@abejarano/ts-express-server 1.7.3 → 1.7.5

package/dist/abstract/ServerTypes.d.ts

@@ -1,3 +1,4 @@
+import type fileUpload from "express-fileupload";
 export declare enum ServerRuntime {
     Express = "express",
     Bun = "bun"
@@ -12,7 +13,7 @@ export interface ServerRequest {
     query: Record<string, string | string[]>;
     headers: Record<string, string | string[] | undefined>;
     body?: unknown;
-    files?: unknown;
+    files?: ServerFiles;
     cookies?: Record<string, string>;
     ip?: string;
     requestId?: string;
@@ -33,8 +34,21 @@ export interface ServerResponse {
         secure?: boolean;
         sameSite?: "lax" | "strict" | "none";
     }): this;
+    download?(path: string, filename?: string, callback?: (err?: unknown) => void): this;
     end(body?: unknown): void | Promise<void>;
 }
+export type BunMultipartFile = {
+    name: string;
+    size: number;
+    type: string;
+    slice?: (start?: number, end?: number) => {
+        arrayBuffer(): Promise<ArrayBuffer>;
+    };
+    arrayBuffer(): Promise<ArrayBuffer>;
+    lastModified?: number;
+};
+export type ServerFile = BunMultipartFile | fileUpload.UploadedFile;
+export type ServerFiles = Record<string, ServerFile | ServerFile[]>;
 export type ServerHandlerInput = ServerHandler | ServerHandler[] | ServerRouter;
 export interface ServerRouter {
     use(pathOrHandler: string | ServerHandlerInput, ...handlers: ServerHandlerInput[]): void;

package/dist/adapters/BunAdapter.d.ts

@@ -1,4 +1,4 @@
-import { ServerAdapter, ServerApp, ServerInstance, ServerRequest, ServerRouter, ServerRuntime } from "../abstract/ServerTypes";
+import { ServerAdapter, ServerApp, ServerInstance, ServerRequest, ServerRouter, ServerRuntime, BunMultipartFile } from "../abstract/ServerTypes";
 export declare class BunAdapter implements ServerAdapter {
     runtime: ServerRuntime;
     createApp(): ServerApp;
@@ -6,13 +6,7 @@ export declare class BunAdapter implements ServerAdapter {
     configure(app: ServerApp, _port: number): void;
     listen(app: ServerApp, port: number, onListen: () => void): ServerInstance;
 }
-type MultipartFile = {
-    name: string;
-    size: number;
-    type: string;
-    arrayBuffer(): Promise<ArrayBuffer>;
-    lastModified?: number;
-};
+type MultipartFile = BunMultipartFile;
 export declare function getFiles(req: ServerRequest, field: string): MultipartFile[];
 export declare function getFile(req: ServerRequest, field: string): MultipartFile | undefined;
 export {};

package/dist/adapters/BunAdapter.js

@@ -5,7 +5,7 @@ exports.getFiles = getFiles;
 exports.getFile = getFile;
 const ServerTypes_1 = require("../abstract/ServerTypes");
 class BunResponse {
-    constructor(cookieJar, handlerTimeoutMs) {
+    constructor(cookieJar, handlerTimeoutMs, cookieDefaults) {
         this.statusCode = 200;
         this.statusExplicitlySet = false;
         this.headers = new Headers();
@@ -14,16 +14,26 @@ class BunResponse {
         this.ended = false;
         this.cookieJar = cookieJar;
         this.handlerTimeoutMs = handlerTimeoutMs;
+        this.cookieDefaults = cookieDefaults;
         this.endPromise = new Promise((resolve) => {
             this.resolveEnd = resolve;
         });
     }
     status(code) {
+        if (this.ended) {
+            return this;
+        }
         this.statusExplicitlySet = true;
         this.statusCode = code;
         return this;
     }
     set(name, value) {
+        if (this.ended) {
+            return this;
+        }
+        if (hasInvalidHeaderValue(value)) {
+            return this;
+        }
         if (name.toLowerCase() === "set-cookie") {
             this.setCookies.push(value);
             return this;
@@ -35,14 +45,24 @@ class BunResponse {
         return this.set(name, value);
     }
     cookie(name, value, options = {}) {
+        if (this.ended) {
+            return this;
+        }
