@daloyjs/core 1.0.0-rc.4 → 1.0.0-rc.6

package/dist/adapters/node.d.ts

@@ -76,7 +76,14 @@ export interface NodeServerOptions {
 export interface NodeServerHandle {
     /** The underlying `node:http` `Server` instance, for advanced wiring (extra listeners, address introspection). */
     server: Server;
-    /** Port the server was asked to listen on ({@link NodeServerOptions.port}, default `3000`). */
+    /**
+     * Bound TCP port once the server emits `listening`.
+     *
+     * Before the listener is ready, this is the requested
+     * {@link NodeServerOptions.port} (default `3000`). In particular, callers
+     * using `port: 0` must await the server's `listening` event before reading
+     * this property to receive the OS-assigned ephemeral port.
+     */
     port: number;
     /** Graceful shutdown: drains {@link App.shutdown} hooks, destroys WebSocket sockets, then closes the server. Idempotent. */
     close(): Promise<void>;

package/dist/adapters/node.js

@@ -2,10 +2,12 @@
  * Node adapter: translates IncomingMessage/ServerResponse to web-standard
  * Request/Response. Includes graceful shutdown wired to SIGTERM/SIGINT.
  */
-import { createServer, } from "node:http";
+import { createServer } from "node:http";
 import { Readable } from "node:stream";
-import { DALOY_RAW_BODY, DALOY_RAW_STREAM, DALOY_REQUEST_RAW_BODY, DALOY_LIGHT_RESPONSE_OK, } from "../app.js";
+import { DALOY_RAW_BODY, DALOY_RAW_STREAM, DALOY_REQUEST_RAW_BODY, DALOY_LIGHT_RESPONSE_OK, DALOY_REQUEST_ABORT, } from "../app.js";
+import { BadRequestError } from "../errors.js";
 import { setClientCertificate, normalizePeerCertificate, } from "../mtls.js";
+import { setConnInfo } from "../conn-info.js";
 import { FrameSink, encodeFrame, encodeClosePayload, encodeSendPayload, validateUpgrade, validateSelectedSubprotocol, checkWebSocketOrigin, WS_OPCODE, WS_CLOSE_CODE, WS_READY_STATE, WS_MAX_CONTROL_PAYLOAD, WebSocketProtocolError, WebSocketPayloadTooLargeError, } from "../websocket.js";
 /**
  * Start a Node.js HTTP (and optional WebSocket) server bound to the given {@link App}.
@@ -72,9 +74,7 @@ export function serve(app, opts = {}) {
     // `0` opts out and restores Node's unbounded-ish default (2000).
     const maxHeaderCount = opts.maxHeaderCount;
     server.maxHeadersCount =
-        typeof maxHeaderCount === "number" && maxHeaderCount >= 0
-            ? maxHeaderCount
-            : 100;
+        typeof maxHeaderCount === "number" && maxHeaderCount >= 0 ? maxHeaderCount : 100;
     // Connection-layer admission control. Reject overflow sockets at accept time
     // rather than queuing them into the event loop under overload.
     if (typeof opts.maxConnections === "number" && opts.maxConnections > 0) {
@@ -85,11 +85,23 @@ export function serve(app, opts = {}) {
         server.on("upgrade", (req, socket, head) => {
             wsSockets.add(socket);
             socket.on("close", () => wsSockets.delete(socket));
-            void handleUpgrade(app, req, socket, head, trustProxy);
+            // Safety net: a rejection here would otherwise be unhandled and, under
+            // the production crash-on-unhandledRejection posture, kill the process
+            // from a single malformed upgrade request.
