unless %r{\A(?:[A-Za-z0-9+/]{4}|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)\z}.match?(group)
+            raise Error.new(:invalid_argument, "Malformed Web base64"), cause: nil
+          end
+
+          value = group.unpack1("m0") #: String
+          raise Error.new(:invalid_argument, "Noncanonical Web base64"), cause: nil unless [value].pack("m0") == group
+
+          decoded << value
+          offset += 4
+        end
+        decoded
+      rescue ArgumentError
+        raise Error.new(:invalid_argument, "Malformed Web base64"), cause: nil
+      end
+
+      def finish_input
+        unless @carry.empty? && (@length.nil? || @length == @encoded)
+          raise Error.new(:invalid_argument, "Truncated Web request"), cause: nil
+        end
+
+        @eof = true
+      end
+    end
+
+    class Output
+      def initialize(output, representation)
+        @output = output
+        @text = representation == :text
+      end
+
+      def write(bytes, timeout: nil)
+        size = @text ? 12_288 : 16_384
+        offset = 0
+        while offset < bytes.bytesize
+          fragment = bytes.byteslice(offset, size) #: String
+          @output.write(@text ? [fragment].pack("m0") : fragment, timeout: timeout)
+          offset += fragment.bytesize
+        end
+        nil
+      end
+
+      def finish(terminal:)
+        @output.finish(terminal: @text ? [terminal].pack("m0") : terminal)
+      end
+
+      def abort = @output.abort
+    end
+
+    # Portable unary materializes one bounded response, never a native stream.
+    class Aggregate
+      attr_reader :body
+
+      def initialize(limit)
+        @limit = limit
+        @body = +"".b
+      end
+
+      def write(bytes, timeout: nil) # rubocop:disable Lint/UnusedMethodArgument -- synchronous bounded append
+        if @body.bytesize + bytes.bytesize > @limit
+          raise Error.new(:resource_exhausted,
+                          "Aggregate Web response exceeds byte limit")
+        end
+
+        @body << bytes
+        nil
+      end
+
+      def finish(terminal:)
+        @terminal = terminal
+        nil
+      end
+
+      def complete
+        terminal = @terminal
+        write(terminal) if terminal
+      end
+
+      def abort
+        @body.clear
+        @terminal = nil
+        nil
+      end
+    end
+
+    class PortableInput
+      def initialize(input)
+        @input = input
+      end
+
+      def read(length, timeout: nil) # rubocop:disable Lint/UnusedMethodArgument -- portable cooperative I/O
+        @input&.read(length)
+      end
+    end
+  end
+end

data/lib/connectrpc/grpc_web_server.rb

@@ -0,0 +1,207 @@
+# frozen_string_literal: true
+
+module ConnectRPC
+  module GRPCWeb
+    class ServerState
+      attr_reader :headers, :publish, :lifecycle, :cancellation, :representation, :path
+      attr_accessor :context, :session, :error, :published
+
+      def initialize(path:, headers:, representation:, publish:, lifecycle:, cancellation:)
+        @path = path
+        @headers = headers
+        @representation = representation
+        @publish = publish
+        @lifecycle = lifecycle
+        @cancellation = cancellation
+        @published = false
+      end
+    end
+  end
+
+  class Server # rubocop:disable Metrics/ClassLength
+    # HTTP-version-neutral publication. Hosts stage finish's terminal until the
+    # original application task has completed all outer cleanup successfully.
+    def call_grpc_web(path:, http_method:, headers:, input:, output:, publish:, capabilities: [:unary], # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+                      lifecycle: nil, cancellation: nil)
+      # @type var owned: bool?
+      owned = nil
+      # @type var error: Exception?
