@beignet/next 0.0.51 → 0.0.53

package/src/index.ts

@@ -606,6 +606,15 @@ export type CreateWebhookRouteOptions<
    * @default false
    */
   allowUnknownEvents?: AllowUnknownEvents;
+  /**
+   * Maximum raw webhook body size in bytes.
+   *
+   * Bodies above this limit are rejected before server resolution, hooks,
+   * context creation, verification, or fulfillment.
+   *
+   * @default 1048576
+   */
+  maxBodyBytes?: number;
   /**
    * App-owned fulfillment handler. The webhook is verified before this runs.
    *
@@ -701,6 +710,16 @@ export type CreatePaymentWebhookRouteOptions<
    * @default "stripe-signature"
    */
   signatureHeader?: string;
+  /**
+   * Maximum raw webhook body size in bytes.
+   *
+   * Signed bodies above this limit are rejected before provider verification
+   * or fulfillment, and before server resolution, hooks, or context creation.
+   * A missing signature takes precedence and cancels the unread body.
+   *
+   * @default 1048576
+   */
+  maxBodyBytes?: number;
   /**
    * App-owned fulfillment handler. The webhook is verified before this runs.
    *
@@ -1117,40 +1136,59 @@ async function storageResponse(
   if (!key) return storageNotFoundResponse();
 
   const object = await storage.get(key);
-  if (object?.visibility !== "public") {
+  if (!object) {
     return storageNotFoundResponse();
   }
-
-  const headers = new Headers(resolveHeaders(options.headers, req));
-  headers.set("content-length", String(object.size));
-  headers.set("last-modified", object.lastModified.toUTCString());
-  if (!headers.has("x-content-type-options")) {
-    headers.set("x-content-type-options", "nosniff");
+  if (object.visibility !== "public") {
+    await object.cancel().catch(() => undefined);
+    return storageNotFoundResponse();
   }
 
-  if (object.contentType && !headers.has("content-type")) {
-    headers.set("content-type", object.contentType);
-  }
+  try {
+    const headers = new Headers(resolveHeaders(options.headers, req));
+    headers.set("content-length", String(object.size));
+    headers.set("last-modified", object.lastModified.toUTCString());
+    if (!headers.has("x-content-type-options")) {
+      headers.set("x-content-type-options", "nosniff");
+    }
 
-  if (!headers.has("content-disposition")) {
-    const contentDisposition = resolveStorageContentDisposition(
-      options,
-      req,
-      object,
-    );
-    if (contentDisposition) {
-      headers.set("content-disposition", contentDisposition);
+    if (object.contentType && !headers.has("content-type")) {
+      headers.set("content-type", object.contentType);
     }
-  }
 
-  if (object.cacheControl && !headers.has("cache-control")) {
-    headers.set("cache-control", object.cacheControl);
-  }
+    if (!headers.has("content-disposition")) {
+      const contentDisposition = resolveStorageContentDisposition(
+        options,
+        req,
+        object,
+      );
+      if (contentDisposition) {
+        headers.set("content-disposition", contentDisposition);
+      }
+    }
 
-  return new Response(includeBody ? object.stream() : null, {
-    status: 200,
-    headers,
-  });
+    if (object.cacheControl && !headers.has("cache-control")) {
+      headers.set("cache-control", object.cacheControl);
+    }
+
+    if (!includeBody) {
+      await object.cancel();
+      return new Response(null, { status: 200, headers });
+    }
+
+    const body = object.stream();
+    try {
+      return new Response(body, { status: 200, headers });
+    } catch (error) {
+      await body.cancel(error).catch(() => undefined);
+      throw error;
+    }
+  } catch (error) {
+    if (!object.bodyUsed) {
+      await object.cancel(error).catch(() => undefined);
+    }
+    throw error;
+  }
 }
 