+        if (!isValidCookieName(name)) {
+            return this;
+        }
+        const resolvedOptions = applyCookieDefaults(options, this.cookieDefaults);
         if (this.cookieJar && typeof this.cookieJar.set === "function") {
-            this.cookieJar.set(name, value, toCookieJarOptions(options));
+            this.cookieJar.set(name, value, toCookieJarOptions(resolvedOptions));
             return this;
         }
-        this.setCookies.push(serializeCookie(name, value, options));
+        this.setCookies.push(serializeCookie(name, value, resolvedOptions));
         return this;
     }
     json(body) {
+        if (this.ended) {
+            return;
+        }
         if (!this.headers.has("content-type")) {
             this.headers.set("content-type", "application/json");
         }
@@ -51,6 +71,9 @@ class BunResponse {
         this.resolveEnd?.();
     }
     send(body) {
+        if (this.ended) {
+            return;
+        }
         if (body instanceof Response) {
             this.rawResponse = body;
             this.ended = true;
@@ -77,6 +100,9 @@ class BunResponse {
         this.resolveEnd?.();
     }
     end(body) {
+        if (this.ended) {
+            return;
+        }
         if (body !== undefined) {
             this.send(body);
             return;
@@ -195,10 +221,11 @@ class BunRouter {
                 }, timeoutMs);
             })
             : null;
+        const runPromise = runHandlers(handlers, req, res);
         try {
             chainCompleted = timeoutPromise
-                ? await Promise.race([runHandlers(handlers, req, res), timeoutPromise])
-                : await runHandlers(handlers, req, res);
+                ? await Promise.race([runPromise, timeoutPromise])
+                : await runPromise;
         }
         catch (error) {
             if (!res.isEnded()) {
@@ -213,6 +240,7 @@ class BunRouter {
             }
         }
         if (timedOut) {
+            runPromise.catch(() => { });
             done();
             return;
         }
@@ -278,6 +306,7 @@ class BunApp extends BunRouter {
     constructor() {
         super(...arguments);
         this.settings = new Map();
+        this.activeRequests = 0;
     }
     set(key, value) {
         this.settings.set(key, value);
@@ -289,12 +318,29 @@ class BunApp extends BunRouter {
         return async (request, server) => {
             const client = server?.requestIP?.(request);
             const cookieJar = request.cookies;
-            const handlerTimeoutMs = this.get("handlerTimeoutMs");
-            const trustProxy = this.get("trustProxy") === true;
-            const ipOverride = trustProxy ? undefined : client?.address;
-            const req = createRequest(request, ipOverride);
-            const res = new BunResponse(cookieJar, typeof handlerTimeoutMs === "number" ? handlerTimeoutMs : undefined);
-            await this.handle(req, res, () => undefined);
+            const handlerTimeoutSetting = this.get("handlerTimeoutMs");
+            const handlerTimeoutMs = handlerTimeoutSetting === undefined
+                ? DEFAULT_HANDLER_TIMEOUT_MS
+                : typeof handlerTimeoutSetting === "number"
+                    ? handlerTimeoutSetting
+                    : undefined;
+            const trustProxy = resolveTrustProxySetting(this.get("trustProxy"));
+            const maxConcurrentRequests = Number(this.get("maxConcurrentRequests") ?? 0);
+            if (maxConcurrentRequests > 0 && this.activeRequests >= maxConcurrentRequests) {
+                return new Response(JSON.stringify({ message: "Server busy" }), {
+                    status: 503,
+                    headers: [["content-type", "application/json"]],
+                });
+            }
+            this.activeRequests += 1;
+            const req = createRequest(request, client?.address, trustProxy);