+            handleUpgrade(app, req, socket, head, trustProxy).catch((err) => {
+                app.log.error({ err }, "WebSocket upgrade failed");
+                try {
+                    writeUpgradeError(socket, 400, "Bad Request");
+                }
+                catch {
+                    /* socket already closed */
+                }
+                socket.destroy();
+            });
         });
     }
-    const port = opts.port ?? 3000;
-    server.listen(port, opts.hostname ?? "0.0.0.0");
+    const requestedPort = opts.port ?? 3000;
+    server.listen(requestedPort, opts.hostname ?? "0.0.0.0");
     // Kill idle keep-alive sockets immediately when draining begins.
     // In-flight requests keep their socket because Node's
     // `closeIdleConnections()` is a no-op for sockets with an in-flight request.
@@ -111,11 +123,21 @@ export function serve(app, opts = {}) {
         await new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));
     };
     if (opts.handleSignals !== false) {
-        const onSignal = (sig) => { app.log.info({ sig }, "DaloyJS received signal, shutting down"); void close().then(() => process.exit(0)); };
+        const onSignal = (sig) => {
+            app.log.info({ sig }, "DaloyJS received signal, shutting down");
+            void close().then(() => process.exit(0));
+        };
         process.once("SIGTERM", () => onSignal("SIGTERM"));
         process.once("SIGINT", () => onSignal("SIGINT"));
     }
-    return { server, port, close };
+    return {
+        server,
+        get port() {
+            const address = server.address();
+            return address !== null && typeof address === "object" ? address.port : requestedPort;
+        },
+        close,
+    };
 }
 /**
  * Default pre-buffer ceiling for the Node adapter. 256 KiB is a compromise:
@@ -135,6 +157,14 @@ function dispatchToApp(app, req, res, trustProxy, bufferedBody) {
         writeAdapterError(res, e);
         return;
     }
+    // Fulfil the conn-info contract: the immediate TCP peer, so
+    // `getConnInfo` / `resolveClientIp` / `behindProxy` and WAF client-IP
+    // attribution work on Node. Never derived from spoofable headers.
+    setConnInfo(request, {
+        remoteAddress: req.socket.remoteAddress,
+        remotePort: req.socket.remotePort,
+        tls: req.socket.encrypted === true,
+    });
     attachClientCertificate(req, request);
     const responseOrPromise = app.fetch(request);
     if (responseOrPromise instanceof Promise) {
@@ -249,11 +279,7 @@ function attachClientCertificate(req, request) {
  * Node's `connect` event rather than the request listener; it is included here
  * defensively for runtimes/proxies that surface it as a normal request.)
  */
-const FETCH_FORBIDDEN_METHODS = new Set([
-    "CONNECT",
-    "TRACE",
-    "TRACK",
-]);
+const FETCH_FORBIDDEN_METHODS = new Set(["CONNECT", "TRACE", "TRACK"]);
 /**
  * Refuse a Fetch-forbidden HTTP method with a spec-correct `501 Not
  * Implemented`. `501` is more accurate than `405` here because the method is
@@ -279,12 +305,15 @@ function writeMethodRefused(res) {
 }
 function writeAdapterError(res, e) {
     if (!res.headersSent) {
-        res.statusCode = 500;
+        const clientError = e instanceof BadRequestError;
+        res.statusCode = clientError ? 400 : 500;
         res.setHeader("content-type", "application/problem+json");
         res.end(JSON.stringify({
-            type: "https://daloyjs.dev/errors/internal",
-            title: "Internal Server Error",
-            status: 500,
+            type: clientError
+                ? "https://daloyjs.dev/errors/bad-request"
+                : "https://daloyjs.dev/errors/internal",
+            title: clientError ? "Bad Request" : "Internal Server Error",
+            status: clientError ? 400 : 500,
         }));
     }
     else {
@@ -307,9 +336,11 @@ function writeAdapterError(res, e) {
  * - `instanceof Request` holds (prototype chain is re-rooted onto
  *   `Request.prototype`), and every WHATWG method/getter is overridden here,
  *   so nothing hits undici's brand-checked prototype accessors.