 function currentRequestServer(req: Request): OpenAPIServer {
@@ -1399,6 +1437,7 @@ type OperationalErrorCode =
   | "CRON_SECRET_NOT_CONFIGURED"
   | "OUTBOX_DRAIN_FAILED"
   | "PAYMENT_WEBHOOK_BODY_READ_FAILED"
+  | "PAYMENT_WEBHOOK_BODY_TOO_LARGE"
   | "PAYMENT_WEBHOOK_CONTEXT_FAILED"
   | "PAYMENT_WEBHOOK_HANDLER_FAILED"
   | "PAYMENT_WEBHOOK_SIGNATURE_MISSING"
@@ -1406,6 +1445,7 @@ type OperationalErrorCode =
   | "SCHEDULE_FAILED"
   | "UNAUTHORIZED"
   | "WEBHOOK_BODY_READ_FAILED"
+  | "WEBHOOK_BODY_TOO_LARGE"
   | "WEBHOOK_CONTEXT_FAILED"
   | "WEBHOOK_HANDLER_FAILED"
   | "WEBHOOK_VERIFICATION_FAILED";
@@ -1448,14 +1488,94 @@ function toHttpResponseHeaders(
  * creation then receives a rehydrated request carrying the same method, URL,
  * headers, and raw body.
  */
-function toContextRequest(req: Request, rawBody: string): HttpRequestLike {
-  return toRequestLike(
-    new Request(req.url, {
-      method: req.method,
-      headers: req.headers,
-      body: rawBody,
-    }),
-  );
+function rehydrateWebhookRequest(req: Request, rawBody: string): Request {
+  return new Request(req.url, {
+    method: req.method,
+    headers: req.headers,
+    body: rawBody,
+    signal: req.signal,
+  });
+}
+
+const DEFAULT_WEBHOOK_BODY_MAX_BYTES = 1024 * 1024;
+
+class WebhookBodyTooLargeError extends Error {
+  constructor(readonly maxBytes: number) {
+    super("Webhook body exceeds the configured size limit.");
+    this.name = "WebhookBodyTooLargeError";
+  }
+}
+
+function webhookBodyLimit(maxBytes: number | undefined): number {
+  const resolved = maxBytes ?? DEFAULT_WEBHOOK_BODY_MAX_BYTES;
+  if (!Number.isFinite(resolved) || resolved <= 0) {
+    throw new Error("Webhook maxBodyBytes must be a positive number.");
+  }
+  return resolved;
+}
+
+function cancelWebhookBody(
+  source: { cancel(reason?: unknown): Promise<void> },
+  reason: unknown,
+): void {
+  try {
+    void source.cancel(reason).catch(() => {});
+  } catch {
+    // Cancellation is best-effort and must not replace the selected response.
+  }
+}
+
+function cancelWebhookRequestBody(req: HttpRequestLike, reason: unknown): void {
+  const body = req.raw?.body ?? nativeRequestOf(req).body;
+  if (body) cancelWebhookBody(body, reason);
+}
+
+async function readWebhookBody(
+  req: HttpRequestLike,
+  maxBytes: number,
+): Promise<string> {
+  const body = req.raw?.body ?? nativeRequestOf(req).body;
+  const contentLength = req.headers.get("content-length");
+
+  if (contentLength !== null) {
+    const declaredBytes = Number(contentLength);
+    if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+      const error = new WebhookBodyTooLargeError(maxBytes);
+      if (body) cancelWebhookBody(body, error);
+      throw error;
+    }
+  }
+
+  if (!body) {
+    const text = await req.text();
+    if (new TextEncoder().encode(text).byteLength > maxBytes) {
+      throw new WebhookBodyTooLargeError(maxBytes);
+    }
+    return text;
+  }
+
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let receivedBytes = 0;
+  let text = "";
+
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+
+      receivedBytes += result.value.byteLength;
+      if (receivedBytes > maxBytes) {
+        const error = new WebhookBodyTooLargeError(maxBytes);
+        cancelWebhookBody(reader, error);
+        throw error;
+      }
+      text += decoder.decode(result.value, { stream: true });
+    }
+    return text + decoder.decode();
+  } finally {
+    reader.releaseLock();
+  }
 }
 
 function headersToRecord(headers: Headers): Record<string, string> {
@@ -1955,8 +2075,9 @@ export function createOutboxDrainRoute<Ctx extends OutboxDrainContext>(
 /**
  * Create a Next.js POST handler for generic verified inbound webhooks.
  *
- * The route reads the raw request body as text, normalizes request headers,
- * builds app context from the real request through
+ * The route bounds and reads the raw request body before resolving the server,
+ * then normalizes request headers and builds app context from a rehydrated
+ * request through
  * `server.createRequestContext(...)`, verifies the event through the webhook
  * definition or a context-aware verifier, validates the matching event
  * payload schema, and delegates fulfillment to app code.
@@ -1970,28 +2091,43 @@ export function createWebhookRoute<
 ): {
   POST: (req: Request) => Promise<Response>;
 } {
+  const maxBodyBytes = webhookBodyLimit(options.maxBodyBytes);
+  const preflightBodies = new WeakMap<Request, string>();
+
   const handleWebhookRequest = async ({
     req,
     ctx,
+    rawBody: providedRawBody,
   }: {
     req: HttpRequestLike;
     ctx: Ctx;
+    rawBody?: string;
   }): Promise<Response> => {
     const nativeReq = nativeRequestOf(req);
     const headers = resolveHeaders(options.headers, nativeReq);
     const requestHeaders = headersToRecord(new Headers(req.headers));
 