+            const res = new BunResponse(cookieJar, handlerTimeoutMs, resolveCookieDefaults(this.get("cookieDefaults")));
+            try {
+                await this.handle(req, res, () => undefined);
+            }
+            finally {
+                this.activeRequests = Math.max(0, this.activeRequests - 1);
+            }
             if (!res.isEnded()) {
                 res.status(204).end();
             }
@@ -314,6 +360,9 @@ class BunAdapter {
     }
     configure(app, _port) {
         const bunApp = app;
+        if (shouldEnableSecurityHeaders(bunApp.get("securityHeaders"))) {
+            bunApp.use(createSecurityHeadersMiddleware(bunApp));
+        }
         bunApp.use(createMultipartBodyParser(bunApp));
         bunApp.use(createJsonBodyParser(bunApp));
         bunApp.use(createUrlEncodedBodyParser(bunApp));
@@ -336,7 +385,7 @@ class BunAdapter {
 exports.BunAdapter = BunAdapter;
 const createJsonBodyParser = (app) => {
     return async (req, res, next) => {
-        if (!req.raw || req.body !== undefined) {
+        if (!req.raw || req.body !== undefined || req.files !== undefined) {
             return next();
         }
         const method = String(req.method || "").toUpperCase();
@@ -357,9 +406,19 @@ const createJsonBodyParser = (app) => {
             return;
         }
         try {
-            req.body = await req.raw.json();
+            if (contentLength === undefined) {
+                const text = await readBodyTextWithLimit(req.raw, limit);
+                req.body = JSON.parse(text);
+            }
+            else {
+                req.body = await req.raw.json();
+            }
         }
-        catch {
+        catch (error) {
+            if (error?.status === 413) {
+                res.status(413).json({ message: "Payload too large" });
+                return;
+            }
             res.status(400).json({ message: "Invalid JSON" });
             return;
         }
@@ -371,6 +430,10 @@ const createUrlEncodedBodyParser = (app) => {
         if (!req.raw || req.body !== undefined) {
             return next();
         }
+        const method = String(req.method || "").toUpperCase();
+        if (method === "GET" || method === "HEAD") {
+            return next();
+        }
         const contentType = String(req.headers["content-type"] || "");
         if (!contentType.includes("application/x-www-form-urlencoded")) {
             return next();
@@ -381,14 +444,26 @@ const createUrlEncodedBodyParser = (app) => {
             res.status(413).json({ message: "Payload too large" });
             return;
         }
-        const text = await req.raw.text();
-        req.body = Object.fromEntries(new URLSearchParams(text));
+        try {
+            const text = contentLength === undefined
+                ? await readBodyTextWithLimit(req.raw, limit)
+                : await req.raw.text();
+            req.body = Object.fromEntries(new URLSearchParams(text));
+        }
+        catch (error) {
+            if (error?.status === 413) {
+                res.status(413).json({ message: "Payload too large" });
+                return;
+            }
+            res.status(400).json({ message: "Invalid form data" });
+            return;
+        }
         next();
     };
 };
 const createMultipartBodyParser = (app) => {
     return async (req, res, next) => {
-        if (!req.raw || req.body !== undefined) {
+        if (!req.raw || req.body !== undefined || req.files !== undefined) {
             return next();
         }
         const contentType = String(req.headers["content-type"] || "");
@@ -398,6 +473,11 @@ const createMultipartBodyParser = (app) => {
         const options = normalizeMultipartOptions(app.get("multipart"));
         const lengthHeader = req.headers["content-length"];
         const contentLength = parseContentLength(lengthHeader);
+        // If content-length is missing, body size limits can't be enforced pre-read.
