@deepkit/http 1.0.19 → 1.1.0

package/src/mime.ts

@@ -0,0 +1,141 @@
+/*
+ * Deepkit Framework
+ * Copyright (C) 2021 Deepkit UG, Marc J. Schmidt
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the MIT License.
+ *
+ * You should have received a copy of the MIT License along with this program.
+ */
+import { extname } from 'path';
+
+/**
+ * File extension to MIME type map of common web types.
+ * Add more types at runtime by setting `mimeTypes[extension] = type`.
+ */
+export const mimeTypes: { [extension: string]: string } = {
+    // text
+    html: 'text/html',
+    htm: 'text/html',
+    css: 'text/css',
+    js: 'text/javascript',
+    mjs: 'text/javascript',
+    cjs: 'application/node',
+    txt: 'text/plain',
+    text: 'text/plain',
+    csv: 'text/csv',
+    tsv: 'text/tab-separated-values',
+    md: 'text/markdown',
+    markdown: 'text/markdown',
+    yaml: 'text/yaml',
+    yml: 'text/yaml',
+    ics: 'text/calendar',
+    vtt: 'text/vtt',
+    appcache: 'text/cache-manifest',
+    // application
+    json: 'application/json',
+    map: 'application/json',
+    jsonld: 'application/ld+json',
+    webmanifest: 'application/manifest+json',
+    xml: 'application/xml',
+    xsl: 'application/xml',
+    rtf: 'application/rtf',
+    wasm: 'application/wasm',
+    pdf: 'application/pdf',
+    zip: 'application/zip',
+    gz: 'application/gzip',
+    tar: 'application/x-tar',
+    bz2: 'application/x-bzip2',
+    '7z': 'application/x-7z-compressed',
+    rar: 'application/vnd.rar',
+    xz: 'application/x-xz',
+    bin: 'application/octet-stream',
+    epub: 'application/epub+zip',
+    doc: 'application/msword',
+    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xls: 'application/vnd.ms-excel',
+    xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    ppt: 'application/vnd.ms-powerpoint',
+    pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    odt: 'application/vnd.oasis.opendocument.text',
+    ods: 'application/vnd.oasis.opendocument.spreadsheet',
+    odp: 'application/vnd.oasis.opendocument.presentation',
+    m3u8: 'application/vnd.apple.mpegurl',
+    mpd: 'application/dash+xml',
+    // images
+    png: 'image/png',
+    apng: 'image/apng',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    jpe: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    avif: 'image/avif',
+    svg: 'image/svg+xml',
+    svgz: 'image/svg+xml',
+    ico: 'image/vnd.microsoft.icon',
+    bmp: 'image/bmp',
+    tif: 'image/tiff',
+    tiff: 'image/tiff',
+    heic: 'image/heic',
+    heif: 'image/heif',
+    jxl: 'image/jxl',
+    psd: 'image/vnd.adobe.photoshop',
+    // fonts
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    ttf: 'font/ttf',
+    otf: 'font/otf',
+    eot: 'application/vnd.ms-fontobject',
+    // audio
+    mp3: 'audio/mpeg',
+    m4a: 'audio/mp4',
+    aac: 'audio/aac',
+    oga: 'audio/ogg',
+    ogg: 'audio/ogg',
+    opus: 'audio/ogg',
+    wav: 'audio/wav',
+    flac: 'audio/x-flac',
+    // video
+    mp4: 'video/mp4',
+    m4v: 'video/x-m4v',
+    webm: 'video/webm',
+    ogv: 'video/ogg',
+    mov: 'video/quicktime',
+    avi: 'video/x-msvideo',
+    mkv: 'video/x-matroska',
+    mpeg: 'video/mpeg',
+    mpg: 'video/mpeg',
+    '3gp': 'video/3gpp',
+    ts: 'video/mp2t',
+    // 3d models
+    glb: 'model/gltf-binary',
+    gltf: 'model/gltf+json',
+    obj: 'model/obj',
+    stl: 'model/stl',
+    usdz: 'model/vnd.usdz+zip',
+};
+
+/**
+ * Returns the MIME type for a file path, file name, or extension (with or without leading dot).
+ * Returns undefined for unknown extensions.
+ *
+ * `getMimeType('/assets/logo.svg')` → `image/svg+xml`
+ */
+export function getMimeType(path: string): string | undefined {
+    const extension = extname('x.' + path)
+        .slice(1)
+        .toLowerCase();
+    return Object.prototype.hasOwnProperty.call(mimeTypes, extension) ? mimeTypes[extension] : undefined;
+}
+
+/**
+ * Returns the value for a Content-Type header, including `charset=utf-8` for text types.
+ * Returns undefined for unknown extensions.
+ */
+export function getContentType(path: string): string | undefined {
+    const type = getMimeType(path);
+    if (!type) return;
+    const isText = type.startsWith('text/') || type === 'application/json' || type === 'application/manifest+json';
+    return isText ? type + '; charset=utf-8' : type;
+}

