@c9up/ream 0.2.28 → 0.2.30

package/dist/http/RedirectBuilder.js

@@ -8,31 +8,39 @@
  *   response.redirect().withQs({ page: '2' }).toPath('/results')
  *   response.redirect().toRoute('posts.show', { id: '42' })
  */
-function isSameOriginOrRelative(referer, requestUrl, allowedHosts = []) {
+/**
+ * AdonisJS `isValidRedirectUrl`: a relative path, or an absolute URL whose host
+ * is the request authority or an allowed host.
+ */
+function isTrustedRedirect(url, authority, allowedHosts) {
     // A relative path is trusted only when it starts with a single "/" and has no
     // backslash: browsers normalise "\" to "/", so "/\evil.com" would become the
     // protocol-relative "//evil.com" that a lone `!startsWith("//")` check misses.
-    if (referer.startsWith('/') && !referer.startsWith('//') && !referer.includes('\\'))
+    if (url.startsWith('/') && !url.startsWith('//') && !url.includes('\\'))
         return true;
-    let ref;
+    let parsed;
     try {
-        ref = new URL(referer);
+        parsed = new URL(url);
     }
     catch {
         return false;
     }
-    // An explicitly allowed host is trusted whatever the request's own origin is
-    // — that is what the list is for (AdonisJS `allowedHosts`).
-    if (allowedHosts.includes(ref.host))
-        return true;
-    if (!requestUrl)
-        return false;
-    try {
-        return ref.origin === new URL(requestUrl).origin;
-    }
-    catch {
+    // Only a web URL is a redirect target: `javascript://app.test/%0aalert(1)`
+    // has the right host and is a script, not a page.
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
         return false;
-    }
+    if (allowedHosts.includes(parsed.host))
+        return true;
+    // Upstream accepts any absolute URL when it knows no host to compare with;
+    // refusing it is the safer reading of an attacker-controlled header.
+    return authority !== undefined && parsed.host === authority;
+}
+/** The query string of a path or URL, without the "?". */
+function searchOf(url) {
+    if (url === undefined)
+        return '';
+    const index = url.indexOf('?');
+    return index === -1 ? '' : url.slice(index + 1);
 }
 export class RedirectBuilder {
     /**
@@ -48,6 +56,7 @@ export class RedirectBuilder {
     #forwardQs = false;
     #requestUrl;
     #requestReferer;
+    #requestAuthority;
     #routeUrlResolver;
     #session;
     #isAjax = false;
@@ -56,6 +65,7 @@ export class RedirectBuilder {
         this.#response = response;
         this.#requestUrl = options?.requestUrl;
         this.#requestReferer = options?.requestReferer;
+        this.#requestAuthority = options?.requestAuthority;
         this.#routeUrlResolver = options?.routeUrlResolver;
         this.#session = options?.session;
         this.#isAjax = options?.isAjax ?? false;
@@ -104,14 +114,9 @@ export class RedirectBuilder {
     #safeIntended(intended, fallback) {
         if (!intended)
             return fallback;
-        if (this.#requestUrl && !isSameOriginOrRelative(intended, this.#requestUrl)) {
-            return fallback;
-        }
-        // A protocol-relative `//evil.com` is absolute to a browser even though it
-        // looks relative — reject it whether or not a request URL is known.
-        if (intended.startsWith('//'))
-            return fallback;
-        return intended;
+        return isTrustedRedirect(intended, this.#requestAuthority, this.allowedHosts)
+            ? intended
+            : fallback;
     }
     /** Set redirect status code. */
     status(code) {
@@ -142,7 +147,11 @@ export class RedirectBuilder {
     }
     /** Redirect to an absolute or relative path. */
     toPath(path) {
-        const url = this.#appendQs(path);
+        this.#send(path, searchOf(this.#requestUrl));
+    }
+    /** Redirect with `withQs()` forwarding `forwardedSearch` (a query string without "?"). */
+    #send(path, forwardedSearch) {
+        const url = this.#appendQs(path, forwardedSearch);
         this.#response.status(this.#status);
         this.#response.header('location', url);
         this.#response.setBody('');
@@ -156,12 +165,13 @@ export class RedirectBuilder {
         this.toPath(path);
     }
     /**
-     * Redirect back to the previous page (Referer header).
-     * Only trusts same-origin or relative referers — external URLs fall back
-     * to `fallback` to prevent open redirect attacks.
+     * Redirect back to the previous page (AdonisJS `back`): the path of
+     * {@link getPreviousUrl}, so the redirect never leaves the site; `withQs()`
+     * forwards the previous page's query string, not the current request's.
