@c9up/ream 0.2.28 → 0.2.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/Codemods.d.ts +16 -0
- package/dist/Codemods.d.ts.map +1 -1
- package/dist/Codemods.js +182 -0
- package/dist/Codemods.js.map +1 -1
- package/dist/Ignitor.d.ts +10 -2
- package/dist/Ignitor.d.ts.map +1 -1
- package/dist/Ignitor.js +21 -22
- package/dist/Ignitor.js.map +1 -1
- package/dist/bodyparser/BodyParserMiddleware.d.ts.map +1 -1
- package/dist/bodyparser/BodyParserMiddleware.js +3 -0
- package/dist/bodyparser/BodyParserMiddleware.js.map +1 -1
- package/dist/bodyparser/qsParse.d.ts +10 -1
- package/dist/bodyparser/qsParse.d.ts.map +1 -1
- package/dist/bodyparser/qsParse.js +53 -15
- package/dist/bodyparser/qsParse.js.map +1 -1
- package/dist/codemods/source.d.ts +57 -0
- package/dist/codemods/source.d.ts.map +1 -0
- package/dist/codemods/source.js +282 -0
- package/dist/codemods/source.js.map +1 -0
- package/dist/graphql/GraphQLEngine.d.ts.map +1 -1
- package/dist/graphql/GraphQLEngine.js +3 -2
- package/dist/graphql/GraphQLEngine.js.map +1 -1
- package/dist/http/Exception.d.ts +14 -1
- package/dist/http/Exception.d.ts.map +1 -1
- package/dist/http/Exception.js +10 -2
- package/dist/http/Exception.js.map +1 -1
- package/dist/http/HttpContext.d.ts +11 -0
- package/dist/http/HttpContext.d.ts.map +1 -1
- package/dist/http/HttpContext.js +2 -1
- package/dist/http/HttpContext.js.map +1 -1
- package/dist/http/RedirectBuilder.d.ts +9 -3
- package/dist/http/RedirectBuilder.d.ts.map +1 -1
- package/dist/http/RedirectBuilder.js +39 -37
- package/dist/http/RedirectBuilder.js.map +1 -1
- package/dist/http/Request.d.ts +42 -17
- package/dist/http/Request.d.ts.map +1 -1
- package/dist/http/Request.js +65 -29
- package/dist/http/Request.js.map +1 -1
- package/dist/http/SseStream.js +6 -7
- package/dist/http/SseStream.js.map +1 -1
- package/dist/http/permissions.d.ts +19 -0
- package/dist/http/permissions.d.ts.map +1 -0
- package/dist/http/permissions.js +28 -0
- package/dist/http/permissions.js.map +1 -0
- package/dist/http-client/HttpClient.d.ts +111 -0
- package/dist/http-client/HttpClient.d.ts.map +1 -0
- package/dist/http-client/HttpClient.js +386 -0
- package/dist/http-client/HttpClient.js.map +1 -0
- package/dist/http-client/addresses.d.ts +14 -0
- package/dist/http-client/addresses.d.ts.map +1 -0
- package/dist/http-client/addresses.js +57 -0
- package/dist/http-client/addresses.js.map +1 -0
- package/dist/http-client/fake.d.ts +50 -0
- package/dist/http-client/fake.d.ts.map +1 -0
- package/dist/http-client/fake.js +95 -0
- package/dist/http-client/fake.js.map +1 -0
- package/dist/http-client/index.d.ts +7 -0
- package/dist/http-client/index.d.ts.map +1 -0
- package/dist/http-client/index.js +7 -0
- package/dist/http-client/index.js.map +1 -0
- package/dist/index.d.ts +4 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/middleware/Pipeline.d.ts.map +1 -1
- package/dist/middleware/Pipeline.js +6 -3
- package/dist/middleware/Pipeline.js.map +1 -1
- package/dist/native/generated.d.ts +78 -7
- package/dist/native/generated.d.ts.map +1 -1
- package/dist/rpc/RpcProvider.d.ts +6 -0
- package/dist/rpc/RpcProvider.d.ts.map +1 -1
- package/dist/rpc/RpcProvider.js +4 -1
- package/dist/rpc/RpcProvider.js.map +1 -1
- package/dist/rpc/RpcRouter.d.ts +27 -14
- package/dist/rpc/RpcRouter.d.ts.map +1 -1
- package/dist/rpc/RpcRouter.js +95 -38
- package/dist/rpc/RpcRouter.js.map +1 -1
- package/dist/scheduler/locks/RedisLockBackend.d.ts.map +1 -1
- package/dist/scheduler/locks/RedisLockBackend.js +13 -2
- package/dist/scheduler/locks/RedisLockBackend.js.map +1 -1
- package/dist/security/CookieSigner.d.ts.map +1 -1
- package/dist/security/CookieSigner.js +17 -3
- package/dist/security/CookieSigner.js.map +1 -1
- package/dist/security/SignedUrl.d.ts.map +1 -1
- package/dist/security/SignedUrl.js +6 -1
- package/dist/security/SignedUrl.js.map +1 -1
- package/dist/server/Server.d.ts +41 -12
- package/dist/server/Server.d.ts.map +1 -1
- package/dist/server/Server.js +31 -10
- package/dist/server/Server.js.map +1 -1
- package/dist/server/nativeGrpc.d.ts +27 -0
- package/dist/server/nativeGrpc.d.ts.map +1 -0
- package/dist/server/nativeGrpc.js +47 -0
- package/dist/server/nativeGrpc.js.map +1 -0
- package/dist/server/nativeLimits.d.ts +49 -0
- package/dist/server/nativeLimits.d.ts.map +1 -0
- package/dist/server/nativeLimits.js +67 -0
- package/dist/server/nativeLimits.js.map +1 -0
- package/dist/session/Session.d.ts +12 -0
- package/dist/session/Session.d.ts.map +1 -1
- package/dist/session/Session.js.map +1 -1
- package/dist/session/SessionMiddleware.d.ts.map +1 -1
- package/dist/session/SessionMiddleware.js +28 -9
- package/dist/session/SessionMiddleware.js.map +1 -1
- package/dist/session/config.d.ts +5 -0
- package/dist/session/config.d.ts.map +1 -1
- package/dist/session/config.js +8 -0
- package/dist/session/config.js.map +1 -1
- package/dist/session/drivers/MemoryDriver.d.ts.map +1 -1
- package/dist/session/drivers/MemoryDriver.js +12 -5
- package/dist/session/drivers/MemoryDriver.js.map +1 -1
- package/dist/session/errors.d.ts +17 -0
- package/dist/session/errors.d.ts.map +1 -1
- package/dist/session/errors.js +21 -0
