@atcute/xrpc-server 1.0.0 → 2.0.1

package/lib/main/utils/request-input.ts

@@ -1,89 +0,0 @@
-import type { XRPCBlobBodyParam, XRPCLexBodyParam } from '@atcute/lexicons/validations';
-
-import type { Result } from '../../types/misc.ts';
-
-/**
- * checks whether a request has a meaningful body.
- *
- * Node.js HTTP-to-fetch adapters always provide a `ReadableStream` for
- * `request.body`, even when no body content was sent. this function
- * uses `content-length` to handle that case while still respecting the
- * web `Request` API where `body === null` signals no body.
- *
- * @param request incoming request to check
- * @returns whether the request has body content
- */
-export const hasRequestBody = (request: Request): boolean => {
-	if (request.body === null) {
-		return false;
-	}
-
-	// Node.js adapters set content-length: 0 for bodiless requests while
-	// still providing a ReadableStream body; treat this as no body.
-	if (request.headers.get('content-length') === '0') {
-		return false;
-	}
-
-	return true;
-};
-
-const jsonMimeValidator = (() => {
-	const JSON_RE = /^\s*application\/json\s*(?:$|;)/;
-
-	return (request: Request): Result<void, string> => {
-		const type = request.headers.get('content-type');
-		if (type === null) {
-			return { ok: false, error: `missing input content type (expected application/json)` };
-		}
-
-		if (!JSON_RE.test(type)) {
-			return { ok: false, error: `invalid input content type (expected application/json)` };
-		}
-
-		return { ok: true, value: undefined };
-	};
-})();
-
-export const constructMimeValidator = (param: XRPCLexBodyParam | XRPCBlobBodyParam) => {
-	if (param.type === 'lex') {
-		return jsonMimeValidator;
-	}
-
-	const mimes = param.encoding;
-	if (mimes === undefined || mimes.length === 0) {
-		return null;
-	}
-
-	const pattern = new RegExp(`^\\s*(?:${mimes.map(escapeRegexp).join('|')})\\s*(?:$|;)`);
-
-	return (request: Request): Result<void, string> => {
-		const type = request.headers.get('content-type');
-		if (type === null) {
-			return { ok: false, error: `missing input content type (expected ${separatedList(mimes, 'or')})` };
-		}
-
-		if (!pattern.test(type)) {
-			return { ok: false, error: `invalid input content type (expected ${separatedList(mimes, 'or')})` };
-		}
-
-		return { ok: true, value: undefined };
-	};
-};
-
-const separatedList = (list: string[], sep: 'or' | 'and'): string => {
-	switch (list.length) {
-		case 0: {
-			return `nothing`;
-		}
-		case 1: {
-			return list[0];
-		}
-		default: {
-			return `${list.slice(0, -1).join(', ')} ${sep} ${list[list.length - 1]}`;
-		}
-	}
-};
-
-const escapeRegexp = (input: string): string => {
-	return input.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&');
-};

package/lib/main/utils/request-params.ts

@@ -1,108 +0,0 @@
-import {
-	safeParse,
-	type ArraySchema,
-	type BaseSchema,
-	type ObjectSchema,
-	type OptionalSchema,
-	type ValidationResult,
-} from '@atcute/lexicons/validations';
-
-import type { Literal } from '../../types/misc.ts';
-
-type MaybeArray<T> = T | T[];
-
-const isArraySchema = (schema: BaseSchema): schema is ArraySchema => {
-	return schema.type === 'array';
-};
-
-const isOptionalSchema = (schema: BaseSchema): schema is OptionalSchema => {
-	return schema.type === 'optional';
-};
-
-const unwrapOptional = (schema: BaseSchema): BaseSchema => {
-	return isOptionalSchema(schema) ? schema.wrapped : schema;
-};
-
-const unwrapArray = (schema: BaseSchema): BaseSchema => {
-	return isArraySchema(schema) ? schema.item : schema;
-};
-
-const coerceBoolean = (str: string): boolean | null => {
-	switch (str) {
-		case 'true':
-			return true;
-		case 'false':
-			return false;
-	}
-
-	return null;
-};
-
-const coerceInteger = (str: string): number => {
-	return Number(str);
-};
-
-export const constructParamsHandler = <TSchema extends ObjectSchema>(schema: TSchema) => {
-	const entries = Object.entries(schema.shape).map(([key, schema]) => {
-		const nonnullable = unwrapOptional(schema);
-		const singular = unwrapArray(nonnullable);
-
-		let coerce: ((x: string) => Literal | null) | undefined;
-		switch (singular.type) {
-			case 'boolean': {
-				coerce = coerceBoolean;
-				break;
-			}
-			case 'integer': {
-				coerce = coerceInteger;
-				break;
-			}
-		}
-
-		return {
-			key: key,
-			coerce: coerce,
-			multiple: isArraySchema(nonnullable),
-			optional: isOptionalSchema(schema) && schema.default === undefined,
-		};
-	});
-
-	const len = entries.length;
-
-	return (searchParams: URLSearchParams): ValidationResult<Record<string, MaybeArray<Literal>>> => {
-		const input: Record<string, MaybeArray<Literal | null>> = {};
-
-		for (let idx = 0; idx < len; idx++) {
-			const entry = entries[idx];
-			const key = entry.key;
-			const coerce = entry.coerce;
-
-			const raw = searchParams.getAll(key);
-			const count = raw.length;
-
-			let value: MaybeArray<Literal | null>;
-
-			if (entry.multiple || count > 1) {
-				value = coerce !== undefined ? raw.map(coerce) : raw;
-			} else {
-				if (count === 0) {
-					continue;
-				}
-
-				value = coerce !== undefined ? coerce(raw[0]) : raw[0];
-			}
-
-			/*#__INLINE__*/ set(input, key, value);
-		}
-
-		return safeParse(schema, input);
-	};
-};
-
-const set = <K extends PropertyKey, V>(obj: Record<K, V>, key: NoInfer<K>, value: NoInfer<V>): void => {
-	if (key === '__proto__') {
-		Object.defineProperty(obj, key, { value });
-	} else {
-		obj[key] = value;
-	}
-};

