@bakery-framework/core 1.2.3 → 2.0.0-alpha.11

package/src/utils/http/html.ts

@@ -4,7 +4,18 @@ import { Try } from '../common/try'
 import { DOMTools, headBodyCache } from './dom'
 import { ETag } from './etag'
 
-function injectBrand(res: Response) {
+/**
+ * Mark `res` as already carrying the head/body injects, so `injectIfHtml` —
+ * and therefore `processResponse`, which every response funnels through —
+ * hands it back untouched.
+ *
+ * Exported for the one caller that means "never", not "already":
+ * `DefaultErrorHandler` brands its production error page so the import map is
+ * not spliced into it. That map names every installed package — an inventory
+ * of the app's module layout — and the page carries no scripts for it (or the
+ * client bundle) to serve anyway.
+ */
+export function injectBrand(res: Response) {
   return Object.defineProperty(res, '__injected__', {
     value: true,
     enumerable: false,
@@ -80,7 +91,7 @@ export const STREAM_THRESHOLD_BYTES = 64 * 1024
 
 export async function injectIfHtml(
   data: string | Response | Blob,
-  params?: MapOf<string>,
+  params?: MapOf<unknown>,
   injects?: HtmlInjects,
 ): Promise<Response | null> {
   if (data instanceof Response && isInjected(data)) return data
@@ -127,7 +138,7 @@ export async function injectIfHtml(
  * streamed path's fallback both come through here. */
 function bufferedResponse(
   content: string,
-  params: MapOf<string> | undefined,
+  params: MapOf<unknown> | undefined,
   injects: HtmlInjects | undefined,
   responseInit: ResponseInit & { headers?: any },
 ): Response {
@@ -182,7 +193,7 @@ function getConfigInjects() {
  * into a pull callback, where the AsyncLocalStorage host context that
  * `getConfigInjects` and `DOMTools.importMap` read may no longer be live.
  */
-function computeInjects(params: MapOf<string>, injects: HtmlInjects) {
+function computeInjects(params: MapOf<unknown>, injects: HtmlInjects) {
   const configInjects = getConfigInjects()
   const paramsStr = DOMTools.params(params)
 
@@ -235,7 +246,7 @@ function rewriteFontsUrls(html: string): string {
 
 export function assembleHtml(
   content: string,
-  params: MapOf<string> = {},
+  params: MapOf<unknown> = {},
   injects: HtmlInjects = {},
 ) {
   const frags = computeInjects(params, injects)

package/src/utils/http/index.ts

@@ -1,4 +1,6 @@
+export * from './authorize'
 export * from './body'
+export * from './credential'
 export * from './csrf'
 export * from './dom'
 export * from './escape'
@@ -7,3 +9,4 @@ export * from './html'
 export * from './ip'
 export * from './response'
 export * from './sse'
+export * from './url'

package/src/utils/http/url.ts

@@ -0,0 +1,35 @@
+/**
+ * The request's parsed URL, parsed at most once.
+ *
+ * Why memoize at all: `new URL` measures ~1.7µs, and the router, the body
+ * parser and the proxy handler all want the same parse of the same request —
+ * so the parse was hoisted into the server's `fetch` in `packages/cli/src/worker.ts`
+ * and shared.
+ *
+ * Why a `WeakMap` rather than the property it replaces. The memo used to be
+ * `(req as any).__parsedUrl`: two writers, six readers across three packages,
+ * every reader spelled `(req as any).__parsedUrl || new URL(req.url)` so that
+ * it silently re-parsed whenever the writer had not run first. That is a
+ * writer/reader ordering hazard with no way to observe it going wrong — a
+ * missed write costs microseconds, not correctness, so nothing ever fails.
+ * One function collapses both roles: there is no ordering left to get wrong,
+ * no `any` cast anywhere, and no writer to forget. The map also keeps the
+ * framework from mutating a `Request` object it does not own — a caller's
+ * `Request` goes in and comes back unchanged — and holds its keys weakly, so
+ * an entry dies with the request rather than needing eviction (convention 6).
+ *
+ * There is deliberately no setter. Nothing outside this module needs to say
+ * what a request's URL is; `req.url` already does.
+ */
+
+const cache = new WeakMap<Request, URL>()
+
+/** The parsed `req.url`, cached per request. */
+export function parsedUrl(req: Request): URL {
+  const cached = cache.get(req)
+  if (cached) return cached
+
+  const url = new URL(req.url)
+  cache.set(req, url)
+  return url
+}

package/src/utils/isomorphic/misc.ts

@@ -15,6 +15,22 @@ export function any<T = any>(value: any): T {
   return value
 }
 
+/**
+ * A hex id of `length` characters, from `crypto.getRandomValues`.
+ *
+ * Isomorphic, and moving it here is what made it so: it lived in
+ * `client/utils.ts` as a browser global only, so the same call in a server
+ * block was a ReferenceError — reported from an app. `crypto` is a global in
+ * both runtimes; nothing here is browser-specific.
+ */
+export function randomId(length = 8) {
+  const arr = new Uint8Array(Math.ceil(length / 2))
+  crypto.getRandomValues(arr)
+  return Array.from(arr, dec => dec.toString(16).padStart(2, '0'))
+    .join('')
+    .slice(0, length)
+}
+
 export function repeat(n: number): number[]
 export function repeat<T>(n: number, fn: (i: number) => T): T[]
 export function repeat<T>(n: number, fn?: (i: number) => T): unknown[] {