edgeway 0.2.0 → 0.3.0

data/js/cloudflare-kv.js

@@ -0,0 +1,47 @@
+import { jspiHelpers } from "./jspi.js";
+
+export const MIN_EXPIRATION_TTL = 60;
+
+export function putOptions(expiresIn) {
+  if (!(expiresIn > 0)) return undefined;
+  return { expirationTtl: Math.max(expiresIn, MIN_EXPIRATION_TTL) };
+}
+
+// An R2 bucket also has get, put and delete; only a KV namespace has getWithMetadata.
+export const isKvNamespace = (value) => Boolean(value) && ["get", "put", "delete", "getWithMetadata"].every((name) => typeof value[name] === "function");
+
+export function kvImports(env, getInstance) {
+  const { readCString, setResult, take } = jspiHelpers(getInstance);
+
+  const namespaceOf = (bindingName) => {
+    const namespace = env[bindingName];
+    if (!isKvNamespace(namespace)) throw new Error(`no KV binding ${bindingName}`);
+    return namespace;
+  };
+
+  const suspending = (operation) => new WebAssembly.Suspending(async (bindingPointer, keyPointer, ...rest) => {
+    let result;
+    try {
+      const namespace = namespaceOf(readCString(bindingPointer));
+      result = await operation(namespace, readCString(keyPointer), ...rest);
+    } catch (error) {
+      result = { error: String(error?.message ?? error) };
+    }
+    return setResult(result);
+  });
+
+  return {
+    edgeway_kv: {
+      get: suspending(async (namespace, key) => ({ value: await namespace.get(key, "text") })),
+      put: suspending(async (namespace, key, textPointer, expiresIn) => {
+        await namespace.put(key, readCString(textPointer), putOptions(expiresIn));
+        return { ok: true };
+      }),
+      delete: suspending(async (namespace, key) => {
+        await namespace.delete(key);
+        return { ok: true };
+      }),
+      take,
+    },
+  };
+}

data/js/cloudflare-ratelimit.js

@@ -0,0 +1,31 @@
+import { jspiHelpers } from "./jspi.js";
+
+const isRateLimit = (value) => Boolean(value) && typeof value.limit === "function";
+
+export function rateLimitImports(env, getInstance) {
+  const { readCString, setResult, take } = jspiHelpers(getInstance);
+
+  const check = new WebAssembly.Suspending(async (bindingPointer, keyPointer) => {
+    let result;
+    try {
+      const bindingName = readCString(bindingPointer);
+      const rateLimit = env[bindingName];
+      if (isRateLimit(rateLimit)) {
+        const { success } = await rateLimit.limit({ key: readCString(keyPointer) });
+        result = { success: success !== false };
+      } else {
+        result = { misconfigured: `no rate limit binding ${bindingName}` };
+      }
+    } catch (error) {
+      result = { error: String(error?.message ?? error) };
+    }
+    return setResult(result);
+  });
+
+  return {
+    edgeway_ratelimit: {
+      check,
+      take,
+    },
+  };
+}