- package/dist/session/errors.js.map +1 -1
- package/dist/session/templateTags.d.ts +14 -0
- package/dist/session/templateTags.d.ts.map +1 -1
- package/dist/session/templateTags.js +45 -17
- package/dist/session/templateTags.js.map +1 -1
- package/dist/storage/StaticMiddleware.d.ts.map +1 -1
- package/dist/storage/StaticMiddleware.js +29 -18
- package/dist/storage/StaticMiddleware.js.map +1 -1
- package/events.darwin-arm64.node +0 -0
- package/events.darwin-x64.node +0 -0
- package/events.win32-x64-msvc.node +0 -0
- package/index.darwin-arm64.node +0 -0
- package/index.darwin-x64.node +0 -0
- package/index.linux-arm64-gnu.node +0 -0
- package/index.linux-x64-gnu.node +0 -0
- package/index.win32-x64-msvc.node +0 -0
- package/package.json +11 -2
- package/scheduler.darwin-arm64.node +0 -0
- package/scheduler.darwin-x64.node +0 -0
- package/scheduler.win32-x64-msvc.node +0 -0
- package/src/Codemods.ts +265 -0
- package/src/Ignitor.ts +37 -22
- package/src/bodyparser/BodyParserMiddleware.ts +3 -0
- package/src/bodyparser/qsParse.ts +69 -14
- package/src/codemods/source.ts +303 -0
- package/src/graphql/GraphQLEngine.ts +3 -2
- package/src/http/Exception.ts +17 -2
- package/src/http/HttpContext.ts +14 -1
- package/src/http/RedirectBuilder.ts +48 -37
- package/src/http/Request.ts +87 -29
- package/src/http/SseStream.ts +6 -7
- package/src/http/permissions.ts +31 -0
- package/src/http-client/HttpClient.ts +505 -0
- package/src/http-client/addresses.ts +58 -0
- package/src/http-client/fake.ts +141 -0
- package/src/http-client/index.ts +21 -0
- package/src/index.ts +5 -1
- package/src/middleware/Pipeline.ts +7 -3
- package/src/native/generated.ts +89 -7
- package/src/rpc/RpcProvider.ts +10 -1
- package/src/rpc/RpcRouter.ts +126 -42
- package/src/scheduler/locks/RedisLockBackend.ts +12 -4
- package/src/security/CookieSigner.ts +17 -3
- package/src/security/SignedUrl.ts +6 -1
- package/src/server/Server.ts +57 -12
- package/src/server/nativeGrpc.ts +59 -0
- package/src/server/nativeLimits.ts +94 -0
- package/src/session/Session.ts +16 -0
- package/src/session/SessionMiddleware.ts +30 -10
- package/src/session/config.ts +7 -0
- package/src/session/drivers/MemoryDriver.ts +11 -5
- package/src/session/errors.ts +31 -0
- package/src/session/templateTags.ts +57 -0
- package/src/storage/StaticMiddleware.ts +28 -18
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"HttpContext.js","sourceRoot":"","sources":["../../src/http/HttpContext.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAQpD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;
|
|
1
|
+
{"version":3,"file":"HttpContext.js","sourceRoot":"","sources":["../../src/http/HttpContext.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAQpD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AA+HxC,+EAA+E;AAC/E,SAAS,aAAa,CAAC,aAAqB;IAC1C,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,IAA8B,EAAQ,EAAE;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,aAAa,KAAK,OAAO,GAAG,IAAI,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAA;IACD,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;KACtC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,IAAmC,EACnC,aAAqB;IAErB,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,CAAA;IAC9C,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChF,CAAC;AAkBD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAgB;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,UAA2C,CAAA;IACpE,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IACxD,OAAO,GAAG,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAe,CAAA;AAE/D;;;;;;;;GAQG;AACH,IAAI,wBAAwB,GAAG,IAAI,CAAA;AAEnC,MAAM,OAAO,WAAY,SAAQ,SAAS;IACxC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,CAAI,GAAgB,EAAE,EAAW;QACzC,IAAI,CAAC,wBAAwB;YAAE,OAAO,EAAE,EAAE,CAAA;QAC1C,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,KAAK,sBAAsB;QAC/B,OAAO,wBAAwB,CAAA;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAAC,OAAgB;QAC1C,wBAAwB,GAAG,OAAO,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,GAAG;QACR,IAAI,CAAC,wBAAwB;YAAE,OAAO,IAAI,CAAA;QAC1C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAA;IAC9C,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,SAAS;QACd,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,oLAAoL,CACrL,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAA;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,8KAA8K,CAC/K,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAI,EAAW;QACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,OAAO;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAA;QACnD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,GAAG,CAAA;IACpE,CAAC;IAED,qCAAqC;IAC5B,EAAE,CAAQ;IAEnB,0BAA0B;IACjB,OAAO,CAAS;IAEzB,mCAAmC;IAC1B,QAAQ,CAAU;IAE3B,uDAAuD;IACvD,mFAAmF;IACnF;;;;;;;OAOG;IACM,MAAM,CAAe;IAE9B,2CAA2C;IAClC,KAAK,CAAW;IAEzB,2DAA2D;IAC3D,IAAI,GAAc,EAAE,eAAe,EAAE,KAAK,EAAE,CAAA;IAE5C;;;;OAIG;IACH,MAAM,GAAG,IAAI,CAAA;IAEb,4EAA4E;IACnE,KAAK,GAAyB,IAAI,GAAG,EAAE,CAAA;IAEhD;;;;;OAKG;IACH,OAAO,CAAU;IAEjB;;;;OAIG;IACH,MAAM,CAAU;IAEhB;;;;OAIG;IACH,OAAO,CAAa;IAEpB;;;;;;;OAOG;IACM,iBAAiB,CAAoB;IAE9C,4DAA4D;IAC5D,OAAO,CAAgB;IAEvB,yEAAyE;IACzE,WAAW,CAAoB;IAE/B,mDAAmD;IACnD,iBAAiB,CAAmB;IAEpC;;;;OAIG;IACH,IAAI,MAAM;