@chidchanun/bcp 0.1.17 → 0.1.18

package/packages/server/src/middleware.ts

@@ -27,6 +27,10 @@ export interface MiddlewareRequest {
     readonly cookies: MiddlewareCookieStore;
 }
 
+export interface MiddlewareContext {
+    readonly state: Record<string, unknown>;
+}
+
 export interface MiddlewareHeaderOptions {
     request?: {
         headers?: HeadersInit;
@@ -66,21 +70,39 @@ export type MiddlewareResult =
     | MiddlewareRewriteResult
     | MiddlewareRedirectResult;
 
-export type MiddlewareHandler = (
-    request: MiddlewareRequest
-) =>
+export type MiddlewareHandlerResult =
     | MiddlewareResult
     | Response
-    | void
-    | Promise<
-        MiddlewareResult |
-        Response |
-        void
-    >;
+    | void;
+
+export type MiddlewareNext =
+    () => Promise<Response>;
+
+export type MiddlewareLegacyHandler = (
+    request: MiddlewareRequest
+) =>
+    | MiddlewareHandlerResult
+    | Promise<MiddlewareHandlerResult>;
+
+export type MiddlewarePipelineHandler = (
+    request: MiddlewareRequest,
+    next: MiddlewareNext,
+    context: MiddlewareContext
+) =>
+    | MiddlewareHandlerResult
+    | Promise<MiddlewareHandlerResult>;
+
+export type MiddlewareHandler =
+    | MiddlewareLegacyHandler
+    | MiddlewarePipelineHandler;
 
 export interface MiddlewareModule {
-    middleware?: MiddlewareHandler;
-    default?: MiddlewareHandler;
+    middleware?:
+        | MiddlewareHandler
+        | readonly MiddlewareHandler[];
+    default?:
+        | MiddlewareHandler
+        | readonly MiddlewareHandler[];
     config?: MiddlewareConfig;
 }
 
@@ -114,6 +136,13 @@ export type MiddlewareExecutionResult =
         response: Response;
     };
 
+export type MiddlewareDownstream = (
+    input: MiddlewareExecutionInput
+) => Promise<Response>;
+
+const middlewareRedirectTargets =
+    new WeakMap<Response, URL>();
+
 export function next(
     options: MiddlewareHeaderOptions = {}
 ): MiddlewareNextResult {
@@ -166,6 +195,10 @@ export function redirect(
     };
 }
 
+/**
+ * Legacy middleware evaluator retained for backward compatibility and tests.
+ * Middleware System v2 runtime traffic uses executeMiddlewarePipeline().
+ */
 export async function executeMiddleware(
     module: MiddlewareModule | null | undefined,
     input: MiddlewareExecutionInput
@@ -204,11 +237,14 @@ export async function executeMiddleware(
         return passthrough();
     }
 
-    const handler =
-        module.middleware ??
-        module.default;
+    const handlers =
+        getMiddlewareHandlers(
+            module
+        );
 
-    if (!handler) {
+    if (
+        handlers.length === 0
+    ) {
         return passthrough();
     }
 
@@ -221,121 +257,308 @@ export async function executeMiddleware(
         return passthrough();
     }
 
-    const request:
-        MiddlewareRequest = {
-        url:
-            originalUrl.href,
-        method:
-            input.method ??
-            "GET",
-        headers:
-            baseHeaders,
-        nextUrl:
+    const handler =
+        handlers[0] as MiddlewareLegacyHandler;
+
+    const request =
+        createMiddlewareRequest(
             originalUrl,
-        cookies:
-            createCookieStore(
-                baseHeaders.get(
-                    "cookie"
-                )
-            ),
-    };
+            input.method ?? "GET",
+            baseHeaders
+        );
 
     const result =
         await handler(
             request
         );
 
-    if (
-        result === undefined
-    ) {
-        return passthrough();
-    }
+    return normalizeLegacyResult(
+        result,
+        originalUrl,
+        baseHeaders
+    );
+}
+
+/**
+ * Middleware System v2 onion pipeline.
+ *
+ * Handlers may call await next() to run the remaining middleware and the
+ * application, inspect or mutate the returned Response, then return it.
+ * Legacy one-argument handlers and next()/rewrite()/redirect() results remain
+ * supported inside the same chain.
+ */
+export async function executeMiddlewarePipeline(
+    module: MiddlewareModule | null | undefined,
+    input: MiddlewareExecutionInput,
+    downstream: MiddlewareDownstream
+): Promise<Response> {
+    const initialUrl =
+        input.url instanceof URL
+            ? new URL(
+                input.url.href
+            )
+            : new URL(
+                input.url
+            );
+    const method =
+        input.method ??
+        "GET";
+    const initialHeaders =
+        new Headers(
+            input.headers
+        );
 
     if (
-        result instanceof Response
+        !module ||
+        isFrameworkInternalPath(
+            initialUrl.pathname
+        ) ||
+        !matchesMiddleware(
+            initialUrl.pathname,
+            module.config?.matcher
+        )
     ) {
-        return {
-            type: "response",
-            response:
-                result,
-        };
+        return downstream({
+            url:
+                initialUrl,
+            method,
+            headers:
+                initialHeaders,
+        });
     }
 
