@c9up/ream 0.2.27 → 0.2.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (195) hide show
  1. package/README.md +1 -0
  2. package/dist/Codemods.d.ts +16 -0
  3. package/dist/Codemods.d.ts.map +1 -1
  4. package/dist/Codemods.js +182 -0
  5. package/dist/Codemods.js.map +1 -1
  6. package/dist/Ignitor.d.ts +11 -1
  7. package/dist/Ignitor.d.ts.map +1 -1
  8. package/dist/Ignitor.js +27 -21
  9. package/dist/Ignitor.js.map +1 -1
  10. package/dist/bodyparser/BodyParserMiddleware.d.ts.map +1 -1
  11. package/dist/bodyparser/BodyParserMiddleware.js +3 -0
  12. package/dist/bodyparser/BodyParserMiddleware.js.map +1 -1
  13. package/dist/bodyparser/qsParse.d.ts +10 -1
  14. package/dist/bodyparser/qsParse.d.ts.map +1 -1
  15. package/dist/bodyparser/qsParse.js +53 -15
  16. package/dist/bodyparser/qsParse.js.map +1 -1
  17. package/dist/codemods/source.d.ts +57 -0
  18. package/dist/codemods/source.d.ts.map +1 -0
  19. package/dist/codemods/source.js +282 -0
  20. package/dist/codemods/source.js.map +1 -0
  21. package/dist/graphql/GraphQLEngine.d.ts.map +1 -1
  22. package/dist/graphql/GraphQLEngine.js +3 -2
  23. package/dist/graphql/GraphQLEngine.js.map +1 -1
  24. package/dist/http/Exception.d.ts +14 -1
  25. package/dist/http/Exception.d.ts.map +1 -1
  26. package/dist/http/Exception.js +10 -2
  27. package/dist/http/Exception.js.map +1 -1
  28. package/dist/http/HttpContext.d.ts +11 -0
  29. package/dist/http/HttpContext.d.ts.map +1 -1
  30. package/dist/http/HttpContext.js +2 -1
  31. package/dist/http/HttpContext.js.map +1 -1
  32. package/dist/http/RedirectBuilder.d.ts +9 -3
  33. package/dist/http/RedirectBuilder.d.ts.map +1 -1
  34. package/dist/http/RedirectBuilder.js +39 -37
  35. package/dist/http/RedirectBuilder.js.map +1 -1
  36. package/dist/http/Request.d.ts +42 -17
  37. package/dist/http/Request.d.ts.map +1 -1
  38. package/dist/http/Request.js +65 -29
  39. package/dist/http/Request.js.map +1 -1
  40. package/dist/http/SseStream.js +6 -7
  41. package/dist/http/SseStream.js.map +1 -1
  42. package/dist/http/permissions.d.ts +19 -0
  43. package/dist/http/permissions.d.ts.map +1 -0
  44. package/dist/http/permissions.js +28 -0
  45. package/dist/http/permissions.js.map +1 -0
  46. package/dist/http-client/HttpClient.d.ts +111 -0
  47. package/dist/http-client/HttpClient.d.ts.map +1 -0
  48. package/dist/http-client/HttpClient.js +386 -0
  49. package/dist/http-client/HttpClient.js.map +1 -0
  50. package/dist/http-client/addresses.d.ts +14 -0
  51. package/dist/http-client/addresses.d.ts.map +1 -0
  52. package/dist/http-client/addresses.js +57 -0
  53. package/dist/http-client/addresses.js.map +1 -0
  54. package/dist/http-client/fake.d.ts +50 -0
  55. package/dist/http-client/fake.d.ts.map +1 -0
  56. package/dist/http-client/fake.js +95 -0
  57. package/dist/http-client/fake.js.map +1 -0
  58. package/dist/http-client/index.d.ts +7 -0
  59. package/dist/http-client/index.d.ts.map +1 -0
  60. package/dist/http-client/index.js +7 -0
  61. package/dist/http-client/index.js.map +1 -0
  62. package/dist/index.d.ts +5 -4
  63. package/dist/index.d.ts.map +1 -1
  64. package/dist/index.js +2 -2
  65. package/dist/index.js.map +1 -1
  66. package/dist/middleware/Pipeline.d.ts.map +1 -1
  67. package/dist/middleware/Pipeline.js +6 -3
  68. package/dist/middleware/Pipeline.js.map +1 -1
  69. package/dist/native/generated.d.ts +108 -3
  70. package/dist/native/generated.d.ts.map +1 -1
  71. package/dist/rpc/RpcProvider.d.ts +6 -0
  72. package/dist/rpc/RpcProvider.d.ts.map +1 -1
  73. package/dist/rpc/RpcProvider.js +4 -1
  74. package/dist/rpc/RpcProvider.js.map +1 -1
  75. package/dist/rpc/RpcRouter.d.ts +27 -14
  76. package/dist/rpc/RpcRouter.d.ts.map +1 -1
  77. package/dist/rpc/RpcRouter.js +95 -38
  78. package/dist/rpc/RpcRouter.js.map +1 -1
  79. package/dist/scheduler/locks/RedisLockBackend.d.ts.map +1 -1
  80. package/dist/scheduler/locks/RedisLockBackend.js +13 -2
  81. package/dist/scheduler/locks/RedisLockBackend.js.map +1 -1
  82. package/dist/security/CookieSigner.d.ts.map +1 -1
  83. package/dist/security/CookieSigner.js +17 -3
  84. package/dist/security/CookieSigner.js.map +1 -1
  85. package/dist/security/SignedUrl.d.ts.map +1 -1
  86. package/dist/security/SignedUrl.js +6 -1
  87. package/dist/security/SignedUrl.js.map +1 -1
  88. package/dist/server/Server.d.ts +75 -9
  89. package/dist/server/Server.d.ts.map +1 -1
  90. package/dist/server/Server.js +60 -9
  91. package/dist/server/Server.js.map +1 -1
  92. package/dist/server/nativeGrpc.d.ts +27 -0
  93. package/dist/server/nativeGrpc.d.ts.map +1 -0
  94. package/dist/server/nativeGrpc.js +47 -0
  95. package/dist/server/nativeGrpc.js.map +1 -0
  96. package/dist/server/nativeLimits.d.ts +49 -0
  97. package/dist/server/nativeLimits.d.ts.map +1 -0
  98. package/dist/server/nativeLimits.js +67 -0
  99. package/dist/server/nativeLimits.js.map +1 -0
  100. package/dist/session/Session.d.ts +45 -0
  101. package/dist/session/Session.d.ts.map +1 -1
  102. package/dist/session/Session.js +31 -2
  103. package/dist/session/Session.js.map +1 -1
  104. package/dist/session/SessionMiddleware.d.ts.map +1 -1
  105. package/dist/session/SessionMiddleware.js +52 -13
  106. package/dist/session/SessionMiddleware.js.map +1 -1
  107. package/dist/session/config.d.ts +5 -0
  108. package/dist/session/config.d.ts.map +1 -1
  109. package/dist/session/config.js +8 -0
  110. package/dist/session/config.js.map +1 -1
  111. package/dist/session/drivers/CookieDriver.d.ts +12 -3
  112. package/dist/session/drivers/CookieDriver.d.ts.map +1 -1
  113. package/dist/session/drivers/CookieDriver.js +20 -6
  114. package/dist/session/drivers/CookieDriver.js.map +1 -1
  115. package/dist/session/drivers/DatabaseDriver.d.ts +2 -0
  116. package/dist/session/drivers/DatabaseDriver.d.ts.map +1 -1
  117. package/dist/session/drivers/DatabaseDriver.js +6 -0
  118. package/dist/session/drivers/DatabaseDriver.js.map +1 -1
  119. package/dist/session/drivers/FileDriver.d.ts +8 -0
  120. package/dist/session/drivers/FileDriver.d.ts.map +1 -1
  121. package/dist/session/drivers/FileDriver.js +85 -11
  122. package/dist/session/drivers/FileDriver.js.map +1 -1
  123. package/dist/session/drivers/MemoryDriver.d.ts +2 -0
  124. package/dist/session/drivers/MemoryDriver.d.ts.map +1 -1
  125. package/dist/session/drivers/MemoryDriver.js +21 -5
  126. package/dist/session/drivers/MemoryDriver.js.map +1 -1
  127. package/dist/session/drivers/RedisDriver.d.ts +2 -0
  128. package/dist/session/drivers/RedisDriver.d.ts.map +1 -1
  129. package/dist/session/drivers/RedisDriver.js +6 -0
  130. package/dist/session/drivers/RedisDriver.js.map +1 -1
  131. package/dist/session/errors.d.ts +27 -0
  132. package/dist/session/errors.d.ts.map +1 -1
  133. package/dist/session/errors.js +33 -0
  134. package/dist/session/errors.js.map +1 -1
  135. package/dist/session/templateTags.d.ts +14 -0
  136. package/dist/session/templateTags.d.ts.map +1 -1
  137. package/dist/session/templateTags.js +45 -17
  138. package/dist/session/templateTags.js.map +1 -1
  139. package/dist/storage/StaticMiddleware.d.ts.map +1 -1
  140. package/dist/storage/StaticMiddleware.js +29 -18
  141. package/dist/storage/StaticMiddleware.js.map +1 -1
  142. package/events.darwin-arm64.node +0 -0
  143. package/events.darwin-x64.node +0 -0
  144. package/events.linux-arm64-gnu.node +0 -0
  145. package/events.linux-x64-gnu.node +0 -0
  146. package/events.win32-x64-msvc.node +0 -0
  147. package/index.darwin-arm64.node +0 -0
  148. package/index.darwin-x64.node +0 -0
  149. package/index.linux-arm64-gnu.node +0 -0
  150. package/index.linux-x64-gnu.node +0 -0
  151. package/index.win32-x64-msvc.node +0 -0
  152. package/package.json +11 -2
  153. package/scheduler.darwin-arm64.node +0 -0
  154. package/scheduler.darwin-x64.node +0 -0
  155. package/scheduler.linux-arm64-gnu.node +0 -0
  156. package/scheduler.linux-x64-gnu.node +0 -0
  157. package/scheduler.win32-x64-msvc.node +0 -0
  158. package/src/Codemods.ts +265 -0
  159. package/src/Ignitor.ts +48 -20
  160. package/src/bodyparser/BodyParserMiddleware.ts +3 -0
  161. package/src/bodyparser/qsParse.ts +69 -14
  162. package/src/codemods/source.ts +303 -0
  163. package/src/graphql/GraphQLEngine.ts +3 -2
  164. package/src/http/Exception.ts +17 -2
  165. package/src/http/HttpContext.ts +14 -1
  166. package/src/http/RedirectBuilder.ts +48 -37
  167. package/src/http/Request.ts +87 -29
  168. package/src/http/SseStream.ts +6 -7
  169. package/src/http/permissions.ts +31 -0
  170. package/src/http-client/HttpClient.ts +505 -0
  171. package/src/http-client/addresses.ts +58 -0
  172. package/src/http-client/fake.ts +141 -0
  173. package/src/http-client/index.ts +21 -0
  174. package/src/index.ts +9 -1
  175. package/src/middleware/Pipeline.ts +7 -3
  176. package/src/native/generated.ts +123 -3
  177. package/src/rpc/RpcProvider.ts +10 -1
  178. package/src/rpc/RpcRouter.ts +126 -42
  179. package/src/scheduler/locks/RedisLockBackend.ts +12 -4
  180. package/src/security/CookieSigner.ts +17 -3
  181. package/src/security/SignedUrl.ts +6 -1
  182. package/src/server/Server.ts +103 -9
  183. package/src/server/nativeGrpc.ts +59 -0
  184. package/src/server/nativeLimits.ts +94 -0
  185. package/src/session/Session.ts +72 -2
  186. package/src/session/SessionMiddleware.ts +53 -14
  187. package/src/session/config.ts +7 -0
  188. package/src/session/drivers/CookieDriver.ts +21 -6
  189. package/src/session/drivers/DatabaseDriver.ts +10 -0
  190. package/src/session/drivers/FileDriver.ts +91 -11
  191. package/src/session/drivers/MemoryDriver.ts +20 -5
  192. package/src/session/drivers/RedisDriver.ts +7 -0
  193. package/src/session/errors.ts +48 -0
  194. package/src/session/templateTags.ts +57 -0
  195. package/src/storage/StaticMiddleware.ts +28 -18
@@ -1 +1 @@
1
- {"version":3,"file":"HttpContext.js","sourceRoot":"","sources":["../../src/http/HttpContext.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAQpD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAmHxC,+EAA+E;AAC/E,SAAS,aAAa,CAAC,aAAqB;IAC1C,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,IAA8B,EAAQ,EAAE;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,aAAa,KAAK,OAAO,GAAG,IAAI,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAA;IACD,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;KACtC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,IAAmC,EACnC,aAAqB;IAErB,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,CAAA;IAC9C,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChF,CAAC;AAkBD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAgB;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,UAA2C,CAAA;IACpE,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IACxD,OAAO,GAAG,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAe,CAAA;AAE/D;;;;;;;;GAQG;AACH,IAAI,wBAAwB,GAAG,IAAI,CAAA;AAEnC,MAAM,OAAO,WAAY,SAAQ,SAAS;IACxC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,CAAI,GAAgB,EAAE,EAAW;QACzC,IAAI,CAAC,wBAAwB;YAAE,OAAO,EAAE,EAAE,CAAA;QAC1C,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,KAAK,sBAAsB;QAC/B,OAAO,wBAAwB,CAAA;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAAC,OAAgB;QAC1C,wBAAwB,GAAG,OAAO,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,GAAG;QACR,IAAI,CAAC,wBAAwB;YAAE,OAAO,IAAI,CAAA;QAC1C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAA;IAC9C,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,SAAS;QACd,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,oLAAoL,CACrL,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAA;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,8KAA8K,CAC/K,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAI,EAAW;QACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,OAAO;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAA;QACnD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,GAAG,CAAA;IACpE,CAAC;IAED,qCAAqC;IAC5B,EAAE,CAAQ;IAEnB,0BAA0B;IACjB,OAAO,CAAS;IAEzB,mCAAmC;IAC1B,QAAQ,CAAU;IAE3B,uDAAuD;IACvD,mFAAmF;IACnF;;;;;;;OAOG;IACM,MAAM,CAAe;IAE9B,2CAA2C;IAClC,KAAK,CAAW;IAEzB,2DAA2D;IAC3D,IAAI,GAAc,EAAE,eAAe,EAAE,KAAK,EAAE,CAAA;IAE5C;;;;OAIG;IACH,MAAM,GAAG,IAAI,CAAA;IAEb,4EAA4E;IACnE,KAAK,GAAyB,IAAI,GAAG,EAAE,CAAA;IAEhD;;;;;OAKG;IACH,OAAO,CAAU;IAEjB;;;;OAIG;IACH,MAAM,CAAU;IAEhB;;;;OAIG;IACH,OAAO,CAAa;IAEpB;;;;;;;OAOG;IACM,iBAAiB,CAAoB;IAE9C,4DAA4D;IAC5D,OAAO,CAAgB;IAEvB,yEAAyE;IACzE,WAAW,CAAoB;IAE/B,mDAAmD;IACnD,iBAAiB,CAAmB;IAEpC;;;;OAIG;IACH,IAAI,MAAM;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,2EAA2E;IAC3E,aAAa,CAAC,MAAyB;QACrC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAA;IAC3B,CAAC;IAED,4FAA4F;IAC5F,eAAe,CAAC,MAAoB;QAClC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,yFAAyF;IACzF,YAAY,CAAC,SAAoB;QAC/B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAED,kEAAkE;IAClE