@chidchanun/bcp 0.2.16 → 0.2.18

package/packages/server/src/middleware.mjs

@@ -0,0 +1,631 @@
+// packages/server/src/security.ts
+var DEFAULT_BODY_LIMIT = 1024 * 1024;
+function assertSafeMiddlewareTarget(target, originalUrl, kind) {
+  if (target.protocol !== "http:" && target.protocol !== "https:") {
+    throw new Error(
+      `BCP Framework: middleware ${kind} only supports http: and https: URLs.`
+    );
+  }
+  if (target.username || target.password) {
+    throw new Error(
+      `BCP Framework: middleware ${kind} URLs must not contain credentials.`
+    );
+  }
+  if (kind === "rewrite" && target.origin !== originalUrl.origin) {
+    throw new Error(
+      "BCP Framework: middleware rewrites must stay on the same origin."
+    );
+  }
+}
+
+// packages/server/src/middleware.ts
+var middlewareRedirectTargets = /* @__PURE__ */ new WeakMap();
+function next(options = {}) {
+  return {
+    type: "next",
+    requestHeaders: new Headers(
+      options.request?.headers
+    ),
+    responseHeaders: new Headers(
+      options.response?.headers
+    )
+  };
+}
+function rewrite(url, options = {}) {
+  return {
+    type: "rewrite",
+    url: url.toString(),
+    requestHeaders: new Headers(
+      options.request?.headers
+    ),
+    responseHeaders: new Headers(
+      options.response?.headers
+    )
+  };
+}
+function redirect(url, options = {}) {
+  return {
+    type: "redirect",
+    url: url.toString(),
+    status: options.status ?? 307,
+    headers: new Headers(
+      options.headers
+    )
+  };
+}
+async function executeMiddleware(module, input) {
+  const originalUrl = input.url instanceof URL ? new URL(
+    input.url.href
+  ) : new URL(
+    input.url
+  );
+  const baseHeaders = new Headers(
+    input.headers
+  );
+  const passthrough = () => ({
+    type: "next",
+    url: originalUrl,
+    requestHeaders: baseHeaders,
+    responseHeaders: new Headers()
+  });
+  if (!module || isFrameworkInternalPath(
+    originalUrl.pathname
+  )) {
+    return passthrough();
+  }
+  const handlers = getMiddlewareHandlers(
+    module
+  );
+  if (handlers.length === 0) {
+    return passthrough();
+  }
+  if (!matchesMiddleware(
+    originalUrl.pathname,
+    module.config?.matcher
+  )) {
+    return passthrough();
+  }
+  const handler = handlers[0];
+  const request = createMiddlewareRequest(
+    originalUrl,
+    input.method ?? "GET",
+    baseHeaders
+  );
+  const result = await handler(
+    request
+  );
+  return normalizeLegacyResult(
+    result,
+    originalUrl,
+    baseHeaders
+  );
+}
+async function executeMiddlewarePipeline(module, input, downstream) {
+  const initialUrl = input.url instanceof URL ? new URL(
+    input.url.href
+  ) : new URL(
+    input.url
+  );
+  const method = input.method ?? "GET";
+  const initialHeaders = new Headers(
+    input.headers
+  );
+  if (!module || isFrameworkInternalPath(
+    initialUrl.pathname
+  ) || !matchesMiddleware(
+    initialUrl.pathname,
+    module.config?.matcher
+  )) {
+    return downstream({
+      url: initialUrl,
+      method,
+      headers: initialHeaders
+    });
+  }
+  const handlers = getMiddlewareHandlers(
+    module
+  );
+  if (handlers.length === 0) {
+    return downstream({
+      url: initialUrl,
+      method,
+      headers: initialHeaders
+    });
+  }
+  const current = {
+    url: initialUrl,
+    headers: initialHeaders
+  };
+  const context = {
+    state: /* @__PURE__ */ Object.create(
+      null
+    )
+  };
+  const dispatch = async (index) => {
+    if (index >= handlers.length) {
+      return downstream({
+        url: new URL(
+          current.url.href
+        ),
+        method,
+        headers: new Headers(
+          current.headers
+        )
+      });
+    }
+    const handler = handlers[index];
+    const request = createMiddlewareRequest(
+      current.url,
+      method,
+      current.headers
+    );
+    let nextPromise = null;
+    const runNext = () => {
+      if (nextPromise) {
+        throw new Error(
+          "BCP Framework: middleware next() may only be called once per handler."