+    const handlers =
+        getMiddlewareHandlers(
+            module
+        );
+
     if (
-        result.type === "next"
+        handlers.length === 0
     ) {
-        return {
-            type: "next",
+        return downstream({
             url:
-                originalUrl,
-            requestHeaders:
-                mergeHeaders(
-                    baseHeaders,
-                    result.requestHeaders
-                ),
-            responseHeaders:
-                result.responseHeaders,
-        };
+                initialUrl,
+            method,
+            headers:
+                initialHeaders,
+        });
     }
 
-    if (
-        result.type === "rewrite"
-    ) {
-        const target =
-            new URL(
-                result.url,
-                originalUrl
-            );
+    const current = {
+        url:
+            initialUrl,
+        headers:
+            initialHeaders,
+    };
+    const context:
+        MiddlewareContext = {
+        state:
+            Object.create(
+                null
+            ) as Record<
+                string,
+                unknown
+            >,
+    };
 
-        assertSafeMiddlewareTarget(
-            target,
-            originalUrl,
-            "rewrite"
-        );
+    const dispatch =
+        async (
+            index: number
+        ): Promise<Response> => {
+            if (
+                index >=
+                handlers.length
+            ) {
+                return downstream({
+                    url:
+                        new URL(
+                            current.url.href
+                        ),
+                    method,
+                    headers:
+                        new Headers(
+                            current.headers
+                        ),
+                });
+            }
 
-        return {
-            type: "rewrite",
-            url:
-                target,
-            requestHeaders:
+            const handler =
+                handlers[index];
+            const request =
+                createMiddlewareRequest(
+                    current.url,
+                    method,
+                    current.headers
+                );
+            let nextPromise:
+                Promise<Response> | null =
+                null;
+
+            const runNext:
+                MiddlewareNext =
+                () => {
+                    if (nextPromise) {
+                        throw new Error(
+                            "BCP Framework: middleware next() may only be called once per handler."
+                        );
+                    }
+
+                    nextPromise =
+                        dispatch(
+                            index + 1
+                        );
+                    return nextPromise;
+                };
+
+            const invoke =
+                handler as (
+                    request:
+                        MiddlewareRequest,
+                    next:
+                        MiddlewareNext,
+                    context:
+                        MiddlewareContext
+                ) =>
+                    | MiddlewareHandlerResult
+                    | Promise<MiddlewareHandlerResult>;
+
+            const result =
+                await invoke(
+                    request,
+                    runNext,
+                    context
+                );
+
+            if (
+                result === undefined
+            ) {
+                return nextPromise
+                    ? await nextPromise
+                    : runNext();
+            }
+
+            if (
+                result instanceof
+                Response
+            ) {
+                return result;
+            }
+
+            if (
+                result.type ===
+                "redirect"
+            ) {
+                const target =
+                    new URL(
+                        result.url,
+                        current.url
+                    );
+
+                assertSafeMiddlewareTarget(
+                    target,
+                    current.url,
+                    "redirect"
+                );
+
+                const headers =
+                    new Headers(
+                        result.headers
+                    );
+                headers.set(
+                    "Location",
+                    target.href
+                );
+
+                const response =
+                    new Response(
+                        null,
+                        {
+                            status:
+                                result.status,
+                            headers,
+                        }
+                    );
+
+                middlewareRedirectTargets.set(
+                    response,
+                    target
+                );
+
+                return response;
+            }
+
+            if (
+                result.type ===
+                "rewrite"
+            ) {
+                if (nextPromise) {
+                    throw new Error(
+                        "BCP Framework: rewrite() must be returned before middleware calls next()."
+                    );
+                }
+
+                const target =
+                    new URL(
+                        result.url,
+                        current.url
+                    );
+
+                assertSafeMiddlewareTarget(
+                    target,
+                    current.url,
+                    "rewrite"
+                );
+
+                current.url =
+                    target;
+                current.headers =
+                    mergeHeaders(
+                        current.headers,
+                        result.requestHeaders
+                    );
+
+                const response =
+                    await runNext();
+
+                return applyHeadersToResponse(
+                    response,
+                    result.responseHeaders
+                );
+            }
+
+            current.headers =
                 mergeHeaders(
-                    baseHeaders,
+                    current.headers,
                     result.requestHeaders
-                ),
-            responseHeaders:
-                result.responseHeaders,
-        };
-    }
+                );
 