-    let rawBody: string;
+    let rawBody = providedRawBody ?? preflightBodies.get(nativeReq);
+    preflightBodies.delete(nativeReq);
 
-    try {
-      rawBody = await req.text();
-    } catch {
-      return operationalErrorJson(
-        "WEBHOOK_BODY_READ_FAILED",
-        "Webhook body read failed.",
-        400,
-        headers,
-      );
+    if (rawBody === undefined) {
+      try {
+        rawBody = await readWebhookBody(req, maxBodyBytes);
+      } catch (error) {
+        return error instanceof WebhookBodyTooLargeError
+          ? operationalErrorJson(
+              "WEBHOOK_BODY_TOO_LARGE",
+              "Webhook body exceeds the configured size limit.",
+              413,
+              headers,
+            )
+          : operationalErrorJson(
+              "WEBHOOK_BODY_READ_FAILED",
+              "Webhook body read failed.",
+              400,
+              headers,
+            );
+      }
     }
 
     let event: WebhookRouteHandlerArgs<
@@ -2102,32 +2238,42 @@ export function createWebhookRoute<
 
   return {
     POST: async (req) => {
-      const server = await resolveServerSource(options.server);
-
-      const pipelined = runPipeline(server);
-      if (pipelined) return pipelined(req);
-
-      // Minimal servers without rawRoute(...) — usually test fakes — build
-      // context directly and run the same handler outside the hooks pipeline.
       const headers = resolveHeaders(options.headers, req);
 
       let rawBody: string;
       try {
-        rawBody = await req.text();
-      } catch {
-        return operationalErrorJson(
-          "WEBHOOK_BODY_READ_FAILED",
-          "Webhook body read failed.",
-          400,
-          headers,
-        );
+        rawBody = await readWebhookBody(toRequestLike(req), maxBodyBytes);
+      } catch (error) {
+        return error instanceof WebhookBodyTooLargeError
+          ? operationalErrorJson(
+              "WEBHOOK_BODY_TOO_LARGE",
+              "Webhook body exceeds the configured size limit.",
+              413,
+              headers,
+            )
+          : operationalErrorJson(
+              "WEBHOOK_BODY_READ_FAILED",
+              "Webhook body read failed.",
+              400,
+              headers,
+            );
+      }
+
+      const contextRequest = rehydrateWebhookRequest(req, rawBody);
+      const server = await resolveServerSource(options.server);
+      const pipelined = runPipeline(server);
+      if (pipelined) {
+        preflightBodies.set(contextRequest, rawBody);
+        return pipelined(contextRequest);
       }
 
-      const contextRequest = toContextRequest(req, rawBody);
+      // Minimal servers without rawRoute(...) — usually test fakes — build
+      // context directly and run the same handler outside the hooks pipeline.
+      const requestLike = toRequestLike(contextRequest);
 
       let ctx: Ctx;
       try {
-        ctx = await server.createRequestContext(contextRequest);
+        ctx = await server.createRequestContext(requestLike);
       } catch {
         return operationalErrorJson(
           "WEBHOOK_CONTEXT_FAILED",
@@ -2137,7 +2283,11 @@ export function createWebhookRoute<
         );
       }
 
-      return handleWebhookRequest({ req: toContextRequest(req, rawBody), ctx });
+      return handleWebhookRequest({
+        req: requestLike,
+        ctx,
+        rawBody,
+      });
     },
   };
 }
@@ -2145,8 +2295,9 @@ export function createWebhookRoute<
 /**
  * Create a Next.js POST handler for provider-verified payment webhooks.
  *
- * The route extracts the provider signature header, reads the raw request
- * body as text, builds app context from the real request through
+ * The route checks the provider signature header and bounds the raw request
+ * body before resolving the server, then builds app context from a rehydrated
+ * request through
  * `server.createRequestContext(...)`, verifies the event through
  * `ctx.ports.payments`, and then delegates fulfillment to app code. This is the canonical helper for Beignet
  * billing flows backed by `PaymentsPort`. Keep this route on the Node.js
@@ -2160,19 +2311,27 @@ export function createPaymentWebhookRoute<
   POST: (req: Request) => Promise<Response>;
 } {
   const signatureHeader = options.signatureHeader ?? "stripe-signature";
+  const maxBodyBytes = webhookBodyLimit(options.maxBodyBytes);
+  const preflightBodies = new WeakMap<Request, string>();
 
   const handlePaymentWebhook = async ({
     req,
     ctx,
+    rawBody: providedRawBody,
   }: {
     req: HttpRequestLike;
     ctx: Ctx;
+    rawBody?: string;
   }): Promise<Response> => {
     const nativeReq = nativeRequestOf(req);
     const headers = resolveHeaders(options.headers, nativeReq);
     const signature = new Headers(req.headers).get(signatureHeader);
 
     if (!signature) {
+      cancelWebhookRequestBody(
+        req,
+        new Error(`Missing ${signatureHeader} header.`),
+      );
       return operationalErrorJson(
         "PAYMENT_WEBHOOK_SIGNATURE_MISSING",
         `Missing ${signatureHeader} header.`,
@@ -2181,17 +2340,27 @@ export function createPaymentWebhookRoute<
       );
     }
 
