@beignet/core 0.0.23 → 0.0.25

package/src/server/server.ts

@@ -275,6 +275,18 @@ type AnyServiceProvider = ServiceProvider<
   any
 >;
 
+/**
+ * Request body limits enforced before contract body validation.
+ */
+export interface RequestBodyOptions {
+  /**
+   * Maximum request body size in bytes for JSON/text route bodies.
+   *
+   * @default 1048576
+   */
+  maxBytes?: number;
+}
+
 /**
  * Options for creating a Beignet server instance.
  */
@@ -350,6 +362,10 @@ export type CreateServerOptions<
    * @default true
    */
   validateResponses?: boolean;
+  /**
+   * Request body parsing limits for JSON/text contract routes.
+   */
+  requestBody?: RequestBodyOptions;
   /**
    * Route list to register up front.
    */
@@ -937,7 +953,89 @@ function defaultErrorResponse(err: unknown, ctx?: unknown): HttpResponseLike {
   };
 }
 
-async function parseBody(req: HttpRequestLike): Promise<unknown> {
+const DEFAULT_REQUEST_BODY_MAX_BYTES = 1024 * 1024;
+
+class RequestBodyTooLargeError extends Error {
+  readonly maxBytes: number;
+  readonly actualBytes?: number;
+
+  constructor(maxBytes: number, actualBytes?: number) {
+    super("Request body exceeds the configured size limit.");
+    this.name = "RequestBodyTooLargeError";
+    this.maxBytes = maxBytes;
+    this.actualBytes = actualBytes;
+  }
+}
+
+function requestBodyLimit(options: RequestBodyOptions | undefined): number {
+  const maxBytes = options?.maxBytes ?? DEFAULT_REQUEST_BODY_MAX_BYTES;
+
+  if (!Number.isFinite(maxBytes) || maxBytes <= 0) {
+    throw new Error(
+      "createServer requestBody.maxBytes must be a positive number.",
+    );
+  }
+
+  return maxBytes;
+}
+
+function assertContentLengthWithinLimit(
+  headers: Headers,
+  maxBytes: number,
+): void {
+  const contentLength = headers.get("content-length");
+  if (contentLength === null) return;
+
+  const actualBytes = Number(contentLength);
+  if (!Number.isFinite(actualBytes) || actualBytes < 0) return;
+  if (actualBytes > maxBytes) {
+    throw new RequestBodyTooLargeError(maxBytes, actualBytes);
+  }
+}
+
+async function readLimitedRequestText(
+  req: HttpRequestLike,
+  maxBytes: number,
+): Promise<string> {
+  assertContentLengthWithinLimit(req.headers, maxBytes);
+
+  const body = req.raw?.body;
+  if (!body) {
+    const text = await req.text();
+    const actualBytes = new TextEncoder().encode(text).byteLength;
+    if (actualBytes > maxBytes) {
+      throw new RequestBodyTooLargeError(maxBytes, actualBytes);
+    }
+    return text;
+  }
+
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let received = 0;
+  let text = "";
+
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      received += result.value.byteLength;
+      if (received > maxBytes) {
+        throw new RequestBodyTooLargeError(maxBytes, received);
+      }
+      text += decoder.decode(result.value, { stream: true });
+    }
+    text += decoder.decode();
+  } finally {
+    reader.releaseLock();
+  }
+
+  return text;
+}
+
+async function parseBody(
+  req: HttpRequestLike,
+  maxBytes: number,
+): Promise<unknown> {
   const method = req.method.toUpperCase() as HttpContractConfig["method"];
   if (!methodSupportsRequestBody(method)) {
     return undefined;
@@ -946,15 +1044,16 @@ async function parseBody(req: HttpRequestLike): Promise<unknown> {
   const bodyReq = req.clone?.() ?? req;
   const contentType = req.headers.get("content-type") || "";
   if (contentType.includes("application/json")) {
-    const text = await bodyReq.text();
+    const text = await readLimitedRequestText(bodyReq, maxBytes);
     if (text === "") return undefined;
     return JSON.parse(text);
   }
 
