@bymax-one/nest-core 1.6.5 → 1.6.7

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { Catch, Inject, Optional, Injectable, ConfigurableModuleBuilder, Module, HttpException, Logger, Get, Res, Controller, Req, HttpStatus, UnauthorizedException, NotFoundException } from '@nestjs/common';
+import { Injectable, Inject, Catch, Optional, ConfigurableModuleBuilder, Module, BadRequestException, HttpException, Logger, Get, Res, Controller, Req, HttpStatus, UnauthorizedException, NotFoundException } from '@nestjs/common';
 import { HttpAdapterHost, DiscoveryService, Reflector, BaseExceptionFilter, APP_FILTER, DiscoveryModule } from '@nestjs/core';
 import { createHash, timingSafeEqual } from 'crypto';
 import { AsyncResource } from 'async_hooks';
@@ -16,6 +16,114 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
+// src/core.tokens.ts
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
+var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:correlation-provider"
+);
+var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
+var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-indicators"
+);
+var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-transition-sink"
+);
+var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:unexpected-error-sink"
+);
+var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:metrics-registry"
+);
+var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
+
+// src/envelope/error-codes.ts
+var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
+var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
+var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
+var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
+var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
+var BYMAX_CONFLICT = "BYMAX_CONFLICT";
+var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
+var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
+var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
+var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
+var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
+var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
+var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
+var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
+var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
+var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
+var STATUS_CODES = /* @__PURE__ */ new Map([
+  [400, BYMAX_BAD_REQUEST],
+  [401, BYMAX_UNAUTHORIZED],
+  [403, BYMAX_FORBIDDEN],
+  [404, BYMAX_NOT_FOUND],
+  [409, BYMAX_CONFLICT],
+  [413, BYMAX_PAYLOAD_TOO_LARGE],
+  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
+  [422, BYMAX_UNPROCESSABLE_ENTITY],
+  [429, BYMAX_TOO_MANY_REQUESTS],
+  [500, BYMAX_INTERNAL_ERROR],
+  [501, BYMAX_NOT_IMPLEMENTED],
+  [502, BYMAX_BAD_GATEWAY],
+  [503, BYMAX_SERVICE_UNAVAILABLE],
+  [504, BYMAX_GATEWAY_TIMEOUT]
+]);
+var CLIENT_ERROR_MIN = 400;
+var CLIENT_ERROR_MAX = 500;
+function codeForStatus(status) {
+  const catalogued = STATUS_CODES.get(status);
+  if (catalogued !== void 0) {
+    return catalogued;
+  }
+  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
+    return BYMAX_CLIENT_ERROR;
+  }
+  return BYMAX_INTERNAL_ERROR;
+}
+
+// src/body-depth/body-depth.middleware.ts
+var BODY_TOO_DEEP_MESSAGE = "Request body is nested too deeply";
+function exceedsDepth(value, maxDepth) {
+  let level = [value];
+  for (let depth = 0; level.length > 0; depth += 1) {
+    const next = [];
+    for (const node of level) {
+      if (typeof node === "object" && node !== null) {
+        if (depth >= maxDepth) {
+          return true;
+        }
+        for (const child of Object.values(node)) {
+          next.push(child);
+        }
+      }
+    }
+    level = next;
+  }
+  return false;
+}
+var BymaxBodyDepthMiddleware = class {
+  constructor(options) {
+    this.options = options;
+  }
+  /**
+   * @param req - The request, whose `body` the parser has already filled.
+   * @param _res - Unused.
+   * @param next - Continues the chain.
+   * @throws BadRequestException When the body is nested too deeply.
