@antelopejs/dms-frontend 0.9.3 → 0.10.1

package/templates/vue/server/proxy-compression.mjs

@@ -20,11 +20,22 @@ const COMPRESSIBLE_TYPE =
   /^(?:text\/(?!event-stream)[\w.+-]+|application\/(?:[\w.-]+\+)?(?:json|xml|javascript|ecmascript)|image\/svg\+xml)\s*(?:;|$)/i;
 const BODILESS_STATUSES = new Set([204, 205, 304]);
 
+/**
+ * What the proxy relays of a backend answer: a fetched `Response`, or the
+ * same fields without its content coding.
+ *
+ * @typedef {Pick<Response, "status" | "headers" | "body" | "url">} ProxiedAnswer
+ */
+
 /**
  * Whether the backend answer is one to compress on its way to the client.
  *
  * A response already encoded, or a range of the bytes, is not compressed:
  * compressing would change what the encoding or the range describes.
+ *
+ * @param {import("node:http").IncomingMessage} request
+ * @param {ProxiedAnswer} upstream
+ * @returns {boolean}
  */
 function isCompressible(request, upstream) {
   if (request.method === "HEAD" || !upstream.body) return false;
@@ -48,6 +59,9 @@ function isCompressible(request, upstream) {
  *
  * Streaming: an answer of unknown length (chunked JSON, streamed text) reaches
  * the client part by part, as the backend writes it.
+ *
+ * @param {import("node:http").IncomingMessage} request
+ * @param {ProxiedAnswer} upstream
  */
 function proxyEncoder(request, upstream) {
   return isCompressible(request, upstream)
@@ -64,6 +78,14 @@ function proxyEncoder(request, upstream) {
  *
  * A decoded partial representation cannot retain the encoded byte offsets, and
  * a complete 200 response is not manufactured from a partial 206 either.
+ *
+ * @param {import("node:http").IncomingMessage} request
+ * @param {import("node:http").ServerResponse} response
+ * @param {ProxiedAnswer} upstream
+ * @param {{
+ *   fetched?: boolean,
+ *   isProxiedPath?: (pathname: string) => boolean
+ * }} [options]
  */
 export async function relayAnswer(
   request,

package/templates/vue/server/proxy-headers.mjs

@@ -15,7 +15,11 @@ const HOP_BY_HOP_HEADERS = [
   "upgrade",
 ];
 
-/** `Accept-Encoding` added to the backend's own `Vary`, once. */
+/**
+ * `Accept-Encoding` added to the backend's own `Vary`, once.
+ *
+ * @param {string | undefined} vary
+ */
 function varyWithEncoding(vary) {
   const names = (vary ?? "")
     .split(",")
@@ -32,6 +36,12 @@ function varyWithEncoding(vary) {
  * known, and a strong validator no longer names these bytes. A `Location` on
  * the backend's origin becomes the same path on the frontend's when
  * `isProxiedPath` says the frontend proxies it (see `relayedLocation`).
+ *
+ * @param {import("node:http").ServerResponse} response
+ * @param {Pick<Response, "status" | "headers" | "url">} upstream
+ * @param {string | undefined} encoding
+ * @param {boolean} [varies]
+ * @param {(pathname: string) => boolean} [isProxiedPath]
  */
 export function writeProxyHeaders(
   response,
@@ -47,7 +57,7 @@ export function writeProxyHeaders(
   for (const name of [...HOP_BY_HOP_HEADERS, ...named]) delete headers[name];
   delete headers["set-cookie"];
   const cookies = upstream.headers.getSetCookie?.() ?? [];
-  if (cookies.length) headers["set-cookie"] = cookies;
+  if (cookies.length) Object.assign(headers, { "set-cookie": cookies });
   if (headers.location && upstream.url)
     headers.location = relayedLocation(
       headers.location,

package/templates/vue/server/proxy-redirects.mjs

@@ -1,7 +1,12 @@
 /** The statuses that send the client to their `Location`. */
 export const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 
+/**
+ * @param {string | URL | undefined} url
+ * @returns {string | undefined}
+ */
 function originOf(url) {
+  if (url === undefined) return undefined;
   try {
     return new URL(url).origin;
   } catch {
@@ -9,7 +14,13 @@ function originOf(url) {
   }
 }
 