+        if (contentLength === undefined) {
+            res.status(411).json({ message: "Length required" });
+            return;
+        }
         if (contentLength !== undefined && contentLength > options.maxBodyBytes) {
             res.status(413).json({ message: "Payload too large" });
             return;
@@ -417,17 +497,34 @@ const createMultipartBodyParser = (app) => {
                         res.status(415).json({ message: "Unsupported media type" });
                         return;
                     }
+                    if (options.validateFile) {
+                        const isValid = await options.validateFile(value);
+                        if (!isValid) {
+                            res.status(415).json({ message: "Unsupported media type" });
+                            return;
+                        }
+                    }
+                    if (options.allowedFileSignatures) {
+                        const signatureAllowed = await isAllowedFileSignature(value, options.allowedFileSignatures);
+                        if (!signatureAllowed) {
+                            res.status(415).json({ message: "Unsupported media type" });
+                            return;
+                        }
+                    }
                     fileCount += 1;
                     if (fileCount > options.maxFiles) {
                         res.status(413).json({ message: "Payload too large" });
                         return;
                     }
-                    const bucket = files[key];
-                    if (bucket) {
-                        bucket.push(value);
+                    const existing = files[key];
+                    if (!existing) {
+                        files[key] = value;
+                    }
+                    else if (Array.isArray(existing)) {
+                        existing.push(value);
                     }
                     else {
-                        files[key] = [value];
+                        files[key] = [existing, value];
                     }
                     continue;
                 }
@@ -457,10 +554,11 @@ const createMultipartBodyParser = (app) => {
         next();
     };
 };
-function createRequest(request, ipOverride) {
+function createRequest(request, remoteAddress, trustProxy) {
     const url = new URL(request.url);
     const headers = toHeaderRecord(request.headers);
     const query = toQueryRecord(url.searchParams);
+    const ip = resolveClientIp(headers, remoteAddress, trustProxy);
     return {
         method: request.method.toUpperCase(),
         path: normalizePath(url.pathname),
@@ -469,7 +567,7 @@ function createRequest(request, ipOverride) {
         query,
         headers,
         cookies: parseCookies(headers.cookie),
-        ip: ipOverride || extractIp(headers),
+        ip,
         raw: request,
     };
 }
@@ -557,6 +655,10 @@ function toCookieJarOptions(options) {
     };
 }
 function getBodyLimit(app) {
+    const configured = app.get("bodyLimit");
+    if (typeof configured === "number" && Number.isFinite(configured)) {
+        return configured;
+    }
     return normalizeMultipartOptions(app.get("multipart")).maxBodyBytes;
 }
 function normalizeMultipartOptions(input) {
@@ -569,6 +671,8 @@ function normalizeMultipartOptions(input) {
         maxFileBytes: value.maxFileBytes ?? DEFAULT_MULTIPART_OPTIONS.maxFileBytes,
         maxFiles: value.maxFiles ?? DEFAULT_MULTIPART_OPTIONS.maxFiles,
         allowedMimeTypes: value.allowedMimeTypes,
+        allowedFileSignatures: value.allowedFileSignatures,
+        validateFile: value.validateFile,
     };
 }
 function isMimeAllowed(type, allowed) {
@@ -629,9 +733,12 @@ function parseContentLength(header) {
     const parsed = Number.parseInt(value, 10);
     return Number.isNaN(parsed) ? undefined : parsed;
 }
+const DEFAULT_HANDLER_TIMEOUT_MS = 30000;
 function readSetCookieHeaders(headers) {
     const bunHeaders = headers;
-    const setCookieFromApi = bunHeaders.getSetCookie?.() ?? bunHeaders.getAll?.("Set-Cookie");
+    const setCookieFromApi = bunHeaders.getSetCookie?.() ??
+        bunHeaders.getAll?.("set-cookie") ??