      */
     back(fallback = '/') {
-        this.toPath(this.getPreviousUrl(fallback));
+        const previous = new URL(this.getPreviousUrl(fallback), 'http://localhost');
+        this.#send(previous.pathname, previous.search.slice(1));
     }
     /**
      * Where "back" goes (AdonisJS `getPreviousUrl`).
@@ -173,7 +183,7 @@ export class RedirectBuilder {
      */
     getPreviousUrl(fallback = '/') {
         const referer = this.#requestReferer;
-        if (referer && isSameOriginOrRelative(referer, this.#requestUrl, this.allowedHosts)) {
+        if (referer && isTrustedRedirect(referer, this.#requestAuthority, this.allowedHosts)) {
             return referer;
         }
         return fallback;
@@ -183,15 +193,11 @@ export class RedirectBuilder {
      * uses, so `withQs()` plus `withQs('page', 2)` overrides an inbound `page`
      * rather than being overridden by it.
      */
-    #appendQs(path) {
+    #appendQs(path, forwardedSearch) {
         const params = new URLSearchParams();
-        if (this.#forwardQs && this.#requestUrl) {
-            const qsIdx = this.#requestUrl.indexOf('?');
-            if (qsIdx !== -1) {
-                for (const [key, value] of new URLSearchParams(this.#requestUrl.slice(qsIdx + 1))) {
-                    params.append(key, value);
-                }
-            }
+        if (this.#forwardQs) {
+            for (const [key, value] of new URLSearchParams(forwardedSearch))
+                params.append(key, value);
         }
         for (const [key, value] of Object.entries(this.#qs)) {
             if (value === undefined || value === null)

package/dist/http/RedirectBuilder.js.map

@@ -1 +1 @@
-{"version":3,"file":"RedirectBuilder.js","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,SAAS,sBAAsB,CAC7B,OAAe,EACf,UAAmB,EACnB,eAAkC,EAAE;IAEpC,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChG,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAQD,MAAM,OAAO,eAAe;IAC1B;;;;;OAKG;IACH,YAAY,GAAa,EAAE,CAAA;IAE3B,SAAS,CAAU;IACnB,OAAO,GAAG,GAAG,CAAA;IACb,GAAG,GAA4B,EAAE,CAAA;IACjC,UAAU,GAAG,KAAK,CAAA;IAClB,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,iBAAiB,CAAmB;IACpC,QAAQ,CAAmB;IAC3B,OAAO,GAAG,KAAK,CAAA;IACf,SAAS,GAAG,IAAI,CAAA;IAEhB,YACE,QAAkB,EAClB,OAUC;QAED,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,UAAU,CAAA;QACtC,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,cAAc,CAAA;QAC9C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,gBAAgB,CAAA;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAA;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAA;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,GAAG,KAAK;QAC5B,IACE,IAAI,CAAC,QAAQ;YACb,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK;YAC9B,CAAC,IAAI,CAAC,OAAO;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,WAAW,EAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,GAAG,GAAG;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,iFAAiF;IACjF,eAAe,CAAC,IAAY,EAAE,MAA+B;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC1E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,aAAa,CAA0B,QAAuB,EAAE,QAAW;QACzE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC9B,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAA;QAC9C,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,gCAAgC;IAChC,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAiBD,MAAM,CAAC,IAAiD,EAAE,KAAe;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,uEAAuE;IACvE,OAAO;QACL,IAAI,CAAC,GAAG,GAAG,EAAE,CAAA;QACb,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,IAAY;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC;IAED,iCAAiC;IACjC,OAAO,CAAC,IAAY,EAAE,MAA+B;QACnD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,QAAQ,GAAG,GAAG;QACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,QAAQ,GAAG,GAAG;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAA;QACpC,IAAI,OAAO,IAAI,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACpF,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,IAAY;QACpB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAQ;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAA;IAC/D,CAAC;CACF"}
+{"version":3,"file":"RedirectBuilder.js","sourceRoot":"","sources":["../../src/http/RedirectBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;GAGG;AACH,SAAS,iBAAiB,CACxB,GAAW,EACX,SAA6B,EAC7B,YAA+B;IAE/B,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,2EAA2E;IAC3E,kDAAkD;IAClD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7E,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,2EAA2E;IAC3E,qEAAqE;IACrE,OAAO,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAA;AAC7D,CAAC;AAED,0DAA0D;AAC1D,SAAS,QAAQ,CAAC,GAAuB;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;AACjD,CAAC;AAQD,MAAM,OAAO,eAAe;IAC1B;;;;;OAKG;IACH,YAAY,GAAa,EAAE,CAAA;IAE3B,SAAS,CAAU;IACnB,OAAO,GAAG,GAAG,CAAA;IACb,GAAG,GAA4B,EAAE,CAAA;IACjC,UAAU,GAAG,KAAK,CAAA;IAClB,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,iBAAiB,CAAS;IAC1B,iBAAiB,CAAmB;IACpC,QAAQ,CAAmB;IAC3B,OAAO,GAAG,KAAK,CAAA;IACf,SAAS,GAAG,IAAI,CAAA;IAEhB,YACE,QAAkB,EAClB,OAgBC;QAED,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