@chidchanun/bcp 0.1.0

package/packages/server/src/middleware.ts

@@ -0,0 +1,704 @@
+import type * as http from "node:http";
+
+import {
+    assertSafeMiddlewareTarget,
+} from "./security.js";
+
+export type MiddlewareMatcher =
+    | string
+    | RegExp;
+
+export interface MiddlewareConfig {
+    matcher?:
+        | MiddlewareMatcher
+        | MiddlewareMatcher[];
+}
+
+export interface MiddlewareCookieStore {
+    get(name: string): string | null;
+    has(name: string): boolean;
+}
+
+export interface MiddlewareRequest {
+    readonly url: string;
+    readonly method: string;
+    readonly headers: Headers;
+    readonly nextUrl: URL;
+    readonly cookies: MiddlewareCookieStore;
+}
+
+export interface MiddlewareHeaderOptions {
+    request?: {
+        headers?: HeadersInit;
+    };
+    response?: {
+        headers?: HeadersInit;
+    };
+}
+
+export interface MiddlewareRedirectOptions {
+    status?: 301 | 302 | 303 | 307 | 308;
+    headers?: HeadersInit;
+}
+
+export interface MiddlewareNextResult {
+    readonly type: "next";
+    readonly requestHeaders: Headers;
+    readonly responseHeaders: Headers;
+}
+
+export interface MiddlewareRewriteResult {
+    readonly type: "rewrite";
+    readonly url: string;
+    readonly requestHeaders: Headers;
+    readonly responseHeaders: Headers;
+}
+
+export interface MiddlewareRedirectResult {
+    readonly type: "redirect";
+    readonly url: string;
+    readonly status: 301 | 302 | 303 | 307 | 308;
+    readonly headers: Headers;
+}
+
+export type MiddlewareResult =
+    | MiddlewareNextResult
+    | MiddlewareRewriteResult
+    | MiddlewareRedirectResult;
+
+export type MiddlewareHandler = (
+    request: MiddlewareRequest
+) =>
+    | MiddlewareResult
+    | Response
+    | void
+    | Promise<
+        MiddlewareResult |
+        Response |
+        void
+    >;
+
+export interface MiddlewareModule {
+    middleware?: MiddlewareHandler;
+    default?: MiddlewareHandler;
+    config?: MiddlewareConfig;
+}
+
+export interface MiddlewareExecutionInput {
+    url: string | URL;
+    method?: string;
+    headers?: HeadersInit;
+}
+
+export type MiddlewareExecutionResult =
+    | {
+        type: "next";
+        url: URL;
+        requestHeaders: Headers;
+        responseHeaders: Headers;
+    }
+    | {
+        type: "rewrite";
+        url: URL;
+        requestHeaders: Headers;
+        responseHeaders: Headers;
+    }
+    | {
+        type: "redirect";
+        url: URL;
+        status: 301 | 302 | 303 | 307 | 308;
+        headers: Headers;
+    }
+    | {
+        type: "response";
+        response: Response;
+    };
+
+export function next(
+    options: MiddlewareHeaderOptions = {}
+): MiddlewareNextResult {
+    return {
+        type: "next",
+        requestHeaders:
+            new Headers(
+                options.request?.headers
+            ),
+        responseHeaders:
+            new Headers(
+                options.response?.headers
+            ),
+    };
+}
+
+export function rewrite(
+    url: string | URL,
+    options: MiddlewareHeaderOptions = {}
+): MiddlewareRewriteResult {
+    return {
+        type: "rewrite",
+        url:
+            url.toString(),
+        requestHeaders:
+            new Headers(
+                options.request?.headers
+            ),
+        responseHeaders:
+            new Headers(
+                options.response?.headers
+            ),
+    };
+}
+
+export function redirect(
+    url: string | URL,
+    options: MiddlewareRedirectOptions = {}
+): MiddlewareRedirectResult {
+    return {
+        type: "redirect",
+        url:
+            url.toString(),
+        status:
+            options.status ?? 307,
+        headers:
+            new Headers(
+                options.headers
+            ),
+    };
+}
+
+export async function executeMiddleware(
+    module: MiddlewareModule | null | undefined,
+    input: MiddlewareExecutionInput
+): Promise<MiddlewareExecutionResult> {
+    const originalUrl =
+        input.url instanceof URL
+            ? new URL(
+                input.url.href
+            )
+            : new URL(
+                input.url
+            );
+
+    const baseHeaders =
+        new Headers(
+            input.headers
+        );
+
+    const passthrough =
+        (): MiddlewareExecutionResult => ({
+            type: "next",
+            url:
+                originalUrl,
+            requestHeaders:
+                baseHeaders,
+            responseHeaders:
+                new Headers(),
+        });
+
+    if (
+        !module ||
+        isFrameworkInternalPath(
+            originalUrl.pathname
+        )
+    ) {
+        return passthrough();
+    }
+
+    const handler =
+        module.middleware ??
