@c9up/ream 0.2.12 → 0.2.14

package/src/index.ts

@@ -101,7 +101,7 @@ export { default as SessionMiddleware } from './session/SessionMiddleware.js'
 
 export type { BodyParserConfig } from './bodyparser/BodyParserMiddleware.js'
 export { default as BodyParserMiddleware } from './bodyparser/BodyParserMiddleware.js'
-export type { FileValidationOptions } from './bodyparser/MultipartFile.js'
+export type { FileValidationOptions, MimeType } from './bodyparser/MultipartFile.js'
 export { MultipartFile } from './bodyparser/MultipartFile.js'
 
 // ─── JSON-RPC ───────────────────────────────────────────────
@@ -286,7 +286,7 @@ export {
 export type { PipelineStageName } from './errors/PipelineStageError.js'
 export {
   createPipelineError,
-  E_PIPELINE_STAGES,
+  PIPELINE_STAGES,
   validatePipelineConfig,
 } from './errors/PipelineStageError.js'
 export { isReamError, ReamError } from './errors/ReamError.js'
@@ -378,4 +378,4 @@ export {
   StatsTracker,
 } from './scheduler/index.js'
 
-export const VERSION = '0.2.12'
+export const VERSION = '0.2.14'

package/src/storage/StaticMiddleware.ts

@@ -9,10 +9,13 @@
  * @implements MISS-25
  */
 
-import { createHash } from 'node:crypto'
 import * as fs from 'node:fs'
+import type { FileHandle } from 'node:fs/promises'
+import * as fsp from 'node:fs/promises'
 import * as path from 'node:path'
+import { matchesIfNoneMatch, statTag } from '../http/etag.js'
 import type { HttpContext } from '../http/HttpContext.js'
+import { contentType } from '../http/mime.js'
 
 export interface StaticConfig {
   /** Root directory to serve files from. */
@@ -51,32 +54,6 @@ const DEFAULT_EXTENSIONS = [
   '.zip',
 ]
 
-const MIME_TYPES: Record<string, string> = {
-  '.html': 'text/html',
-  '.css': 'text/css',
-  '.js': 'application/javascript',
-  '.json': 'application/json',
-  '.xml': 'application/xml',
-  '.txt': 'text/plain',
-  '.png': 'image/png',
-  '.jpg': 'image/jpeg',
-  '.jpeg': 'image/jpeg',
-  '.gif': 'image/gif',
-  '.svg': 'image/svg+xml',
-  '.ico': 'image/x-icon',
-  '.webp': 'image/webp',
-  '.woff': 'font/woff',
-  '.woff2': 'font/woff2',
-  '.ttf': 'font/ttf',
-  '.eot': 'application/vnd.ms-fontobject',
-  '.mp4': 'video/mp4',
-  '.webm': 'video/webm',
-  '.mp3': 'audio/mpeg',
-  '.ogg': 'audio/ogg',
-  '.pdf': 'application/pdf',
-  '.zip': 'application/zip',
-}
-
 export class StaticMiddleware {
   #root: string
   #prefix: string
@@ -95,46 +72,65 @@ export class StaticMiddleware {
       return next()
     }
 
-    const resolved = this.#resolveServableFile(ctx.request.path())
+    const resolved = await this.#openServableFile(ctx.request.path())
     if (!resolved) return next()
-    const { realFilePath, ext, stat } = resolved
-
-    const etag = createHash('md5').update(`${stat.size}-${stat.mtimeMs}`).digest('hex')
-
-    // ETag check — 304 Not Modified
-    const ifNoneMatch = ctx.request.header('if-none-match')
-    if (ifNoneMatch === etag) {
-      ctx.response.status(304)
-      return
-    }
+    const { handle, ext, stat } = resolved
 
-    const mime = MIME_TYPES[ext] ?? 'application/octet-stream'
-    ctx.response.header('Content-Type', mime)
-    ctx.response.header('Content-Length', String(stat.size))
-    ctx.response.header('Cache-Control', `public, max-age=${this.#maxAge}`)
-    ctx.response.header('ETag', etag)
-
-    if (ctx.request.method() === 'HEAD') {
+    // The handle is ours until the read stream takes it; every path that does
+    // not hand it over closes it, or the process leaks a descriptor per 304.
+    let owned = true
+    try {
+      const etag = statTag(stat)
+
+      if (matchesIfNoneMatch(ctx.request.header('if-none-match'), etag)) {
+        ctx.response.status(304)
+        return
+      }
+
+      // One table for the whole package (`src/http/mime.ts`), generated from
+      // mime-db. A second hand-written one here is how `.js` came to be
+      // served as `application/javascript` from one code path and
+      // `text/javascript` from the other.
+      ctx.response.header('Content-Type', contentType(ext) || 'application/octet-stream')
+      ctx.response.header('Content-Length', String(stat.size))
+      ctx.response.header('Cache-Control', `public, max-age=${this.#maxAge}`)
+      ctx.response.header('ETag', etag)
+
+      if (ctx.request.method() === 'HEAD') {
+        ctx.response.status(200)
+        return
+      }
+
+      // Streamed, not read whole.
+      //
+      // `readFileSync` stalled the event loop for EVERY concurrent request
+      // while one client asked for a file, and the allowed extensions include
+      // `.mp4`, `.zip` and `.pdf` — so one large asset became every other
+      // request's latency, and each request allocated the file again. The
+      // stream applies backpressure and holds one chunk at a time.
+      //
+      // The read stream owns the handle from here and closes it at end.
       ctx.response.status(200)
-      return
+      owned = false
+      await ctx.response.stream(handle.createReadStream())
+    } finally {
+      if (owned) await handle.close().catch(() => {})
     }
-
-    // Send the raw Buffer — `content.toString()` would interpret PNG /
-    // PDF / ZIP bytes as UTF-8 and replace any byte the encoding can't
-    // round-trip (anything in the surrogate range, plus invalid
-    // sequences) with U+FFFD.
-    const content = fs.readFileSync(realFilePath)
-    ctx.response.status(200).sendBuffer(content)
   }
 
   /**
-   * Resolve a request path to a real, in-root, existing file, or `null` when it
-   * is not servable (wrong prefix/extension, outside the root, missing, or a
-   * symlink escaping the root). Returning `null` tells `handle` to call `next()`.
+   * Open a request path as a real, in-root, regular file, or answer `null`
+   * when it is not servable (wrong prefix/extension, outside the root,
+   * missing, or a symlink escaping the root). `null` tells `handle` to call
+   * `next()`.
+   *
+   * The file is OPENED here rather than merely checked, and its metadata read
+   * from the descriptor: what gets served is then the same file that passed
+   * the checks, which a path re-read after the fact cannot promise.
    */
-  #resolveServableFile(
+  async #openServableFile(
     reqPath: string,
-  ): { realFilePath: string; ext: string; stat: fs.Stats } | null {
+  ): Promise<{ handle: FileHandle; ext: string; stat: fs.Stats } | null> {
     // Match only when the prefix is followed by `/` or end-of-path —
     // otherwise `/staticx/foo.js` would be intercepted when the configured
     // prefix is `/static`, hijacking unrelated routes.
@@ -152,7 +148,7 @@ export class StaticMiddleware {
     // Two containment checks. The first uses `path.sep` to reject sibling
     // directories with a shared prefix (`/var/www-static-secret` slipping
     // past a guard for `/var/www-static`). The second resolves symlinks
-    // via realpathSync so a symlink planted inside the root cannot point
+    // via realpath so a symlink planted inside the root cannot point
     // outside it. We do realpath AFTER the lexical check so a non-existent
     // path returns `next()` rather than throwing.
     const rootWithSep = this.#root.endsWith(path.sep) ? this.#root : this.#root + path.sep
@@ -160,15 +156,11 @@ export class StaticMiddleware {
       return null
     }
 
-    if (!fs.existsSync(filePath) || !fs.statSync(filePath).isFile()) {
-      return null
-    }
-
     let realFilePath: string
     let realRoot: string
     try {
-      realFilePath = fs.realpathSync(filePath)
-      realRoot = fs.realpathSync(this.#root)
+      realFilePath = await fsp.realpath(filePath)
+      realRoot = await fsp.realpath(this.#root)
     } catch {
       return null
     }
@@ -177,6 +169,29 @@ export class StaticMiddleware {
       return null
     }
 
-    return { realFilePath, ext, stat: fs.statSync(realFilePath) }
+    // O_NOFOLLOW closes the window the checks above leave open: between
+    // `realpath` and the read, the last path component can be replaced by a
+    // symlink pointing anywhere, and a read by name follows it. Refusing to
+    // follow a link at open time makes that swap fail the open instead of
+    // serving a file outside the root. A parent directory swapped in the same
+    // window is not covered — that needs openat(), which Node does not expose.
+    let handle: FileHandle
+    try {
+      handle = await fsp.open(realFilePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW)
+    } catch {
+      return null
+    }
+
+    try {
+      const stat = await handle.stat()
+      if (!stat.isFile()) {
+        await handle.close()
+        return null
+      }
+      return { handle, ext, stat }
+    } catch {
+      await handle.close().catch(() => {})
+      return null
+    }
   }
 }