-/** Whether `url` is on the backend's origin. */
+/**
+ * Whether `url` is on the backend's origin.
+ *
+ * @param {string} url
+ * @param {string} [backendBaseUrl]
+ * @returns {boolean}
+ */
 export function isBackendUrl(
   url,
   backendBaseUrl = process.env.DMS_API_BASE_URL,
@@ -34,16 +45,18 @@ export function isBackendUrl(
  *
  * `//host` would name another host, so `/.` keeps the location a path.
  *
- * @param location The backend's `Location`
- * @param fetchedUrl The backend URL the answer came from
- * @param isProxiedPath `(pathname) => boolean`, whether the frontend server
- *   sends that path to the backend
+ * @param {string} location The backend's `Location`
+ * @param {string | URL} fetchedUrl The backend URL the answer came from
+ * @param {(pathname: string) => boolean} [isProxiedPath] Whether the frontend
+ *   server sends that path to the backend
+ * @returns {string}
  */
 export function relayedLocation(
   location,
   fetchedUrl,
   isProxiedPath = () => false,
 ) {
+  /** @type {URL} */
   let target;
   try {
     target = new URL(location, fetchedUrl);
@@ -60,6 +73,9 @@ export function relayedLocation(
  * The cookies of a `Response` a module route returns. A fetch that followed a
  * redirect to another site would set that site's cookies on the frontend's
  * origin: those are dropped.
+ *
+ * @param {Response} answer
+ * @returns {string[]}
  */
 export function relayableCookies(answer) {
   if (answer.redirected && !isBackendUrl(answer.url)) return [];

package/templates/vue/server/proxy-request.mjs

@@ -0,0 +1,58 @@
+import { backendHeaders } from "./backend-request.mjs";
+import { PLAIN_ANSWER_HEADERS, relayAnswer } from "./proxy-compression.mjs";
+import { sendWithinLimit } from "./proxy-transfers.mjs";
+import { proxyAccess, refuseCrossOrigin } from "./public-endpoints.mjs";
+import { backendUrl } from "./request-target.mjs";
+
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+
+/**
+ * Sends a request to the backend through the proxy it reached.
+ * `isProxiedPath` says which backend paths a relayed `Location` may name on
+ * the frontend's origin.
+ *
+ * A client that left while the request was routed closed the response already,
+ * and would never abort the request below.
+ *
+ * Cancelling the body alone misses a client that leaves before the backend
+ * answers: its stream, an SSE feed above all, then stayed open for good.
+ *
+ * A backend redirect is the browser's to follow: Media sends a file's link to
+ * the storage's signed URL, on the public origin the server itself may not
+ * reach, which turned every download into a 502.
+ *
+ * @param {import("./request-target.mjs").ServerRequest} request
+ * @param {import("node:http").ServerResponse} response
+ * @param {import("./backend-proxies.mjs").BackendProxy} backendProxy
+ * @param {(path: string) => boolean} isProxiedPath
+ * @returns {Promise<true | undefined>}
+ */
+export async function proxy(request, response, backendProxy, isProxiedPath) {
+  const access = proxyAccess(request, SAFE_METHODS, backendProxy);
+  if (access.isRefused) {
+    refuseCrossOrigin(response);
+    return true;
+  }
+  if (response.closed) return;
+  const abandoned = new AbortController();
+  response.once("close", () => abandoned.abort());
+  /** @type {RequestInit} */
+  const init = {
+    signal: abandoned.signal,
+    method: request.method,
+    headers: { ...backendHeaders(request, access), ...PLAIN_ANSWER_HEADERS },
+    duplex: "half",
+    redirect: "manual",
+  };
+  const upstream = await sendWithinLimit(
+    request,
+    response,
+    backendProxy.maxBodyBytes,
+    (body) => fetch(backendUrl(request.url), { ...init, body }),
+  );
+  if (!upstream) return true;
+  await relayAnswer(request, response, upstream, {
+    fetched: true,
+    isProxiedPath,
+  });
+}

package/templates/vue/server/proxy-transfers.mjs

@@ -1,3 +1,5 @@
+import { isObjectLike } from "./type-guards.mjs";
+
 const PAYLOAD_TOO_LARGE = 413;
 const TOO_LARGE_BODY = JSON.stringify({ message: "Payload Too Large" });
 /**
@@ -26,6 +28,11 @@ export const SERVER_OPTIONS = Object.freeze({
 
 class BodyTooLargeError extends Error {}
 
+/**
+ * @param {import("node:http").IncomingMessage} request
+ * @param {number} maxBodyBytes
+ * @returns {AsyncGenerator<Buffer>}
+ */
 async function* limitedChunks(request, maxBodyBytes) {
   let received = 0;
   for await (const chunk of request.iterator(BODY_ITERATION)) {
@@ -35,6 +42,10 @@ async function* limitedChunks(request, maxBodyBytes) {
   }
 }
 