package/lib/main/utils/response.ts

@@ -1,14 +0,0 @@
-import type { Err } from '@atcute/lexicons/validations';
-
-export const invalidRequest = (message: string) => {
-	return Response.json({ error: 'InvalidRequest', message }, { status: 400 });
-};
-
-export const validationError = (kind: 'params' | 'input', err: Err): Response => {
-	const message = `invalid ${kind}: ${err.message}`;
-
-	return Response.json(
-		{ error: 'InvalidRequest', message: message, 'net.kelinci.atcute.issues': err.issues },
-		{ status: 400 },
-	);
-};

package/lib/main/utils/websocket-mock.ts

@@ -1,118 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-
-import { SimpleEventEmitter } from '@mary-ext/simple-event-emitter';
-
-import type { Promisable } from '../../types/misc.ts';
-import type { XRPCRouter } from '../router.ts';
-import type { WebSocketAdapter, WebSocketConnection } from '../types/websocket.ts';
-
-interface WebSocketHandlerContext {
-	handler: ((ws: WebSocketConnection) => Promisable<void>) | null;
-}
-
-export interface CloseEvent {
-	code: number;
-	reason: string;
-	wasClean: boolean;
-}
-
-export interface SubscriptionClient extends Disposable {
-	onMessage: SimpleEventEmitter<[data: Uint8Array]>;
-	onClose: SimpleEventEmitter<[event: CloseEvent]>;
-	dispose(): void;
-}
-
-export interface SubscriptionMock {
-	subscribe(url: string): Promise<SubscriptionClient>;
-}
-
-export class MockWebSocketAdapter implements WebSocketAdapter {
-	#context = new AsyncLocalStorage<WebSocketHandlerContext>();
-
-	upgrade(
-		_request: Request,
-		handler: (ws: WebSocketConnection) => Promisable<void>,
-	): Promisable<Response | undefined> {
-		const ctx = this.#context.getStore();
-		if (!ctx) {
-			return undefined;
-		}
-
-		ctx.handler = handler;
-
-		return new Response(null);
-	}
-
-	attach(router: XRPCRouter): SubscriptionMock {
-		return {
-			subscribe: async (url) => {
-				const ctx: WebSocketHandlerContext = {
-					handler: null,
-				};
-
-				await this.#context.run(ctx, async () => {
-					const urlp = new URL(url, 'http://localhost');
-					const request = new Request(urlp, {
-						headers: {
-							upgrade: 'websocket',
-							connection: 'upgrade',
-						},
-					});
-
-					const response = await router.fetch(request);
-
-					return response;
-				});
-
-				if (!ctx.handler) {
-					throw new Error(`WebSocket upgrade succeeded but no handler was set`);
-				}
-
-				const onMessage = new SimpleEventEmitter<[data: Uint8Array]>();
-				const onClose = new SimpleEventEmitter<[event: CloseEvent]>();
-
-				const controller = new AbortController();
-				const signal = controller.signal;
-
-				const connection: WebSocketConnection = {
-					signal: signal,
-					send(data) {
-						onMessage.emit(data);
-					},
-					drain() {
-						// tests have no outgoing buffer to observe
-					},
-					close(code = 1000, reason = '') {
-						if (!signal.aborted) {
-							onClose.emit({ code, reason, wasClean: true });
-							controller.abort();
-						}
-					},
-				};
-
-				{
-					const handler = ctx.handler;
-					setTimeout(() => {
-						handler(connection);
-					}, 1);
-				}
-
-				const client: SubscriptionClient = {
-					onMessage,
-					onClose,
-					dispose() {
-						if (!signal.aborted) {
-							onClose.emit({ code: 1000, reason: '', wasClean: true });
-							controller.abort();
-						}
-					},
-					[Symbol.dispose]() {
-						this.dispose();
-					},
-				};
-
-				return client;
-			},
-		};
-	}
-}