data/js/cloudflare-test-database.js

@@ -0,0 +1,112 @@
+// The databases of `edgeway test` on a local D1: dropped and migrated again
+// before each test, so every test starts from the migrations' state.
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+
+// What wrangler and D1 keep in the database themselves.
+const KEPT_OBJECT = /^(sqlite_|_cf_)|^d1_migrations$/;
+
+const quoted = (name) => `"${name.replaceAll('"', '""')}"`;
+
+const COMMENT = /--[^\n]*|\/\*[\s\S]*?\*\//g;
+const withoutComments = (sql) => sql.replace(COMMENT, " ");
+const startsTrigger = (statement) => /^\s*create\s+(temp(orary)?\s+)?trigger\b/i.test(withoutComments(statement));
+// A trigger's body is statements ending in ';', and the trigger ends at the
+// END after the last of them (sqlite3_complete's rule): not at the END of a
+// CASE, nor a column named end.
+const triggerEnded = (statement) => /;\s*end\s*$/i.test(withoutComments(statement));
+
+// SQL text split into statements at the ';' outside strings, comments and a
+// trigger's body. Each statement is run with prepare(), which takes one.
+// Text with nothing but comments is no statement (D1 refuses it).
+export function splitStatements(sql) {
+  const statements = [];
+  let current = "";
+  let at = 0;
+  const copyUntil = (terminator) => {
+    const stop = sql.indexOf(terminator, at + 1);
+    const end = stop === -1 ? sql.length : stop + terminator.length;
+    current += sql.slice(at, end);
+    at = end;
+  };
+  const endsStatement = () => !startsTrigger(current) || triggerEnded(current);
+  while (at < sql.length) {
+    const char = sql[at];
+    if (char === "'" || char === '"' || char === "`") copyUntil(char);
+    else if (char === "[") copyUntil("]");
+    else if (sql.startsWith("--", at)) copyUntil("\n");
+    else if (sql.startsWith("/*", at)) copyUntil("*/");
+    else if (char === ";" && endsStatement()) {
+      statements.push(current.trim());
+      current = "";
+      at++;
+    } else {
+      current += char;
+      at++;
+    }
+  }
+  statements.push(current.trim());
+  return statements.filter((statement) => withoutComments(statement).trim() !== "");
+}
+
+// The files of a migrations directory in file name order, each as
+// { name, statements }. A directory that is not there has none.
+export function migrationFiles(directory, { readdir = readdirSync, read = readFileSync, exists = existsSync } = {}) {
+  if (!exists(directory)) return [];
+  return readdir(directory)
+    .filter((name) => name.endsWith(".sql"))
+    .sort()
+    .map((name) => ({ name, statements: splitStatements(read(join(directory, name), "utf8")) }));
+}
+
+// databases: [{ binding, migrations: directory }]
+export function loadMigrations(databases, options) {
+  return databases.map(({ binding, migrations }) => ({ binding, files: migrationFiles(migrations, options) }));
+}
+
+// The statements that empty a database, from the rows of sqlite_master
+// ({ type, name }). Dropping a table drops its indexes and triggers. Foreign
+// keys are enforced, so the checks wait for the end of the batch.
+export function dropStatements(objects) {
+  const dropped = objects.filter(({ name }) => !KEPT_OBJECT.test(name));
+  const views = dropped.filter(({ type }) => type === "view");
+  const tables = dropped.filter(({ type }) => type === "table");
+  if (views.length + tables.length === 0) return [];
+  return [
+    "PRAGMA defer_foreign_keys = on",
+    ...views.map(({ name }) => `DROP VIEW IF EXISTS ${quoted(name)}`),
+    ...tables.map(({ name }) => `DROP TABLE IF EXISTS ${quoted(name)}`),
+  ];
+}
+
+async function dropEverything(database) {
+  const { results } = await database.prepare("SELECT type, name FROM sqlite_master WHERE type IN ('table', 'view')").all();
+  const statements = dropStatements(results);
+  if (statements.length > 0) await database.batch(statements.map((sql) => database.prepare(sql)));
+}
+
+async function migrate(database, files) {
+  for (const { name, statements } of files) {
+    if (statements.length === 0) continue;
+    try {
+      await database.batch(statements.map((sql) => database.prepare(sql)));
+    } catch (error) {
+      throw new Error(`migration ${name}: ${error?.message ?? error}`);
+    }
+  }
+}
+
+// migrations: loadMigrations' answer. Entries that share a binding are one
+// database: it is emptied once, then every entry's files are applied in order.
+export async function resetDatabases(env, migrations) {
+  const filesByBinding = new Map();
+  for (const { binding, files } of migrations) {
+    filesByBinding.set(binding, [...(filesByBinding.get(binding) ?? []), ...files]);
+  }
+  for (const [binding, files] of filesByBinding) {
+    const database = env[binding];
+    if (!database) throw new Error(`no D1 binding ${binding} in wrangler.toml`);
+    await dropEverything(database);
+    await migrate(database, files);
+  }
+}