package/src/model.ts

@@ -312,13 +312,21 @@ export class RequestBuilder {
         }, this.contentBuffer);
     }
 
+    /**
+     * Replaces all headers. Names are lowercased like Node does for incoming requests.
+     */
     headers(headers: { [name: string]: string }): this {
-        this._headers = headers;
+        this._headers = {};
+        for (const [name, value] of Object.entries(headers)) this.header(name, value);
         return this;
     }
 
+    /**
+     * Sets a header. The name is lowercased like Node does for incoming requests,
+     * so `header('Authorization', ...)` is found by `authorization: HttpHeader<string>`.
+     */
     header(name: string, value: string | number): this {
-        this._headers[name] = String(value);
+        this._headers[name.toLowerCase()] = String(value);
         return this;
     }
 

package/src/module.ts

@@ -32,8 +32,9 @@ export class HttpModule extends createModuleClass({
         HttpResultFormatter,
         HttpRouterRegistry,
         HttpRouterFilterResolver,
-        { provide: HttpResponse, scope: 'http' },
-        { provide: HttpRequest, scope: 'http' },
+        { provide: InjectorContext, useValue: undefined, scope: 'http' },
+        { provide: HttpResponse, useValue: undefined, scope: 'http' },
+        { provide: HttpRequest, useValue: undefined, scope: 'http' },
         { provide: RouteConfig, useValue: undefined, scope: 'http' },
         { provide: Logger, useValue: new Logger([new ConsoleTransport()]) },
     ],
@@ -49,6 +50,7 @@ export class HttpModule extends createModuleClass({
         HttpKernel,
         HttpResultFormatter,
         HttpRouterFilterResolver,
+        InjectorContext,
         HttpResponse,
         HttpRequest,
         HttpControllers,

