@askrjs/node 0.0.5 → 0.0.6

package/README.md

@@ -23,7 +23,7 @@ const app = createServerApp({
   routes: [{ path: "/health", handler: () => json({ status: "ok" }) }],
 });
 
-createServer(createNodeHandler(app)).listen(3000);
+createServer(createNodeHandler(app, { baseUrl: "http://localhost:3000" })).listen(3000);
 ```
 
 `createNodeHandler` also works as Connect middleware because it accepts an optional `next`

package/dist/index.d.ts

@@ -6,9 +6,11 @@ import { AddressInfo } from "node:net";
 interface NodeWebSocketOptions {
   readonly maxPayload?: number;
   readonly perMessageDeflate?: boolean | PerMessageDeflateOptions;
+  readonly allowedOrigins?: readonly string[];
 }
 interface NodeHandlerOptions {
   baseUrl?: string;
+  allowedHosts?: readonly string[];
 }
 interface ListenOptions {
   port?: number;

package/dist/index.js

@@ -5,6 +5,7 @@ import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
 import { extname, resolve, sep } from "node:path";
 //#region src/request.ts
+var NodeRequestError = class extends TypeError {};
 function requestHeaders(request) {
 	const headers = new Headers();
 	for (const [key, value] of Object.entries(request.headers)) {
@@ -14,10 +15,17 @@ function requestHeaders(request) {
 	return headers;
 }
 function requestFromNode(request, options, signal) {
-	const base = options.baseUrl ?? `http://${request.headers.host ?? "localhost"}`;
+	const host = request.headers.host;
+	if (!options.baseUrl && !options.allowedHosts?.length) throw new NodeRequestError("Node handling requires baseUrl or an allowedHosts allowlist.");
+	if (!host) throw new NodeRequestError("Request Host header is required.");
+	const hostName = host.startsWith("[") ? host.slice(1, host.indexOf("]")) : host.split(":", 1)[0];
+	if (options.allowedHosts?.length && !options.allowedHosts.some((allowed) => allowed === host || allowed === hostName)) throw new NodeRequestError("Request Host header is not allowed.");
+	const base = options.baseUrl ?? `http://${host}`;
+	const target = new URL(request.url ?? "/", base);
+	if (/^https?:\/\//i.test(request.url ?? "") && target.origin !== new URL(base).origin) throw new NodeRequestError("Absolute-form request target origin is not allowed.");
 	const method = request.method ?? "GET";
 	const body = method === "GET" || method === "HEAD" ? void 0 : Readable.toWeb(request);
-	return new Request(new URL(request.url ?? "/", base), {
+	return new Request(target, {
 		method,
 		headers: requestHeaders(request),
 		body,
@@ -101,10 +109,11 @@ function minimalError(response, error) {
 		response.destroy(error instanceof Error ? error : void 0);
 		return;
 	}
-	response.statusCode = 500;
-	response.statusMessage = "Internal Server Error";
+	const clientError = error instanceof NodeRequestError;
+	response.statusCode = clientError ? 400 : 500;
+	response.statusMessage = clientError ? "Bad Request" : "Internal Server Error";
 	response.setHeader("content-type", "text/plain; charset=utf-8");
-	response.end("Internal Server Error");
+	response.end(clientError ? "Bad Request" : "Internal Server Error");
 }
 function attachAbort(request, response, controller) {
 	const abort = () => controller.abort();
@@ -172,6 +181,19 @@ function installWebSockets(server, app, options = {}, handlerOptions = {}) {
 		const controller = new AbortController();
 		let accepted;
 		Promise.resolve().then(() => requestFromNode(request, handlerOptions, controller.signal)).then(async (webRequest) => {
+			const originHeader = request.headers.origin;
+			const origin = Array.isArray(originHeader) ? void 0 : originHeader;
+			const allowedOrigins = options.allowedOrigins ?? [new URL(webRequest.url).origin];
+			let normalizedOrigin;
+			try {
+				normalizedOrigin = origin ? new URL(origin).origin : void 0;
+			} catch {
+				normalizedOrigin = void 0;
+			}
+			if (!normalizedOrigin || !allowedOrigins.includes(normalizedOrigin)) {
+				await rejectUpgrade(socket, new Response("Forbidden", { status: 403 }));
+				return;
+			}
 			let marker;
 			const response = await app.fetch(webRequest, { websocket: { upgrade: (_request, handler, context) => {
 				marker = new Response(null, { status: 200 });
@@ -200,11 +222,12 @@ function installWebSockets(server, app, options = {}, handlerOptions = {}) {
 //#endregion
 //#region src/listen.ts
 function listen(app, options = {}) {
-	const server = createServer(createNodeHandler(app));
+	const handlerOptions = { allowedHosts: [options.host ?? "127.0.0.1", "localhost"] };
+	const server = createServer(createNodeHandler(app, handlerOptions));
 	if (options.requestTimeout !== void 0) server.requestTimeout = options.requestTimeout;