+/**
+ * @param {import("./request-target.mjs").ServerRequest} request
+ * @param {number | undefined} maxBodyBytes
+ */
 function requestBody(request, maxBodyBytes) {
   if (BODILESS_METHODS.has(request.method)) return undefined;
   return maxBodyBytes === undefined
@@ -42,6 +53,11 @@ function requestBody(request, maxBodyBytes) {
     : limitedChunks(request, maxBodyBytes);
 }
 
+/**
+ * @param {import("node:http").IncomingMessage} request
+ * @param {number | undefined} maxBodyBytes
+ * @returns {boolean}
+ */
 function declaresTooLargeBody(request, maxBodyBytes) {
   return (
     maxBodyBytes !== undefined &&
@@ -49,10 +65,14 @@ function declaresTooLargeBody(request, maxBodyBytes) {
   );
 }
 
+/**
+ * @param {unknown} error
+ * @returns {boolean}
+ */
 function isBodyTooLarge(error) {
   return (
     error instanceof BodyTooLargeError ||
-    error?.cause instanceof BodyTooLargeError
+    (isObjectLike(error) && error.cause instanceof BodyTooLargeError)
   );
 }
 
@@ -65,6 +85,9 @@ function isBodyTooLarge(error) {
  * the browser's upload failing without a reason. The rest of the body is read
  * and dropped instead (RFC 9112, section 9.6, "tear-down"), for `LINGER_MS`
  * at most; the response ends with it and the connection then closes cleanly.
+ *
+ * @param {import("node:http").IncomingMessage} request
+ * @param {import("node:http").ServerResponse} response
  */
 function refuseTooLargeBody(request, response) {
   response.writeHead(PAYLOAD_TOO_LARGE, {
@@ -72,7 +95,10 @@ function refuseTooLargeBody(request, response) {
     connection: "close",
   });
   response.write(TOO_LARGE_BODY);
-  if (request.complete) return response.end();
+  if (request.complete) {
+    response.end();
+    return;
+  }
   const close = () => {
     clearTimeout(timer);
     response.end();
@@ -96,19 +122,27 @@ function refuseTooLargeBody(request, response) {
  * before a byte is passed on, a chunked body is cut off as soon as it goes
  * over.
  *
- * @param send `(body) => Promise<Response>`, the backend request with the
- *   body to stream: none for a GET or a HEAD, the request itself, or its
- *   bytes cut off past the limit
- * @returns The backend's answer, or `undefined` once the body went over and
- *   `response` got the 413
+ * @param {import("./request-target.mjs").ServerRequest} request
+ * @param {import("node:http").ServerResponse} response
+ * @param {number | undefined} maxBodyBytes
+ * @param {(
+ *   body: import("node:http").IncomingMessage | AsyncGenerator<Buffer> | undefined
+ * ) => Promise<Response>} send The backend request with the body to stream:
+ *   none for a GET or a HEAD, the request itself, or its bytes cut off past
+ *   the limit
+ * @returns {Promise<Response | undefined>} The backend's answer, or
+ *   `undefined` once the body went over and `response` got the 413
  */
 export async function sendWithinLimit(request, response, maxBodyBytes, send) {
-  if (declaresTooLargeBody(request, maxBodyBytes))
-    return refuseTooLargeBody(request, response);
+  if (declaresTooLargeBody(request, maxBodyBytes)) {
+    refuseTooLargeBody(request, response);
+    return undefined;
+  }
   try {
     return await send(requestBody(request, maxBodyBytes));
   } catch (error) {
     if (!isBodyTooLarge(error)) throw error;
-    return refuseTooLargeBody(request, response);
+    refuseTooLargeBody(request, response);
+    return undefined;
   }
 }

package/templates/vue/server/public-endpoints.mjs

@@ -1,6 +1,27 @@
 import { readFileSync } from "node:fs";
 import { json } from "./auth/backend.mjs";
 import { CROSS_ORIGIN_ERROR, isSameOrigin } from "./auth/client-ip.mjs";
+import { PROXY_AUTH_MODES } from "./backend-proxies.mjs";
+import { isNumber, isObjectLike, isRecord, isString } from "./type-guards.mjs";
+
+/**
+ * A public endpoint, compiled from a declaration that passed every check.
+ *
+ * @typedef {object} PublicEndpoint
+ * @property {string} path
+ * @property {string[]} methods
+ * @property {string[]} headers
+ * @property {RegExp} matcher
+ */
+
+/**
+ * A declaration as the manifest or the environment holds it, before any check.
+ *
+ * @typedef {object} PublicEndpointDeclaration
+ * @property {unknown} [path]
+ * @property {unknown} [methods]
+ * @property {unknown} [headers]
+ */
 