+        bunHeaders.getAll?.("Set-Cookie");
     if (setCookieFromApi && setCookieFromApi.length > 0) {
         return setCookieFromApi;
     }
@@ -645,7 +752,11 @@ function readSetCookieHeaders(headers) {
 }
 function getFiles(req, field) {
     const map = (req.files ?? {});
-    return map[field] ?? [];
+    const entry = map[field];
+    if (!entry) {
+        return [];
+    }
+    return Array.isArray(entry) ? entry : [entry];
 }
 function getFile(req, field) {
     return getFiles(req, field)[0];
@@ -657,6 +768,78 @@ function extractIp(headers) {
     }
     return headers["x-real-ip"];
 }
+function resolveClientIp(headers, remoteAddress, trustProxy) {
+    const normalizedRemote = normalizeIp(remoteAddress);
+    if (!trustProxy) {
+        return normalizedRemote;
+    }
+    if (trustProxy === true) {
+        return extractIp(headers) || normalizedRemote;
+    }
+    if (typeof trustProxy === "function") {
+        return trustProxy(normalizedRemote)
+            ? extractIp(headers) || normalizedRemote
+            : normalizedRemote;
+    }
+    const trusted = isTrustedProxy(normalizedRemote, trustProxy);
+    return trusted ? extractIp(headers) || normalizedRemote : normalizedRemote;
+}
+function normalizeIp(ip) {
+    if (!ip) {
+        return undefined;
+    }
+    if (ip.includes(".") && ip.includes(":")) {
+        return ip.split(":")[0];
+    }
+    return ip;
+}
+function isTrustedProxy(ip, allowlist) {
+    if (!ip) {
+        return false;
+    }
+    for (const entry of allowlist) {
+        if (entry.includes("/")) {
+            if (matchesCidr(ip, entry)) {
+                return true;
+            }
+            continue;
+        }
+        if (entry === ip) {
+            return true;
+        }
+    }
+    return false;
+}
+function matchesCidr(ip, cidr) {
+    const [range, bitsString] = cidr.split("/");
+    if (!range || !bitsString) {
+        return false;
+    }
+    if (range.includes(":") || ip.includes(":")) {
+        return range === ip;
+    }
+    const bits = Number(bitsString);
+    if (!Number.isFinite(bits) || bits < 0 || bits > 32) {
+        return false;
+    }
+    const ipValue = ipv4ToInt(ip);
+    const rangeValue = ipv4ToInt(range);
+    if (ipValue === null || rangeValue === null) {
+        return false;
+    }
+    const mask = bits === 0 ? 0 : ~((1 << (32 - bits)) - 1);
+    return (ipValue & mask) === (rangeValue & mask);
+}
+function ipv4ToInt(ip) {
+    const parts = ip.split(".").map((part) => Number(part));
+    if (parts.length !== 4 || parts.some((part) => part < 0 || part > 255)) {
+        return null;
+    }
+    return ((parts[0] << 24) +
+        (parts[1] << 16) +
+        (parts[2] << 8) +
+        parts[3]) >>> 0;
+}
 function normalizePath(path) {
     if (!path.startsWith("/")) {
         path = `/${path}`;
@@ -689,7 +872,12 @@ function matchPath(routePath, requestPath) {
         const routePart = routeParts[index];
         const requestPart = requestParts[index];
         if (routePart.startsWith(":")) {
-            params[routePart.slice(1)] = decodeURIComponent(requestPart);
+            try {
+                params[routePart.slice(1)] = decodeURIComponent(requestPart);
+            }
+            catch {
+                return null;
+            }
             continue;
         }
         if (routePart !== requestPart) {
@@ -709,6 +897,128 @@ function normalizeHandlers(inputs) {
     }
     return handlers;
 }
+function applyCookieDefaults(options, defaults) {
+    if (!defaults) {
+        return options;
+    }
+    const applyTo = defaults.applyTo ?? "session";
+    const isSession = options.maxAge === undefined && options.expires === undefined;
+    if (applyTo !== "all" && !isSession) {
+        return options;
+    }
+    return { ...defaults.options, ...options };
+}
+function resolveCookieDefaults(input) {
+    if (!input || typeof input !== "object") {
+        return undefined;
+    }
+    const defaults = input;
+    if (!defaults.options || typeof defaults.options !== "object") {
+        return undefined;
+    }
+    return defaults;
+}
+function resolveTrustProxySetting(input) {
+    if (input === true || input === false) {
+        return input;
+    }
+    if (Array.isArray(input) && input.every((entry) => typeof entry === "string")) {
+        return input;