+        module.default;
+
+    if (!handler) {
+        return passthrough();
+    }
+
+    if (
+        !matchesMiddleware(
+            originalUrl.pathname,
+            module.config?.matcher
+        )
+    ) {
+        return passthrough();
+    }
+
+    const request:
+        MiddlewareRequest = {
+        url:
+            originalUrl.href,
+        method:
+            input.method ??
+            "GET",
+        headers:
+            baseHeaders,
+        nextUrl:
+            originalUrl,
+        cookies:
+            createCookieStore(
+                baseHeaders.get(
+                    "cookie"
+                )
+            ),
+    };
+
+    const result =
+        await handler(
+            request
+        );
+
+    if (
+        result === undefined
+    ) {
+        return passthrough();
+    }
+
+    if (
+        result instanceof Response
+    ) {
+        return {
+            type: "response",
+            response:
+                result,
+        };
+    }
+
+    if (
+        result.type === "next"
+    ) {
+        return {
+            type: "next",
+            url:
+                originalUrl,
+            requestHeaders:
+                mergeHeaders(
+                    baseHeaders,
+                    result.requestHeaders
+                ),
+            responseHeaders:
+                result.responseHeaders,
+        };
+    }
+
+    if (
+        result.type === "rewrite"
+    ) {
+        const target =
+            new URL(
+                result.url,
+                originalUrl
+            );
+
+        assertSafeMiddlewareTarget(
+            target,
+            originalUrl,
+            "rewrite"
+        );
+
+        return {
+            type: "rewrite",
+            url:
+                target,
+            requestHeaders:
+                mergeHeaders(
+                    baseHeaders,
+                    result.requestHeaders
+                ),
+            responseHeaders:
+                result.responseHeaders,
+        };
+    }
+
+    if (
+        result.type === "redirect"
+    ) {
+        const target =
+            new URL(
+                result.url,
+                originalUrl
+            );
+
+        assertSafeMiddlewareTarget(
+            target,
+            originalUrl,
+            "redirect"
+        );
+
+        return {
+            type: "redirect",
+            url:
+                target,
+            status:
+                result.status,
+            headers:
+                result.headers,
+        };
+    }
+
+    throw new Error(
+        "BCP Framework: middleware returned an unsupported result."
+    );
+}
+
+export function matchesMiddleware(
+    pathname: string,
+    matcher:
+        | MiddlewareConfig["matcher"]
+        | undefined
+): boolean {
+    if (
+        matcher === undefined
+    ) {
+        return true;
+    }
+
+    const matchers =
+        Array.isArray(
+            matcher
+        )
+            ? matcher
+            : [
+                matcher,
+            ];
+
+    if (
+        matchers.length === 0
+    ) {
+        return false;
+    }
+
+    return matchers.some(
+        (value) => {
+            if (
+                value instanceof RegExp
+            ) {
+                value.lastIndex = 0;
+                return value.test(
+                    pathname
+                );
+            }
+
+            return matchPathPattern(
+                pathname,
+                value
+            );
+        }
+    );
+}
+
+export function applyMiddlewareRequestHeaders(
+    req: http.IncomingMessage,
+    headers: Headers
+): void {
+    const nextHeaders:
+        http.IncomingHttpHeaders = {};
+
+    headers.forEach(
+        (value, key) => {
+            nextHeaders[
+                key.toLowerCase()
+            ] =
+                value;
+        }
+    );
+
+    req.headers =
+        nextHeaders;
+}
+
+export function applyMiddlewareResponseHeaders(
+    res: http.ServerResponse,
+    headers: Headers
+): void {
+    headers.forEach(
+        (value, key) => {
+            res.setHeader(
+                key,
+                value
+            );
+        }
+    );
+}
+
+export function sendMiddlewareRedirect(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    result: Extract<
+        MiddlewareExecutionResult,
+        {
+            type: "redirect";
+        }
+    >
+): void {
+    applyMiddlewareResponseHeaders(
+        res,
+        result.headers
+    );
+
+    res.statusCode =
+        result.status;
+    res.setHeader(
+        "Location",
+        result.url.href
+    );
+    res.setHeader(
+        "Cache-Control",
+        "no-store"
+    );
+
+    if (
+        req.method === "HEAD"
+    ) {
+        res.end();
+        return;
+    }
+
+    res.end();
+}
+
+export async function sendMiddlewareResponse(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    response: Response