 /**
  * Written at the workspace root by the loader, from the endpoints each
@@ -41,39 +62,101 @@ const HEADER_NAME = /^x-[a-z0-9-]+$/;
 const RESERVED_HEADER =
   /^x-(?:forwarded-|real-ip$|dms-|inertia|http-method|method-override|original-|rewrite-)/;
 
+/** @type {unknown[] | undefined} */
 let declaredEndpoints;
+/** @type {import("./backend-proxies.mjs").ManifestProxy[] | undefined} */
 let declaredProxies;
 
 /**
  * The public endpoints the modules of this deployment declared, unchecked.
  *
- * @param file Generated file to read
- * @returns The declared entries, or none when the file is absent or broken
+ * @param {URL | string} [file] Generated file to read
+ * @returns {unknown[]} The declared entries, or none when the file is absent or broken
  */
 export function readDeclaredPublicEndpoints(file = DECLARED_ENDPOINTS_FILE) {
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(readFileSync(file, "utf8"));
-    return Array.isArray(parsed?.endpoints) ? parsed.endpoints : [];
+    const endpoints = isObjectLike(parsed) ? parsed.endpoints : undefined;
+    return Array.isArray(endpoints) ? endpoints : [];
   } catch {
     return [];
   }
 }
 
+/**
+ * Whether `entry` names a path and, when it says so, an auth mode and a body
+ * limit of the right type. The path pattern and the limit's range are judged
+ * when the proxies are resolved.
+ *
+ * @param {unknown} entry
+ * @returns {entry is { path: string, auth?: "session" | "none", maxBodyBytes?: number, module?: unknown }}
+ */
+function isProxyDeclaration(entry) {
+  return (
+    isRecord(entry) &&
+    !Array.isArray(entry) &&
+    isString(entry.path) &&
+    (entry.auth === undefined ||
+      PROXY_AUTH_MODES.some((mode) => mode === entry.auth)) &&
+    (entry.maxBodyBytes === undefined || isNumber(entry.maxBodyBytes))
+  );
+}
+
+/**
+ * @param {unknown[]} entries
+ * @param {string} source Where they were declared, for the warning
+ * @param {(entry: unknown) => boolean} isUsable
+ */
+function warnUnusableProxies(entries, source, isUsable) {
+  const unusable = entries.filter((entry) => !isUsable(entry)).length;
+  if (unusable)
+    console.warn(
+      `Ignoring ${unusable} ${unusable === 1 ? "entry" : "entries"} of ${source}: not a backend proxy declaration (a path, an auth of session or none, a body limit in bytes)`,
+    );
+}
+
+/**
+ * @param {unknown} entry
+ * @returns {entry is import("./backend-proxies.mjs").ManifestProxy}
+ */
+function isDeclaredProxy(entry) {
+  return (
+    isRecord(entry) &&
+    isProxyDeclaration(entry) &&
+    (entry.module === undefined || isString(entry.module))
+  );
+}
+
 /**
  * The backend proxies the backend modules declared in the manifest, as
- * `{ module, path, auth?, maxBodyBytes? }`, unchecked.
+ * `{ module, path, auth?, maxBodyBytes? }`. An entry that is not one is
+ * reported and left out.
  *
  * A missing or broken file declares no proxy.
  *
- * @param file Generated file to read
+ * @param {URL | string} [file] Generated file to read
+ * @returns {import("./backend-proxies.mjs").ManifestProxy[]}
  */
 export function readDeclaredBackendProxies(file = DECLARED_ENDPOINTS_FILE) {
   if (file === DECLARED_ENDPOINTS_FILE && declaredProxies)
     return declaredProxies;
+  /** @type {import("./backend-proxies.mjs").ManifestProxy[]} */
   let proxies = [];
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(readFileSync(file, "utf8"));
-    if (Array.isArray(parsed?.proxies)) proxies = parsed.proxies;
+    const listed = isObjectLike(parsed) ? parsed.proxies : undefined;
+    if (Array.isArray(listed)) {
+      /** @type {unknown[]} */
+      const entries = listed;
+      warnUnusableProxies(
+        entries,
+        "the generated manifest file",
+        isDeclaredProxy,
+      );
+      proxies = entries.filter(isDeclaredProxy);
+    }
   } catch {}
   if (file === DECLARED_ENDPOINTS_FILE) declaredProxies = proxies;
   return proxies;
@@ -82,29 +165,40 @@ export function readDeclaredBackendProxies(file = DECLARED_ENDPOINTS_FILE) {
 /**
  * The backend proxies `DMS_BACKEND_PROXIES` adds: a JSON array of
  * `{ path, auth?, maxBodyBytes? }`, as the manifest's `backendProxies`, for an
- * operator. A value that is not a JSON array is reported and ignored.
+ * operator. A value that is not a JSON array is reported and ignored, and so
+ * is each entry that is not a declaration.
  *
- * @param declaration The variable's value
+ * @param {string} [declaration] The variable's value
+ * @returns {import("./backend-proxies.mjs").ManifestProxy[]}
  */
 export function environmentBackendProxies(
   declaration = process.env.DMS_BACKEND_PROXIES,
 ) {
   if (!declaration?.trim()) return [];
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(declaration);
-    if (Array.isArray(parsed))
-      return parsed.map((entry) => ({
-        ...entry,
-        module: "DMS_BACKEND_PROXIES",
-      }));
+    if (Array.isArray(parsed)) {
+      /** @type {unknown[]} */
+      const entries = parsed;
+      warnUnusableProxies(entries, "DMS_BACKEND_PROXIES", isProxyDeclaration);
+      return entries
+        .filter(isProxyDeclaration)
+        .map((entry) => ({ ...entry, module: "DMS_BACKEND_PROXIES" }));
+    }
   } catch {}
   console.warn("Ignoring DMS_BACKEND_PROXIES: not a JSON array");
   return [];
 }
 