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,4FAA4F;IAC5F,IAAI,QAAQ;QACV,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IACzD,CAAC;IAED,YACE,EAAU,EACV,UAAsB,EACtB,MAAqB,EACrB,KAAgB,EAChB,iBAAqC;QAErC,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;QAC9B,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtC,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvC,0EAA0E;QAC1E,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAA;QACxB,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC;SACtC,CAAC,CAAA;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,IAAI,CAAA;QAEjF,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAC9B,GAAG,EAAE,CACH,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAC9B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;SACzC,CAAC,CACL,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,mBAAmB,CAAC,QAA0B;QAC5C,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAA;IACnC,CAAC;CACF;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,MAA0B;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;IACnD,OAAO,OAAO,IAAI,SAAS,CAAA;AAC7B,CAAC"}
1
+ {"version":3,"file":"HttpContext.js","sourceRoot":"","sources":["../../src/http/HttpContext.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAQpD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AA+HxC,+EAA+E;AAC/E,SAAS,aAAa,CAAC,aAAqB;IAC1C,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,IAA8B,EAAQ,EAAE;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,aAAa,KAAK,OAAO,GAAG,IAAI,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAA;IACD,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;KACtC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,IAAmC,EACnC,aAAqB;IAErB,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,CAAA;IAC9C,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChF,CAAC;AAkBD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAgB;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,UAA2C,CAAA;IACpE,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IACxD,OAAO,GAAG,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAe,CAAA;AAE/D;;;;;;;;GAQG;AACH,IAAI,wBAAwB,GAAG,IAAI,CAAA;AAEnC,MAAM,OAAO,WAAY,SAAQ,SAAS;IACxC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,CAAI,GAAgB,EAAE,EAAW;QACzC,IAAI,CAAC,wBAAwB;YAAE,OAAO,EAAE,EAAE,CAAA;QAC1C,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,KAAK,sBAAsB;QAC/B,OAAO,wBAAwB,CAAA;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAAC,OAAgB;QAC1C,wBAAwB,GAAG,OAAO,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,GAAG;QACR,IAAI,CAAC,wBAAwB;YAAE,OAAO,IAAI,CAAA;QAC1C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAA;IAC9C,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,SAAS;QACd,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,oLAAoL,CACrL,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAA;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,8KAA8K,CAC/K,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAI,EAAW;QACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,OAAO;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAA;QACnD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,GAAG,CAAA;IACpE,CAAC;IAED,qCAAqC;IAC5B,EAAE,CAAQ;IAEnB,0BAA0B;IACjB,OAAO,CAAS;IAEzB,mCAAmC;IAC1B,QAAQ,CAAU;IAE3B,uDAAuD;IACvD,mFAAmF;IACnF;;;;;;;OAOG;IACM,MAAM,CAAe;IAE9B,2CAA2C;IAClC,KAAK,CAAW;IAEzB,2DAA2D;IAC3D,IAAI,GAAc,EAAE,eAAe,EAAE,KAAK,EAAE,CAAA;IAE5C;;;;OAIG;IACH,MAAM,GAAG,IAAI,CAAA;IAEb,4EAA4E;IACnE,KAAK,GAAyB,IAAI,GAAG,EAAE,CAAA;IAEhD;;;;;OAKG;IACH,OAAO,CAAU;IAEjB;;;;OAIG;IACH,MAAM,CAAU;IAEhB;;;;OAIG;IACH,OAAO,CAAa;IAEpB;;;;;;;OAOG;IACM,iBAAiB,CAAoB;IAE9C,4DAA4D;IAC5D,OAAO,CAAgB;IAEvB,yEAAyE;IACzE,WAAW,CAAoB;IAE/B,mDAAmD;IACnD,iBAAiB,CAAmB;IAEpC;;;;OAIG;IACH,IAAI,MAAM;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,2EAA2E;IAC3E,aAAa,CAAC,MAAyB;QACrC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAA;IAC3B,CAAC;IAED,4FAA4F;IAC5F,eAAe,CAAC,MAAoB;QAClC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,yFAAyF;IACzF,YAAY,CAAC,SAAoB;QAC/B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAED,kEAAkE;IAClE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,4FAA4F;IAC5F,IAAI,QAAQ;QACV,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IACzD,CAAC;IAED,YACE,EAAU,EACV,UAAsB,EACtB,MAAqB,EACrB,KAAgB,EAChB,iBAAqC;QAErC,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;QAC9B,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtC,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvC,0EAA0E;QAC1E,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAA;QACxB,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC;SACtC,CAAC,CAAA;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,IAAI,CAAA;QAEjF,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAC9B,GAAG,EAAE,CACH,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAClC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,SAAS;YACvD,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;SACzC,CAAC,CACL,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,mBAAmB,CAAC,QAA0B;QAC5C,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAA;IACnC,CAAC;CACF;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,MAA0B;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;IACnD,OAAO,OAAO,IAAI,SAAS,CAAA;AAC7B,CAAC"}
@@ -25,8 +25,14 @@ export declare class RedirectBuilder {
25
25
  */
26
26
  allowedHosts: string[];
27
27
  constructor(response: Response, options?: {
28
+ /** The request path with its query string. */
28
29
  requestUrl?: string;
29
30
  requestReferer?: string;
31
+ /**
32
+ * The request authority (`:authority` or `Host`, never X-Forwarded-Host)
33
+ * an absolute redirect target must match.
34
+ */
35
+ requestAuthority?: string;
30
36
  routeUrlResolver?: RouteUrlResolver;
31
37
  /** The request session, for the intended-URL methods. */
32
38
  session?: IntendedUrlStore;
@@ -79,9 +85,9 @@ export declare class RedirectBuilder {
79
85
  /** Redirect to a named route. */
80
86
  toRoute(name: string, params?: Record<string, string>): void;
81
87
  /**
82
- * Redirect back to the previous page (Referer header).
83
- * Only trusts same-origin or relative referers — external URLs fall back
84
- * to `fallback` to prevent open redirect attacks.
88
+ * Redirect back to the previous page (AdonisJS `back`): the path of
89
+ * {@link getPreviousUrl}, so the redirect never leaves the site; `withQs()`
90
+ * forwards the previous page's query string, not the current request's.