package/lib/main/xrpc-error.ts

@@ -1,201 +0,0 @@
-/**
- * a single WWW-Authenticate challenge. exactly one of `params` or `token68` may
- * be provided. a bare scheme (no params, no token) is valid and renders as just
- * the scheme name.
- *
- * @see {@link https://datatracker.ietf.org/doc/html/rfc7235#section-4.1 | RFC 7235 §4.1}
- */
-export interface WWWAuthenticateChallenge {
-	/** authentication scheme, e.g. `Bearer`, `DPoP`, `Basic`. */
-	scheme: string;
-	/** auth-param pairs. entries whose value is `undefined` are omitted. */
-	params?: Record<string, string | undefined>;
-	/**
-	 * token68 value for schemes that carry one instead of auth-params (e.g.
-	 * `Basic`). mutually exclusive with `params`.
-	 */
-	token68?: string;
-}
-
-/**
- * formats one or more WWW-Authenticate challenges into a single header value.
- *
- * each challenge is emitted as `<scheme>` followed by its params or token68.
- * multiple challenges are joined with `, `. auth-param values are quoted using
- * `JSON.stringify` (RFC 7230 quoted-string semantics for ASCII content).
- *
- * @param challenges one challenge, or an ordered array of challenges
- * @returns the formatted header value
- *
- * @example
- * ```ts
- * formatWWWAuthenticate({ scheme: 'Bearer', params: { error: 'BadJwtSignature' } })
- * // => `Bearer error="BadJwtSignature"`
- * ```
- */
-export const formatWWWAuthenticate = (
-	challenges: WWWAuthenticateChallenge | WWWAuthenticateChallenge[],
-): string => {
-	const list = Array.isArray(challenges) ? challenges : [challenges];
-	return list.map(formatChallenge).join(', ');
-};
-
-const formatChallenge = (challenge: WWWAuthenticateChallenge): string => {
-	if (challenge.token68 !== undefined) {
-		return `${challenge.scheme} ${challenge.token68}`;
-	}
-
-	if (challenge.params !== undefined) {
-		const parts: string[] = [];
-		for (const name in challenge.params) {
-			const value = challenge.params[name];
-			if (value !== undefined) {
-				parts.push(`${name}=${JSON.stringify(value)}`);
-			}
-		}
-
-		if (parts.length > 0) {
-			return `${challenge.scheme} ${parts.join(', ')}`;
-		}
-	}
-
-	return challenge.scheme;
-};
-
-export interface XRPCErrorOptions {
-	status: number;
-	error: string;
-	message?: string;
-	headers?: HeadersInit;
-}
-
-export class XRPCError extends Error {
-	/** response status */
-	readonly status: number;
-
-	/** error name */
-	readonly error: string;
-	/** response headers */
-	readonly headers?: HeadersInit;
-
-	constructor({ status, error, message, headers }: XRPCErrorOptions) {
-		super(message);
-
-		this.status = status;
-
-		this.error = error;
-		this.headers = headers;
-	}
-
-	toResponse(): Response {
-		return Response.json(
-			{ error: this.error, message: this.message || undefined },
-			{ status: this.status, headers: this.headers },
-		);
-	}
-}
-
-export class InvalidRequestError extends XRPCError {
-	constructor({ status = 400, error = 'InvalidRequest', message, headers }: Partial<XRPCErrorOptions> = {}) {
-		super({ status, error, message, headers });
-	}
-}
-
-export interface AuthRequiredErrorOptions extends Partial<XRPCErrorOptions> {
-	/**
-	 * WWW-Authenticate challenge(s) to attach to the response. the formatted
-	 * header is set on `headers` automatically, and `access-control-expose-headers`
-	 * is appended so browsers can read it from CORS responses.
-	 */
-	wwwAuthenticate?: WWWAuthenticateChallenge | WWWAuthenticateChallenge[];
-}
-
-export class AuthRequiredError extends XRPCError {
-	constructor({
-		status = 401,
-		error = 'AuthenticationRequired',
-		message,
-		headers,
-		wwwAuthenticate,
-	}: AuthRequiredErrorOptions = {}) {
-		let mergedHeaders = headers;
-
-		if (wwwAuthenticate !== undefined) {
-			const target = new Headers(headers);
-			target.set('www-authenticate', formatWWWAuthenticate(wwwAuthenticate));
-			target.append('access-control-expose-headers', 'www-authenticate');
-			mergedHeaders = target;
-		}
-
-		super({ status, error, message, headers: mergedHeaders });
-	}
-}
-
-export class ForbiddenError extends XRPCError {
-	constructor({ status = 403, error = 'Forbidden', message, headers }: Partial<XRPCErrorOptions> = {}) {
-		super({ status, error, message, headers });
-	}
-}
-
-export class RateLimitExceededError extends XRPCError {
-	constructor({
-		status = 429,
-		error = 'RateLimitExceeded',
-		message,
-		headers,
-	}: Partial<XRPCErrorOptions> = {}) {
-		super({ status, error, message, headers });
-	}
-}
-
-export class InternalServerError extends XRPCError {
-	constructor({
-		status = 500,
-		error = 'InternalServerError',
-		message,
-		headers,
-	}: Partial<XRPCErrorOptions> = {}) {
-		super({ status, error, message, headers });
-	}
-}
-
-export class UpstreamFailureError extends XRPCError {
-	constructor({ status = 502, error = 'UpstreamFailure', message, headers }: Partial<XRPCErrorOptions> = {}) {
-		super({ status, error, message, headers });
-	}
-}
-
-export class NotEnoughResourcesError extends XRPCError {
-	constructor({
-		status = 503,
-		error = 'NotEnoughResources',
-		message,
-		headers,
-	}: Partial<XRPCErrorOptions> = {}) {
-		super({ status, error, message, headers });
-	}
-}
-
-export class UpstreamTimeoutError extends XRPCError {
-	constructor({ status = 504, error = 'UpstreamTimeout', message, headers }: Partial<XRPCErrorOptions> = {}) {
-		super({ status, error, message, headers });
-	}
-}
-
-export interface XRPCSubscriptionErrorOptions {
-	closeCode?: number;
-	error: string;
-	message?: string;
-}
-
-export class XRPCSubscriptionError extends Error {
-	readonly closeCode: number;
-	readonly error: string;
-
-	constructor({ closeCode = 1008, error, message }: XRPCSubscriptionErrorOptions) {
-		super(message);
-
-		this.closeCode = closeCode;
-		this.error = error;
-	}
-}