+      error = nil
+      GRPCWeb.capabilities!(capabilities)
+      values = Protocol.headers(headers)
+      early = cors_response(path: path, http_method: http_method, headers: values)
+      return early if early
+
+      lifecycle, owned = begin_native_processing(path, values, lifecycle, http_method)
+      work = lambda do
+        rejection = web_preflight(http_method, values, cancellation)
+        if rejection
+          lifecycle&.processing_finished(code: nil, http_status: rejection.status)
+          next cors_response(path: path, http_method: http_method, headers: values, response: rejection) || rejection
+        end
+
+        request = GRPCWeb.media(Protocol.single(values, "content-type")) #: GRPCWeb::representation
+        representation = GRPCWeb.representation(values, request) #: GRPCWeb::representation
+        state = GRPCWeb::ServerState.new(path: path, headers: values, representation: representation,
+                                         publish: publish, lifecycle: lifecycle, cancellation: cancellation)
+        process_grpc_web(state, input, output, request, capabilities)
+        nil
+      end
+      lifecycle ? lifecycle.activate(&work) : work.call
+    rescue Exception => e # rubocop:disable Lint/RescueException -- discard staged status and preserve the original failure
+      error = e
+      lifecycle&.record_failure(e) unless owned.nil?
+      begin
+        output.abort unless owned.nil?
+      rescue StandardError => cleanup_error
+        lifecycle&.record_failure(cleanup_error)
+      end
+      raise
+    ensure
+      finish_native_processing(lifecycle, owned, error) unless owned.nil?
+    end
+
+    private
+
+    def web_preflight(http_method, headers, cancellation)
+      fields = { "vary" => ["Accept"] }
+      return bare(415, fields, cancellation: cancellation) unless @protocol.include?(:grpc_web)
+      return bare(405, fields.merge("allow" => ["POST"]), cancellation: cancellation) unless http_method == "POST"
+
+      representation = GRPCWeb.media(Protocol.single(headers, "content-type"))
+      unless representation
+        return bare(415, fields.merge("accept-post" => [GRPCWeb::CONTENT_TYPES.values.join(", ")]),
+                    cancellation: cancellation)
+      end
+      return if GRPCWeb.representation(headers, representation)
+
+      bare(406, fields, cancellation: cancellation)
+    end
+
+    def call_grpc_web_unary(path, http_method, headers, input, lifecycle, cancellation) # rubocop:disable Metrics/MethodLength, Metrics/ParameterLists
+      # Separately padded writes can expand every raw byte by four. The bounded
+      # aggregate includes one data prefix and the separately staged terminal.
+      output = GRPCWeb::Aggregate.new(4 * (5 + @response_wire_limit + 5 + @grpc_status_wire_limit))
+      head = nil #: StreamHead?
+      response = call_grpc_web(path: path, http_method: http_method, headers: headers,
+                               input: GRPCWeb::PortableInput.new(input), output: output,
+                               lifecycle: lifecycle, cancellation: cancellation,
+                               publish: ->(published) { head = published })
+      return response if response
+
+      output.complete
+      published = head #: StreamHead
+      TransportResponse.new(status: published.status, headers: published.headers, body: output.body)
+    rescue Exception # rubocop:disable Lint/RescueException -- discard staged status, preserve arbitrary cleanup failure
+      output&.abort
+      raise
+    end
+
+    def process_grpc_web(state, input, output, request, capabilities)
+      prepared = GRPCWeb::Output.new(output, state.representation)
+      capture_stream_error(state) { execute_grpc_web(state, input, prepared, request, capabilities) }
+      render_grpc_web_terminal(state, prepared)
+    ensure
+      state.session&.close
+      state.context&.close
+    end
+
+    def execute_grpc_web(state, input, output, representation, capabilities) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+      GRPCProtocol.check_fields!(state.headers)
+      declaration = @methods[state.path]
+      allowed = if declaration.is_a?(Method)
+                  capabilities.include?(:unary)
+                else
+                  declaration.is_a?(ServerStreamMethod) && capabilities.include?(:server_stream) &&
+                    @handlers[state.path]
+                end
+      raise Error.new(:unimplemented, "Unsupported Web method"), cause: nil unless allowed
+
+      GRPCProtocol.encoding(state.headers, request: true, enabled: :identity)
+      unless Protocol.identity_encoding?(state.headers)
+        raise Error.new(:unimplemented, "Web requires identity HTTP encoding"), cause: nil
+      end
+
+      context = state.context = web_context(state, declaration)
+      incoming = GRPCWeb::Input.new(input, representation: representation, wire_limit: @request_wire_limit,
+                                           headers: state.headers)
+      session = state.session = Streaming::Session.new(
+        binding: @binding, method: declaration, codec: :proto, state: context, input: incoming, output: output,
+        request_limit: @request_limit, response_limit: @response_limit,
+        request_wire_limit: @request_wire_limit, response_wire_limit: @response_wire_limit,
+        request_encoding: :identity, response_encoding: :identity,
+        terminal_wire_limit: @grpc_status_wire_limit, terminal_limit: @grpc_status_limit,
+        server: true, context: context, lifecycle: state.lifecycle,
+        publish: -> { publish_web_head(state) }, strategy: GRPCWeb::Strategy.new
+      )
+      message = session.receive
+      if message.nil? || incoming.read(1, timeout: context.deadline&.remaining)
+        raise Error.new(:unimplemented, "Expected exactly one request"), cause: nil
+      end
+
+      context.check!