-    if (
-        result.type === "redirect"
-    ) {
-        const target =
-            new URL(
-                result.url,
-                originalUrl
+            const response =
+                nextPromise
+                    ? await nextPromise
+                    : await runNext();
+
+            return applyHeadersToResponse(
+                response,
+                result.responseHeaders
             );
+        };
 
-        assertSafeMiddlewareTarget(
-            target,
-            originalUrl,
-            "redirect"
-        );
+    return dispatch(0);
+}
 
-        return {
-            type: "redirect",
-            url:
-                target,
-            status:
-                result.status,
-            headers:
-                result.headers,
-        };
-    }
+export function getMiddlewareRedirectTarget(
+    response: Response
+): URL | null {
+    const target =
+        middlewareRedirectTargets.get(
+            response
+        );
 
-    throw new Error(
-        "BCP Framework: middleware returned an unsupported result."
-    );
+    return target
+        ? new URL(
+            target.href
+        )
+        : null;
 }
 
 export function matchesMiddleware(
@@ -526,6 +749,223 @@ export async function sendMiddlewareResponse(
     );
 }
 
+function getMiddlewareHandlers(
+    module: MiddlewareModule
+): MiddlewareHandler[] {
+    const value =
+        module.middleware ??
+        module.default;
+
+    if (!value) {
+        return [];
+    }
+
+    return Array.isArray(
+        value
+    )
+        ? [
+            ...value,
+        ]
+        : [
+            value as MiddlewareHandler,
+        ];
+}
+
+function createMiddlewareRequest(
+    url: URL,
+    method: string,
+    headers: Headers
+): MiddlewareRequest {
+    const requestUrl =
+        new URL(
+            url.href
+        );
+    const requestHeaders =
+        new Headers(
+            headers
+        );
+
+    return {
+        url:
+            requestUrl.href,
+        method,
+        headers:
+            requestHeaders,
+        nextUrl:
+            requestUrl,
+        cookies:
+            createCookieStore(
+                requestHeaders.get(
+                    "cookie"
+                )
+            ),
+    };
+}
+
+function normalizeLegacyResult(
+    result: MiddlewareHandlerResult,
+    originalUrl: URL,
+    baseHeaders: Headers
+): MiddlewareExecutionResult {
+    if (
+        result === undefined
+    ) {
+        return {
+            type: "next",
+            url:
+                originalUrl,
+            requestHeaders:
+                baseHeaders,
+            responseHeaders:
+                new Headers(),
+        };
+    }
+
+    if (
+        result instanceof Response
+    ) {
+        return {
+            type: "response",
+            response:
+                result,
+        };
+    }
+
+    if (
+        result.type === "next"
+    ) {
+        return {
+            type: "next",
+            url:
+                originalUrl,
+            requestHeaders:
+                mergeHeaders(
+                    baseHeaders,
+                    result.requestHeaders
+                ),
+            responseHeaders:
+                result.responseHeaders,
+        };
+    }
+
+    if (
+        result.type === "rewrite"
+    ) {
+        const target =
+            new URL(
+                result.url,
+                originalUrl
+            );
+
+        assertSafeMiddlewareTarget(
+            target,
+            originalUrl,
+            "rewrite"
+        );
+
+        return {
+            type: "rewrite",
+            url:
+                target,
+            requestHeaders:
+                mergeHeaders(
+                    baseHeaders,
+                    result.requestHeaders
+                ),
+            responseHeaders:
+                result.responseHeaders,
+        };
+    }
+
+    if (
+        result.type === "redirect"
+    ) {
+        const target =
+            new URL(
+                result.url,
+                originalUrl
+            );
+
+        assertSafeMiddlewareTarget(
+            target,
+            originalUrl,
+            "redirect"
+        );
+
+        return {
+            type: "redirect",
+            url:
+                target,
+            status:
+                result.status,
+            headers:
+                result.headers,
+        };
+    }
+
+    throw new Error(
+        "BCP Framework: middleware returned an unsupported result."
+    );
+}
+
+function applyHeadersToResponse(
+    response: Response,
+    additions: Headers
+): Response {
+    let hasAdditions =
+        false;
+
+    additions.forEach(
+        () => {
+            hasAdditions =
+                true;
+        }
+    );
+
+    if (!hasAdditions) {
+        return response;
+    }
+
+    const headers =
+        new Headers(
+            response.headers
+        );
+
+    additions.forEach(
+        (value, key) => {
+            headers.set(
+                key,
+                value
+            );
+        }
+    );
+
+    const wrapped =
+        new Response(
+            response.body,
+            {
+                status:
+                    response.status,
+                statusText:
+                    response.statusText,
+                headers,
+            }
+        );
+    const redirectTarget =
+        middlewareRedirectTargets.get(
+            response
+        );
+
+    if (redirectTarget) {
+        middlewareRedirectTargets.set(
+            wrapped,
+            redirectTarget
+        );
+    }
+
+    return wrapped;
+}
+
 function matchPathPattern(
     pathname: string,
     pattern: string