data/js/cloudflare-test-runner.js

@@ -0,0 +1,76 @@
+// Runs the wasm build of an app's tests, on a local in-memory D1:
+//
+//   node cloudflare-test-runner.js TEST.wasm [ARGS...]
+//
+// `edgeway test` starts it (with --experimental-wasm-jspi and --experimental-wasm-exnref on Node.js 24); ARGS
+// go to the program (-n NAME). The environment is wrangler's getPlatformProxy
+// with persist: false, so the state in .wrangler/state is never touched. The
+// wasm calls edgeway_test.reset before each test, and the exit status is its own.
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import config from "./config.js";
+import { WASI } from "./wasi-shim.js";
+import { lineSplitter, parseLogLine } from "./runtime.js";
+import { d1Imports, varsOf } from "./cloudflare.js";
+import { jwtImports } from "./jwt.js";
+import { fetchImports } from "./fetch.js";
+import { kvImports } from "./cloudflare-kv.js";
+import { rateLimitImports } from "./cloudflare-ratelimit.js";
+import { D1Sessions } from "./cloudflare-d1-sessions.js";
+import { loadMigrations, resetDatabases } from "./cloudflare-test-database.js";
+
+function requireJspi() {
+  if (typeof WebAssembly.Suspending === "function") return;
+  throw new Error("this Node.js has no WebAssembly JSPI; Node.js 24 needs --experimental-wasm-jspi (`edgeway test` passes it)");
+}
+
+function logText(line) {
+  const { level, message, ...fields } = parseLogLine(line) ?? {};
+  if (level === undefined) return line;
+  const pairs = Object.entries(fields).map(([name, value]) => ` ${name}=${typeof value === "string" ? value : JSON.stringify(value)}`);
+  return `[edgeway] ${level.toUpperCase()} ${message}${pairs.join("")}`;
+}
+
+async function runTests(wasmPath, args, env) {
+  const migrations = loadMigrations(config.databases);
+  const stderr = lineSplitter((line) => process.stderr.write(`${logText(line)}\n`));
+  const wasi = new WASI({
+    args: ["test", ...args],
+    env: { ...varsOf(env), EDGEWAY_ENV: config.env },
+    onStdout: (text) => process.stdout.write(text),
+    onStderr: (text) => stderr.push(text),
+  });
+  const reset = new WebAssembly.Suspending(() => resetDatabases(env, migrations));
+  let instance;
+  instance = new WebAssembly.Instance(await WebAssembly.compile(readFileSync(wasmPath)), {
+    wasi_snapshot_preview1: wasi.wasiImport,
+    ...d1Imports(env, () => instance, new D1Sessions(env, undefined, config.sessions)),
+    ...jwtImports(env, () => instance),
+    ...fetchImports(() => instance),
+    ...kvImports(env, () => instance),
+    ...rateLimitImports(env, () => instance),
+    edgeway_test: { reset },
+  });
+  try {
+    return await wasi.startAsync(instance);
+  } finally {
+    stderr.flush();
+  }
+}
+
+async function main() {
+  const [wasmPath, ...args] = process.argv.slice(2);
+  requireJspi();
+  const { getPlatformProxy } = await import("wrangler");
+  const proxy = await getPlatformProxy({ configPath: join(config.appRoot, "wrangler.toml"), persist: false });
+  try {
+    process.exitCode = await runTests(wasmPath, args, proxy.env);
+  } finally {
+    await proxy.dispose();
+  }
+}
+
+main().catch((error) => {
+  console.error(`edgeway test: ${error instanceof WebAssembly.RuntimeError ? error.stack : error?.message ?? error}`);
+  process.exitCode = 1;
+});

data/js/cloudflare.js

@@ -10,6 +10,9 @@
 import { runCgi } from "./runtime.js";
 import config from "./config.js";
 import { jwtImports } from "./jwt.js";
+import { fetchImports } from "./fetch.js";
+import { kvImports } from "./cloudflare-kv.js";
+import { rateLimitImports } from "./cloudflare-ratelimit.js";
 import { withCors } from "./cors.js";
 import { BOOKMARK_HEADER, D1Sessions } from "./cloudflare-d1-sessions.js";
 