+      if declaration.is_a?(Method)
+        session.send_message(@invoker.call(declaration, message, context))
+      else
+        handler = @handlers.fetch(state.path) #: _ServerStreamHandler[untyped, untyped]
+        streaming = context #: StreamingContext
+        handler.call(message, ResponseWriter.new(session, streaming), streaming)
+      end
+      context.check!
+    end
+
+    def web_context(state, declaration = nil, headers: state.headers)
+      metadata = Protocol.metadata(headers)
+      state.lifecycle.request_metadata = Instrumentation.carrier(metadata) if state.lifecycle
+      options = { request_metadata: metadata, deadline: GRPCProtocol.request_deadline(headers),
+                  cancellation: state.cancellation, lifecycle: state.lifecycle }
+      return Context.new(**options) unless declaration.is_a?(ServerStreamMethod)
+
+      StreamingContext.new(publish: ->(snapshot) { publish_web_snapshot(state, snapshot) }, **options)
+    end
+
+    def publish_web_head(state)
+      return if state.published
+
+      context = state.context #: Context
+      if context.is_a?(StreamingContext)
+        context.send(:publish_headers, check: false)
+      else
+        context.response_metadata.freeze
+        publish_web_snapshot(state, context.response_metadata)
+      end
+    end
+
+    def publish_web_snapshot(state, metadata) # rubocop:disable Metrics/AbcSize
+      fields = metadata.to_h.merge("content-type" => [GRPCWeb::CONTENT_TYPES.fetch(state.representation)],
+                                   "grpc-accept-encoding" => ["identity"])
+      GRPCWeb.vary(fields, "Accept")
+      response = TransportResponse.new(status: 200, headers: fields, body: "")
+      response = cors_response(path: state.path, http_method: "POST", headers: state.headers,
+                               response: response) || response
+      GRPCProtocol.check_fields!(response.headers.merge(":status" => [response.status.to_s]))
+      state.publish.call(StreamHead.new(status: response.status, headers: response.headers))
+      state.published = true
+      nil
+    end
+
+    def render_grpc_web_terminal(state, output) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+      context = state.context ||= web_context(state, headers: {})
+      merge_stream_error_metadata(state.error, context)
+      codec = @status_codec #: _GRPCStatusCodec
+      bytes, effective = GRPCWeb.terminal(
+        state.error, stream_trailers(state.error, context),
+        codec: codec,
+        wire_limit: @grpc_status_wire_limit, limit: @grpc_status_limit,
+        on_error: lambda { |error|
+          state.lifecycle&.record_failure(error)
+        }
+      )
+      observe_stream_result(state, effective) if state.error
+      publish_web_head(state)
+      output.finish(terminal: bytes)
+      context.commit! unless state.error
+      observe_stream_result(state, effective) unless state.error
+    end
+  end
+end