-    let rawBody: string;
+    let rawBody = providedRawBody ?? preflightBodies.get(nativeReq);
+    preflightBodies.delete(nativeReq);
 
-    try {
-      rawBody = await req.text();
-    } catch {
-      return operationalErrorJson(
-        "PAYMENT_WEBHOOK_BODY_READ_FAILED",
-        "Payment webhook body read failed.",
-        400,
-        headers,
-      );
+    if (rawBody === undefined) {
+      try {
+        rawBody = await readWebhookBody(req, maxBodyBytes);
+      } catch (error) {
+        return error instanceof WebhookBodyTooLargeError
+          ? operationalErrorJson(
+              "PAYMENT_WEBHOOK_BODY_TOO_LARGE",
+              "Payment webhook body exceeds the configured size limit.",
+              413,
+              headers,
+            )
+          : operationalErrorJson(
+              "PAYMENT_WEBHOOK_BODY_READ_FAILED",
+              "Payment webhook body read failed.",
+              400,
+              headers,
+            );
+      }
     }
 
     let event: PaymentWebhookEvent;
@@ -2274,17 +2443,15 @@ export function createPaymentWebhookRoute<
 
   return {
     POST: async (req) => {
-      const server = await resolveServerSource(options.server);
-
-      const pipelined = runPipeline(server);
-      if (pipelined) return pipelined(req);
-
-      // Minimal servers without rawRoute(...) — usually test fakes — build
-      // context directly and run the same handler outside the hooks pipeline.
-      // The signature gate runs first so no context is created without one.
       const headers = resolveHeaders(options.headers, req);
 
       if (!req.headers.get(signatureHeader)) {
+        if (req.body) {
+          cancelWebhookBody(
+            req.body,
+            new Error(`Missing ${signatureHeader} header.`),
+          );
+        }
         return operationalErrorJson(
           "PAYMENT_WEBHOOK_SIGNATURE_MISSING",
           `Missing ${signatureHeader} header.`,
@@ -2295,19 +2462,38 @@ export function createPaymentWebhookRoute<
 
       let rawBody: string;
       try {
-        rawBody = await req.text();
-      } catch {
-        return operationalErrorJson(
-          "PAYMENT_WEBHOOK_BODY_READ_FAILED",
-          "Payment webhook body read failed.",
-          400,
-          headers,
-        );
+        rawBody = await readWebhookBody(toRequestLike(req), maxBodyBytes);
+      } catch (error) {
+        return error instanceof WebhookBodyTooLargeError
+          ? operationalErrorJson(
+              "PAYMENT_WEBHOOK_BODY_TOO_LARGE",
+              "Payment webhook body exceeds the configured size limit.",
+              413,
+              headers,
+            )
+          : operationalErrorJson(
+              "PAYMENT_WEBHOOK_BODY_READ_FAILED",
+              "Payment webhook body read failed.",
+              400,
+              headers,
+            );
+      }
+
+      const contextRequest = rehydrateWebhookRequest(req, rawBody);
+      const server = await resolveServerSource(options.server);
+      const pipelined = runPipeline(server);
+      if (pipelined) {
+        preflightBodies.set(contextRequest, rawBody);
+        return pipelined(contextRequest);
       }
 
+      // Minimal servers without rawRoute(...) — usually test fakes — build
+      // context directly and run the same handler outside the hooks pipeline.
+      const requestLike = toRequestLike(contextRequest);
+
       let ctx: Ctx;
       try {
-        ctx = await server.createRequestContext(toContextRequest(req, rawBody));
+        ctx = await server.createRequestContext(requestLike);
       } catch {
         return operationalErrorJson(
           "PAYMENT_WEBHOOK_CONTEXT_FAILED",
@@ -2317,7 +2503,11 @@ export function createPaymentWebhookRoute<
         );
       }
 
-      return handlePaymentWebhook({ req: toContextRequest(req, rawBody), ctx });
+      return handlePaymentWebhook({
+        req: requestLike,
+        ctx,
+        rawBody,
+      });
     },
   };
 }