+/**
+ * @param {string | undefined} declaration
+ * @returns {unknown[]}
+ */
 function environmentEndpoints(declaration) {
   if (!declaration?.trim()) return [];
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(declaration);
     return Array.isArray(parsed) ? parsed : [];
   } catch {
@@ -113,6 +207,7 @@ function environmentEndpoints(declaration) {
   }
 }
 
+/** @param {unknown} methods */
 function normalizedMethods(methods) {
   if (methods === undefined) return DEFAULT_METHODS;
   if (!Array.isArray(methods) || methods.length === 0) return undefined;
@@ -122,6 +217,7 @@ function normalizedMethods(methods) {
     : undefined;
 }
 
+/** @param {unknown} headers */
 function normalizedHeaders(headers) {
   if (headers === undefined) return [];
   if (!Array.isArray(headers)) return undefined;
@@ -133,6 +229,7 @@ function normalizedHeaders(headers) {
     : undefined;
 }
 
+/** @param {string} path */
 function pathMatcher(path) {
   const pattern = path
     .split("/")
@@ -148,11 +245,13 @@ function pathMatcher(path) {
 /**
  * A declaration made usable, or `undefined` when any part of it is malformed:
  * a bad entry is dropped whole, never widened to what it might have meant.
+ *
+ * @param {unknown} entry
+ * @returns {PublicEndpoint | undefined}
  */
 export function compilePublicEndpoint(entry) {
-  if (typeof entry !== "object" || entry === null) return undefined;
-  if (typeof entry.path !== "string" || !PUBLIC_PATH.test(entry.path))
-    return undefined;
+  if (!isObjectLike(entry)) return undefined;
+  if (!isString(entry.path) || !PUBLIC_PATH.test(entry.path)) return undefined;
   const methods = normalizedMethods(entry.methods);
   const headers = normalizedHeaders(entry.headers);
   if (!methods || !headers) return undefined;
@@ -168,6 +267,10 @@ export function compilePublicEndpoint(entry) {
  * The backend endpoints this deployment serves to anyone: what the backend's
  * modules declared, plus what `DMS_PUBLIC_ENDPOINTS` adds (a JSON array of the
  * same `{ path, methods?, headers? }` entries).
+ *
+ * @param {string} [declaration]
+ * @param {unknown[]} [declared]
+ * @returns {PublicEndpoint[]}
  */
 export function allowedPublicEndpoints(
   declaration = process.env.DMS_PUBLIC_ENDPOINTS,
@@ -175,7 +278,9 @@ export function allowedPublicEndpoints(
 ) {
   return [...declared, ...environmentEndpoints(declaration)].flatMap(
     (entry) => {
-      const endpoint = compilePublicEndpoint(entry);
+      const endpoint = isRecord(entry)
+        ? compilePublicEndpoint(entry)
+        : undefined;
       if (!endpoint)
         console.warn(
           `Ignoring malformed public endpoint ${JSON.stringify(entry)}: expected ` +
@@ -189,6 +294,8 @@ export function allowedPublicEndpoints(
 /**
  * Compiled once per value of the environment variable, so a malformed entry
  * is reported once rather than on every request.
+ *
+ * @type {{ declaration: string | undefined, endpoints: PublicEndpoint[] } | undefined}
  */
 let compiled;
 