,UAAU,CAAA;QACtC,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,cAAc,CAAA;QAC9C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,gBAAgB,CAAA;QAClD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,gBAAgB,CAAA;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAA;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAA;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,GAAG,KAAK;QAC5B,IACE,IAAI,CAAC,QAAQ;YACb,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK;YAC9B,CAAC,IAAI,CAAC,OAAO;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,WAAW,EAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,GAAG,GAAG;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,iFAAiF;IACjF,eAAe,CAAC,IAAY,EAAE,MAA+B;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,CAAA;QACzD,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC1E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,aAAa,CAA0B,QAAuB,EAAE,QAAW;QACzE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC9B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC;YAC3E,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAA;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAiBD,MAAM,CAAC,IAAiD,EAAE,KAAe;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,uEAAuE;IACvE,OAAO;QACL,IAAI,CAAC,GAAG,GAAG,EAAE,CAAA;QACb,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,IAAY,EAAE,eAAuB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC;IAED,iCAAiC;IACjC,OAAO,CAAC,IAAY,EAAE,MAA+B;QACnD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,QAAQ,GAAG,GAAG;QACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,QAAQ,GAAG,GAAG;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAA;QACpC,IAAI,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrF,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,IAAY,EAAE,eAAuB;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,eAAe,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5F,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAQ;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAA;IAC/D,CAAC;CACF"}

package/dist/http/Request.d.ts

@@ -27,6 +27,26 @@ export interface RawRequest {
      * `ip()` accessor falls back to legacy header parsing.
      */
     ip?: string;
+    /**
+     * The trusted address chain, closest hop first — the socket peer, then each
+     * `X-Forwarded-For` entry the Rust layer walked right to left while the hop
+     * before it was a trusted proxy. Its last entry is {@link ip}. Absent in
+     * hand-built fixtures, where the chain is the peer alone.
+     */
+    ips?: string[];
+    /**
+     * Whether the socket peer is one of the trusted proxies configured with
+     * `server.trustedProxies()`, as the Rust layer decided against the same
+     * list that resolves {@link ip}. Absent in hand-built fixtures: untrusted.
+     */
+    peerTrusted?: boolean;
+    /**
+     * The body was over its content type's limit (`config/bodyparser.ts`): the
+     * Rust layer did not keep it, and `body` is empty. Reading the body then
+     * throws `E_REQUEST_ENTITY_TOO_LARGE` instead of handing back nothing as if
+     * nothing had been sent.
+     */
+    bodyTooLarge?: boolean;
     /**
      * Connection scheme as seen by the server (`http`/`https`), when the Rust
      * layer ships it. Defaults to `http` in `protocol()` when absent; the
@@ -167,13 +187,6 @@ export declare class Request extends Macroable {
      * desired resolved value.
      */
     ip(): string;
-    /**
-     * Enable/disable trusting proxy headers (`X-Forwarded-Proto`/`-Host`/`-For`)
-     * for `protocol()`/`host()`/`ips()`. OFF by default — turning it on when the
-     * app is NOT behind a trusted proxy lets clients spoof their scheme/host/IP,
-     * so it's an explicit opt-in (same stance as {@link setMethodSpoofing}).
-     */
-    setTrustProxy(enabled: boolean): void;
     /**
      * The HTTP/2 `:authority` pseudo-header, falling back to `Host` (AdonisJS
      * `authority`).
@@ -187,22 +200,27 @@ export declare class Request extends Macroable {
     authority(): string | null;
     /**
      * The request host including port (AdonisJS `host`). Honours
-     * `X-Forwarded-Host` ONLY when trust-proxy is enabled; otherwise the `Host`
-     * header. Returns null when neither is present.
+     * `X-Forwarded-Host` ONLY when the request came through a trusted proxy (see
+     * `server.trustedProxies()`); otherwise the `Host` header. Returns null when
+     * neither is present.
      */
     host(): string | null;
     /**
-     * The request protocol — `http` or `https` (AdonisJS `protocol`). Honours
-     * `X-Forwarded-Proto` only under trust-proxy; otherwise the connection scheme
-     * the Rust layer reported (defaulting to `http`).
+     * The request protocol — `http` or `https` (AdonisJS `protocol`). A TLS
+     * connection is `https` whatever the headers say. Otherwise
+     * `X-Forwarded-Proto` is honoured only when the request came through a
+     * trusted proxy (see `server.trustedProxies()`), and the connection scheme
+     * the Rust layer reported (defaulting to `http`) is used when it is not.