 	if (options.headersTimeout !== void 0) server.headersTimeout = options.headersTimeout;
 	if (options.keepAliveTimeout !== void 0) server.keepAliveTimeout = options.keepAliveTimeout;
-	const webSockets = options.websocket ? installWebSockets(server, app, options.websocket === true ? {} : options.websocket) : void 0;
+	const webSockets = options.websocket ? installWebSockets(server, app, options.websocket === true ? {} : options.websocket, handlerOptions) : void 0;
 	if (webSockets) {
 		const nativeClose = server.close.bind(server);
 		server.close = ((callback) => {
@@ -249,6 +272,7 @@ function isAssetPath(pathname) {
 }
 async function serve(app, options = {}) {
 	const root = options.assets ? resolve(options.assets.root) : void 0;
+	const handlerOptions = { allowedHosts: [options.host ?? "127.0.0.1", "localhost"] };
 	const applicationHandler = createNodeHandler({ async fetch(request, dispatchOptions) {
 		const result = await app.fetch(request, dispatchOptions);
 		if (!result.headers.has("cache-control") && result.headers.get("content-type")?.includes("text/html")) {
@@ -261,7 +285,7 @@ async function serve(app, options = {}) {
 			});
 		}
 		return result;
-	} });
+	} }, handlerOptions);
 	const server = createServer(async (request, response) => {
 		let pathname;
 		try {
@@ -303,7 +327,7 @@ async function serve(app, options = {}) {
 	if (options.requestTimeout !== void 0) server.requestTimeout = options.requestTimeout;
 	if (options.headersTimeout !== void 0) server.headersTimeout = options.headersTimeout;
 	if (options.keepAliveTimeout !== void 0) server.keepAliveTimeout = options.keepAliveTimeout;
-	const webSockets = options.websocket ? installWebSockets(server, app, options.websocket === true ? {} : options.websocket) : void 0;
+	const webSockets = options.websocket ? installWebSockets(server, app, options.websocket === true ? {} : options.websocket, handlerOptions) : void 0;
 	let closing;
 	const signals = options.signals === false ? [] : options.signals ?? ["SIGINT", "SIGTERM"];
 	const removeListeners = () => {

package/dist/mcp.d.ts

@@ -10,6 +10,8 @@ interface McpStdioOptions<Dependencies = undefined> {
   signal?: AbortSignal;
   auth?: AuthContext | ((environment: NodeJS.ProcessEnv) => AuthContext | Promise<AuthContext>);
   environment?: NodeJS.ProcessEnv;
+  maxLineBytes?: number;
+  maxConcurrency?: number;
 }
 interface McpStdioConnection {
   readonly closed: Promise<void>;

package/dist/mcp.js

@@ -22,6 +22,11 @@ function connectMcpStdio(mcp, options) {
 		finish = resolve;
 	});
 	let ended = false;
+	const maxLineBytes = options.maxLineBytes ?? 1048576;
+	const maxConcurrency = options.maxConcurrency ?? 16;
+	if (!Number.isInteger(maxLineBytes) || maxLineBytes <= 0) throw new TypeError("MCP maxLineBytes must be a positive integer.");
+	if (!Number.isInteger(maxConcurrency) || maxConcurrency <= 0) throw new TypeError("MCP maxConcurrency must be a positive integer.");
+	let active = 0;
 	const write = (message) => new Promise((resolve, reject) => {
 		output.write(`${JSON.stringify(message)}\n`, (error) => error ? reject(error) : resolve());
 	});
@@ -37,6 +42,29 @@ function connectMcpStdio(mcp, options) {
 	};
 	options.signal?.addEventListener("abort", () => void close(), { once: true });
 	lines.on("line", (line) => {
+		if (Buffer.byteLength(line) > maxLineBytes) {
+			write({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32600,
+					message: "Request line exceeds the configured limit"
+				}
+			}).catch(() => void close());
+			return;
+		}
+		if (active >= maxConcurrency) {
+			write({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32600,
+					message: "Too many concurrent requests"
+				}
+			}).catch(() => void close());
+			return;
+		}
+		active += 1;
 		(async () => {
 			let message;
 			try {
@@ -78,7 +106,9 @@ function connectMcpStdio(mcp, options) {
 					if (controller && id !== void 0) controllers.delete(id);
 				}
 			}
-		})().catch((error) => diagnostics.write(`MCP stdio error: ${error instanceof Error ? error.message : String(error)}\n`));
+		})().catch((error) => diagnostics.write(`MCP stdio error: ${error instanceof Error ? error.message : String(error)}\n`)).finally(() => {
+			active -= 1;
+		});
 	});
 	lines.once("close", () => {
 		if (!ended) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askrjs/node",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "Node http adapter for @askrjs/server",
   "keywords": [
     "askr",
@@ -60,6 +60,7 @@
     "ws": "^8.21.1"
   },
   "devDependencies": {
+    "@askrjs/schema": ">=0.0.2 <0.1.0",
     "@types/node": "^26.0.0",
     "@types/ws": "^8.18.1",
     "publint": "^0.3.21",