   try {
-    const text = await bodyReq.text();
+    const text = await readLimitedRequestText(bodyReq, maxBytes);
     return text === "" ? undefined : text;
-  } catch {
+  } catch (error) {
+    if (error instanceof RequestBodyTooLargeError) throw error;
     return undefined;
   }
 }
@@ -1011,6 +1110,7 @@ function createRequestExecutor<
   preMatchedParams?: Record<string, string>,
 ) => Promise<HttpResponse> {
   const warnedNativeReplacementHooks = new WeakSet<object>();
+  const maxRequestBodyBytes = requestBodyLimit(options.requestBody);
 
   return async (
     target: ExecutionTarget<Ctx, C>,
@@ -1521,19 +1621,33 @@ function createRequestExecutor<
           let body: any;
           if (!result) {
             try {
-              body = await parseBody(req);
+              body = await parseBody(req, maxRequestBodyBytes);
             } catch (error) {
-              result = {
-                response: requestValidationError(
-                  contract,
-                  400,
-                  "INVALID_BODY",
-                  "Malformed JSON",
-                  "body",
-                  error,
-                ),
-                owner: "framework",
-              };
+              if (error instanceof RequestBodyTooLargeError) {
+                result = {
+                  response: requestValidationError(
+                    contract,
+                    413,
+                    "PAYLOAD_TOO_LARGE",
+                    "Request body is too large",
+                    "body",
+                    error,
+                  ),
+                  owner: "framework",
+                };
+              } else {
+                result = {
+                  response: requestValidationError(
+                    contract,
+                    400,
+                    "INVALID_BODY",
+                    "Malformed JSON",
+                    "body",
+                    error,
+                  ),
+                  owner: "framework",
+                };
+              }
             }
           }
 

package/src/server-only.ts

@@ -3,5 +3,7 @@
  *
  * Host frameworks may provide their own runtime-only enforcement. This marker
  * is intentionally a no-op so Beignet can enforce intent through `beignet lint`.
+ * Import it for side effects at the top of server-only modules:
+ * `import "@beignet/core/server-only";`.
  */
 export const beignetServerOnly = true;

package/src/uploads/index.ts

@@ -190,6 +190,14 @@ export type UploadAuthorizeResult =
       reason?: string;
     };
 
+/**
+ * Upload access mode.
+ *
+ * Protected uploads require an `authorize(...)` hook. Public uploads are
+ * intentionally reachable without that hook.
+ */
+export type UploadAccess = "protected" | "public";
+
 /**
  * Arguments passed to upload definition hooks.
  */
@@ -231,6 +239,12 @@ export interface DefineUploadOptions<
    * File constraints for this upload workflow.
    */
   file: UploadFileConstraints;
+  /**
+   * Whether this upload may be prepared without an authorize hook.
+   *
+   * @default "protected"
+   */
+  access?: UploadAccess;
   /**
    * Optional human-readable description for docs and tooling.
    */
@@ -274,6 +288,7 @@ export interface UploadDef<
   readonly name: Name;
   readonly metadata: MetadataSchema;
   readonly file: UploadFileConstraints;
+  readonly access?: UploadAccess;
   readonly description?: string;
   authorize?(
     args: UploadFileHookArgs<InferSchemaOutput<MetadataSchema>, Ctx>,
@@ -348,6 +363,25 @@ export interface UploadManifestEntry {
   file: UploadFileConstraints;
 }
 