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,2EAA2E;IAC3E,aAAa,CAAC,MAAyB;QACrC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAA;IAC3B,CAAC;IAED,4FAA4F;IAC5F,eAAe,CAAC,MAAoB;QAClC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,yFAAyF;IACzF,YAAY,CAAC,SAAoB;QAC/B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAED,kEAAkE;IAClE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,4FAA4F;IAC5F,IAAI,QAAQ;QACV,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IACzD,CAAC;IAED,YACE,EAAU,EACV,UAAsB,EACtB,MAAqB,EACrB,KAAgB,EAChB,iBAAqC;QAErC,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;QAC9B,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtC,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvC,0EAA0E;QAC1E,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAA;QACxB,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC;SACtC,CAAC,CAAA;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,IAAI,CAAA;QAEjF,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAC9B,GAAG,EAAE,CACH,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAClC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,SAAS;YACvD,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;SACzC,CAAC,CACL,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,mBAAmB,CAAC,QAA0B;QAC5C,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAA;IACnC,CAAC;CACF;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,MAA0B;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;IACnD,OAAO,OAAO,IAAI,SAAS,CAAA;AAC7B,CAAC"}
|
|
@@ -25,8 +25,14 @@ export declare class RedirectBuilder {
|
|
|
25
25
|
*/
|
|
26
26
|
allowedHosts: string[];
|
|
27
27
|
constructor(response: Response, options?: {
|
|
28
|
+
/** The request path with its query string. */
|
|
28
29
|
requestUrl?: string;
|
|
29
30
|
requestReferer?: string;
|
|
31
|
+
/**
|
|
32
|
+
* The request authority (`:authority` or `Host`, never X-Forwarded-Host)
|
|
33
|
+
* an absolute redirect target must match.
|
|
34
|
+
*/
|
|
35
|
+
requestAuthority?: string;
|
|
30
36
|
routeUrlResolver?: RouteUrlResolver;
|
|
31
37
|
/** The request session, for the intended-URL methods. */
|
|
32
38
|
session?: IntendedUrlStore;
|
|
@@ -79,9 +85,9 @@ export declare class RedirectBuilder {
|
|
|
79
85
|
/** Redirect to a named route. */
|
|
80
86
|
toRoute(name: string, params?: Record<string, string>): void;
|
|
81
87
|
/**
|
|
82
|
-
* Redirect back to the previous page (
|
|
83
|
-
*
|
|
84
|
-
*
|
|
88
|
+
* Redirect back to the previous page (AdonisJS `back`): the path of
|
|
89
|
+
* {@link getPreviousUrl}, so the redirect never leaves the site; `withQs()`
|
|
90
|
+
* forwards the previous page's query string, not the current request's.
|
|
85
91
|
*/
|
|
86
92
|
back(fallback?: string): void;
|
|
87
93
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RedirectBuilder.d.ts","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"RedirectBuilder.d.ts","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAA;AAkCxF,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,qBAAa,eAAe;;IAC1B;;;;;OAKG;IACH,YAAY,EAAE,MAAM,EAAE,CAAK;gBAezB,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE;QACR,8CAA8C;QAC9C,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;QACnC,yDAAyD;QACzD,OAAO,CAAC,EAAE,gBAAgB,CAAA;QAC1B,8DAA8D;QAC9D,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,8DAA8D;QAC9D,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB;IAYH;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,SAAQ,GAAG,IAAI;IAarC;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,SAAM,GAAG,IAAI;IAKhC,iFAAiF;IACjF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAiBpE,gCAAgC;IAChC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAK1B;;;;;;;;;;OAUG;IACH,MAAM,IAAI,IAAI;IACd,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAkB1C,uEAAuE;IACvE,OAAO,IAAI,IAAI;IAMf,gDAAgD;IAChD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAY1B,iCAAiC;IACjC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAQ5D;;;;OAIG;IACH,IAAI,CAAC,QAAQ,SAAM,GAAG,IAAI;IAK1B;;;;;;;OAOG;IACH,cAAc,CAAC,QAAQ,SAAM,GAAG,MAAM;CA0BvC"}
|
|
@@ -8,31 +8,35 @@
|
|
|
8
8
|
* response.redirect().withQs({ page: '2' }).toPath('/results')
|
|
9
9
|
* response.redirect().toRoute('posts.show', { id: '42' })
|
|
10
10
|
*/
|
|
11
|
-
|
|
11
|
+
/**
|
|
12
|
+
* AdonisJS `isValidRedirectUrl`: a relative path, or an absolute URL whose host
|
|
13
|
+
* is the request authority or an allowed host.
|
|
14
|
+
*/
|
|
15
|
+
function isTrustedRedirect(url, authority, allowedHosts) {
|
|
12
16
|
// A relative path is trusted only when it starts with a single "/" and has no
|
|
13
17
|
// backslash: browsers normalise "\" to "/", so "/\evil.com" would become the
|
|
14
18
|
// protocol-relative "//evil.com" that a lone `!startsWith("//")` check misses.
|
|
15
|
-
if (
|
|
19
|
+
if (url.startsWith('/') && !url.startsWith('//') && !url.includes('\\'))
|
|
16
20
|
return true;
|
|
17
|
-
let
|
|
21
|
+
let parsed;
|
|
18
22
|
try {
|
|
19
|
-
|
|
23
|
+
parsed = new URL(url);
|
|
20
24
|
}
|
|
21
25
|
catch {
|
|
22
26
|
return false;
|
|
23
27
|
}
|
|
24
|
-
|
|
25
|
-
// — that is what the list is for (AdonisJS `allowedHosts`).