package/lib/main/xrpc-handler.ts

@@ -1,53 +0,0 @@
-import type { XRPCProcedureMetadata, XRPCQueryMetadata } from '@atcute/lexicons/validations';
-
-import { XRPCRouter, type XRPCRouterOptions } from './router.ts';
-import type { ProcedureConfig, QueryConfig } from './types/operation.ts';
-import { unwrapLxm, type Namespaced } from './utils/namespaced.ts';
-
-type XrpcHandlerRouterOptions = Pick<XRPCRouterOptions, 'middlewares' | 'handleNotFound' | 'handleException'>;
-
-export type XrpcQueryHandlerOptions<TQuery extends XRPCQueryMetadata> = {
-	lxm: TQuery | Namespaced<TQuery>;
-	routerOptions?: XrpcHandlerRouterOptions;
-} & QueryConfig<TQuery>;
-
-export type XrpcProcedureHandlerOptions<TProcedure extends XRPCProcedureMetadata> = {
-	lxm: TProcedure | Namespaced<TProcedure>;
-	routerOptions?: XrpcHandlerRouterOptions;
-} & ProcedureConfig<TProcedure>;
-
-export type XrpcHandlerOptions =
-	| XrpcQueryHandlerOptions<XRPCQueryMetadata>
-	| XrpcProcedureHandlerOptions<XRPCProcedureMetadata>;
-
-/**
- * create a fetch handler for a single xrpc query or procedure.
- * requests are expected at `/xrpc/<nsid>`.
- * subscriptions are not supported.
- */
-export function createXrpcHandler<TQuery extends XRPCQueryMetadata>(
-	options: XrpcQueryHandlerOptions<TQuery>,
-): (request: Request) => Promise<Response>;
-export function createXrpcHandler<TProcedure extends XRPCProcedureMetadata>(
-	options: XrpcProcedureHandlerOptions<TProcedure>,
-): (request: Request) => Promise<Response>;
-export function createXrpcHandler(options: XrpcHandlerOptions): (request: Request) => Promise<Response> {
-	const { lxm, handler, routerOptions } = options;
-
-	const router = new XRPCRouter(routerOptions);
-
-	const schema = unwrapLxm(lxm);
-
-	switch (schema.type) {
-		case 'xrpc_query': {
-			router.addQuery(schema, { handler: handler as QueryConfig<XRPCQueryMetadata>['handler'] });
-			break;
-		}
-		case 'xrpc_procedure': {
-			router.addProcedure(schema, { handler: handler as ProcedureConfig<XRPCProcedureMetadata>['handler'] });
-			break;
-		}
-	}
-
-	return router.fetch;
-}