+   */
+  use(req, _res, next) {
+    if (exceedsDepth(req.body, this.options.bodyDepth.maxDepth)) {
+      throw new BadRequestException({ code: BYMAX_BAD_REQUEST, message: BODY_TOO_DEEP_MESSAGE });
+    }
+    next();
+  }
+};
+BymaxBodyDepthMiddleware = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(BYMAX_CORE_OPTIONS))
+], BymaxBodyDepthMiddleware);
+
 // src/route-defaults.ts
 var DEFAULT_HEALTH_PATH = "health";
 var DEFAULT_METRICS_PATH = "metrics";
@@ -62,6 +170,16 @@ function resolveTiming(raw) {
   const threshold = raw?.slowRequestThresholdMs;
   return threshold === void 0 ? { enabled } : { enabled, slowRequestThresholdMs: threshold };
 }
+var DEFAULT_MAX_BODY_DEPTH = 32;
+function resolveBodyDepth(raw) {
+  const maxDepth = raw?.maxDepth ?? DEFAULT_MAX_BODY_DEPTH;
+  if (!Number.isSafeInteger(maxDepth) || maxDepth < 1) {
+    throw new Error(
+      `bodyDepth.maxDepth must be a positive safe integer, received ${String(maxDepth)}`
+    );
+  }
+  return { enabled: raw?.enabled ?? false, maxDepth };
+}
 function resolveHealth(raw) {
   return {
     enabled: raw?.enabled ?? true,
@@ -134,6 +252,7 @@ function normalizeCoreOptions(raw) {
   return deepFreeze({
     envelope: resolveEnvelope(raw?.envelope),
     timing: resolveTiming(raw?.timing),
+    bodyDepth: resolveBodyDepth(raw?.bodyDepth),
     health: resolveHealth(raw?.health),
     metrics: resolveMetrics(raw?.metrics),
     openapi: resolveOpenApi(raw?.openapi, raw?.environment),
@@ -146,26 +265,6 @@ function normalizeCoreOptions(raw) {
 }
 normalizeCoreOptions();
 
-// src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
-var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:correlation-provider"
-);
-var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
-var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-indicators"
-);
-var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-transition-sink"
-);
-var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:unexpected-error-sink"
-);
-var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:metrics-registry"
-);
-var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
-
 // src/optional-peer.ts
 function isMissingModuleError(cause) {
   const code = cause.code;
@@ -273,52 +372,6 @@ function containRejection(returned, onFailure) {
   }
 }
 
-// src/envelope/error-codes.ts
-var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
-var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
-var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
-var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
-var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
-var BYMAX_CONFLICT = "BYMAX_CONFLICT";
-var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
-var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
-var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
-var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
-var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
-var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
-var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
-var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
-var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
-var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
-var STATUS_CODES = /* @__PURE__ */ new Map([
-  [400, BYMAX_BAD_REQUEST],
-  [401, BYMAX_UNAUTHORIZED],
-  [403, BYMAX_FORBIDDEN],
-  [404, BYMAX_NOT_FOUND],
-  [409, BYMAX_CONFLICT],
-  [413, BYMAX_PAYLOAD_TOO_LARGE],
-  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
-  [422, BYMAX_UNPROCESSABLE_ENTITY],
-  [429, BYMAX_TOO_MANY_REQUESTS],
-  [500, BYMAX_INTERNAL_ERROR],
-  [501, BYMAX_NOT_IMPLEMENTED],
-  [502, BYMAX_BAD_GATEWAY],
-  [503, BYMAX_SERVICE_UNAVAILABLE],
-  [504, BYMAX_GATEWAY_TIMEOUT]
-]);
-var CLIENT_ERROR_MIN = 400;
-var CLIENT_ERROR_MAX = 500;
-function codeForStatus(status) {
-  const catalogued = STATUS_CODES.get(status);
-  if (catalogued !== void 0) {
-    return catalogued;
-  }
-  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
-    return BYMAX_CLIENT_ERROR;
-  }
-  return BYMAX_INTERNAL_ERROR;
-}
-
 // src/envelope/error-envelope.ts
 function buildErrorEnvelope(input) {
   const base = {
@@ -357,6 +410,12 @@ function extractRequestInfo(context) {
 var INTERNAL_ERROR_STATUS = 500;
 var INTERNAL_ERROR_MESSAGE = "Internal server error";
 var VALIDATION_FAILED_MESSAGE = "Validation failed";
+var MALFORMED_REQUEST_MESSAGE = "Malformed request";
+var PRE_ROUTING_MESSAGES = /* @__PURE__ */ new Map([
+  [400, MALFORMED_REQUEST_MESSAGE],
+  [413, "Request entity too large"],
+  [415, "Unsupported media type"]
+]);
 var ABSOLUTE_FORM_PREFIX = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
 function pathOf(url) {
   let target = String(url);
@@ -407,8 +466,9 @@ function resolveExposedClientError(exception) {
   if (typeof status !== "number" || !Number.isInteger(status) || status < CLIENT_ERROR_MIN2 || status >= CLIENT_ERROR_MAX2) {
     return void 0;
   }
+  const fixed = typeof candidate.type === "string" ? PRE_ROUTING_MESSAGES.get(status) : void 0;
   const message = exception instanceof Error ? exception.message : "";
-  return { status, message: message === "" ? INTERNAL_ERROR_MESSAGE : message };
+  return { status, message: fixed ?? (message === "" ? INTERNAL_ERROR_MESSAGE : message) };
 }
 function isValidationResponse(response) {
   return typeof response === "object" && response !== null && "message" in response && Array.isArray(response.message);
@@ -609,6 +669,9 @@ var BymaxExceptionFilter = class {
         toValidationDetails(response.message)
       );
     }
+    if (status === 400 && readRequestInfo(request).route === UNMATCHED_ROUTE) {
+      return this.toEnvelope(status, codeForStatus(status), MALFORMED_REQUEST_MESSAGE, context);
+    }
     const message = extractHttpMessage(response, exception);
     const rawUrl = String(this.adapterHost.httpAdapter.getRequestUrl(request));
     return this.toEnvelope(
@@ -1685,12 +1748,14 @@ var BymaxCoreModule = class extends BymaxCoreModuleBase {
    * @param consumer - Nest's middleware consumer.