@@ -202,9 +309,9 @@ function currentPublicEndpoints() {
 /**
  * The public endpoint a request reaches, if any.
  *
- * @param method The request's method
- * @param pathname The request's normalized path, without its query string
- * @param endpoints The endpoints to match, this deployment's by default
+ * @param {string} method The request's method
+ * @param {string} pathname The request's normalized path, without its query string
+ * @param {PublicEndpoint[]} [endpoints] The endpoints to match, this deployment's by default
  */
 export function matchPublicEndpoint(
   method,
@@ -226,23 +333,23 @@ export function matchPublicEndpoint(
  * Origin. Under `auth: "session"`, a state-changing request needs one unless
  * it reaches a public endpoint, which is why the proxy never sends a public
  * endpoint the session: a cross-site form posting to it acts as nobody.
+ * Under either mode, a request that reaches a public endpoint carries the
+ * endpoint's declared headers.
  *
- * @param request The incoming request
- * @param safeMethods Methods that change nothing and need no Origin
- * @param proxy The backend proxy the request reached
+ * @param {import("./request-target.mjs").ServerRequest} request The incoming request
+ * @param {ReadonlySet<string>} safeMethods Methods that change nothing and need no Origin
+ * @param {import("./backend-proxies.mjs").BackendProxy} proxy The backend proxy the request reached
  * @returns `{ anonymous, headers, isRefused }`
  */
 export function proxyAccess(request, safeMethods, proxy) {
-  if (proxy.auth === "none")
-    return { anonymous: true, headers: [], isRefused: false };
   const publicEndpoint = matchPublicEndpoint(
     request.method,
     new URL(request.url, "http://frontend.local").pathname,
   );
-  if (publicEndpoint)
+  if (publicEndpoint || proxy.auth === "none")
     return {
       anonymous: true,
-      headers: publicEndpoint.headers,
+      headers: publicEndpoint?.headers ?? [],
       isRefused: false,
     };
   return {
@@ -252,7 +359,11 @@ export function proxyAccess(request, safeMethods, proxy) {
   };
 }
 
-/** Answers the 403 of a request `proxyAccess` refused. */
+/**
+ * Answers the 403 of a request `proxyAccess` refused.
+ *
+ * @param {import("node:http").ServerResponse} response
+ */
 export function refuseCrossOrigin(response) {
   json(response, 403, CROSS_ORIGIN_ERROR);
 }

package/templates/vue/server/public-options.mjs

@@ -1,15 +1,25 @@
+import { isRecord } from "./type-guards.mjs";
+
 const VARIABLE = "DMS_PUBLIC_OPTIONS";
 export const PUBLIC_OPTIONS_ELEMENT_ID = "dms-public-options";
 
+/**
+ * The registry the workspace was materialized with.
+ *
+ * @typedef {object} FrontendRegistry
+ * @property {{ id: string, options?: unknown }[]} modules The modules, highest priority first
+ */
+
+/**
+ * @param {string | undefined} raw
+ * @returns {Record<string, unknown> | undefined}
+ */
 function parse(raw) {
   if (!raw) return undefined;
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(raw);
-    return typeof parsed === "object" &&
-      parsed !== null &&
-      !Array.isArray(parsed)
-      ? parsed
-      : undefined;
+    return isRecord(parsed) && !Array.isArray(parsed) ? parsed : undefined;
   } catch {
     console.warn(`${VARIABLE} is not a JSON object of options by module id`);
     return undefined;
@@ -27,7 +37,11 @@ function parse(raw) {
  */
 export const RUNTIME_PUBLIC_OPTIONS = parse(process.env[VARIABLE]);
 
-/** The options of each module of the registry, the runtime ones first. */
+/**
+ * The options of each module of the registry, the runtime ones first.
+ *
+ * @param {FrontendRegistry} registry
+ */
 export function publicOptionsOf(registry) {
   return Object.fromEntries(
     registry.modules.map((module) => [