85
91
  */
86
92
  back(fallback?: string): void;
87
93
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"RedirectBuilder.d.ts","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAA;AA4BxF,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,qBAAa,eAAe;;IAC1B;;;;;OAKG;IACH,YAAY,EAAE,MAAM,EAAE,CAAK;gBAczB,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;QACnC,yDAAyD;QACzD,OAAO,CAAC,EAAE,gBAAgB,CAAA;QAC1B,8DAA8D;QAC9D,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,8DAA8D;QAC9D,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB;IAWH;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,SAAQ,GAAG,IAAI;IAarC;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,SAAM,GAAG,IAAI;IAKhC,iFAAiF;IACjF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAqBpE,gCAAgC;IAChC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAK1B;;;;;;;;;;OAUG;IACH,MAAM,IAAI,IAAI;IACd,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAkB1C,uEAAuE;IACvE,OAAO,IAAI,IAAI;IAMf,gDAAgD;IAChD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAO1B,iCAAiC;IACjC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAQ5D;;;;OAIG;IACH,IAAI,CAAC,QAAQ,SAAM,GAAG,IAAI;IAI1B;;;;;;;OAOG;IACH,cAAc,CAAC,QAAQ,SAAM,GAAG,MAAM;CA+BvC"}
1
+ {"version":3,"file":"RedirectBuilder.d.ts","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAA;AAkCxF,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,qBAAa,eAAe;;IAC1B;;;;;OAKG;IACH,YAAY,EAAE,MAAM,EAAE,CAAK;gBAezB,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE;QACR,8CAA8C;QAC9C,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;QACnC,yDAAyD;QACzD,OAAO,CAAC,EAAE,gBAAgB,CAAA;QAC1B,8DAA8D;QAC9D,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,8DAA8D;QAC9D,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB;IAYH;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,SAAQ,GAAG,IAAI;IAarC;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,SAAM,GAAG,IAAI;IAKhC,iFAAiF;IACjF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAiBpE,gCAAgC;IAChC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAK1B;;;;;;;;;;OAUG;IACH,MAAM,IAAI,IAAI;IACd,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAkB1C,uEAAuE;IACvE,OAAO,IAAI,IAAI;IAMf,gDAAgD;IAChD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAY1B,iCAAiC;IACjC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAQ5D;;;;OAIG;IACH,IAAI,CAAC,QAAQ,SAAM,GAAG,IAAI;IAK1B;;;;;;;OAOG;IACH,cAAc,CAAC,QAAQ,SAAM,GAAG,MAAM;CA0BvC"}
@@ -8,31 +8,35 @@
8
8
  * response.redirect().withQs({ page: '2' }).toPath('/results')
9
9
  * response.redirect().toRoute('posts.show', { id: '42' })
10
10
  */
11
- function isSameOriginOrRelative(referer, requestUrl, allowedHosts = []) {
11
+ /**
12
+ * AdonisJS `isValidRedirectUrl`: a relative path, or an absolute URL whose host
13
+ * is the request authority or an allowed host.
14
+ */
15
+ function isTrustedRedirect(url, authority, allowedHosts) {
12
16
  // A relative path is trusted only when it starts with a single "/" and has no
13
17
  // backslash: browsers normalise "\" to "/", so "/\evil.com" would become the
14
18
  // protocol-relative "//evil.com" that a lone `!startsWith("//")` check misses.
15
- if (referer.startsWith('/') && !referer.startsWith('//') && !referer.includes('\\'))
19
+ if (url.startsWith('/') && !url.startsWith('//') && !url.includes('\\'))
16
20
  return true;
17
- let ref;
21
+ let parsed;
18
22
  try {
19
- ref = new URL(referer);
23
+ parsed = new URL(url);
20
24
  }
21
25
  catch {
22
26
  return false;
23
27
  }
24
- // An explicitly allowed host is trusted whatever the request's own origin is
25
- // — that is what the list is for (AdonisJS `allowedHosts`).
26
- if (allowedHosts.includes(ref.host))
28
+ if (allowedHosts.includes(parsed.host))
27
29
  return true;
28
- if (!requestUrl)
29
- return false;
30
- try {
31
- return ref.origin === new URL(requestUrl).origin;
32
- }
33
- catch {
34
- return false;
35
- }
30
+ // Upstream accepts any absolute URL when it knows no host to compare with;
31
+ // refusing it is the safer reading of an attacker-controlled header.
32
+ return authority !== undefined && parsed.host === authority;
33
+ }
34
+ /** The query string of a path or URL, without the "?". */
35
+ function searchOf(url) {
36
+ if (url === undefined)
37
+ return '';
38
+ const index = url.indexOf('?');
39
+ return index === -1 ? '' : url.slice(index + 1);
36
40
  }
37
41
  export class RedirectBuilder {
38
42
  /**
@@ -48,6 +52,7 @@ export class RedirectBuilder {
48
52
  #forwardQs = false;
49
53
  #requestUrl;
50
54
  #requestReferer;
55
+ #requestAuthority;
51
56
  #routeUrlResolver;
52
57
  #session;
53
58
  #isAjax = false;
@@ -56,6 +61,7 @@ export class RedirectBuilder {
56
61
  this.#response = response;
57
62
  this.#requestUrl = options?.requestUrl;
58
63
  this.#requestReferer = options?.requestReferer;
64
+ this.#requestAuthority = options?.requestAuthority;
59
65
  this.#routeUrlResolver = options?.routeUrlResolver;
60
66
  this.#session = options?.session;
61
67
  this.#isAjax = options?.isAjax ?? false;
@@ -104,14 +110,9 @@ export class RedirectBuilder {
104
110
  #safeIntended(intended, fallback) {
105
111
  if (!intended)
106
112
  return fallback;
107
- if (this.#requestUrl && !isSameOriginOrRelative(intended, this.#requestUrl)) {
108
- return fallback;
109
- }
110
- // A protocol-relative `//evil.com` is absolute to a browser even though it
111
- // looks relative — reject it whether or not a request URL is known.
112
- if (intended.startsWith('//'))
113
- return fallback;
114
- return intended;
113
+ return isTrustedRedirect(intended, this.#requestAuthority, this.allowedHosts)
114
+ ? intended
115
+ : fallback;
115
116
  }
116
117
  /** Set redirect status code. */
117
118
  status(code) {
@@ -142,7 +143,11 @@ export class RedirectBuilder {
142
143
  }
143
144
  /** Redirect to an absolute or relative path. */
144
145
  toPath(path) {
145
- const url = this.#appendQs(path);
146
+ this.#send(path, searchOf(this.#requestUrl));
147
+ }
148
+ /** Redirect with `withQs()` forwarding `forwardedSearch` (a query string without "?"). */
149
+ #send(path, forwardedSearch) {
150
+ const url = this.#appendQs(path, forwardedSearch);
146
151
  this.#response.status(this.#status);
147
152
  this.#response.header('location', url);
148
153
  this.#response.setBody('');
@@ -156,12 +161,13 @@ export class RedirectBuilder {
156
161
  this.toPath(path);
157
162
  }
158
163
  /**
159
- * Redirect back to the previous page (Referer header).
160
- * Only trusts same-origin or relative referers — external URLs fall back
161
- * to `fallback` to prevent open redirect attacks.
164
+ * Redirect back to the previous page (AdonisJS `back`): the path of
165
+ * {@link getPreviousUrl}, so the redirect never leaves the site; `withQs()`
166
+ * forwards the previous page's query string, not the current request's.
162
167
  */
163
168
  back(fallback = '/') {
164
- this.toPath(this.getPreviousUrl(fallback));
169
+ const previous = new URL(this.getPreviousUrl(fallback), 'http://localhost');
170
+ this.#send(previous.pathname, previous.search.slice(1));
165
171
  }
166
172
  /**
167
173
  * Where "back" goes (AdonisJS `getPreviousUrl`).
@@ -173,7 +179,7 @@ export class RedirectBuilder {
173
179
  */
174
180
  getPreviousUrl(fallback = '/') {
175
181
  const referer = this.#requestReferer;
176
- if (referer && isSameOriginOrRelative(referer, this.#requestUrl, this.allowedHosts)) {
182
+ if (referer && isTrustedRedirect(referer, this.#requestAuthority, this.allowedHosts)) {
177
183
  return referer;
178
184
  }
179
185
  return fallback;
@@ -183,15 +189,11 @@ export class RedirectBuilder {
183
189
  * uses, so `withQs()` plus `withQs('page', 2)` overrides an inbound `page`
184
190
  * rather than being overridden by it.
185
191
  */
186
- #appendQs(path) {
192
+ #appendQs(path, forwardedSearch) {
187
193
  const params = new URLSearchParams();
188
- if (this.#forwardQs && this.#requestUrl) {
189
- const qsIdx = this.#requestUrl.indexOf('?');
190
- if (qsIdx !== -1) {
191
- for (const [key, value] of new URLSearchParams(this.#requestUrl.slice(qsIdx + 1))) {
192
- params.append(key, value);
193
- }
194
- }
194
+ if (this.#forwardQs) {
195
+ for (const [key, value] of new URLSearchParams(forwardedSearch))
196
+ params.append(key, value);
195
197
  }
196
198
  for (const [key, value] of Object.entries(this.#qs)) {
197
199
  if (value === undefined || value === null)
@@ -1 +1 @@
1
- {"version":3,"file":"RedirectBuilder.js","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,SAAS,sBAAsB,CAC7B,OAAe,EACf,UAAmB,EACnB,eAAkC,EAAE;IAEpC,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChG,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAQD,MAAM,OAAO,eAAe;IAC1B;;;;;OAKG;IACH,YAAY,GAAa,EAAE,CAAA;IAE3B,SAAS,CAAU;IACnB,OAAO,GAAG,GAAG,CAAA;IACb,GAAG,GAA4B,EAAE,CAAA;IACjC,UAAU,GAAG,KAAK,CAAA;IAClB,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,iBAAiB,CAAmB;IACpC,QAAQ,CAAmB;IAC3B,OAAO,GAAG,KAAK,CAAA;IACf,SAAS,GAAG,IAAI,CAAA;IAEhB,YACE,QAAkB,EAClB,OAUC;QAED,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,UAAU,CAAA;QACtC,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,cAAc,CAAA;QAC9C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,gBAAgB,CAAA;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAA;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAA;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,GAAG,KAAK;QAC5B,IACE,IAAI,CAAC,QAAQ;YACb,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK;YAC9B,CAAC,IAAI,CAAC,OAAO;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,WAAW,EAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,GAAG,GAAG;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,iFAAiF;IACjF,eAAe,CAAC,IAAY,EAAE,MAA+B;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC1E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,aAAa,CAA0B,QAAuB,EAAE,QAAW;QACzE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC9B,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAA;QAC9C,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,gCAAgC;IAChC,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAiBD,MAAM,CAAC,IAAiD,EAAE,KAAe;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,uEAAuE;IACvE,OAAO;QACL,IAAI,CAAC,GAAG,GAAG,EAAE,CAAA;QACb,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,IAAY;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC;IAED,iCAAiC;IACjC,OAAO,CAAC,IAAY,EAAE,MAA+B;QACnD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,QAAQ,GAAG,GAAG;QACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,QAAQ,GAAG,GAAG;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAA;QACpC,IAAI,OAAO,IAAI,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACpF,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,IAAY;QACpB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAQ;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAA;IAC/D,CAAC;CACF"}
1
+ {"version":3,"file":"RedirectBuilder.js","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;GAGG;AACH,SAAS,iBAAiB,CACxB,GAAW,EACX,SAA6B,EAC7B,YAA+B;IAE/B,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,2EAA2E;IAC3E,qEAAqE;IACrE,OAAO,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAA;AAC7D,CAAC;AAED,0DAA0D;AAC1D,SAAS,QAAQ,CAAC,GAAuB;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;AACjD,CAAC;AAQD,MAAM,OAAO,eAAe;IAC1B;;;;;OAKG;IACH,YAAY,GAAa,EAAE,CAAA;IAE3B,SAAS,CAAU;IACnB,OAAO,GAAG,GAAG,CAAA;IACb,GAAG,GAA4B,EAAE,CAAA;IACjC,UAAU,GAAG,KAAK,CAAA;IAClB,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,iBAAiB,CAAS;IAC1B,iBAAiB,CAAmB;IACpC,QAAQ,CAAmB;IAC3B,OAAO,GAAG,KAAK,CAAA;IACf,SAAS,GAAG,IAAI,CAAA;IAEhB,YACE,QAAkB,EAClB,OAgBC;QAED,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,UAAU,CAAA;QACtC,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,cAAc,CAAA;QAC9C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,gBAAgB,CAAA;QAClD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,gBAAgB,CAAA;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAA;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAA;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,GAAG,KAAK;QAC5B,IACE,IAAI,CAAC,QAAQ;YACb,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK;YAC9B,CAAC,IAAI,CAAC,OAAO;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,WAAW,EAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,GAAG,GAAG;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,iFAAiF;IACjF,eAAe,CAAC,IAAY,EAAE,MAA+B;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC1E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,aAAa,CAA0B,QAAuB,EAAE,QAAW;QACzE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC9B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC;YAC3E,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAA;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAiBD,MAAM,CAAC,IAAiD,EAAE,KAAe;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,uEAAuE;IACvE,OAAO;QACL,IAAI,CAAC,GAAG,GAAG,EAAE,CAAA;QACb,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,IAAY,EAAE,eAAuB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC;IAED,iCAAiC;IACjC,OAAO,CAAC,IAAY,EAAE,MAA+B;QACnD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,QAAQ,GAAG,GAAG;QACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,QAAQ,GAAG,GAAG;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAA;QACpC,IAAI,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrF,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,IAAY,EAAE,eAAuB;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,eAAe,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5F,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAQ;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAA;IAC/D,CAAC;CACF"}
@@ -27,6 +27,26 @@ export interface RawRequest {
27
27
  * `ip()` accessor falls back to legacy header parsing.
28
28
  */
29
29
  ip?: string;
30
+ /**
31
+ * The trusted address chain, closest hop first — the socket peer, then each
32
+ * `X-Forwarded-For` entry the Rust layer walked right to left while the hop
33
+ * before it was a trusted proxy. Its last entry is {@link ip}. Absent in
34
+ * hand-built fixtures, where the chain is the peer alone.
35
+ */
36
+ ips?: string[];
37
+ /**
38
+ * Whether the socket peer is one of the trusted proxies configured with
39
+ * `server.trustedProxies()`, as the Rust layer decided against the same
40
+ * list that resolves {@link ip}. Absent in hand-built fixtures: untrusted.
41
+ */
42
+ peerTrusted?: boolean;
43
+ /**
44
+ * The body was over its content type's limit (`config/bodyparser.ts`): the
45
+ * Rust layer did not keep it, and `body` is empty. Reading the body then
46
+ * throws `E_REQUEST_ENTITY_TOO_LARGE` instead of handing back nothing as if
47
+ * nothing had been sent.
48
+ */
49
+ bodyTooLarge?: boolean;
30
50
  /**
31
51
  * Connection scheme as seen by the server (`http`/`https`), when the Rust
32
52
  * layer ships it. Defaults to `http` in `protocol()` when absent; the
@@ -167,13 +187,6 @@ export declare class Request extends Macroable {
167
187
  * desired resolved value.
168
188
  */
169
189
  ip(): string;
170
- /**
171
- * Enable/disable trusting proxy headers (`X-Forwarded-Proto`/`-Host`/`-For`)
172
- * for `protocol()`/`host()`/`ips()`. OFF by default — turning it on when the
173
- * app is NOT behind a trusted proxy lets clients spoof their scheme/host/IP,
174
- * so it's an explicit opt-in (same stance as {@link setMethodSpoofing}).
175
- */
176
- setTrustProxy(enabled: boolean): void;
177
190
  /**
178
191
  * The HTTP/2 `:authority` pseudo-header, falling back to `Host` (AdonisJS
179
192
  * `authority`).
@@ -187,22 +200,27 @@ export declare class Request extends Macroable {
187
200
  authority(): string | null;
188
201
  /**
189
202
  * The request host including port (AdonisJS `host`). Honours
190
- * `X-Forwarded-Host` ONLY when trust-proxy is enabled; otherwise the `Host`
191
- * header. Returns null when neither is present.
203
+ * `X-Forwarded-Host` ONLY when the request came through a trusted proxy (see
204
+ * `server.trustedProxies()`); otherwise the `Host` header. Returns null when
205
+ * neither is present.
192
206
  */
193
207
  host(): string | null;
194
208
  /**
195
- * The request protocol — `http` or `https` (AdonisJS `protocol`). Honours
196
- * `X-Forwarded-Proto` only under trust-proxy; otherwise the connection scheme
197
- * the Rust layer reported (defaulting to `http`).
209
+ * The request protocol — `http` or `https` (AdonisJS `protocol`). A TLS
210
+ * connection is `https` whatever the headers say. Otherwise
211
+ * `X-Forwarded-Proto` is honoured only when the request came through a
212
+ * trusted proxy (see `server.trustedProxies()`), and the connection scheme
213
+ * the Rust layer reported (defaulting to `http`) is used when it is not.
198
214
  */
199
215
  protocol(): string;
200
216
  /** True when the request protocol is `https` (AdonisJS `secure`). */
201
217
  secure(): boolean;
202
218
  /**
203
- * The client IP chain (AdonisJS `ips`). Under trust-proxy, the parsed
204
- * `X-Forwarded-For` list (left-most = original client); otherwise just the
205
- * single resolved {@link ip}.
219
+ * The trusted address chain, closest hop first (AdonisJS `ips`): the socket
220
+ * peer, then each `X-Forwarded-For` hop a trusted proxy vouched for. The
221
+ * last entry is {@link ip}. Hops added by an untrusted peer are not in it —
222
+ * the Rust layer stops at the first address it does not trust, so the chain
223
+ * goes past the peer only when {@link peerTrusted} holds.
206
224
  */
207
225
  ips(): string[];
208
226
  /** The request hostname without port (AdonisJS `hostname`), or null. */
@@ -282,9 +300,16 @@ export declare class Request extends Macroable {
282
300
  * `purpose`. Returns false without an APP_KEY-backed signer.
283
301
  */
284
302
  hasValidSignature(purpose?: string): boolean;
285
- /** Get the raw body as a string (decoded from base64 if binary). */
303
+ /**
304
+ * Get the raw body as a string (decoded from base64 if binary). Throws
305
+ * `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit: what
306
+ * the server kept of it is nothing, and nothing is not the body.
307
+ */
286
308
  raw(): string;
287
- /** Get the raw body as a Buffer (preserves binary integrity for file uploads). */
309
+ /**
310
+ * Get the raw body as a Buffer (preserves binary integrity for file uploads).
311
+ * Throws `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit.
312
+ */
288
313
  rawBuffer(): Buffer;
289
314
  /** Get a single request header (case-insensitive), or `defaultValue` when absent. */
290
315
  header(key: string): string | undefined;
@@ -1 +1 @@
1
- {"version":3,"file":"Request.d.ts","sourceRoot":"","sources":["../../src/http/Request.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAA;AAI9B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;IAChC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC9C,KAAK,EAAE,KAAK,CAAC;YACX,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,EAAE,MAAM,CAAA;YAClB,WAAW,EAAE,MAAM,CAAA;YACnB,IAAI,EAAE,MAAM,CAAA;YACZ,UAAU,EAAE,MAAM,CAAA;SACnB,CAAC,CAAA;KACH,CAAA;IACD;;;;OAIG;IACH,OAAO,CAAC,EAAE,IAAI,CAAA;CACf;AAED,qBAAa,OAAQ,SAAQ,SAAS;;IAkBpC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;gBAEX,GAAG,EAAE,UAAU,EAAE,MAAM,GAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAM;IAQjE;;;;;;OAMG;IACH,MAAM,IAAI,MAAM;IAQhB,mFAAmF;IACnF,QAAQ,IAAI,MAAM;IAIlB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAIzC,gGAAgG;IAChG,WAAW,CAAC,QAAQ,EAAE;QAAE,KAAK,IAAI,OAAO,CAAA;KAAE,GAAG,IAAI;IAIjD,wFAAwF;IACxF,YAAY,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIhF;;;;OAIG;IACH,KAAK,IAAI,OAAO;IAIhB,wDAAwD;IACxD,KAAK,IAAI,OAAO;IAIhB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO;IASpD;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIzC;;;;;;;OAOG;IACH,GAAG,CAAC,SAAS,UAAQ,GAAG,MAAM;IAO9B,2CAA2C;IAC3C,IAAI,IAAI,MAAM;IAId;;;;;;;;;;;;;;;OAeG;IACH,EAAE,IAAI,MAAM;IAKZ;;;;;OAKG;IACH,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIrC;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI;IAM1B;;;;OAIG;IACH,IAAI,IAAI,MAAM,GAAG,IAAI;IAWrB;;;;OAIG;IACH,QAAQ,IAAI,MAAM;IASlB,qEAAqE;IACrE,MAAM,IAAI,OAAO;IAIjB;;;;OAIG;IACH,GAAG,IAAI,MAAM,EAAE;IAaf,wEAAwE;IACxE,QAAQ,IAAI,MAAM,GAAG,IAAI;IASzB;;;;OAIG;IACH,UAAU,CAAC,MAAM,SAAI,GAAG,MAAM,EAAE;IAQhC;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAqBf,sEAAsE;IACtE,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAI3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAClD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAc1D;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI;IAC/C,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC;IAC1F,WAAW,CAAC,CAAC,GAAG,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,EACvB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9B,CAAC,GAAG,IAAI;IACX,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC,GAAG,IAAI;IAclG;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAC5C,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOnE,oFAAoF;IACpF,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAIxC;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAO5C,oEAAoE;IACpE,GAAG,IAAI,MAAM;IAQb,kFAAkF;IAClF,SAAS,IAAI,MAAM;IASnB,qFAAqF;IACrF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK9D,+BAA+B;IAC/B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC;IAMzB;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7D,oEAAoE;IACpE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAM3C;;;;;OAKG;IACH,EAAE,IAAI,MAAM,GAAG,SAAS;IAIxB,2EAA2E;IAC3E,SAAS,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAShE,4DAA4D;IAC5D,IAAI,IAAI,OAAO;IAIf,0DAA0D;IAC1D,IAAI,IAAI,OAAO;IAIf;;;;;;;OAOG;IACH,QAAQ,IAAI,OAAO;IAWnB;;;;OAIG;IACH,WAAW,CAAC,kBAAkB,UAAQ,GAAG,MAAM;IAK/C;;;;;;;OAOG;IACH,cAAc,CAAC,YAAY,GAAE,MAAM,EAAO,EAAE,QAAQ,SAAM,GAAG,MAAM;IAgBnE,0EAA0E;IAC1E,KAAK,IAAI,MAAM,EAAE;IAIjB,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB,0EAA0E;IAC1E,QAAQ,IAAI,MAAM,EAAE;IAIpB;;;;OAIG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAIlD,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IA6CpD,qDAAqD;IACrD,WAAW,IAAI,IAAI;IAInB;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiBpC,uEAAuE;IACvE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjC;;;;;;;;OAQG;IACH,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAexC,4CAA4C;IAC5C,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;IAanB,mCAAmC;IACnC,IAAI,IAAI,OAAO;IAOf;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC;IAMpD,qDAAqD;IACrD,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;IA8BpB;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,EACb,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,CAAC;IAIb,0EAA0E;IAC1E,gBAAgB,CAAC,CAAC,EAChB,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAIvC;;;OAGG;IACH,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;IAKzB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAInC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAIrC;;;;OAIG;IACH,OAAO,IAAI,OAAO;IASlB,wEAAwE;IACxE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAYlC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAiB/C;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAoBhD,0CAA0C;IAC1C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,GAAG,IAAI;IAOhE,+CAA+C;IAC/C,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,EAAE;IAQ3D,8BAA8B;IAC9B,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,CAAC;IAIjF;;;;;;OAMG;IACH,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS;IAI7D,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,GAAG,IAAI;IAW/E,uEAAuE;IACvE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKxC;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAMnC;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIpC;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAIjC;;;;;;OAMG;IACH,SAAS,IAAI,OAAO;CAkBrB"}