@@ -165,6 +168,7 @@ export function d1Imports(env, getInstance, sessions = new D1Sessions(env)) {
 // out.
 const FRAMEWORK_VARS = new Set([
   "JWT_ISSUER", "JWT_AUDIENCE", "JWT_LEEWAY", "JWT_ALGORITHMS", "JWT_JWKS_URL",
+  "LOG_LEVEL",
 ]);
 
 // The Worker's variables (strings) become CGI environment variables, which
@@ -182,9 +186,19 @@ export function varsOf(env) {
   return vars;
 }
 
+// Not CORS-safelisted, so a page reads it on a 429 or 503 only when exposed.
+const RETRY_AFTER_HEADER = "Retry-After";
+
 export function corsOptions(sessionBindings) {
-  const names = sessionBindings.length > 0 ? [BOOKMARK_HEADER] : [];
-  return { exposeHeaders: names, allowHeaders: names };
+  const bookmark = sessionBindings.length > 0 ? [BOOKMARK_HEADER] : [];
+  return { exposeHeaders: [RETRY_AFTER_HEADER, ...bookmark], allowHeaders: bookmark };
+}
+
+// What identifies the request in every log line: the ray id (absent in local
+// development).
+export function logFieldsOf(request) {
+  const ray = request.headers.get("cf-ray");
+  return ray ? { ray } : {};
 }
 
 // appModule: the WebAssembly.Module that `import app from "...app.wasm"` gives.
@@ -194,9 +208,16 @@ export function createWorker(appModule) {
       const sessions = new D1Sessions(env, request, config.sessions ?? []);
       const response = await runCgi(appModule, request, {
         extraEnv: { EDGEWAY_ENV: config.env, ...varsOf(env) },
-        // Both modules are always supplied, whether or not the app uses them:
+        logFields: logFieldsOf(request),
+        // Every module is always supplied, whether or not the app uses it:
         // the wasm instance needs every import it declares.
-        imports: (getInstance) => ({ ...d1Imports(env, getInstance, sessions), ...jwtImports(env, getInstance) }),
+        imports: (getInstance) => ({
+          ...d1Imports(env, getInstance, sessions),
+          ...jwtImports(env, getInstance),
+          ...fetchImports(getInstance),
+          ...kvImports(env, getInstance),
+          ...rateLimitImports(env, getInstance),
+        }),
       });
       return sessions.annotate(response);
     }, corsOptions(config.sessions ?? [])),