+        );
+      }
+      nextPromise = dispatch(
+        index + 1
+      );
+      return nextPromise;
+    };
+    const invoke = handler;
+    const result = await invoke(
+      request,
+      runNext,
+      context
+    );
+    if (result === void 0) {
+      return nextPromise ? await nextPromise : runNext();
+    }
+    if (result instanceof Response) {
+      return result;
+    }
+    if (result.type === "redirect") {
+      const target = new URL(
+        result.url,
+        current.url
+      );
+      assertSafeMiddlewareTarget(
+        target,
+        current.url,
+        "redirect"
+      );
+      const headers = new Headers(
+        result.headers
+      );
+      headers.set(
+        "Location",
+        target.href
+      );
+      const response2 = new Response(
+        null,
+        {
+          status: result.status,
+          headers
+        }
+      );
+      middlewareRedirectTargets.set(
+        response2,
+        target
+      );
+      return response2;
+    }
+    if (result.type === "rewrite") {
+      if (nextPromise) {
+        throw new Error(
+          "BCP Framework: rewrite() must be returned before middleware calls next()."
+        );
+      }
+      const target = new URL(
+        result.url,
+        current.url
+      );
+      assertSafeMiddlewareTarget(
+        target,
+        current.url,
+        "rewrite"
+      );
+      current.url = target;
+      current.headers = mergeHeaders(
+        current.headers,
+        result.requestHeaders
+      );
+      const response2 = await runNext();
+      return applyHeadersToResponse(
+        response2,
+        result.responseHeaders
+      );
+    }
+    current.headers = mergeHeaders(
+      current.headers,
+      result.requestHeaders
+    );
+    const response = nextPromise ? await nextPromise : await runNext();
+    return applyHeadersToResponse(
+      response,
+      result.responseHeaders
+    );
+  };
+  return dispatch(0);
+}
+function getMiddlewareRedirectTarget(response) {
+  const target = middlewareRedirectTargets.get(
+    response
+  );
+  return target ? new URL(
+    target.href
+  ) : null;
+}
+function matchesMiddleware(pathname, matcher) {
+  if (matcher === void 0) {
+    return true;
+  }
+  const matchers = Array.isArray(
+    matcher
+  ) ? matcher : [
+    matcher
+  ];
+  if (matchers.length === 0) {
+    return false;
+  }
+  return matchers.some(
+    (value) => {
+      if (value instanceof RegExp) {
+        value.lastIndex = 0;
+        return value.test(
+          pathname
+        );
+      }
+      return matchPathPattern(
+        pathname,
+        value
+      );
+    }
+  );
+}
+function applyMiddlewareRequestHeaders(req, headers) {
+  const nextHeaders = {};
+  headers.forEach(
+    (value, key) => {
+      nextHeaders[key.toLowerCase()] = value;
+    }
+  );
+  req.headers = nextHeaders;
+}
+function applyMiddlewareResponseHeaders(res, headers) {
+  headers.forEach(
+    (value, key) => {
+      res.setHeader(
+        key,
+        value
+      );
+    }
+  );
+}
+function sendMiddlewareRedirect(req, res, result) {
+  applyMiddlewareResponseHeaders(
+    res,
+    result.headers
+  );
+  res.statusCode = result.status;
+  res.setHeader(
+    "Location",
+    result.url.href
+  );
+  res.setHeader(
+    "Cache-Control",
+    "no-store"
+  );
+  if (req.method === "HEAD") {
+    res.end();
+    return;
+  }
+  res.end();
+}
+async function sendMiddlewareResponse(req, res, response) {
+  res.statusCode = response.status;
+  response.headers.forEach(
+    (value, key) => {
+      res.setHeader(
+        key,
+        value
+      );
+    }
+  );
+  const getSetCookie = response.headers.getSetCookie;
+  if (typeof getSetCookie === "function") {
+    const cookies = getSetCookie.call(
+      response.headers
+    );
+    if (cookies.length > 0) {
+      res.setHeader(
+        "Set-Cookie",
+        cookies
+      );
+    }
+  }
+  if (req.method === "HEAD" || response.body === null) {
+    res.end();
+    return;
+  }
+  const body = Buffer.from(
+    await response.arrayBuffer()
+  );
+  if (!res.hasHeader(
+    "Content-Length"
+  )) {
+    res.setHeader(
+      "Content-Length",
+      body.length
+    );
+  }
+  res.end(
+    body
+  );
+}
+function getMiddlewareHandlers(module) {
+  const value = module.middleware ?? module.default;
+  if (!value) {
+    return [];
+  }
+  return Array.isArray(
+    value
+  ) ? [
+    ...value
+  ] : [
+    value
+  ];
+}
+function createMiddlewareRequest(url, method, headers) {
+  const requestUrl = new URL(
+    url.href
+  );
+  const requestHeaders = new Headers(
+    headers
+  );
+  return {
+    url: requestUrl.href,
+    method,
+    headers: requestHeaders,
+    nextUrl: requestUrl,
+    cookies: createCookieStore(
+      requestHeaders.get(
+        "cookie"
+      )
+    )
+  };
+}
+function normalizeLegacyResult(result, originalUrl, baseHeaders) {
+  if (result === void 0) {
+    return {
+      type: "next",
+      url: originalUrl,
+      requestHeaders: baseHeaders,
+      responseHeaders: new Headers()
+    };
+  }
+  if (result instanceof Response) {
+    return {
+      type: "response",
+      response: result
+    };
+  }
+  if (result.type === "next") {
+    return {
+      type: "next",
+      url: originalUrl,
+      requestHeaders: mergeHeaders(
+        baseHeaders,
+        result.requestHeaders
+      ),
+      responseHeaders: result.responseHeaders
+    };
+  }
+  if (result.type === "rewrite") {
+    const target = new URL(
+      result.url,
+      originalUrl
+    );
+    assertSafeMiddlewareTarget(
+      target,
+      originalUrl,
+      "rewrite"
+    );
+    return {
+      type: "rewrite",
+      url: target,
+      requestHeaders: mergeHeaders(
+        baseHeaders,
+        result.requestHeaders
+      ),
+      responseHeaders: result.responseHeaders
+    };
+  }
+  if (result.type === "redirect") {
+    const target = new URL(
+      result.url,
+      originalUrl
+    );
+    assertSafeMiddlewareTarget(
+      target,
+      originalUrl,
+      "redirect"
+    );
+    return {
+      type: "redirect",
+      url: target,
+      status: result.status,
+      headers: result.headers
+    };
+  }
+  throw new Error(
+    "BCP Framework: middleware returned an unsupported result."