|
|
26
|
-
if (allowedHosts.includes(ref.host))
|
|
28
|
+
if (allowedHosts.includes(parsed.host))
|
|
27
29
|
return true;
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
30
|
+
// Upstream accepts any absolute URL when it knows no host to compare with;
|
|
31
|
+
// refusing it is the safer reading of an attacker-controlled header.
|
|
32
|
+
return authority !== undefined && parsed.host === authority;
|
|
33
|
+
}
|
|
34
|
+
/** The query string of a path or URL, without the "?". */
|
|
35
|
+
function searchOf(url) {
|
|
36
|
+
if (url === undefined)
|
|
37
|
+
return '';
|
|
38
|
+
const index = url.indexOf('?');
|
|
39
|
+
return index === -1 ? '' : url.slice(index + 1);
|
|
36
40
|
}
|
|
37
41
|
export class RedirectBuilder {
|
|
38
42
|
/**
|
|
@@ -48,6 +52,7 @@ export class RedirectBuilder {
|
|
|
48
52
|
#forwardQs = false;
|
|
49
53
|
#requestUrl;
|
|
50
54
|
#requestReferer;
|
|
55
|
+
#requestAuthority;
|
|
51
56
|
#routeUrlResolver;
|
|
52
57
|
#session;
|
|
53
58
|
#isAjax = false;
|
|
@@ -56,6 +61,7 @@ export class RedirectBuilder {
|
|
|
56
61
|
this.#response = response;
|
|
57
62
|
this.#requestUrl = options?.requestUrl;
|
|
58
63
|
this.#requestReferer = options?.requestReferer;
|
|
64
|
+
this.#requestAuthority = options?.requestAuthority;
|
|
59
65
|
this.#routeUrlResolver = options?.routeUrlResolver;
|
|
60
66
|
this.#session = options?.session;
|
|
61
67
|
this.#isAjax = options?.isAjax ?? false;
|
|
@@ -104,14 +110,9 @@ export class RedirectBuilder {
|
|
|
104
110
|
#safeIntended(intended, fallback) {
|
|
105
111
|
if (!intended)
|
|
106
112
|
return fallback;
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
// A protocol-relative `//evil.com` is absolute to a browser even though it
|
|
111
|
-
// looks relative — reject it whether or not a request URL is known.
|
|
112
|
-
if (intended.startsWith('//'))
|
|
113
|
-
return fallback;
|
|
114
|
-
return intended;
|
|
113
|
+
return isTrustedRedirect(intended, this.#requestAuthority, this.allowedHosts)
|
|
114
|
+
? intended
|
|
115
|
+
: fallback;
|
|
115
116
|
}
|
|
116
117
|
/** Set redirect status code. */
|
|
117
118
|
status(code) {
|
|
@@ -142,7 +143,11 @@ export class RedirectBuilder {
|
|
|
142
143
|
}
|
|
143
144
|
/** Redirect to an absolute or relative path. */
|
|
144
145
|
toPath(path) {
|
|
145
|
-
|
|
146
|
+
this.#send(path, searchOf(this.#requestUrl));
|
|
147
|
+
}
|
|
148
|
+
/** Redirect with `withQs()` forwarding `forwardedSearch` (a query string without "?"). */
|
|
149
|
+
#send(path, forwardedSearch) {
|
|
150
|
+
const url = this.#appendQs(path, forwardedSearch);
|
|
146
151
|
this.#response.status(this.#status);
|
|
147
152
|
this.#response.header('location', url);
|
|
148
153
|
this.#response.setBody('');
|
|
@@ -156,12 +161,13 @@ export class RedirectBuilder {
|
|
|
156
161
|
this.toPath(path);
|
|
157
162
|
}
|
|
158
163
|
/**
|
|
159
|
-
* Redirect back to the previous page (
|
|
160
|
-
*
|
|
161
|
-
*
|
|
164
|
+
* Redirect back to the previous page (AdonisJS `back`): the path of
|
|
165
|
+
* {@link getPreviousUrl}, so the redirect never leaves the site; `withQs()`
|
|
166
|
+
* forwards the previous page's query string, not the current request's.
|
|
162
167
|
*/
|
|
163
168
|
back(fallback = '/') {
|
|
164
|
-
|
|
169
|
+
const previous = new URL(this.getPreviousUrl(fallback), 'http://localhost');
|
|
170
|
+
this.#send(previous.pathname, previous.search.slice(1));
|
|
165
171
|
}
|
|
166
172
|
/**
|
|
167
173
|
* Where "back" goes (AdonisJS `getPreviousUrl`).
|
|
@@ -173,7 +179,7 @@ export class RedirectBuilder {
|
|
|
173
179
|
*/
|
|
174
180
|
getPreviousUrl(fallback = '/') {
|
|
175
181
|
const referer = this.#requestReferer;
|
|
176
|
-
if (referer &&
|
|
182
|
+
if (referer && isTrustedRedirect(referer, this.#requestAuthority, this.allowedHosts)) {
|
|
177
183
|
return referer;
|
|
178
184
|
}
|
|
179
185
|
return fallback;
|
|
@@ -183,15 +189,11 @@ export class RedirectBuilder {
|
|
|
183
189
|
* uses, so `withQs()` plus `withQs('page', 2)` overrides an inbound `page`
|
|
184
190
|
* rather than being overridden by it.
|
|
185
191
|
*/
|
|
186
|
-
#appendQs(path) {
|
|
192
|
+
#appendQs(path, forwardedSearch) {
|
|
187
193
|
const params = new URLSearchParams();
|
|
188
|
-
if (this.#forwardQs
|
|
189
|
-
const
|
|
190
|
-
|
|
191
|
-
for (const [key, value] of new URLSearchParams(this.#requestUrl.slice(qsIdx + 1))) {
|
|
192
|
-
params.append(key, value);
|
|
193
|
-
}
|
|
194
|
-
}
|
|
194
|
+
if (this.#forwardQs) {
|
|
195
|
+
for (const [key, value] of new URLSearchParams(forwardedSearch))
|
|
196
|
+
params.append(key, value);
|
|
195
197
|
}
|
|
196
198
|
for (const [key, value] of Object.entries(this.#qs)) {
|
|
197
199
|
if (value === undefined || value === null)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RedirectBuilder.js","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,SAAS,
|
|
1
|
+
{"version":3,"file":"RedirectBuilder.js","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;GAGG;AACH,SAAS,iBAAiB,CACxB,GAAW,EACX,SAA6B,EAC7B,YAA+B;IAE/B,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,2EAA2E;IAC3E,qEAAqE;IACrE,OAAO,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAA;AAC7D,CAAC;AAED,0DAA0D;AAC1D,SAAS,QAAQ,CAAC,GAAuB;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;AACjD,CAAC;AAQD,MAAM,OAAO,eAAe;IAC1B;;;;;OAKG;IACH,YAAY,GAAa,EAAE,CAAA;IAE3B,SAAS,CAAU;IACnB,OAAO,GAAG,GAAG,CAAA;IACb,GAAG,GAA4B,EAAE,CAAA;IACjC,UAAU,GAAG,KAAK,CAAA;IAClB,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,iBAAiB,CAAS;IAC1B,iBAAiB,CAAmB;IACpC,QAAQ,CAAmB;IAC3B,OAAO,GAAG,KAAK,CAAA;IACf,SAAS,GAAG,IAAI,CAAA;IAEhB,YACE,QAAkB,EAClB,OAgBC;QAED,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,UAAU,CAAA;QACtC,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,cAAc,CAAA;QAC9C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,gBAAgB,CAAA;QAClD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,gBAAgB,CAAA;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAA;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAA;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,GAAG,KAAK;QAC5B,IACE,IAAI,CAAC,QAAQ;YACb,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK;YAC9B,CAAC,IAAI,CAAC,OAAO;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,WAAW,EAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,GAAG,GAAG;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,iFAAiF;IACjF,eAAe,CAAC,IAAY,EAAE,MAA+B;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC1E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,aAAa,CAA0B,QAAuB,EAAE,QAAW;QACzE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC9B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC;YAC3E,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAA;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAiBD,MAAM,CAAC,IAAiD,EAAE,KAAe;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,uEAAuE;IACvE,OAAO;QACL,IAAI,CAAC,GAAG,GAAG,EAAE,CAAA;QACb,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,IAAY,EAAE,eAAuB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC;IAED,iCAAiC;IACjC,OAAO,CAAC,IAAY,EAAE,MAA+B;QACnD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,QAAQ,GAAG,GAAG;QACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,QAAQ,GAAG,GAAG;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAA;QACpC,IAAI,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrF,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,IAAY,EAAE,eAAuB;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,eAAe,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5F,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAQ;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAA;IAC/D,CAAC;CACF"}
|
package/dist/http/Request.d.ts
CHANGED
|
@@ -27,6 +27,26 @@ export interface RawRequest {
|
|
|
27
27
|
* `ip()` accessor falls back to legacy header parsing.
|
|
28
28
|
*/
|
|
29
29
|
ip?: string;
|
|
30
|
+
/**
|
|
31
|
+
* The trusted address chain, closest hop first — the socket peer, then each
|
|
32
|
+
* `X-Forwarded-For` entry the Rust layer walked right to left while the hop
|
|
33
|
+
* before it was a trusted proxy. Its last entry is {@link ip}. Absent in
|
|
34
|
+
* hand-built fixtures, where the chain is the peer alone.
|
|
35
|
+
*/
|
|
36
|
+
ips?: string[];
|
|
37
|
+
/**
|
|
38
|
+
* Whether the socket peer is one of the trusted proxies configured with
|
|
39
|
+
* `server.trustedProxies()`, as the Rust layer decided against the same
|
|
40
|
+
* list that resolves {@link ip}. Absent in hand-built fixtures: untrusted.
|
|
41
|
+
*/
|
|
42
|
+
peerTrusted?: boolean;
|
|
43
|
+
/**
|
|
44
|
+
* The body was over its content type's limit (`config/bodyparser.ts`): the
|
|
45
|
+
* Rust layer did not keep it, and `body` is empty. Reading the body then
|
|
46
|
+
* throws `E_REQUEST_ENTITY_TOO_LARGE` instead of handing back nothing as if
|
|
47
|
+
* nothing had been sent.
|
|
48
|
+
*/
|
|
49
|
+
bodyTooLarge?: boolean;
|
|
30
50
|
/**
|
|
31
51
|
* Connection scheme as seen by the server (`http`/`https`), when the Rust
|
|
32
52
|
* layer ships it. Defaults to `http` in `protocol()` when absent; the
|
|
@@ -167,13 +187,6 @@ export declare class Request extends Macroable {
|
|
|
167
187
|
* desired resolved value.
|
|
168
188
|
*/
|
|
169
189
|
ip(): string;
|
|
170
|
-
/**
|
|
171
|
-
* Enable/disable trusting proxy headers (`X-Forwarded-Proto`/`-Host`/`-For`)
|
|
172
|
-
* for `protocol()`/`host()`/`ips()`. OFF by default — turning it on when the
|
|
173
|
-
* app is NOT behind a trusted proxy lets clients spoof their scheme/host/IP,
|
|
174
|
-
* so it's an explicit opt-in (same stance as {@link setMethodSpoofing}).
|
|
175
|
-
*/
|
|
176
|
-
setTrustProxy(enabled: boolean): void;
|
|
177
190
|
/**
|
|
178
191
|
* The HTTP/2 `:authority` pseudo-header, falling back to `Host` (AdonisJS
|
|
179
192
|
* `authority`).
|
|
@@ -187,22 +200,27 @@ export declare class Request extends Macroable {
|
|
|
187
200
|
authority(): string | null;
|
|
188
201
|
/**
|
|
189
202
|
* The request host including port (AdonisJS `host`). Honours
|
|
190
|
-
* `X-Forwarded-Host` ONLY when
|
|
191
|
-
* header. Returns null when
|
|
203
|
+
* `X-Forwarded-Host` ONLY when the request came through a trusted proxy (see
|
|
204
|
+
* `server.trustedProxies()`); otherwise the `Host` header. Returns null when
|
|
205
|
+
* neither is present.
|
|
192
206
|
*/
|
|
193
207
|
host(): string | null;
|
|
194
208
|
/**
|
|
195
|
-
* The request protocol — `http` or `https` (AdonisJS `protocol`).