- * - `signal` is an inert per-instance `AbortSignal`. This matches the real
- *   adapter behaviour today: the Node adapter never wires socket aborts into
- *   the request signal, so the signal never fires in either implementation.
+ * - `signal` is a lazily-created per-instance `AbortSignal`. The framework
+ *   aborts it (via the {@link DALOY_REQUEST_ABORT} hook) when the request
+ *   exceeds `requestTimeoutMs`, so a handler that forwards `ctx.request.signal`
+ *   to downstream `fetch`/DB calls sees them cancel on timeout. It is still NOT
+ *   wired to client socket-disconnect — that teardown never fires the signal.
  * - Passing this object directly to `fetch()` is not supported (undici
  *   brand-checks its input) — forward with `request.clone()` instead, which
  *   returns a real `Request`. This mirrors @hono/node-server's shim.
@@ -327,7 +358,7 @@ class LightRequest {
     #headers;
     #bodyBytes;
     #real;
-    #signal;
+    #controller;
     constructor(url, method, headers, bodyBytes) {
         this.#url = url;
         this.#method = method;
@@ -355,10 +386,22 @@ class LightRequest {
         return this.#headers;
     }
     get signal() {
-        // Inert, lazily created: the Node adapter has never wired socket
-        // teardown into the request signal, so a never-firing signal is
-        // behaviourally identical to the one a real `Request` would carry.
-        return (this.#signal ??= new AbortController().signal);
+        // Lazily created so only handlers that actually read `signal` pay for the
+        // controller. The framework aborts it via the DALOY_REQUEST_ABORT hook
+        // below when the request exceeds `requestTimeoutMs`; client
+        // socket-disconnect is not wired into it.
+        return (this.#controller ??= new AbortController()).signal;
+    }
+    /**
+     * Framework abort hook ({@link DALOY_REQUEST_ABORT}). Invoked by the core on
+     * request timeout so `ctx.request.signal` fires for cooperative teardown.
+     * A no-op when no handler ever read `signal` — there is no controller to
+     * abort and nothing observing it.
+     *
+     * @param reason - Abort reason surfaced on `signal.reason` (a `TimeoutError`).
+     */
+    [DALOY_REQUEST_ABORT](reason) {
+        this.#controller?.abort(reason);
     }
     get body() {
         return this.#materialize().body;
@@ -496,16 +539,18 @@ Object.setPrototypeOf(LightRequest.prototype, Request.prototype);
 LightRequest.prototype[DALOY_LIGHT_RESPONSE_OK] = true;
 function toWebRequest(req, trustProxy, bufferedBody) {
     const reqHeaders = req.headers;
-    const forwardedHost = trustProxy
-        ? firstHeader(reqHeaders["x-forwarded-host"])
-        : undefined;
+    const forwardedHost = trustProxy ? firstHeader(reqHeaders["x-forwarded-host"]) : undefined;
     const host = forwardedHost ?? reqHeaders.host ?? "localhost";
-    const forwardedProto = trustProxy
-        ? firstHeader(reqHeaders["x-forwarded-proto"])
-        : undefined;
-    const proto = forwardedProto ??
-        (req.socket.encrypted ? "https" : "http");
+    const forwardedProto = trustProxy ? firstHeader(reqHeaders["x-forwarded-proto"]) : undefined;
+    const proto = forwardedProto ?? (req.socket.encrypted ? "https" : "http");
     const url = `${proto}://${host}${normalizeRequestTarget(req.url)}`;
+    // Reject malformed Host / request-target combinations at the adapter
+    // boundary instead of letting the invalid URL propagate as a 500 later.
+    // URL.canParse applies WHATWG validation without allocating and immediately
+    // discarding a URL object on every request.