data/js/fetch.js

@@ -0,0 +1,113 @@
+import { jspiHelpers } from "./jspi.js";
+
+const LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+export const DEFAULT_MAX_BYTES = 1024 * 1024;
+const BASE64_CHUNK = 8192;
+
+export function urlAllowed(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol === "https:") return true;
+  return parsed.protocol === "http:" && LOCAL_HOSTS.includes(parsed.hostname);
+}
+
+export function fetchWithTimeout(url, init, timeoutMs, fetch = globalThis.fetch) {
+  return fetch(url, { ...init, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+}
+
+function checkDeclaredSize(response, maxBytes) {
+  const declared = response.headers?.get("content-length");
+  if (declared !== null && declared !== undefined && Number(declared) > maxBytes) throw new Error("response is too large");
+}
+
+function joinChunks(chunks, size) {
+  const all = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    all.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return all;
+}
+
+// A chunked body has no Content-Length, so the size is counted again while reading.
+export async function readCapped(response, maxBytes) {
+  checkDeclaredSize(response, maxBytes);
+  if (!response.body) return new Uint8Array(0);
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > maxBytes) {
+      await reader.cancel().catch(() => {});
+      throw new Error("response is too large");
+    }
+    chunks.push(value);
+  }
+  return joinChunks(chunks, size);
+}
+
+function base64Of(bytes) {
+  let binary = "";
+  for (let offset = 0; offset < bytes.length; offset += BASE64_CHUNK) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + BASE64_CHUNK));
+  }
+  return btoa(binary);
+}
+
+const INVALID_REQUEST = "request is not valid UTF-8";
+
+export function parseRequest(bytes) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    return null;
+  }
+}
+
+function failure(error) {
+  if (error?.name === "TimeoutError") return { error: "request timed out", timeout: true };
+  return { error: String(error?.message ?? error) };
+}
+
+export async function performRequest(spec, { fetch = globalThis.fetch, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+  if (!urlAllowed(spec.url)) return { error: "url must be https (http only for localhost)" };
+  try {
+    const init = { method: spec.method, headers: spec.headers };
+    if (spec.body) init.body = spec.body;
+    const response = await fetchWithTimeout(spec.url, init, spec.timeout_ms, fetch);
+    const bytes = await readCapped(response, maxBytes);
+    return { status: response.status, headers: Object.fromEntries(response.headers), body_base64: base64Of(bytes) };
+  } catch (error) {
+    return failure(error);
+  }
+}
+
+// The wasm import module "edgeway_fetch" (lib/edgeway/service/fetch.rb):
+//   request(json) -> {"status": n, "headers": {"lower-case-name": "value"}, "body_base64": "..."}
+//                  | {"error": "message"}
+//                  | {"error": "message", "timeout": true}
+// json is {"method", "url", "headers", "body", "timeout_ms"}. A redirect is not
+// followed: its response (with the location header) is the answer. A call answers the
+// byte length of the result and take() copies it out; request is wrapped in
+// WebAssembly.Suspending.
+export function fetchImports(getInstance, { fetch = globalThis.fetch, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+  const { readBytes, setResult, take } = jspiHelpers(getInstance);
+
+  return {
+    edgeway_fetch: {
+      request: new WebAssembly.Suspending(async (specPointer) => {
+        const spec = parseRequest(readBytes(specPointer));
+        return setResult(spec ? await performRequest(spec, { fetch, maxBytes }) : { error: INVALID_REQUEST });
+      }),
+      take,
+    },
+  };
+}

data/js/jspi.js

@@ -0,0 +1,32 @@
+const textDecoder = new TextDecoder("utf-8", { fatal: true });
+const textEncoder = new TextEncoder();
+
+// What the wasm side of a JSPI import module needs: C strings read from its
+// memory, and a result handed over in two steps, since an import can't return
+// a string. A suspending import answers the byte length of its JSON result and
+// the wasm side then calls take(buffer) to copy it.
+export function jspiHelpers(getInstance) {
+  const memory = () => new Uint8Array(getInstance().exports.memory.buffer);
+  let pending = new Uint8Array(0);
+
+  const readBytes = (pointer) => {
+    const bytes = memory();
+    let end = pointer;
+    while (bytes[end]) end++;
+    return bytes.subarray(pointer, end);
+  };
+
+  const readCString = (pointer) => textDecoder.decode(readBytes(pointer));
+
+  const setResult = (result) => {
+    pending = textEncoder.encode(JSON.stringify(result));
+    return pending.length;
+  };
+
+  const take = (buffer) => {
+    memory().set(pending, buffer);
+    pending = new Uint8Array(0);
+  };
+
+  return { readBytes, readCString, setResult, take };
+}

data/js/jwt.js

@@ -21,6 +21,8 @@
 // (RFC 7515 4.1.11: no extension is understood), and a JWKS key needs a `kid`
 // on the token and, if it has key_ops, "verify" in them.
 
+import { fetchWithTimeout, readCapped, urlAllowed } from "./fetch.js";
+
 const MAX_TOKEN = 8192;
 // A JWKS is kept this long, and re-fetched early (for an unknown kid) at
 // most this often.
@@ -90,45 +92,9 @@ function parseJsonPart(s, what) {
 // await I/O that another request started.
 const sharedCache = new Map();
 
-// Only https, so a JWKS can't be swapped on the way; a local server (tests,
-// `wrangler dev`) may use http.
-function jwksUrlAllowed(url) {
-  let u;
-  try {
-    u = new URL(url);
-  } catch {
-    return false;
-  }
-  if (u.protocol === "https:") return true;
-  return u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname);
-}
-
-// The body of res as text, at most MAX_JWKS bytes (checked on Content-Length
-// when there is one, and again while reading, because a chunked body has none).
 async function limitedText(res) {
-  const declared = res.headers?.get("content-length");
-  if (declared !== null && declared !== undefined && Number(declared) > MAX_JWKS) throw new Error("response is too large");
   if (!res.body) throw new Error("no body");
-  const reader = res.body.getReader();
-  const chunks = [];
-  let size = 0;
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    size += value.byteLength;
-    if (size > MAX_JWKS) {
-      await reader.cancel().catch(() => {});
-      throw new Error("response is too large");
-    }
-    chunks.push(value);
-  }
-  const all = new Uint8Array(size);
-  let at = 0;
-  for (const c of chunks) {
-    all.set(c, at);
-    at += c.byteLength;
-  }
-  return new TextDecoder("utf-8", { fatal: true }).decode(all);
+  return new TextDecoder("utf-8", { fatal: true }).decode(await readCapped(res, MAX_JWKS));
 }
 
 export function jwtVerifier(env, { fetch = globalThis.fetch, now = Date.now, cache = sharedCache, timeoutMs = JWKS_TIMEOUT_MS } = {}) {
@@ -141,7 +107,7 @@ export function jwtVerifier(env, { fetch = globalThis.fetch, now = Date.now, cac
     // No stale JWKS: past its TTL (or when a forced refetch fails) a failed
     // fetch is "unavailable", never an old key.
     try {
-      const res = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      const res = await fetchWithTimeout(url, {}, timeoutMs, fetch);
       if (res.status !== 200) throw new Error(`status ${res.status}`);
       const keys = JSON.parse(await limitedText(res)).keys;
       if (!Array.isArray(keys)) throw new Error("no keys");
@@ -189,7 +155,7 @@ export function jwtVerifier(env, { fetch = globalThis.fetch, now = Date.now, cac
     }
     const url = env.JWT_JWKS_URL;
     if (!url) throw new JwtError("JWT_JWKS_URL is not set", true);
-    if (!jwksUrlAllowed(url)) throw new JwtError("JWT_JWKS_URL must be https (http only for localhost)", true);
+    if (!urlAllowed(url)) throw new JwtError("JWT_JWKS_URL must be https (http only for localhost)", true);
     if (kid === undefined) throw new JwtError("kid is required");
     let entry = await loadKeys(url, false);
     let jwk = pick(entry, alg, algo, kid);

data/js/runtime.js

@@ -44,6 +44,41 @@ async function readBody(request) {
   return concatBytes(chunks);
 }
 
+const LOG_LEVELS = ["debug", "info", "warn", "error"];
+
+export function parseLogLine(line) {
+  if (!line.startsWith("{")) return null;
+  let entry;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  const isObject = entry !== null && typeof entry === "object" && !Array.isArray(entry);
+  return isObject && LOG_LEVELS.includes(entry.level) && typeof entry.message === "string" ? entry : null;
+}
+
+export function logLine(line, logFields = {}, sink = console) {
+  const entry = parseLogLine(line);
+  if (entry) sink[entry.level]({ ...logFields, ...entry });
+  else sink.error(line);
+}
+
+export function lineSplitter(onLine) {
+  let pending = "";
+  return {
+    push(text) {
+      const lines = (pending + text).split(/\r?\n/);
+      pending = lines.pop();
+      for (const line of lines) if (line !== "") onLine(line);
+    },
+    flush() {
+      if (pending !== "") onLine(pending);
+      pending = "";
+    },
+  };
+}
+
 function internalError() {
   return new Response('{"error":"internal error"}\n', {
     status: 500,
@@ -55,23 +90,24 @@ function internalError() {
 // Response.
 //   extraEnv: more CGI environment variables (strings), such as the app's
 //             settings and EDGEWAY_ENV.
+//   logFields: fields added to every structured log line the app writes.
 //   imports:  (getInstance) => { moduleName: { name: fn } }, the wasm import
 //             modules besides WASI. A function wrapped in
 //             WebAssembly.Suspending may await (JSPI).
-export async function runCgi(appModule, request, { extraEnv = {}, imports = () => ({}) } = {}) {
+export async function runCgi(appModule, request, { extraEnv = {}, imports = () => ({}), logFields = {} } = {}) {
   const body = request.method === "GET" || request.method === "HEAD"
     ? new Uint8Array(0)
     : await readBody(request);
   if (body === null) return payloadTooLarge();
 