|
|
196
|
-
* `
|
|
197
|
-
*
|
|
209
|
+
* The request protocol — `http` or `https` (AdonisJS `protocol`). A TLS
|
|
210
|
+
* connection is `https` whatever the headers say. Otherwise
|
|
211
|
+
* `X-Forwarded-Proto` is honoured only when the request came through a
|
|
212
|
+
* trusted proxy (see `server.trustedProxies()`), and the connection scheme
|
|
213
|
+
* the Rust layer reported (defaulting to `http`) is used when it is not.
|
|
198
214
|
*/
|
|
199
215
|
protocol(): string;
|
|
200
216
|
/** True when the request protocol is `https` (AdonisJS `secure`). */
|
|
201
217
|
secure(): boolean;
|
|
202
218
|
/**
|
|
203
|
-
* The
|
|
204
|
-
* `X-Forwarded-For`
|
|
205
|
-
*
|
|
219
|
+
* The trusted address chain, closest hop first (AdonisJS `ips`): the socket
|
|
220
|
+
* peer, then each `X-Forwarded-For` hop a trusted proxy vouched for. The
|
|
221
|
+
* last entry is {@link ip}. Hops added by an untrusted peer are not in it —
|
|
222
|
+
* the Rust layer stops at the first address it does not trust, so the chain
|
|
223
|
+
* goes past the peer only when {@link peerTrusted} holds.
|
|
206
224
|
*/
|
|
207
225
|
ips(): string[];
|
|
208
226
|
/** The request hostname without port (AdonisJS `hostname`), or null. */
|
|
@@ -282,9 +300,16 @@ export declare class Request extends Macroable {
|
|
|
282
300
|
* `purpose`. Returns false without an APP_KEY-backed signer.
|
|
283
301
|
*/
|
|
284
302
|
hasValidSignature(purpose?: string): boolean;
|
|
285
|
-
/**
|
|
303
|
+
/**
|
|
304
|
+
* Get the raw body as a string (decoded from base64 if binary). Throws
|
|
305
|
+
* `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit: what
|
|
306
|
+
* the server kept of it is nothing, and nothing is not the body.
|
|
307
|
+
*/
|
|
286
308
|
raw(): string;
|
|
287
|
-
/**
|
|
309
|
+
/**
|
|
310
|
+
* Get the raw body as a Buffer (preserves binary integrity for file uploads).
|
|
311
|
+
* Throws `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit.
|
|
312
|
+
*/
|
|
288
313
|
rawBuffer(): Buffer;
|
|
289
314
|
/** Get a single request header (case-insensitive), or `defaultValue` when absent. */
|
|
290
315
|
header(key: string): string | undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Request.d.ts","sourceRoot":"","sources":["../../src/http/Request.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;
|
|
1
|
+
{"version":3,"file":"Request.d.ts","sourceRoot":"","sources":["../../src/http/Request.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAGjD,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAA;AAI9B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;IAChC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC9C,KAAK,EAAE,KAAK,CAAC;YACX,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,EAAE,MAAM,CAAA;YAClB,WAAW,EAAE,MAAM,CAAA;YACnB,IAAI,EAAE,MAAM,CAAA;YACZ,UAAU,EAAE,MAAM,CAAA;SACnB,CAAC,CAAA;KACH,CAAA;IACD;;;;OAIG;IACH,OAAO,CAAC,EAAE,IAAI,CAAA;CACf;AAED,qBAAa,OAAQ,SAAQ,SAAS;;IAiBpC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;gBAEX,GAAG,EAAE,UAAU,EAAE,MAAM,GAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAM;IAQjE;;;;;;OAMG;IACH,MAAM,IAAI,MAAM;IAQhB,mFAAmF;IACnF,QAAQ,IAAI,MAAM;IAIlB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAIzC,gGAAgG;IAChG,WAAW,CAAC,QAAQ,EAAE;QAAE,KAAK,IAAI,OAAO,CAAA;KAAE,GAAG,IAAI;IAIjD,wFAAwF;IACxF,YAAY,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIhF;;;;OAIG;IACH,KAAK,IAAI,OAAO;IAIhB,wDAAwD;IACxD,KAAK,IAAI,OAAO;IAIhB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO;IASpD;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIzC;;;;;;;OAOG;IACH,GAAG,CAAC,SAAS,UAAQ,GAAG,MAAM;IAO9B,2CAA2C;IAC3C,IAAI,IAAI,MAAM;IAId;;;;;;;;;;;;;;;OAeG;IACH,EAAE,IAAI,MAAM;IAmBZ;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI;IAM1B;;;;;OAKG;IACH,IAAI,IAAI,MAAM,GAAG,IAAI;IAWrB;;;;;;OAMG;IACH,QAAQ,IAAI,MAAM;IAUlB,qEAAqE;IACrE,MAAM,IAAI,OAAO;IAIjB;;;;;;OAMG;IACH,GAAG,IAAI,MAAM,EAAE;IAMf,wEAAwE;IACxE,QAAQ,IAAI,MAAM,GAAG,IAAI;IASzB;;;;OAIG;IACH,UAAU,CAAC,MAAM,SAAI,GAAG,MAAM,EAAE;IAQhC;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAqBf,sEAAsE;IACtE,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAI3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAClD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAc1D;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI;IAC/C,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC;IAC1F,WAAW,CAAC,CAAC,GAAG,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,EACvB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9B,CAAC,GAAG,IAAI;IACX,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC,GAAG,IAAI;IAclG;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAC5C,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOnE,oFAAoF;IACpF,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAIxC;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAO5C;;;;OAIG;IACH,GAAG,IAAI,MAAM;IASb;;;OAGG;IACH,SAAS,IAAI,MAAM;IAUnB,qFAAqF;IACrF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK9D,+BAA+B;IAC/B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC;IAMzB;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7D,oEAAoE;IACpE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAM3C;;;;;OAKG;IACH,EAAE,IAAI,MAAM,GAAG,SAAS;IAIxB,2EAA2E;IAC3E,SAAS,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAShE,4DAA4D;IAC5D,IAAI,IAAI,OAAO;IAIf,0DAA0D;IAC1D,IAAI,IAAI,OAAO;IAIf;;;;;;;OAOG;IACH,QAAQ,IAAI,OAAO;IAWnB;;;;OAIG;IACH,WAAW,CAAC,kBAAkB,UAAQ,GAAG,MAAM;IAK/C;;;;;;;OAOG;