+    if (!URL.canParse(url)) {
+        throw new BadRequestError("Invalid request target or Host header");
+    }
     // Build headers from `rawHeaders` (a flat [k0,v0,k1,v1,...] array) instead
     // of the parsed `req.headers` object. This matches @hono/node-server's
     // `newHeadersFromIncoming`: one `new Headers([[k,v],...])` constructor
@@ -578,7 +623,21 @@ function normalizeRequestTarget(target) {
 }
 function sendWebResponse(res, out) {
     out.statusCode = res.status;
-    res.headers.forEach((v, k) => out.setHeader(k, v));
+    // `Headers.forEach` yields each `Set-Cookie` as a separate callback while
+    // `ServerResponse.setHeader` overwrites repeated keys — copying naively
+    // keeps only the LAST cookie (e.g. dropping the session cookie when
+    // `csrf()` also sets its token cookie). Collect them via `getSetCookie()`
+    // and set the array once so every cookie reaches the wire.
+    let hasSetCookie = false;
+    res.headers.forEach((v, k) => {
+        if (k === "set-cookie") {
+            hasSetCookie = true;
+            return;
+        }
+        out.setHeader(k, v);
+    });
+    if (hasSetCookie)
+        out.setHeader("set-cookie", res.headers.getSetCookie());
     // Fast-path: response was produced by serializeResult and carries the raw
     // body bytes via the DALOY_RAW_BODY Symbol. Skip arrayBuffer() and the
     // reader-loop microtask churn entirely for buffer-backed responses.
@@ -598,7 +657,8 @@ function sendWebResponse(res, out) {
     // which we must strip so Node falls back to chunked transfer-encoding.
     const rawStream = res[DALOY_RAW_STREAM];
     if (rawStream !== undefined) {
-        if (typeof rawStream.pipe === "function" && !(rawStream instanceof ReadableStream)) {
+        if (typeof rawStream.pipe === "function" &&
+            !(rawStream instanceof ReadableStream)) {
             // Node `Readable` from the handler: skip the Web-stream bridge entirely
             // and `.pipe(out)` like Fastify/Koa/Express do.
             out.removeHeader("content-length");
@@ -652,16 +712,22 @@ function pumpBody(body, out) {
 }
 // ---------- WebSocket upgrade ----------
 async function handleUpgrade(app, req, socket, head, trustProxy) {
-    const forwardedHost = trustProxy
-        ? firstHeader(req.headers["x-forwarded-host"])
-        : undefined;
+    const forwardedHost = trustProxy ? firstHeader(req.headers["x-forwarded-host"]) : undefined;
     const host = forwardedHost ?? req.headers.host ?? "localhost";
-    const forwardedProto = trustProxy
-        ? firstHeader(req.headers["x-forwarded-proto"])
-        : undefined;
-    const proto = forwardedProto ??
-        (req.socket.encrypted ? "https" : "http");
-    const url = new URL(`${proto}://${host}${req.url ?? "/"}`);
+    const forwardedProto = trustProxy ? firstHeader(req.headers["x-forwarded-proto"]) : undefined;
+    const proto = forwardedProto ?? (req.socket.encrypted ? "https" : "http");
+    // A malformed `Host` header (e.g. containing a space) reaches this point:
+    // Node's HTTP parser accepts it and fires `upgrade`, but WHATWG URL
+    // parsing throws. Reject it as the client error it is instead of letting
+    // the throw escape the adapter.