+    }
+    if (typeof input === "function") {
+        return input;
+    }
+    return undefined;
+}
+function hasInvalidHeaderValue(value) {
+    return value.includes("\r") || value.includes("\n");
+}
+function shouldEnableSecurityHeaders(setting) {
+    if (typeof setting === "boolean") {
+        return setting;
+    }
+    return process?.env?.NODE_ENV === "production";
+}
+function createSecurityHeadersMiddleware(_app) {
+    return (_req, res, next) => {
+        res.set("x-content-type-options", "nosniff");
+        res.set("referrer-policy", "no-referrer");
+        res.set("x-frame-options", "DENY");
+        next();
+    };
+}
+async function readBodyTextWithLimit(request, limit) {
+    const bytes = await readBodyBytesWithLimit(request, limit);
+    return new TextDecoder().decode(bytes);
+}
+async function readBodyBytesWithLimit(request, limit) {
+    if (!request.body) {
+        return new Uint8Array();
+    }
+    const reader = request.body.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        if (value) {
+            total += value.length;
+            if (total > limit) {
+                const error = new Error("Payload too large");
+                error.status = 413;
+                throw error;
+            }
+            chunks.push(value);
+        }
+    }
+    const result = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return result;
+}
+async function isAllowedFileSignature(file, allowed) {
+    const head = typeof file.slice === "function" ? file.slice(0, 32) : file;
+    const buffer = new Uint8Array(await head.arrayBuffer());
+    for (const kind of allowed) {
+        if (matchesSignature(buffer, kind)) {
+            return true;
+        }
+    }
+    return false;
+}
+function matchesSignature(buffer, kind) {
+    if (kind === "png") {
+        return (buffer.length >= 8 &&
+            buffer[0] === 0x89 &&
+            buffer[1] === 0x50 &&
+            buffer[2] === 0x4e &&
+            buffer[3] === 0x47 &&
+            buffer[4] === 0x0d &&
+            buffer[5] === 0x0a &&
+            buffer[6] === 0x1a &&
+            buffer[7] === 0x0a);
+    }
+    if (kind === "pdf") {
+        return (buffer.length >= 4 &&
+            buffer[0] === 0x25 &&
+            buffer[1] === 0x50 &&
+            buffer[2] === 0x44 &&
+            buffer[3] === 0x46);
+    }
+    // jpg/jpeg
+    return (buffer.length >= 3 &&
+        buffer[0] === 0xff &&
+        buffer[1] === 0xd8 &&
+        buffer[2] === 0xff);
+}
+function isValidCookieName(name) {
+    return /^[!#$%&'*+\-.^_|~0-9A-Za-z]+$/.test(name);
+}
 async function runHandlers(handlers, req, res) {
     let index = 0;
     const dispatch = async () => {

package/dist/modules/FileUploadModule.js

@@ -24,41 +24,6 @@ class FileUploadModule extends abstract_1.BaseServerModule {
             app.use(fileUpload(this.fileUploadOptions));
             return;
         }
-        app.use(createBunFileUploadMiddleware());
     }
 }
 exports.FileUploadModule = FileUploadModule;
-const createBunFileUploadMiddleware = () => {
-    return async (req, _res, next) => {
-        if (!req.raw || req.files) {
-            return next();
-        }
-        const contentType = String(req.headers?.["content-type"] || "");
-        if (!contentType.includes("multipart/form-data")) {
-            return next();
-        }
-        try {
-            const formData = await req.raw.formData();
-            const files = {};
-            const body = {};
-            formData.forEach((value, key) => {
-                if (value instanceof File) {
-                    files[key] = value;
-                }
-                else {
-                    body[key] = value;
-                }
-            });
-            if (Object.keys(files).length) {
-                req.files = files;
-            }
-            if (Object.keys(body).length && req.body === undefined) {
-                req.body = body;
-            }
-        }
-        catch {
-            // Ignore malformed multipart payloads.
-        }
-        next();
-    };
-};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@abejarano/ts-express-server",
   "author": "angel bejarano / angel.bejarano@jaspesoft.com",
-  "version": "1.7.3",
+  "version": "1.7.5",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [