@colyseus/core 0.18.2 → 0.18.4

package/src/router/node.ts

@@ -13,14 +13,28 @@ import * as matchMaker from '../MatchMaker.ts';
 import { setResponse } from '@colyseus/better-call/node';
 import { postMatchmakeMethod } from './default_routes.ts';
 
+/** Matchmaking options are small — the cap only stops unbounded buffering. */
+const MAX_BODY_SIZE = 1024 * 1024;
+
+const badRequest = (status: number, message: string) =>
+  Object.assign(new Error(message), { status });
+
 function readBody(req: http.IncomingMessage): Promise<any> {
   return new Promise((resolve, reject) => {
     let data = '';
 
     req.on('data', (chunk: Buffer | string) => {
       data += chunk.toString();
+      if (data.length > MAX_BODY_SIZE) {
+        reject(badRequest(413, 'request body too large'));
+        req.destroy();
+      }
+    });
+    // JSON.parse throws on a later tick — uncaught here it kills the process.
+    req.on('end', () => {
+      try { resolve(data ? JSON.parse(data) : {}); }
+      catch { reject(badRequest(400, 'malformed JSON body')); }
     });
-    req.on('end', () => resolve(data ? JSON.parse(data) : {}));
     req.on('error', reject);
   });
 }
@@ -112,10 +126,20 @@ export function createNodeMatchmakingMiddleware() {
 
     const [, method, roomName] = match;
 
+    let body: any;
+    try {
+      body = await readBody(req);
+    } catch (e: any) {
+      // answer here — next() would report a misleading 404 for a bad body
+      res.writeHead(e.status ?? 400, { ...corsHeaders, 'content-type': 'application/json' });
+      res.end(JSON.stringify({ error: e.message }));
+      return;
+    }
+
     try {
       const response = await postMatchmakeMethod({
         params: { method, roomName },
-        body: await readBody(req),
+        body,
         headers: req.headers as Record<string, string>,
         request: { headers } as any,
         asResponse: true,

package/src/utils/Utils.ts

@@ -22,6 +22,24 @@ export type ExtractMethodOrPropertyType<
   ? Awaited<R>
   : TClass[TKey];
 
+/**
+ * Return type of `remoteRoomCall()`.
+ *
+ * Resolves to the method's awaited return type (or the property's type) when
+ * the method name was captured as a literal type. Falls back to `any` when it
+ * wasn't — e.g. `remoteRoomCall<MyRoom>(...)` with only the room type given:
+ * TypeScript applies the `TMethod` default instead of inferring the literal
+ * once an explicit type argument list is present (microsoft/TypeScript#26242).
+ * Pass both type arguments (`remoteRoomCall<MyRoom, 'myMethod'>`) for a
+ * precise return type.
+ */
+export type RemoteRoomCallReturn<
+  TRoom,
+  TMethod extends keyof TRoom
+> = keyof TRoom extends TMethod
+  ? any
+  : ExtractMethodOrPropertyType<TRoom, TMethod>;
+
 // remote room call timeouts
 export const REMOTE_ROOM_SHORT_TIMEOUT = Number(process.env.COLYSEUS_PRESENCE_SHORT_TIMEOUT || 2000);
 export const MAX_CONCURRENT_CREATE_ROOM_WAIT_TIME = Number(process.env.COLYSEUS_MAX_CONCURRENT_CREATE_ROOM_WAIT_TIME || 0.5);

package/src/utils/nanoevents.ts

@@ -10,7 +10,10 @@ export const createNanoEvents = () => ({
         callbacks[i](...args)
       }
     },
-    events: {},
+    // null-prototype: event names are client-supplied (message types), and on a
+    // plain object "__proto__" / "constructor" / "toString" resolve to inherited
+    // members instead of missing (colyseus/colyseus#951)
+    events: Object.create(null) as { [event: string]: Array<(...args: any[]) => void> },
     on(event: string, cb: (...args: any[]) => void) {
       ;(this.events[event] ||= []).push(cb)
       return () => {