    */
   configure(consumer) {
-    if (!this.resolved.timing.enabled) {
-      return;
-    }
     const adapter = this.adapterHost?.httpAdapter;
-    const onFastify = bridgeFastifyRouteMetadata(adapter);
-    consumer.apply(BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    if (this.resolved.timing.enabled) {
+      const onFastify = bridgeFastifyRouteMetadata(adapter);
+      consumer.apply(BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    }
+    if (this.resolved.bodyDepth.enabled && adapter?.getType?.() !== "fastify") {
+      consumer.apply(BymaxBodyDepthMiddleware).forRoutes("/");
+    }
   }
   /**
    * Register the module synchronously. Options are known now, so disabled
@@ -1882,4 +1947,4 @@ TimingInterceptor = __decorateClass([
   __decorateParam(3, Inject(BYMAX_TRACE_CONTEXT))
 ], TimingInterceptor);
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxBodyDepthMiddleware, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-core",
-  "version": "1.6.5",
+  "version": "1.6.7",
   "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing middleware, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -63,6 +63,16 @@
         "default": "./dist/metrics/index.cjs"
       }
     },
+    "./http": {
+      "import": {
+        "types": "./dist/http/index.d.ts",
+        "default": "./dist/http/index.mjs"
+      },
+      "require": {
+        "types": "./dist/http/index.d.cts",
+        "default": "./dist/http/index.cjs"
+      }
+    },
     "./openapi": {
       "import": {
         "types": "./dist/openapi/index.d.ts",
@@ -77,6 +87,7 @@
   },
   "scripts": {
     "build": "pnpm clean && tsup",
+    "check:file-length": "node scripts/check-file-length.mjs",
     "check:exports": "attw --pack . --profile strict",
     "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
@@ -94,8 +105,8 @@
     "size": "node scripts/check-size.mjs",
     "test": "jest",
     "test:cov": "jest --coverage",
-    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
-    "test:e2e": "jest --config jest.e2e.config.ts",
+    "test:cov:all": "node --experimental-vm-modules --disable-warning=ExperimentalWarning node_modules/jest/bin/jest.js --config jest.coverage.config.ts --coverage",
+    "test:e2e": "node --experimental-vm-modules --disable-warning=ExperimentalWarning node_modules/jest/bin/jest.js --config jest.e2e.config.ts",
     "test:watch": "jest --watch",
     "typecheck": "tsc --noEmit"
   },
@@ -113,6 +124,7 @@
     "@nestjs/core": "^11.1.18",
     "@nestjs/swagger": "^11.0.0",
     "@opentelemetry/api": "^1.9.0",
+    "helmet": "^8.0.0",
     "prom-client": "^15.0.0",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.0.0"
@@ -124,6 +136,9 @@
     "@opentelemetry/api": {
       "optional": true
     },
+    "helmet": {
+      "optional": true
+    },
     "prom-client": {
       "optional": true
     }
@@ -150,6 +165,8 @@
     "@types/supertest": "^7.2.0",
     "@typescript-eslint/eslint-plugin": "^8.59.3",
     "@typescript-eslint/parser": "^8.59.3",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
@@ -158,6 +175,7 @@
     "eslint-plugin-security": "^4.0.0",
     "fastify": "^5.12.5",
     "globals": "^17.6.0",
+    "helmet": "^8.3.0",
     "husky": "^9.1.7",
     "jest": "^30.4.2",
     "lint-staged": "^17.2.0",
@@ -182,6 +200,7 @@
     "metrics",
     "openapi",
     "swagger",
+    "helmet",
     "opentelemetry",
     "tracing",
     "typescript"
@@ -209,6 +228,9 @@
       ],
       "metrics": [
         "./dist/metrics/index.d.cts"
+      ],
+      "http": [
+        "./dist/http/index.d.cts"
       ]
     }
   }