+  );
+}
+function applyHeadersToResponse(response, additions) {
+  let hasAdditions = false;
+  additions.forEach(
+    () => {
+      hasAdditions = true;
+    }
+  );
+  if (!hasAdditions) {
+    return response;
+  }
+  const headers = new Headers(
+    response.headers
+  );
+  additions.forEach(
+    (value, key) => {
+      headers.set(
+        key,
+        value
+      );
+    }
+  );
+  const wrapped = new Response(
+    response.body,
+    {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    }
+  );
+  const redirectTarget = middlewareRedirectTargets.get(
+    response
+  );
+  if (redirectTarget) {
+    middlewareRedirectTargets.set(
+      wrapped,
+      redirectTarget
+    );
+  }
+  return wrapped;
+}
+function matchPathPattern(pathname, pattern) {
+  if (pattern === "*" || pattern === "/:path*") {
+    return true;
+  }
+  if (!pattern.startsWith(
+    "/"
+  )) {
+    throw new Error(
+      `BCP Framework: middleware matcher "${pattern}" must start with "/".`
+    );
+  }
+  const escaped = pattern.split("/").filter(
+    Boolean
+  ).map(
+    (segment) => {
+      if (segment === "*" || /^:[A-Za-z_][A-Za-z0-9_]*\*$/.test(
+        segment
+      )) {
+        return "(?:.*)?";
+      }
+      if (/^:[A-Za-z_][A-Za-z0-9_]*$/.test(
+        segment
+      )) {
+        return "[^/]+";
+      }
+      return escapeRegExp(
+        segment
+      );
+    }
+  );
+  if (escaped.length === 0) {
+    return pathname === "/";
+  }
+  const source = `^/${escaped.join("/")}/?$`;
+  return new RegExp(
+    source
+  ).test(
+    pathname
+  );
+}
+function createCookieStore(cookieHeader) {
+  const values = /* @__PURE__ */ new Map();
+  if (cookieHeader) {
+    for (const part of cookieHeader.split(";")) {
+      const separator = part.indexOf("=");
+      if (separator < 0) {
+        continue;
+      }
+      const name = part.slice(
+        0,
+        separator
+      ).trim();
+      const rawValue = part.slice(
+        separator + 1
+      ).trim();
+      if (!name) {
+        continue;
+      }
+      try {
+        values.set(
+          name,
+          decodeURIComponent(
+            rawValue
+          )
+        );
+      } catch {
+        values.set(
+          name,
+          rawValue
+        );
+      }
+    }
+  }
+  return {
+    get(name) {
+      return values.get(
+        name
+      ) ?? null;
+    },
+    has(name) {
+      return values.has(
+        name
+      );
+    }
+  };
+}
+function mergeHeaders(base, additions) {
+  const result = new Headers(
+    base
+  );
+  additions.forEach(
+    (value, key) => {
+      result.set(
+        key,
+        value
+      );
+    }
+  );
+  return result;
+}
+function isFrameworkInternalPath(pathname) {
+  return pathname === "/_bcp" || pathname.startsWith(
+    "/_bcp/"
+  );
+}
+function escapeRegExp(value) {
+  return value.replace(
+    /[.*+?^${}()|[\]\\]/g,
+    "\\$&"
+  );
+}
+export {
+  applyMiddlewareRequestHeaders,
+  applyMiddlewareResponseHeaders,
+  executeMiddleware,
+  executeMiddlewarePipeline,
+  getMiddlewareRedirectTarget,
+  matchesMiddleware,
+  next,
+  redirect,
+  rewrite,
+  sendMiddlewareRedirect,
+  sendMiddlewareResponse
+};