+/**
+ * Request body limits for upload route actions.
+ */
+export interface UploadRequestLimits {
+  /**
+   * Maximum JSON body size for prepare and complete actions.
+   *
+   * @default 262144
+   */
+  jsonMaxBytes?: number;
+  /**
+   * Maximum multipart body size for server-handled upload actions when
+   * Content-Length is present. File constraints still enforce per-file limits.
+   *
+   * @default 26214400
+   */
+  multipartMaxBytes?: number;
+}
+
 /**
  * Options for `createUploadRouter(...)`.
  */
@@ -368,6 +402,10 @@ export interface CreateUploadRouterOptions<Ctx> {
    * Optional signer used to prepare direct upload instructions.
    */
   signer?: UploadSignerPort;
+  /**
+   * Request body limits for upload actions.
+   */
+  limits?: UploadRequestLimits;
   /**
    * Optional instrumentation target used by devtools/provider watchers.
    */
@@ -410,6 +448,7 @@ export type UploadErrorCode =
   | "INVALID_UPLOAD_FILE"
   | "UNAUTHORIZED_UPLOAD"
   | "UPLOAD_OBJECT_NOT_FOUND"
+  | "UPLOAD_BODY_TOO_LARGE"
   | "INVALID_UPLOAD_BODY";
 
 /**
@@ -455,6 +494,7 @@ export function defineUpload<
       maxFiles: options.file.maxFiles ?? 1,
       visibility: options.file.visibility ?? "private",
     },
+    access: options.access ?? "protected",
     ...(options.description !== undefined
       ? { description: options.description }
       : {}),
@@ -558,6 +598,7 @@ export function createUploadRouter<Ctx>(
       watcher: "uploads",
     },
   );
+  const requestLimits = uploadRequestLimits(options.limits);
 
   async function resolveCtx(): Promise<Ctx> {
     return typeof options.ctx === "function"
@@ -841,6 +882,7 @@ export function createUploadRouter<Ctx>(
           const input = await readJsonBody(request, {
             uploadName: requestOptions.uploadName,
             action: "prepare",
+            maxBytes: requestLimits.jsonMaxBytes,
           });
           return jsonResponse(
             await prepare(
@@ -854,6 +896,7 @@ export function createUploadRouter<Ctx>(
           const input = await readJsonBody(request, {
             uploadName: requestOptions.uploadName,
             action: "complete",
+            maxBytes: requestLimits.jsonMaxBytes,
           });
           return jsonResponse(
             await complete(
@@ -863,6 +906,11 @@ export function createUploadRouter<Ctx>(
           );
         }
 
+        assertUploadContentLengthWithinLimit(request.headers, {
+          uploadName: requestOptions.uploadName,
+          action: "upload",
+          maxBytes: requestLimits.multipartMaxBytes,
+        });
         const formData = await request.formData();
         return jsonResponse(
           await upload(requestOptions.uploadName, {
@@ -876,13 +924,134 @@ export function createUploadRouter<Ctx>(
   };
 }
 
+const DEFAULT_UPLOAD_JSON_MAX_BYTES = 256 * 1024;
+const DEFAULT_UPLOAD_MULTIPART_MAX_BYTES = 25 * 1024 * 1024;
+
+function uploadRequestLimits(
+  limits: UploadRequestLimits | undefined,
+): Required<UploadRequestLimits> {
+  return {
+    jsonMaxBytes: positiveLimit(
+      limits?.jsonMaxBytes,
+      DEFAULT_UPLOAD_JSON_MAX_BYTES,
+      "limits.jsonMaxBytes",
+    ),
+    multipartMaxBytes: positiveLimit(
+      limits?.multipartMaxBytes,
+      DEFAULT_UPLOAD_MULTIPART_MAX_BYTES,
+      "limits.multipartMaxBytes",
+    ),
+  };
+}
+
+function positiveLimit(
+  value: number | undefined,
+  fallback: number,
+  name: string,
+): number {
+  const limit = value ?? fallback;
+  if (!Number.isFinite(limit) || limit <= 0) {
+    throw new Error(`createUploadRouter ${name} must be a positive number.`);
+  }
+  return limit;
+}
+
+function assertUploadContentLengthWithinLimit(
+  headers: Headers,
+  context: {
+    uploadName: string;
+    action: "prepare" | "complete" | "upload";
+    maxBytes: number;
+  },
+): void {
+  const contentLength = headers.get("content-length");
+  if (contentLength === null) return;
+
+  const actualBytes = Number(contentLength);
+  if (!Number.isFinite(actualBytes) || actualBytes < 0) return;
+  if (actualBytes > context.maxBytes) {
+    throw new UploadError({
+      code: "UPLOAD_BODY_TOO_LARGE",
+      status: 413,
+      message: `Upload "${context.uploadName}" ${context.action} body is too large.`,
+      details: {
+        maxBytes: context.maxBytes,
+        actualBytes,
+      },
+    });
+  }
+}
+
+async function readLimitedRequestText(
+  request: Request,
+  context: {
+    uploadName: string;
+    action: "prepare" | "complete";
+    maxBytes: number;
+  },
+): Promise<string> {
+  assertUploadContentLengthWithinLimit(request.headers, context);
+
+  if (!request.body) {
+    const text = await request.text();
+    const actualBytes = new TextEncoder().encode(text).byteLength;
+    if (actualBytes > context.maxBytes) {
+      throw new UploadError({
+        code: "UPLOAD_BODY_TOO_LARGE",
+        status: 413,
+        message: `Upload "${context.uploadName}" ${context.action} body is too large.`,
+        details: {
+          maxBytes: context.maxBytes,
+          actualBytes,
+        },
+      });
+    }
+    return text;
+  }
+
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder();
+  let actualBytes = 0;
+  let text = "";
+
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      actualBytes += result.value.byteLength;
+      if (actualBytes > context.maxBytes) {
+        throw new UploadError({
+          code: "UPLOAD_BODY_TOO_LARGE",
+          status: 413,
+          message: `Upload "${context.uploadName}" ${context.action} body is too large.`,
+          details: {
+            maxBytes: context.maxBytes,
+            actualBytes,
+          },
+        });
+      }
+      text += decoder.decode(result.value, { stream: true });
+    }
+    text += decoder.decode();
+  } finally {
+    reader.releaseLock();
+  }
+
+  return text;
+}
+
 async function readJsonBody(
   request: Request,
-  context: { uploadName: string; action: "prepare" | "complete" },
+  context: {
+    uploadName: string;
+    action: "prepare" | "complete";
+    maxBytes: number;
+  },
 ): Promise<unknown> {
   try {
-    return await request.json();
-  } catch {
+    return JSON.parse(await readLimitedRequestText(request, context));
+  } catch (error) {
+    if (error instanceof UploadError) throw error;
     throw new UploadError({
       code: "INVALID_UPLOAD_BODY",
       status: 400,
@@ -1056,6 +1225,16 @@ async function assertAuthorized<Metadata, Ctx>(
   upload: UploadDef<string, StandardSchema, Ctx>,
   args: UploadFileHookArgs<Metadata, Ctx>,
 ): Promise<void> {
+  if (!upload.authorize) {
+    if ((upload.access ?? "protected") === "public") return;
+
+    throw new UploadError({
+      code: "UNAUTHORIZED_UPLOAD",
+      status: 403,
+      message: `Upload "${upload.name}" must declare authorize(...) or set access: "public".`,
+    });
+  }
+
   const result = await upload.authorize?.(
     args as UploadFileHookArgs<InferUploadMetadata<typeof upload>, Ctx>,
   );
@@ -1084,6 +1263,33 @@ function assertStoredObject(
 ): void {
   assertFiles(upload, [file]);
 
+  if (
+    upload.file.maxSizeBytes !== undefined &&
+    object.size > upload.file.maxSizeBytes
+  ) {
+    throw new UploadError({
+      code: "INVALID_UPLOAD_FILE",
+      status: 413,
+      message: `Uploaded object "${object.key}" exceeds the maximum file size.`,
+      details: {
+        size: object.size,
+        maxSizeBytes: upload.file.maxSizeBytes,
+      },
+    });
+  }
+
+  if (object.size !== file.size) {
+    throw new UploadError({
+      code: "INVALID_UPLOAD_FILE",
+      status: 422,
+      message: `Uploaded object "${object.key}" size does not match the prepared file.`,
+      details: {
+        expected: file.size,
+        actual: object.size,
+      },
+    });
+  }
+
   if (
     object.contentType &&
     file.contentType &&