1
+ {"version":3,"file":"Request.d.ts","sourceRoot":"","sources":["../../src/http/Request.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAGjD,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAA;AAI9B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;IAChC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC9C,KAAK,EAAE,KAAK,CAAC;YACX,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,EAAE,MAAM,CAAA;YAClB,WAAW,EAAE,MAAM,CAAA;YACnB,IAAI,EAAE,MAAM,CAAA;YACZ,UAAU,EAAE,MAAM,CAAA;SACnB,CAAC,CAAA;KACH,CAAA;IACD;;;;OAIG;IACH,OAAO,CAAC,EAAE,IAAI,CAAA;CACf;AAED,qBAAa,OAAQ,SAAQ,SAAS;;IAiBpC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;gBAEX,GAAG,EAAE,UAAU,EAAE,MAAM,GAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAM;IAQjE;;;;;;OAMG;IACH,MAAM,IAAI,MAAM;IAQhB,mFAAmF;IACnF,QAAQ,IAAI,MAAM;IAIlB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAIzC,gGAAgG;IAChG,WAAW,CAAC,QAAQ,EAAE;QAAE,KAAK,IAAI,OAAO,CAAA;KAAE,GAAG,IAAI;IAIjD,wFAAwF;IACxF,YAAY,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIhF;;;;OAIG;IACH,KAAK,IAAI,OAAO;IAIhB,wDAAwD;IACxD,KAAK,IAAI,OAAO;IAIhB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO;IASpD;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIzC;;;;;;;OAOG;IACH,GAAG,CAAC,SAAS,UAAQ,GAAG,MAAM;IAO9B,2CAA2C;IAC3C,IAAI,IAAI,MAAM;IAId;;;;;;;;;;;;;;;OAeG;IACH,EAAE,IAAI,MAAM;IAmBZ;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI;IAM1B;;;;;OAKG;IACH,IAAI,IAAI,MAAM,GAAG,IAAI;IAWrB;;;;;;OAMG;IACH,QAAQ,IAAI,MAAM;IAUlB,qEAAqE;IACrE,MAAM,IAAI,OAAO;IAIjB;;;;;;OAMG;IACH,GAAG,IAAI,MAAM,EAAE;IAMf,wEAAwE;IACxE,QAAQ,IAAI,MAAM,GAAG,IAAI;IASzB;;;;OAIG;IACH,UAAU,CAAC,MAAM,SAAI,GAAG,MAAM,EAAE;IAQhC;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAqBf,sEAAsE;IACtE,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAI3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAClD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAc1D;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI;IAC/C,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC;IAC1F,WAAW,CAAC,CAAC,GAAG,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,EACvB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9B,CAAC,GAAG,IAAI;IACX,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC,GAAG,IAAI;IAclG;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAC5C,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOnE,oFAAoF;IACpF,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAIxC;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAO5C;;;;OAIG;IACH,GAAG,IAAI,MAAM;IASb;;;OAGG;IACH,SAAS,IAAI,MAAM;IAUnB,qFAAqF;IACrF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK9D,+BAA+B;IAC/B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC;IAMzB;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7D,oEAAoE;IACpE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAM3C;;;;;OAKG;IACH,EAAE,IAAI,MAAM,GAAG,SAAS;IAIxB,2EAA2E;IAC3E,SAAS,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAShE,4DAA4D;IAC5D,IAAI,IAAI,OAAO;IAIf,0DAA0D;IAC1D,IAAI,IAAI,OAAO;IAIf;;;;;;;OAOG;IACH,QAAQ,IAAI,OAAO;IAWnB;;;;OAIG;IACH,WAAW,CAAC,kBAAkB,UAAQ,GAAG,MAAM;IAK/C;;;;;;;OAOG;IACH,cAAc,CAAC,YAAY,GAAE,MAAM,EAAO,EAAE,QAAQ,SAAM,GAAG,MAAM;IAgBnE,0EAA0E;IAC1E,KAAK,IAAI,MAAM,EAAE;IAIjB,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB,0EAA0E;IAC1E,QAAQ,IAAI,MAAM,EAAE;IAIpB;;;;OAIG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAIlD,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IA6CpD,qDAAqD;IACrD,WAAW,IAAI,IAAI;IAInB;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAkBpC,uEAAuE;IACvE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjC;;;;;;;;OAQG;IACH,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAexC,4CAA4C;IAC5C,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;IAanB,mCAAmC;IACnC,IAAI,IAAI,OAAO;IAOf;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC;IAMpD,qDAAqD;IACrD,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;IA8BpB;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,EACb,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,CAAC;IAIb,0EAA0E;IAC1E,gBAAgB,CAAC,CAAC,EAChB,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAIvC;;;OAGG;IACH,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;IAKzB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAInC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAIrC;;;;OAIG;IACH,OAAO,IAAI,OAAO;IASlB,wEAAwE;IACxE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAYlC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAiB/C;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAoBhD,0CAA0C;IAC1C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,GAAG,IAAI;IAOhE,+CAA+C;IAC/C,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,EAAE;IAQ3D,8BAA8B;IAC9B,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,CAAC;IAIjF;;;;;;OAMG;IACH,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS;IAI7D,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,GAAG,IAAI;IAW/E,uEAAuE;IACvE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKxC;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAMnC;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIpC;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAIjC;;;;;;OAMG;IACH,SAAS,IAAI,OAAO;CA2CrB"}
@@ -9,6 +9,7 @@
9
9
  import { parseQueryString } from '../bodyparser/qsParse.js';
10
10
  import { Macroable } from '../utils/Macroable.js';
11
11
  import { getPath, omitPaths, pickPaths } from '../utils/objectPath.js';
12
+ import { Exception } from './Exception.js';
12
13
  import { RequestValidator } from './RequestValidator.js';
13
14
  import { unpackCookieValue } from './Response.js';
14
15
  export class Request extends Macroable {
@@ -17,7 +18,6 @@ export class Request extends Macroable {
17
18
  #cookieSigner;
18
19
  #signedUrl;
19
20
  #allowMethodSpoofing = false;
20
- #trustProxy = false;
21
21
  #routeInfo;
22
22
  #response;
23
23
  #parsedBody;
@@ -173,13 +173,17 @@ export class Request extends Macroable {
173
173
  return this.#raw.remoteAddr ?? '127.0.0.1';
174
174
  }
175
175
  /**
176
- * Enable/disable trusting proxy headers (`X-Forwarded-Proto`/`-Host`/`-For`)
177
- * for `protocol()`/`host()`/`ips()`. OFF by default — turning it on when the
178
- * app is NOT behind a trusted proxy lets clients spoof their scheme/host/IP,
179
- * so it's an explicit opt-in (same stance as {@link setMethodSpoofing}).