package/lib/middlewares/cors.ts

@@ -1,104 +0,0 @@
-import type { FetchMiddleware } from '../main/router.ts';
-
-export interface CORSOptions {
-	/** Additional headers to expose to the client */
-	exposedHeaders?: string[];
-	/** Additional headers to allow */
-	allowedHeaders?: string[];
-	/** NSID prefixes to exclude from CORS handling */
-	exclude?: string[];
-	/** allow requests from private networks (e.g., localhost to a local server) */
-	allowPrivateNetwork?: boolean;
-}
-
-const DEFAULT_EXPOSED_HEADERS = [
-	'dpop-nonce',
-	'www-authenticate',
-
-	'ratelimit-limit',
-	'ratelimit-policy',
-	'ratelimit-remaining',
-	'ratelimit-reset',
-];
-
-const DEFAULT_ALLOWED_HEADERS = [
-	'content-type',
-
-	'authorization',
-	'dpop',
-
-	'atproto-accept-labelers',
-	'atproto-proxy',
-];
-
-const RE_XRPC_NSID = /^\/xrpc\/([^?]*)/;
-
-export const cors = (options: CORSOptions = {}): FetchMiddleware => {
-	const exposedHeaders = Array.from(
-		new Set([...DEFAULT_EXPOSED_HEADERS, ...(options.exposedHeaders?.map((h) => h.toLowerCase()) || [])]),
-	)
-		// oxlint-disable-next-line unicorn/no-array-sort -- Array.from already clones
-		.sort();
-
-	const allowedHeaders = Array.from(
-		new Set([...DEFAULT_ALLOWED_HEADERS, ...(options.allowedHeaders?.map((h) => h.toLowerCase()) || [])]),
-	)
-		// oxlint-disable-next-line unicorn/no-array-sort -- Array.from already clones
-		.sort()
-		.join(',');
-
-	const exclude = options.exclude;
-	const allowPrivateNetwork = options.allowPrivateNetwork;
-
-	return async (request, next) => {
-		// check if this NSID should be excluded from CORS handling
-		if (exclude) {
-			const url = new URL(request.url);
-			const match = RE_XRPC_NSID.exec(url.pathname);
-
-			if (match) {
-				const nsid = match[1];
-				const excluded = exclude.some((pattern) => {
-					if (pattern.endsWith('.*')) {
-						return nsid.startsWith(pattern.slice(0, -1));
-					}
-					return nsid === pattern;
-				});
-
-				if (excluded) {
-					return next(request);
-				}
-			}
-		}
-
-		const origin = request.headers.get('origin') || '*';
-
-		// Handle preflight requests
-		if (request.method === 'OPTIONS') {
-			const headers = new Headers();
-			headers.set('access-control-max-age', '86400');
-			headers.set('access-control-allow-origin', origin);
-
-			if (allowedHeaders) {
-				headers.set('access-control-allow-headers', allowedHeaders);
-			}
-
-			if (allowPrivateNetwork && request.headers.get('access-control-request-private-network') === 'true') {
-				headers.set('access-control-allow-private-network', 'true');
-			}
-
-			return new Response(null, { status: 204, headers: headers });
-		}
-
-		const response = await next(request);
-
-		const expose = exposedHeaders.filter((h) => response.headers.has(h)).join(',');
-
-		response.headers.set('access-control-allow-origin', origin);
-		if (expose.length > 0) {
-			response.headers.append('access-control-expose-headers', expose);
-		}
-
-		return response;
-	};
-};

package/lib/types/misc.ts

@@ -1,4 +0,0 @@
-export type Promisable<T> = T | Promise<T>;
-export type Literal = string | number | boolean;
-
-export type Result<T, E> = { ok: true; value: T } | { ok: false; error: E };