package/src/query-string.ts

@@ -0,0 +1,228 @@
+/*
+ * Deepkit Framework
+ * Copyright (C) 2021 Deepkit UG, Marc J. Schmidt
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the MIT License.
+ *
+ * You should have received a copy of the MIT License along with this program.
+ */
+
+/**
+ * Query string parser compatible with the default behavior of `qs.parse`.
+ *
+ * Supports nested objects (`a[b]=1`), arrays (`a[]=1`, `a[0]=1`) and duplicate keys (`a=1&a=2` becomes an array).
+ *
+ * Limits:
+ * - at most 1000 parameters are parsed, the rest is ignored
+ * - at most 5 levels of nesting, the remainder is used as literal key (`a[b][c][d][e][f][g]` → `a.b.c.d.e.f['[g]']`)
+ * - array indices above 20 create object keys instead of sparse arrays (`a[100]=1` → `{a: {100: '1'}}`)
+ *
+ * Keys that exist on Object.prototype (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, ...) are dropped.
+ */
+const parameterLimit = 1000;
+const depthLimit = 5;
+const arrayLimit = 20;
+
+const has = Object.prototype.hasOwnProperty;
+const isArray = Array.isArray;
+
+function decode(str: string): string {
+    if (str.indexOf('+') !== -1) str = str.replace(/\+/g, ' ');
+    if (str.indexOf('%') === -1) return str;
+    try {
+        return decodeURIComponent(str);
+    } catch {
+        return str;
+    }
+}
+
+/**
+ * Query strings without brackets, the common case: `a=1&b=2&a=3` → `{a: ['1', '3'], b: '2'}`.
+ * Same result as the general parser, without its nesting and compaction steps.
+ */
+function parseFlat(str: string): Record<string, any> {
+    const obj: Record<string, any> = {};
+    for (const part of str.split('&', parameterLimit)) {
+        const pos = part.indexOf('=');
+        const key = decode(pos === -1 ? part : part.slice(0, pos));
+        if (!key || has.call(Object.prototype, key)) continue;
+        const val = pos === -1 ? '' : decode(part.slice(pos + 1));
+        obj[key] = has.call(obj, key) ? ([] as any[]).concat(obj[key], val) : val;
+    }
+    return obj;
+}
+
+const nesting = /[[\]]|%5[bd]/i;
+
+function parseValues(str: string): Record<string, any> {
+    const obj: Record<string, any> = Object.create(null);
+    const parts = str.replace(/%5B/gi, '[').replace(/%5D/gi, ']').split('&', parameterLimit);
+
+    for (const part of parts) {
+        const bracketEqualsPos = part.indexOf(']=');
+        const pos = bracketEqualsPos === -1 ? part.indexOf('=') : bracketEqualsPos + 1;
+
+        const key = decode(pos === -1 ? part : part.slice(0, pos));
+        const val = pos === -1 ? '' : decode(part.slice(pos + 1));
+
+        obj[key] = has.call(obj, key) ? ([] as any[]).concat(obj[key], val) : val;
+    }
+
+    return obj;
+}
+
+function parseObject(chain: string[], val: any): any {
+    let leaf = val;
+
+    for (let i = chain.length - 1; i >= 0; --i) {
+        let obj: any;
+        const root = chain[i];
+
+        if (root === '[]') {
+            obj = ([] as any[]).concat(leaf);
+        } else {
+            obj = {};
+            const cleanRoot = root.charAt(0) === '[' && root.charAt(root.length - 1) === ']' ? root.slice(1, -1) : root;
+            const index = parseInt(cleanRoot, 10);
+            if (
+                !isNaN(index) &&
+                root !== cleanRoot &&
+                String(index) === cleanRoot &&
+                index >= 0 &&
+                index <= arrayLimit
+            ) {
+                obj = [];
+                obj[index] = leaf;
+            } else if (cleanRoot !== '__proto__') {
+                obj[cleanRoot] = leaf;
+            }
+        }
+
+        leaf = obj;
+    }
+
+    return leaf;
+}
+
+function parseKeys(key: string, val: any): any {
+    if (!key) return;
+
+    const brackets = /(\[[^[\]]*])/;
+    const child = /(\[[^[\]]*])/g;
+
+    let segment = brackets.exec(key);
+    const parent = segment ? key.slice(0, segment.index) : key;
+
+    const keys: string[] = [];
+    if (parent) {
+        if (has.call(Object.prototype, parent)) return;
+        keys.push(parent);
+    }
+
+    let i = 0;
+    while ((segment = child.exec(key)) !== null && i < depthLimit) {
+        i += 1;
+        if (has.call(Object.prototype, segment[1].slice(1, -1))) return;
+        keys.push(segment[1]);
+    }
+
+    // depth limit reached, the remainder is used as literal key
+    if (segment) keys.push('[' + key.slice(segment.index) + ']');
+
+    return parseObject(keys, val);
+}
+
+function arrayToObject(source: any[]): Record<string, any> {
+    const obj: Record<string, any> = {};
+    for (let i = 0; i < source.length; ++i) {
+        if (source[i] !== undefined) obj[i] = source[i];
+    }
+    return obj;
+}
+
+function merge(target: any, source: any): any {
+    if (!source) return target;
+
+    if (typeof source !== 'object') {
+        if (isArray(target)) {
+            target.push(source);
+        } else if (target && typeof target === 'object') {
+            if (!has.call(Object.prototype, source)) target[source] = true;
+        } else {
+            return [target, source];
+        }
+        return target;
+    }
+
+    if (!target || typeof target !== 'object') {
+        return [target].concat(source);
+    }
+
+    if (isArray(target) && isArray(source)) {
+        source.forEach((item, i) => {
+            if (has.call(target, i)) {
+                const targetItem = target[i];
+                if (targetItem && typeof targetItem === 'object' && item && typeof item === 'object') {
+                    target[i] = merge(targetItem, item);
+                } else {
+                    target.push(item);
+                }
+            } else {
+                target[i] = item;
+            }
+        });
+        return target;
+    }
+
+    const mergeTarget = isArray(target) && !isArray(source) ? arrayToObject(target) : target;
+    for (const key of Object.keys(source)) {
+        mergeTarget[key] = has.call(mergeTarget, key) ? merge(mergeTarget[key], source[key]) : source[key];
+    }
+    return mergeTarget;
+}
+
+/**
+ * Removes holes from (sparse) arrays, e.g. `a[1]=x` results in `['x']`, not `[undefined, 'x']`.
+ */
+function compact(value: Record<string, any>): Record<string, any> {
+    const queue: { obj: any; prop: string }[] = [{ obj: { o: value }, prop: 'o' }];
+    const refs: any[] = [];
+
+    for (let i = 0; i < queue.length; ++i) {
+        const obj = queue[i].obj[queue[i].prop];
+        for (const key of Object.keys(obj)) {
+            const val = obj[key];
+            if (typeof val === 'object' && val !== null && refs.indexOf(val) === -1) {
+                queue.push({ obj, prop: key });
+                refs.push(val);
+            }
+        }
+    }
+
+    while (queue.length > 1) {
+        const item = queue.pop()!;
+        const obj = item.obj[item.prop];
+        if (isArray(obj)) item.obj[item.prop] = obj.filter(v => v !== undefined);
+    }
+
+    return value;
+}
+
+/**
+ * Parses a query string (without leading `?`) into an object.
+ *
+ * `a=1&b[c]=2&d[]=3&d[]=4` → `{a: '1', b: {c: '2'}, d: ['3', '4']}`
+ */
+export function parseQueryString(str: string): Record<string, any> {
+    if (!str) return {};
+    if (!nesting.test(str)) return parseFlat(str);
+
+    const values = parseValues(str);
+    let obj: Record<string, any> = {};
+    for (const key of Object.keys(values)) {
+        obj = merge(obj, parseKeys(key, values[key]));
+    }
+
+    return compact(obj);
+}