IACH,cAAc,CAAC,YAAY,GAAE,MAAM,EAAO,EAAE,QAAQ,SAAM,GAAG,MAAM;IAgBnE,0EAA0E;IAC1E,KAAK,IAAI,MAAM,EAAE;IAIjB,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB,0EAA0E;IAC1E,QAAQ,IAAI,MAAM,EAAE;IAIpB;;;;OAIG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAIlD,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IA6CpD,qDAAqD;IACrD,WAAW,IAAI,IAAI;IAInB;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAkBpC,uEAAuE;IACvE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjC;;;;;;;;OAQG;IACH,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAexC,4CAA4C;IAC5C,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;IAanB,mCAAmC;IACnC,IAAI,IAAI,OAAO;IAOf;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC;IAMpD,qDAAqD;IACrD,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;IA8BpB;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,EACb,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,CAAC;IAIb,0EAA0E;IAC1E,gBAAgB,CAAC,CAAC,EAChB,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAIvC;;;OAGG;IACH,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;IAKzB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAInC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAIrC;;;;OAIG;IACH,OAAO,IAAI,OAAO;IASlB,wEAAwE;IACxE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAYlC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAiB/C;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAoBhD,0CAA0C;IAC1C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,GAAG,IAAI;IAOhE,+CAA+C;IAC/C,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,EAAE;IAQ3D,8BAA8B;IAC9B,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,CAAC;IAIjF;;;;;;OAMG;IACH,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS;IAI7D,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,GAAG,IAAI;IAW/E,uEAAuE;IACvE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKxC;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAMnC;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIpC;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAIjC;;;;;;OAMG;IACH,SAAS,IAAI,OAAO;CA2CrB"}
|
package/dist/http/Request.js
CHANGED
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
import { parseQueryString } from '../bodyparser/qsParse.js';
|
|
10
10
|
import { Macroable } from '../utils/Macroable.js';
|
|
11
11
|
import { getPath, omitPaths, pickPaths } from '../utils/objectPath.js';
|
|
12
|
+
import { Exception } from './Exception.js';
|
|
12
13
|
import { RequestValidator } from './RequestValidator.js';
|
|
13
14
|
import { unpackCookieValue } from './Response.js';
|
|
14
15
|
export class Request extends Macroable {
|
|
@@ -17,7 +18,6 @@ export class Request extends Macroable {
|
|
|
17
18
|
#cookieSigner;
|
|
18
19
|
#signedUrl;
|
|
19
20
|
#allowMethodSpoofing = false;
|
|
20
|
-
#trustProxy = false;
|
|
21
21
|
#routeInfo;
|
|
22
22
|
#response;
|
|
23
23
|
#parsedBody;
|
|
@@ -173,13 +173,17 @@ export class Request extends Macroable {
|
|
|
173
173
|
return this.#raw.remoteAddr ?? '127.0.0.1';
|
|
174
174
|
}
|
|
175
175
|
/**
|
|
176
|
-
*
|
|
177
|
-
*
|
|
178
|
-
*
|
|
179
|
-
*
|
|
176
|
+
* Whether the socket peer is one of the trusted proxies configured with
|
|
177
|
+
* `server.trustedProxies()` — the condition under which `X-Forwarded-Proto`
|
|
178
|
+
* and `X-Forwarded-Host` are believed by {@link protocol} and {@link host}.
|
|
179
|
+
*
|
|
180
|
+
* The decision is the Rust layer's (`peerTrusted`), made once per request
|
|
181
|
+
* against the same list that resolves {@link ip}, so a trusted proxy that
|
|
182
|
+
* forwards the scheme or host without an `X-Forwarded-For` is believed too.
|
|
183
|
+
* A request without the flag — a hand-built fixture — is untrusted.
|
|
180
184
|
*/
|
|
181
|
-
|
|
182
|
-
this.#
|
|
185
|
+
#peerIsTrustedProxy() {
|
|
186
|
+
return this.#raw.peerTrusted === true;
|
|
183
187
|
}
|
|
184
188
|
/**
|
|
185
189
|
* The HTTP/2 `:authority` pseudo-header, falling back to `Host` (AdonisJS
|
|
@@ -199,11 +203,12 @@ export class Request extends Macroable {
|
|
|
199
203
|
}
|
|
200
204
|
/**
|
|
201
205
|
* The request host including port (AdonisJS `host`). Honours
|
|
202
|
-
* `X-Forwarded-Host` ONLY when
|
|
203
|
-
* header. Returns null when
|
|
206
|
+
* `X-Forwarded-Host` ONLY when the request came through a trusted proxy (see
|
|
207
|
+
* `server.trustedProxies()`); otherwise the `Host` header. Returns null when
|
|
208
|
+
* neither is present.
|
|
204
209
|
*/
|
|
205
210
|
host() {
|
|
206
|
-
if (this.#
|
|
211
|
+
if (this.#peerIsTrustedProxy()) {
|
|
207
212
|
const forwarded = this.#raw.headers['x-forwarded-host'];
|
|
208
213
|
// The first hop in the list, named rather than indexed: `split` always
|
|
209
214
|
// yields one element, and saying so beats being told it might not.
|
|
@@ -214,12 +219,16 @@ export class Request extends Macroable {
|
|
|
214
219
|
return this.#raw.headers.host ?? null;
|
|
215
220
|
}
|
|
216
221
|
/**
|
|
217
|
-
* The request protocol — `http` or `https` (AdonisJS `protocol`).
|
|
218
|
-
* `
|
|
219
|
-
*
|
|
222
|
+
* The request protocol — `http` or `https` (AdonisJS `protocol`). A TLS
|
|
223
|
+
* connection is `https` whatever the headers say. Otherwise
|
|
224
|
+
* `X-Forwarded-Proto` is honoured only when the request came through a
|
|
225
|
+
* trusted proxy (see `server.trustedProxies()`), and the connection scheme
|
|
226
|
+
* the Rust layer reported (defaulting to `http`) is used when it is not.