      */
     protocol(): string;
     /** True when the request protocol is `https` (AdonisJS `secure`). */
     secure(): boolean;
     /**
-     * The client IP chain (AdonisJS `ips`). Under trust-proxy, the parsed
-     * `X-Forwarded-For` list (left-most = original client); otherwise just the
-     * single resolved {@link ip}.
+     * The trusted address chain, closest hop first (AdonisJS `ips`): the socket
+     * peer, then each `X-Forwarded-For` hop a trusted proxy vouched for. The
+     * last entry is {@link ip}. Hops added by an untrusted peer are not in it —
+     * the Rust layer stops at the first address it does not trust, so the chain
+     * goes past the peer only when {@link peerTrusted} holds.
      */
     ips(): string[];
     /** The request hostname without port (AdonisJS `hostname`), or null. */
@@ -282,9 +300,16 @@ export declare class Request extends Macroable {
      * `purpose`. Returns false without an APP_KEY-backed signer.
      */
     hasValidSignature(purpose?: string): boolean;
-    /** Get the raw body as a string (decoded from base64 if binary). */
+    /**
+     * Get the raw body as a string (decoded from base64 if binary). Throws
+     * `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit: what
+     * the server kept of it is nothing, and nothing is not the body.
+     */
     raw(): string;
-    /** Get the raw body as a Buffer (preserves binary integrity for file uploads). */
+    /**
+     * Get the raw body as a Buffer (preserves binary integrity for file uploads).
+     * Throws `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit.
+     */
     rawBuffer(): Buffer;
     /** Get a single request header (case-insensitive), or `defaultValue` when absent. */
     header(key: string): string | undefined;

package/dist/http/Request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Request.d.ts","sourceRoot":"","sources":["../../src/http/Request.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAA;AAI9B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;IAChC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC9C,KAAK,EAAE,KAAK,CAAC;YACX,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,EAAE,MAAM,CAAA;YAClB,WAAW,EAAE,MAAM,CAAA;YACnB,IAAI,EAAE,MAAM,CAAA;YACZ,UAAU,EAAE,MAAM,CAAA;SACnB,CAAC,CAAA;KACH,CAAA;IACD;;;;OAIG;IACH,OAAO,CAAC,EAAE,IAAI,CAAA;CACf;AAED,qBAAa,OAAQ,SAAQ,SAAS;;IAkBpC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;gBAEX,GAAG,EAAE,UAAU,EAAE,MAAM,GAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAM;IAQjE;;;;;;OAMG;IACH,MAAM,IAAI,MAAM;IAQhB,mFAAmF;IACnF,QAAQ,IAAI,MAAM;IAIlB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAIzC,gGAAgG;IAChG,WAAW,CAAC,QAAQ,EAAE;QAAE,KAAK,IAAI,OAAO,CAAA;KAAE,GAAG,IAAI;IAIjD,wFAAwF;IACxF,YAAY,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIhF;;;;OAIG;IACH,KAAK,IAAI,OAAO;IAIhB,wDAAwD;IACxD,KAAK,IAAI,OAAO;IAIhB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO;IASpD;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIzC;;;;;;;OAOG;IACH,GAAG,CAAC,SAAS,UAAQ,GAAG,MAAM;IAO9B,2CAA2C;IAC3C,IAAI,IAAI,MAAM;IAId;;;;;;;;;;;;;;;OAeG;IACH,EAAE,IAAI,MAAM;IAKZ;;;;;OAKG;IACH,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIrC;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI;IAM1B;;;;OAIG;IACH,IAAI,IAAI,MAAM,GAAG,IAAI;IAWrB;;;;OAIG;IACH,QAAQ,IAAI,MAAM;IASlB,qEAAqE;IACrE,MAAM,IAAI,OAAO;IAIjB;;;;OAIG;IACH,GAAG,IAAI,MAAM,EAAE;IAaf,wEAAwE;IACxE,QAAQ,IAAI,MAAM,GAAG,IAAI;IASzB;;;;OAIG;IACH,UAAU,CAAC,MAAM,SAAI,GAAG,MAAM,EAAE;IAQhC;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAqBf,sEAAsE;IACtE,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAI3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAClD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAc1D;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI;IAC/C,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC;IAC1F,WAAW,CAAC,CAAC,GAAG,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,EACvB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9B,CAAC,GAAG,IAAI;IACX,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC,GAAG,IAAI;IAclG;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAC5C,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOnE,oFAAoF;IACpF,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAIxC;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAO5C,oEAAoE;IACpE,GAAG,IAAI,MAAM;IAQb,kFAAkF;IAClF,SAAS,IAAI,MAAM;IASnB,qFAAqF;IACrF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK9D,+BAA+B;IAC/B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC;IAMzB;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7D,oEAAoE;IACpE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAM3C;;;;;OAKG;IACH,EAAE,IAAI,MAAM,GAAG,SAAS;IAIxB,2EAA2E;IAC3E,SAAS,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAShE,4DAA4D;IAC5D,IAAI,IAAI,OAAO;IAIf,0DAA0D;IAC1D,IAAI,IAAI,OAAO;IAIf;;;;;;;OAOG;IACH,QAAQ,IAAI,OAAO;IAWnB;;;;OAIG;IACH,WAAW,CAAC,kBAAkB,UAAQ,GAAG,MAAM;IAK/C;;;;;;;OAOG;IACH,cAAc,CAAC,YAAY,GAAE,MAAM,EAAO,EAAE,QAAQ,SAAM,GAAG,MAAM;IAgBnE,0EAA0E;IAC1E,KAAK,IAAI,MAAM,EAAE;IAIjB,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB,0EAA0E;IAC1E,QAAQ,IAAI,MAAM,EAAE;IAIpB;;;;OAIG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAIlD,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IA6CpD,qDAAqD;IACrD,WAAW,IAAI,IAAI;IAInB;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiBpC,uEAAuE;IACvE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjC;;;;;;;;OAQG;IACH,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAexC,4CAA4C;IAC5C,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;IAanB,mCAAmC;IACnC,IAAI,IAAI,OAAO;IAOf;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC;IAMpD,qDAAqD;IACrD,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;IA8BpB;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,EACb,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,CAAC;IAIb,0EAA0E;IAC1E,gBAAgB,CAAC,CAAC,EAChB,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAIvC;;;OAGG;IACH,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;IAKzB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAInC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAIrC;;;;OAIG;IACH,OAAO,IAAI,OAAO;IASlB,wEAAwE;IACxE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAYlC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAiB/C;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAoBhD,0CAA0C;IAC1C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,GAAG,IAAI;IAOhE,+CAA+C;IAC/C,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,EAAE;IAQ3D,8BAA8B;IAC9B,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,CAAC;IAIjF;;;;;;OAMG;IACH,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS;IAI7D,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,GAAG,IAAI;IAW/E,uEAAuE;IACvE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKxC;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAMnC;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIpC;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAIjC;;;;;;OAMG;IACH,SAAS,IAAI,OAAO;CAkBrB"}
+{"version":3,"file":"Request.d.ts","sourceRoot":"","sources":["../../src/http/Request.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAGjD,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAA;AAI9B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;IAChC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC9C,KAAK,EAAE,KAAK,CAAC;YACX,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,EAAE,MAAM,CAAA;YAClB,WAAW,EAAE,MAAM,CAAA;YACnB,IAAI,EAAE,MAAM,CAAA;YACZ,UAAU,EAAE,MAAM,CAAA;SACnB,CAAC,CAAA;KACH,CAAA;IACD;;;;OAIG;IACH,OAAO,CAAC,EAAE,IAAI,CAAA;CACf;AAED,qBAAa,OAAQ,SAAQ,SAAS;;IAiBpC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;gBAEX,GAAG,EAAE,UAAU,EAAE,MAAM,GAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAM;IAQjE;;;;;;OAMG;IACH,MAAM,IAAI,MAAM;IAQhB,mFAAmF;IACnF,QAAQ,IAAI,MAAM;IAIlB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAIzC,gGAAgG;IAChG,WAAW,CAAC,QAAQ,EAAE;QAAE,KAAK,IAAI,OAAO,CAAA;KAAE,GAAG,IAAI;IAIjD,wFAAwF;IACxF,YAAY,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIhF;;;;OAIG;IACH,KAAK,IAAI,OAAO;IAIhB,wDAAwD;IACxD,KAAK,IAAI,OAAO;IAIhB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO;IASpD;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIzC;;;;;;;OAOG;IACH,GAAG,CAAC,SAAS,UAAQ,GAAG,MAAM;IAO9B,2CAA2C;IAC3C,IAAI,IAAI,MAAM;IAId;;;;;;;;;;;;;;;OAeG;IACH,EAAE,IAAI,MAAM;IAmBZ;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI;IAM1B;;;;;OAKG;IACH,IAAI,IAAI,MAAM,GAAG,IAAI;IAWrB;;;;;;OAMG;IACH,QAAQ,IAAI,MAAM;IAUlB,qEAAqE;IACrE,MAAM,IAAI,OAAO;IAIjB;;;;;;OAMG;IACH,GAAG,IAAI,MAAM,EAAE;IAMf,wEAAwE;IACxE,QAAQ,IAAI,MAAM,GAAG,IAAI;IASzB;;;;OAIG;IACH,UAAU,CAAC,MAAM,SAAI,GAAG,MAAM,EAAE;IAQhC;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAqBf,sEAAsE;IACtE,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAI3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAClD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAc1D;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI;IAC/C,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC;IAC1F,WAAW,CAAC,CAAC,GAAG,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,EACvB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9B,CAAC,GAAG,IAAI;IACX,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,CAAC,GAAG,IAAI;IAclG;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAC5C,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IASnE,oFAAoF;IACpF,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAIxC;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAO5C;;;;OAIG;IACH,GAAG,IAAI,MAAM;IASb;;;OAGG;IACH,SAAS,IAAI,MAAM;IAUnB,qFAAqF;IACrF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK9D,+BAA+B;IAC/B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC;IAMzB;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IACtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7D,oEAAoE;IACpE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAM3C;;;;;OAKG;IACH,EAAE,IAAI,MAAM,GAAG,SAAS;IAIxB,2EAA2E;IAC3E,SAAS,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAShE,4DAA4D;IAC5D,IAAI,IAAI,OAAO;IAIf,0DAA0D;IAC1D,IAAI,IAAI,OAAO;IAIf;;;;;;;OAOG;IACH,QAAQ,IAAI,OAAO;IAWnB;;;;OAIG;IACH,WAAW,CAAC,kBAAkB,UAAQ,GAAG,MAAM;IAK/C;;;;;;;OAOG;IACH,cAAc,CAAC,YAAY,GAAE,MAAM,EAAO,EAAE,QAAQ,SAAM,GAAG,MAAM;IAgBnE,0EAA0E;IAC1E,KAAK,IAAI,MAAM,EAAE;IAIjB,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB,0EAA0E;IAC1E,QAAQ,IAAI,MAAM,EAAE;IAIpB;;;;OAIG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAIlD,4EAA4E;IAC5E,SAAS,IAAI,MAAM,EAAE;IAIrB;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IA6CpD,qDAAqD;IACrD,WAAW,IAAI,IAAI;IAInB;;;;;;;;;OASG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAoBpC,uEAAuE;IACvE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjC;;;;;;;;OAQG;IACH,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAexC,4CAA4C;IAC5C,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;IAanB,mCAAmC;IACnC,IAAI,IAAI,OAAO;IAOf;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC;IAMpD,qDAAqD;IACrD,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;IA8BpB;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,EACb,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,CAAC;IAIb,0EAA0E;IAC1E,gBAAgB,CAAC,CAAC,EAChB,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAIvC;;;OAGG;IACH,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;IAKzB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAInC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAIrC;;;;OAIG;IACH,OAAO,IAAI,OAAO;IASlB,wEAAwE;IACxE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAYlC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAiB/C;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI;IAoBhD,0CAA0C;IAC1C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,GAAG,IAAI;IAOhE,+CAA+C;IAC/C,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,gCAAgC,EAAE,qBAAqB,GACvE,OAAO,gCAAgC,EAAE,aAAa,EAAE;IAQ3D,8BAA8B;IAC9B,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,CAAC;IAIjF;;;;;;OAMG;IACH,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS;IAI7D,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,gCAAgC,EAAE,aAAa,EAAE,GAAG,IAAI;IAW/E,uEAAuE;IACvE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKxC;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAKrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI;IAMnC;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIpC;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAIjC;;;;;;OAMG;IACH,SAAS,IAAI,OAAO;CAyCrB"}

package/dist/http/Request.js

@@ -9,6 +9,7 @@
 import { parseQueryString } from '../bodyparser/qsParse.js';
 import { Macroable } from '../utils/Macroable.js';
 import { getPath, omitPaths, pickPaths } from '../utils/objectPath.js';
+import { Exception } from './Exception.js';
 import { RequestValidator } from './RequestValidator.js';
 import { unpackCookieValue } from './Response.js';
 export class Request extends Macroable {
@@ -17,7 +18,6 @@ export class Request extends Macroable {
     #cookieSigner;
     #signedUrl;
     #allowMethodSpoofing = false;
-    #trustProxy = false;
     #routeInfo;
     #response;
     #parsedBody;
@@ -173,13 +173,17 @@ export class Request extends Macroable {
         return this.#raw.remoteAddr ?? '127.0.0.1';
     }
     /**
-     * Enable/disable trusting proxy headers (`X-Forwarded-Proto`/`-Host`/`-For`)
-     * for `protocol()`/`host()`/`ips()`. OFF by default — turning it on when the
-     * app is NOT behind a trusted proxy lets clients spoof their scheme/host/IP,
-     * so it's an explicit opt-in (same stance as {@link setMethodSpoofing}).