176
+ * Whether the socket peer is one of the trusted proxies configured with
177
+ * `server.trustedProxies()` — the condition under which `X-Forwarded-Proto`
178
+ * and `X-Forwarded-Host` are believed by {@link protocol} and {@link host}.
179
+ *
180
+ * The decision is the Rust layer's (`peerTrusted`), made once per request
181
+ * against the same list that resolves {@link ip}, so a trusted proxy that
182
+ * forwards the scheme or host without an `X-Forwarded-For` is believed too.
183
+ * A request without the flag — a hand-built fixture — is untrusted.
180
184
  */
181
- setTrustProxy(enabled) {
182
- this.#trustProxy = enabled;
185
+ #peerIsTrustedProxy() {
186
+ return this.#raw.peerTrusted === true;
183
187
  }
184
188
  /**
185
189
  * The HTTP/2 `:authority` pseudo-header, falling back to `Host` (AdonisJS
@@ -199,11 +203,12 @@ export class Request extends Macroable {
199
203
  }
200
204
  /**
201
205
  * The request host including port (AdonisJS `host`). Honours
202
- * `X-Forwarded-Host` ONLY when trust-proxy is enabled; otherwise the `Host`
203
- * header. Returns null when neither is present.
206
+ * `X-Forwarded-Host` ONLY when the request came through a trusted proxy (see
207
+ * `server.trustedProxies()`); otherwise the `Host` header. Returns null when
208
+ * neither is present.
204
209
  */
205
210
  host() {
206
- if (this.#trustProxy) {
211
+ if (this.#peerIsTrustedProxy()) {
207
212
  const forwarded = this.#raw.headers['x-forwarded-host'];
208
213
  // The first hop in the list, named rather than indexed: `split` always
209
214
  // yields one element, and saying so beats being told it might not.
@@ -214,12 +219,16 @@ export class Request extends Macroable {
214
219
  return this.#raw.headers.host ?? null;
215
220
  }
216
221
  /**
217
- * The request protocol — `http` or `https` (AdonisJS `protocol`). Honours
218
- * `X-Forwarded-Proto` only under trust-proxy; otherwise the connection scheme
219
- * the Rust layer reported (defaulting to `http`).
222
+ * The request protocol — `http` or `https` (AdonisJS `protocol`). A TLS
223
+ * connection is `https` whatever the headers say. Otherwise
224
+ * `X-Forwarded-Proto` is honoured only when the request came through a
225
+ * trusted proxy (see `server.trustedProxies()`), and the connection scheme
226
+ * the Rust layer reported (defaulting to `http`) is used when it is not.
220
227
  */
221
228
  protocol() {
222
- if (this.#trustProxy) {
229
+ if (this.#raw.scheme === 'https')
230
+ return 'https';
231
+ if (this.#peerIsTrustedProxy()) {
223
232
  const forwarded = this.#raw.headers['x-forwarded-proto'];
224
233
  const [first] = forwarded?.split(',') ?? [];
225
234
  if (first !== undefined)
@@ -232,20 +241,16 @@ export class Request extends Macroable {
232
241
  return this.protocol() === 'https';
233
242
  }
234
243
  /**
235
- * The client IP chain (AdonisJS `ips`). Under trust-proxy, the parsed
236
- * `X-Forwarded-For` list (left-most = original client); otherwise just the
237
- * single resolved {@link ip}.
244
+ * The trusted address chain, closest hop first (AdonisJS `ips`): the socket
245
+ * peer, then each `X-Forwarded-For` hop a trusted proxy vouched for. The
246
+ * last entry is {@link ip}. Hops added by an untrusted peer are not in it —
247
+ * the Rust layer stops at the first address it does not trust, so the chain
248
+ * goes past the peer only when {@link peerTrusted} holds.
238
249
  */
239
250
  ips() {
240
- if (this.#trustProxy) {
241
- const forwarded = this.#raw.headers['x-forwarded-for'];
242
- if (forwarded) {
243
- return forwarded
244
- .split(',')
245
- .map((value) => value.trim())
246
- .filter((value) => value.length > 0);
247
- }
248
- }
251
+ const chain = this.#raw.ips;
252
+ if (chain && chain.length > 0 && this.#peerIsTrustedProxy())
253
+ return [...chain];
249
254
  return [this.ip()];
250
255
  }
251
256
  /** The request hostname without port (AdonisJS `hostname`), or null. */
@@ -354,17 +359,26 @@ export class Request extends Macroable {
354
359
  // the expiry and the signature itself live in the query.
355
360
  return this.#signedUrl.verify(this.url(true), purpose);
356
361
  }
357
- /** Get the raw body as a string (decoded from base64 if binary). */
362
+ /**
363
+ * Get the raw body as a string (decoded from base64 if binary). Throws
364
+ * `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit: what
365
+ * the server kept of it is nothing, and nothing is not the body.
366
+ */
358
367
  raw() {
359
368
  if (this.#rawBodyOverride !== undefined)
360
369
  return this.#rawBodyOverride;
370
+ this.#assertBodyKept();
361
371
  if (this.#raw.bodyEncoding === 'base64') {
362
372
  return Buffer.from(this.#raw.body, 'base64').toString('utf8');
363
373
  }
364
374
  return this.#raw.body;
365
375
  }
366
- /** Get the raw body as a Buffer (preserves binary integrity for file uploads). */
376
+ /**
377
+ * Get the raw body as a Buffer (preserves binary integrity for file uploads).
378
+ * Throws `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit.
379
+ */
367
380
  rawBuffer() {
381
+ this.#assertBodyKept();
368
382
  if (this.#raw.bodyEncoding === 'base64') {
369
383
  return Buffer.from(this.#raw.body, 'base64');
370
384
  }
@@ -556,7 +570,8 @@ export class Request extends Macroable {
556
570
  id: this.id(),
557
571
  url: this.url(true),
558
572
  query: this.parsedUrl().search?.slice(1) ?? '',
559
- body: this.body(),
573
+ // A dump must not throw: an over-limit body is reported as absent.
574
+ body: this.#bodyWasDropped() ? undefined : this.body(),
560
575
  params: this.params(),
561
576
  headers: this.headers(),
562
577
  method: this.method(),
@@ -871,9 +886,30 @@ export class Request extends Macroable {
871
886
  validated() {
872
887
  return this.#validated;
873
888
  }
889
+ /** The body was over its limit and nothing has replaced it since. */
890
+ #bodyWasDropped() {
891
+ return (this.#raw.bodyTooLarge === true &&
892
+ this.#parsedBody === undefined &&
893
+ this.#rawBodyOverride === undefined);
894
+ }
895
+ /**
896
+ * Refuse to read a body the server did not keep. The same 413 the body
897
+ * parser raises, so a route without it still answers the client properly
898
+ * the moment it reaches for the body — and a route that never does is not
899
+ * charged for it.
900
+ */
901
+ #assertBodyKept() {
902
+ if (this.#raw.bodyTooLarge === true) {
903
+ throw new Exception('request entity too large', {
904
+ status: 413,
905
+ code: 'E_REQUEST_ENTITY_TOO_LARGE',
906
+ });
907
+ }
908
+ }
874
909
  #ensureParsedBody() {
875
910
  if (this.#parsedBody !== undefined)
876
911
  return;
912
+ this.#assertBodyKept();
877
913
  const raw = this.#raw.body;
878
914
  if (!raw || raw.length === 0) {
879
915
  this.#parsedBody = {};