|
|
220
227
|
*/
|
|
221
228
|
protocol() {
|
|
222
|
-
if (this.#
|
|
229
|
+
if (this.#raw.scheme === 'https')
|
|
230
|
+
return 'https';
|
|
231
|
+
if (this.#peerIsTrustedProxy()) {
|
|
223
232
|
const forwarded = this.#raw.headers['x-forwarded-proto'];
|
|
224
233
|
const [first] = forwarded?.split(',') ?? [];
|
|
225
234
|
if (first !== undefined)
|
|
@@ -232,20 +241,16 @@ export class Request extends Macroable {
|
|
|
232
241
|
return this.protocol() === 'https';
|
|
233
242
|
}
|
|
234
243
|
/**
|
|
235
|
-
* The
|
|
236
|
-
* `X-Forwarded-For`
|
|
237
|
-
*
|
|
244
|
+
* The trusted address chain, closest hop first (AdonisJS `ips`): the socket
|
|
245
|
+
* peer, then each `X-Forwarded-For` hop a trusted proxy vouched for. The
|
|
246
|
+
* last entry is {@link ip}. Hops added by an untrusted peer are not in it —
|
|
247
|
+
* the Rust layer stops at the first address it does not trust, so the chain
|
|
248
|
+
* goes past the peer only when {@link peerTrusted} holds.
|
|
238
249
|
*/
|
|
239
250
|
ips() {
|
|
240
|
-
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
return forwarded
|
|
244
|
-
.split(',')
|
|
245
|
-
.map((value) => value.trim())
|
|
246
|
-
.filter((value) => value.length > 0);
|
|
247
|
-
}
|
|
248
|
-
}
|
|
251
|
+
const chain = this.#raw.ips;
|
|
252
|
+
if (chain && chain.length > 0 && this.#peerIsTrustedProxy())
|
|
253
|
+
return [...chain];
|
|
249
254
|
return [this.ip()];
|
|
250
255
|
}
|
|
251
256
|
/** The request hostname without port (AdonisJS `hostname`), or null. */
|
|
@@ -354,17 +359,26 @@ export class Request extends Macroable {
|
|
|
354
359
|
// the expiry and the signature itself live in the query.
|
|
355
360
|
return this.#signedUrl.verify(this.url(true), purpose);
|
|
356
361
|
}
|
|
357
|
-
/**
|
|
362
|
+
/**
|
|
363
|
+
* Get the raw body as a string (decoded from base64 if binary). Throws
|
|
364
|
+
* `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit: what
|
|
365
|
+
* the server kept of it is nothing, and nothing is not the body.
|
|
366
|
+
*/
|
|
358
367
|
raw() {
|
|
359
368
|
if (this.#rawBodyOverride !== undefined)
|
|
360
369
|
return this.#rawBodyOverride;
|
|
370
|
+
this.#assertBodyKept();
|
|
361
371
|
if (this.#raw.bodyEncoding === 'base64') {
|
|
362
372
|
return Buffer.from(this.#raw.body, 'base64').toString('utf8');
|
|
363
373
|
}
|
|
364
374
|
return this.#raw.body;
|
|
365
375
|
}
|
|
366
|
-
/**
|
|
376
|
+
/**
|
|
377
|
+
* Get the raw body as a Buffer (preserves binary integrity for file uploads).
|
|
378
|
+
* Throws `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit.
|
|
379
|
+
*/
|
|
367
380
|
rawBuffer() {
|
|
381
|
+
this.#assertBodyKept();
|
|
368
382
|
if (this.#raw.bodyEncoding === 'base64') {
|
|
369
383
|
return Buffer.from(this.#raw.body, 'base64');
|
|
370
384
|
}
|
|
@@ -556,7 +570,8 @@ export class Request extends Macroable {
|
|
|
556
570
|
id: this.id(),
|
|
557
571
|
url: this.url(true),
|
|
558
572
|
query: this.parsedUrl().search?.slice(1) ?? '',
|
|
559
|
-
|
|
573
|
+
// A dump must not throw: an over-limit body is reported as absent.
|
|
574
|
+
body: this.#bodyWasDropped() ? undefined : this.body(),
|
|
560
575
|
params: this.params(),
|
|
561
576
|
headers: this.headers(),
|
|
562
577
|
method: this.method(),
|
|
@@ -871,9 +886,30 @@ export class Request extends Macroable {
|
|
|
871
886
|
validated() {
|
|
872
887
|
return this.#validated;
|
|
873
888
|
}
|
|
889
|
+
/** The body was over its limit and nothing has replaced it since. */
|
|
890
|
+
#bodyWasDropped() {
|
|
891
|
+
return (this.#raw.bodyTooLarge === true &&
|
|
892
|
+
this.#parsedBody === undefined &&
|
|
893
|
+
this.#rawBodyOverride === undefined);
|
|
894
|
+
}
|
|
895
|
+
/**
|
|
896
|
+
* Refuse to read a body the server did not keep. The same 413 the body
|
|
897
|
+
* parser raises, so a route without it still answers the client properly
|
|
898
|
+
* the moment it reaches for the body — and a route that never does is not
|
|
899
|
+
* charged for it.
|
|
900
|
+
*/
|
|
901
|
+
#assertBodyKept() {
|
|
902
|
+
if (this.#raw.bodyTooLarge === true) {
|
|
903
|
+
throw new Exception('request entity too large', {
|
|
904
|
+
status: 413,
|
|
905
|
+
code: 'E_REQUEST_ENTITY_TOO_LARGE',
|
|
906
|
+
});
|
|
907
|
+
}
|
|
908
|
+
}
|
|
874
909
|
#ensureParsedBody() {
|
|
875
910
|
if (this.#parsedBody !== undefined)
|
|
876
911
|
return;
|
|
912
|
+
this.#assertBodyKept();
|
|
877
913
|
const raw = this.#raw.body;
|
|
878
914
|
if (!raw || raw.length === 0) {
|
|
879
915
|
this.#parsedBody = {};
|