+): Promise<void> {
+    res.statusCode =
+        response.status;
+
+    response.headers.forEach(
+        (value, key) => {
+            res.setHeader(
+                key,
+                value
+            );
+        }
+    );
+
+    const getSetCookie =
+        (
+            response.headers as Headers & {
+                getSetCookie?: () => string[];
+            }
+        ).getSetCookie;
+
+    if (
+        typeof getSetCookie ===
+        "function"
+    ) {
+        const cookies =
+            getSetCookie.call(
+                response.headers
+            );
+
+        if (
+            cookies.length > 0
+        ) {
+            res.setHeader(
+                "Set-Cookie",
+                cookies
+            );
+        }
+    }
+
+    if (
+        req.method === "HEAD" ||
+        response.body === null
+    ) {
+        res.end();
+        return;
+    }
+
+    const body =
+        Buffer.from(
+            await response.arrayBuffer()
+        );
+
+    if (
+        !res.hasHeader(
+            "Content-Length"
+        )
+    ) {
+        res.setHeader(
+            "Content-Length",
+            body.length
+        );
+    }
+
+    res.end(
+        body
+    );
+}
+
+function matchPathPattern(
+    pathname: string,
+    pattern: string
+): boolean {
+    if (
+        pattern === "*" ||
+        pattern === "/:path*"
+    ) {
+        return true;
+    }
+
+    if (
+        !pattern.startsWith(
+            "/"
+        )
+    ) {
+        throw new Error(
+            `BCP Framework: middleware matcher "${pattern}" must start with "/".`
+        );
+    }
+
+    const escaped =
+        pattern
+            .split("/")
+            .filter(
+                Boolean
+            )
+            .map(
+                (segment) => {
+                    if (
+                        segment === "*" ||
+                        /^:[A-Za-z_][A-Za-z0-9_]*\*$/.test(
+                            segment
+                        )
+                    ) {
+                        return "(?:.*)?";
+                    }
+
+                    if (
+                        /^:[A-Za-z_][A-Za-z0-9_]*$/.test(
+                            segment
+                        )
+                    ) {
+                        return "[^/]+";
+                    }
+
+                    return escapeRegExp(
+                        segment
+                    );
+                }
+            );
+
+    if (
+        escaped.length === 0
+    ) {
+        return pathname === "/";
+    }
+
+    const source =
+        `^/${escaped.join("/")}/?$`;
+
+    return new RegExp(
+        source
+    ).test(
+        pathname
+    );
+}
+
+function createCookieStore(
+    cookieHeader: string | null
+): MiddlewareCookieStore {
+    const values =
+        new Map<string, string>();
+
+    if (cookieHeader) {
+        for (
+            const part
+            of cookieHeader.split(";")
+        ) {
+            const separator =
+                part.indexOf("=");
+
+            if (
+                separator < 0
+            ) {
+                continue;
+            }
+
+            const name =
+                part
+                    .slice(
+                        0,
+                        separator
+                    )
+                    .trim();
+            const rawValue =
+                part
+                    .slice(
+                        separator + 1
+                    )
+                    .trim();
+
+            if (!name) {
+                continue;
+            }
+
+            try {
+                values.set(
+                    name,
+                    decodeURIComponent(
+                        rawValue
+                    )
+                );
+            } catch {
+                values.set(
+                    name,
+                    rawValue
+                );
+            }
+        }
+    }
+
+    return {
+        get(name) {
+            return values.get(
+                name
+            ) ?? null;
+        },
+        has(name) {
+            return values.has(
+                name
+            );
+        },
+    };
+}
+
+function mergeHeaders(
+    base: Headers,
+    additions: Headers
+): Headers {
+    const result =
+        new Headers(
+            base
+        );
+
+    additions.forEach(
+        (value, key) => {
+            result.set(
+                key,
+                value
+            );
+        }
+    );
+
+    return result;
+}
+
+function isFrameworkInternalPath(
+    pathname: string
+): boolean {
+    return (
+        pathname === "/_bcp" ||
+        pathname.startsWith(
+            "/_bcp/"
+        )
+    );
+}
+
+function escapeRegExp(
+    value: string
+): string {
+    return value.replace(
+        /[.*+?^${}()|[\]\\]/g,
+        "\\$&"
+    );
+}