+     * Whether the socket peer is one of the trusted proxies configured with
+     * `server.trustedProxies()` — the condition under which `X-Forwarded-Proto`
+     * and `X-Forwarded-Host` are believed by {@link protocol} and {@link host}.
+     *
+     * The decision is the Rust layer's (`peerTrusted`), made once per request
+     * against the same list that resolves {@link ip}, so a trusted proxy that
+     * forwards the scheme or host without an `X-Forwarded-For` is believed too.
+     * A request without the flag — a hand-built fixture — is untrusted.
      */
-    setTrustProxy(enabled) {
-        this.#trustProxy = enabled;
+    #peerIsTrustedProxy() {
+        return this.#raw.peerTrusted === true;
     }
     /**
      * The HTTP/2 `:authority` pseudo-header, falling back to `Host` (AdonisJS
@@ -199,11 +203,12 @@ export class Request extends Macroable {
     }
     /**
      * The request host including port (AdonisJS `host`). Honours
-     * `X-Forwarded-Host` ONLY when trust-proxy is enabled; otherwise the `Host`
-     * header. Returns null when neither is present.
+     * `X-Forwarded-Host` ONLY when the request came through a trusted proxy (see
+     * `server.trustedProxies()`); otherwise the `Host` header. Returns null when
+     * neither is present.
      */
     host() {
-        if (this.#trustProxy) {
+        if (this.#peerIsTrustedProxy()) {
             const forwarded = this.#raw.headers['x-forwarded-host'];
             // The first hop in the list, named rather than indexed: `split` always
             // yields one element, and saying so beats being told it might not.
@@ -214,12 +219,16 @@ export class Request extends Macroable {
         return this.#raw.headers.host ?? null;
     }
     /**
-     * The request protocol — `http` or `https` (AdonisJS `protocol`). Honours
-     * `X-Forwarded-Proto` only under trust-proxy; otherwise the connection scheme
-     * the Rust layer reported (defaulting to `http`).
+     * The request protocol — `http` or `https` (AdonisJS `protocol`). A TLS
+     * connection is `https` whatever the headers say. Otherwise
+     * `X-Forwarded-Proto` is honoured only when the request came through a
+     * trusted proxy (see `server.trustedProxies()`), and the connection scheme
+     * the Rust layer reported (defaulting to `http`) is used when it is not.
      */
     protocol() {
-        if (this.#trustProxy) {
+        if (this.#raw.scheme === 'https')
+            return 'https';
+        if (this.#peerIsTrustedProxy()) {
             const forwarded = this.#raw.headers['x-forwarded-proto'];
             const [first] = forwarded?.split(',') ?? [];
             if (first !== undefined)
@@ -232,20 +241,16 @@ export class Request extends Macroable {
         return this.protocol() === 'https';
     }
     /**
-     * The client IP chain (AdonisJS `ips`). Under trust-proxy, the parsed
-     * `X-Forwarded-For` list (left-most = original client); otherwise just the
-     * single resolved {@link ip}.
+     * The trusted address chain, closest hop first (AdonisJS `ips`): the socket
+     * peer, then each `X-Forwarded-For` hop a trusted proxy vouched for. The
+     * last entry is {@link ip}. Hops added by an untrusted peer are not in it —
+     * the Rust layer stops at the first address it does not trust, so the chain
+     * goes past the peer only when {@link peerTrusted} holds.
      */
     ips() {
-        if (this.#trustProxy) {
-            const forwarded = this.#raw.headers['x-forwarded-for'];
-            if (forwarded) {
-                return forwarded
-                    .split(',')
-                    .map((value) => value.trim())
-                    .filter((value) => value.length > 0);
-            }
-        }
+        const chain = this.#raw.ips;
+        if (chain && chain.length > 0 && this.#peerIsTrustedProxy())
+            return [...chain];
         return [this.ip()];
     }
     /** The request hostname without port (AdonisJS `hostname`), or null. */
@@ -334,7 +339,9 @@ export class Request extends Macroable {
     }
     encryptedCookie(name, defaultValue) {
         const raw = this.plainCookie(name, undefined, { encoded: false });
-        const value = raw === null || !this.#cookieSigner ? null : this.#cookieSigner.decrypt(raw);
+        // Decrypted for the purpose it was written under — its own name — so a
+        // value issued as another encrypted cookie is refused here.