+    let url;
+    try {
+        url = new URL(`${proto}://${host}${req.url ?? "/"}`);
+    }
+    catch {
+        writeUpgradeError(socket, 400, "Bad Request");
+        return;
+    }
     const match = app.webSocketRoutes.find(url.pathname);
     if (!match) {
         writeUpgradeError(socket, 404, "Not Found");
@@ -682,6 +748,11 @@ async function handleUpgrade(app, req, socket, head, trustProxy) {
         method: "GET",
         headers,
     });
+    setConnInfo(request, {
+        remoteAddress: req.socket.remoteAddress,
+        remotePort: req.socket.remotePort,
+        tls: req.socket.encrypted === true,
+    });
     const ctx = {
         request,
         params: match.params,

package/dist/app.d.ts

@@ -78,7 +78,12 @@ export interface AppOptions {
     bodyLimitBytes?: number;
     /** Reject requests whose Content-Type isn't in this allowlist (when a body schema is declared). */
     allowedContentTypes?: string[];
-    /** Per-request timeout in ms (handler + hooks). Default: 30000. Set 0 to disable. */
+    /**
+     * Per-request timeout in ms (handler + hooks). Default: 30000. Set 0 to
+     * disable. On timeout the framework aborts `ctx.request.signal` (cooperative
+     * cancellation of downstream I/O) and responds `408`; see
+     * {@link RequestTimeoutError}. It does not forcibly stop CPU-bound work.
+     */
     requestTimeoutMs?: number;
     /**
      * Maximum number of distinct request header fields accepted before the
@@ -771,6 +776,23 @@ export declare const DALOY_RAW_BODY: unique symbol;
  * so first-party adapters can opt in; not part of the userland API surface.
  */
 export declare const DALOY_REQUEST_RAW_BODY: unique symbol;
+/**
+ * Internal Symbol an adapter sets (on its request shim) to expose the request's
+ * abort hook: a `(reason: unknown) => void` that aborts the `AbortController`
+ * backing `request.signal`. The core invokes it when a request exceeds
+ * {@link AppOptions.requestTimeoutMs} so a handler that forwarded
+ * `ctx.request.signal` to downstream I/O (`fetch`, a DB driver) sees those
+ * calls cancel — cooperative teardown, since single-threaded JS cannot preempt
+ * a running handler.
+ *
+ * The hook is invoked as a method on the request (`this` stays bound to the
+ * shim) so it can reach the shim's private controller. Absent on runtimes
+ * whose `Request.signal` is managed by the platform (Bun / Deno / Workers) and
+ * on direct `app.fetch()` callers, where {@link abortRequest} is a safe no-op
+ * and the timeout still resolves as a `408`. Module-public so first-party
+ * adapters can opt in; not part of the userland API surface.
+ */
+export declare const DALOY_REQUEST_ABORT: unique symbol;
 /**
  * Internal Symbol set by handlers/serializers to attach a raw stream
  * (Node `Readable` or Web `ReadableStream`) to a `Response`. The Node
@@ -1154,7 +1176,11 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *    auth hook unless it opted out with `mcpRoutes(path, handler, { public: true })`.
      *    MCP tools are model-controlled and side-effecting, so a public one is a
      *    high-impact default.
-     * 3. **Missing CSRF** — when `session()` is installed and any route accepts a
+     * 3. **Cache ahead of tenancy** — a `responseCache()` that runs before
+     *    `tenancy()` builds its key before the tenant exists in `ctx.state`, so
+     *    every tenant collides on one entry and one tenant's response is served to
+     *    the next caller (CWE-524).
+     * 4. **Missing CSRF** — when `session()` is installed and any route accepts a
      *    state-changing method (`POST`/`PUT`/`PATCH`/`DELETE`), a `csrf()` hook
      *    (or third-party equivalent stamped with {@link CSRF_HOOK_MARKER}) must
      *    also be present. Skipped when `app({ csrf: "off" })`.
@@ -1687,8 +1713,8 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * "draining" signal); then the app waits up to `timeoutMs` for in-flight
      * requests to settle; finally, {@link App.onClose} cleanups run.
      *
-     * Both Node and Bun adapters call this automatically on `SIGINT` / `SIGTERM`.
-     * Call it manually from custom runtimes or integration tests.
+     * The Node, Bun, and Deno adapters call this automatically on `SIGINT` /
+     * `SIGTERM`. Call it manually from custom runtimes or integration tests.
      *
      * @param timeoutMs - Maximum time (ms) to wait for inflight requests. Default: `10_000`.
      * @param reason - Optional human-readable reason forwarded to listeners.