   const out = [];
-  let err = "";
+  const stderr = lineSplitter((line) => logLine(line, logFields));
   const wasi = new WASI({
     args: ["app"],
     env: { ...extraEnv, ...cgiEnv(request, body), SPINEL_GC_SLAB_MB: SLAB_MB },
     stdin: body,
     onStdoutBytes: (b) => out.push(b),
-    onStderr: (s) => (err += s),
+    onStderr: (text) => stderr.push(text),
   });
   // Whatever goes wrong inside the app (a trap, a non-zero exit) is logged
   // and answered with a fixed body: stderr and error messages never reach
@@ -86,10 +122,11 @@ export async function runCgi(appModule, request, { extraEnv = {}, imports = () =
     });
     status = await wasi.startAsync(instance);
   } catch (e) {
-    console.error("app trapped:", e, err);
+    stderr.flush();
+    console.error("app trapped:", e);
     return internalError();
   }
-  if (err) console.error(err);
+  stderr.flush();
   if (status !== 0) {
     console.error(`app exited with ${status}`);
     return internalError();

data/lib/edgeway/application.rb

@@ -29,33 +29,42 @@ module Edgeway
       elsif e.is_a?(InvalidToken)
         # The reason (e.message) goes to the log only; the client gets a fixed
         # body and challenge, so a probe learns nothing from the wording.
-        Edgeway.logger.info "401 #{e.message}"
+        Edgeway.logger.info(e.message, status: 401)
         unauthorized("invalid token", 'Bearer error="invalid_token"')
       elsif e.is_a?(Unauthorized)
-        Edgeway.logger.info "401 #{e.message}"
+        Edgeway.logger.info(e.message, status: 401)
         unauthorized("authentication required", "Bearer")
+      elsif e.is_a?(TooManyRequests)
+        too_many_requests(e)
       elsif e.is_a?(RecordNotUnique)
         # The message names the table and columns: the log only.
-        Edgeway.logger.info "409 #{e.message}"
+        Edgeway.logger.info(e.message, status: 409)
         message(409, "record not unique")
       elsif e.is_a?(DatabaseUnavailable)
-        Edgeway.logger.error "503 #{e.message}"
+        Edgeway.logger.error(e.message, status: 503)
         response = message(503, "database unavailable")
         response.headers["Retry-After"] = "1"
         response
       elsif e.is_a?(RoutingError) || e.is_a?(RecordNotFound)
         # The message can hold the path or an id from the request: the log only.
-        Edgeway.logger.info "404 #{e.message}"
+        Edgeway.logger.info(e.message, status: 404)
         message(404, "not found")
       else
-        # The details go to the log (stderr), never to the client.
-        Edgeway.logger.error "#{e.class}: #{e.message}"
+        # The details go to the log, never to the client.
+        Edgeway.logger.error("#{e.class}: #{e.message}", status: 500)
         message(500, "internal error")
       end
     end
 
     private
 
+    def too_many_requests(error)
+      Edgeway.logger.info(error.message, status: 429)
+      response = message(429, "rate limit exceeded")
+      response.headers["Retry-After"] = error.retry_after.to_s if error.retry_after > 0
+      response
+    end
+
     def unauthorized(text, challenge)
       response = message(401, text)
       response.headers["WWW-Authenticate"] = challenge