+        const value = raw === null || !this.#cookieSigner ? null : this.#cookieSigner.decrypt(raw, name);
         return value ?? defaultValue ?? null;
     }
     /** @internal Inject the APP_KEY-backed signed-URL helper — wired by HttpContext. */
@@ -354,17 +361,26 @@ export class Request extends Macroable {
         // the expiry and the signature itself live in the query.
         return this.#signedUrl.verify(this.url(true), purpose);
     }
-    /** Get the raw body as a string (decoded from base64 if binary). */
+    /**
+     * Get the raw body as a string (decoded from base64 if binary). Throws
+     * `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit: what
+     * the server kept of it is nothing, and nothing is not the body.
+     */
     raw() {
         if (this.#rawBodyOverride !== undefined)
             return this.#rawBodyOverride;
+        this.#assertBodyKept();
         if (this.#raw.bodyEncoding === 'base64') {
             return Buffer.from(this.#raw.body, 'base64').toString('utf8');
         }
         return this.#raw.body;
     }
-    /** Get the raw body as a Buffer (preserves binary integrity for file uploads). */
+    /**
+     * Get the raw body as a Buffer (preserves binary integrity for file uploads).
+     * Throws `E_REQUEST_ENTITY_TOO_LARGE` (413) when the body was over its limit.
+     */
     rawBuffer() {
+        this.#assertBodyKept();
         if (this.#raw.bodyEncoding === 'base64') {
             return Buffer.from(this.#raw.body, 'base64');
         }
@@ -556,7 +572,8 @@ export class Request extends Macroable {
             id: this.id(),
             url: this.url(true),
             query: this.parsedUrl().search?.slice(1) ?? '',
-            body: this.body(),
+            // A dump must not throw: an over-limit body is reported as absent.
+            body: this.#bodyWasDropped() ? undefined : this.body(),
             params: this.params(),
             headers: this.headers(),
             method: this.method(),
@@ -564,7 +581,9 @@ export class Request extends Macroable {
             cookies: this.cookies(),
             hostname: this.hostname(),
             ip: this.ip(),
-            subdomains: this.subdomains(),
+            // What the route's domain captured (`ctx.subdomains`), as upstream
+            // serialises it — not the host's labels, which `subdomains()` returns.
+            subdomains: (this.ctx === undefined ? undefined : Reflect.get(this.ctx, 'subdomains')) ?? {},
         };
     }
     /** Same as {@link serialize} — what `JSON.stringify(request)` uses. */
@@ -871,38 +890,41 @@ export class Request extends Macroable {
     validated() {
         return this.#validated;
     }
+    /** The body was over its limit and nothing has replaced it since. */
+    #bodyWasDropped() {
+        return (this.#raw.bodyTooLarge === true &&
+            this.#parsedBody === undefined &&
+            this.#rawBodyOverride === undefined);
+    }
+    /**
+     * Refuse to read a body the server did not keep. The same 413 the body
+     * parser raises, so a route without it still answers the client properly
+     * the moment it reaches for the body — and a route that never does is not
+     * charged for it.
+     */
+    #assertBodyKept() {
+        if (this.#raw.bodyTooLarge === true) {
+            throw new Exception('request entity too large', {
+                status: 413,
+                code: 'E_REQUEST_ENTITY_TOO_LARGE',
+            });
+        }
+    }
+    /**
+     * The body is whatever the body parser decided it is, and `{}` when no
+     * parser claimed it. Nothing is parsed here: a JSON body is only JSON when
+     * its Content-Type says so. Reading any body as JSON let a foreign page
+     * drive a JSON route with a CORS simple request (no Content-Type, or
+     * `text/plain`), which a browser sends cross-site with the user's cookies
+     * and without a preflight.
+     */
     #ensureParsedBody() {
         if (this.#parsedBody !== undefined)
             return;
-        const raw = this.#raw.body;
-        if (!raw || raw.length === 0) {
-            this.#parsedBody = {};
-            return;
-        }
-        try {
-            const parsed = JSON.parse(raw);
-            this.#parsedBody = isPlainObject(parsed) ? parsed : { _body: parsed };
-        }
-        catch {
-            this.#parsedBody = {};
-        }
+        this.#assertBodyKept();
+        this.#parsedBody = {};
     }
 }
-/** Parse a query string (key=value&key2=value2) into an object. */
-/**
- * Test whether an IPv4 address is within a CIDR range. Bare IP entries
- * (`10.0.0.42`) are accepted as `/32`. IPv6 falls back to string equality
- * — a full v6 implementation isn't required by the current security tests.
- */
-/**
- * Type guard for plain JSON-decoded objects. Excludes `null` (which is
- * `typeof === 'object'`) and arrays so consumers can index by string key
- * without a separate runtime check.
- */
-function isPlainObject(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-/** True for an IPv4 dotted-quad or a (bracketed) IPv6 literal — hosts with no subdomains. */
 /**
  * Headers whose VALUE is a credential. Listing them is useful; printing them
  * hands whoever reads the log a working key.