package/src/request-parser.ts

@@ -19,7 +19,7 @@ import {
 } from '@deepkit/type';
 import { BodyValidationError, createRequestWithCachedBody, getRegExp, HttpRequest, ValidatedBody } from './model.js';
 import { getRouteActionLabel, RouteConfig, UploadedFile, UploadedFileSymbol } from './router.js';
-import qs from 'qs';
+import { parseQueryString } from './query-string.js';
 import formidable, { Fields, Files, Options } from 'formidable';
 import { HttpParserOptions } from './module.config.js';
 import type IncomingForm from 'formidable/Formidable.js';
@@ -231,10 +231,10 @@ export function buildRequestParser(parseOptions: HttpParserOptions, parameters:
         routeConfig
     });
     compiler.context.set('ValidationError', ValidationError);
-    compiler.context.set('qs', qs);
+    compiler.context.set('parseQueryString', parseQueryString);
 
     let needsQueryString = !!params.find(v => v.query || v.queries || v.requestParser);
-    const query = needsQueryString ? '_qPosition === -1 ? {} : qs.parse(_url.substr(_qPosition + 1))' : '{}';
+    const query = needsQueryString ? '_qPosition === -1 ? {} : parseQueryString(_url.substr(_qPosition + 1))' : '{}';
 
     const regexVar = compiler.reserveVariable('regex', new RegExp('^' + pathRegex + '$'));
 
@@ -329,7 +329,9 @@ export function getRequestParserCodeForParameters(
 
             const queryPath = parameter.typePath === undefined && !parameter.queries ? parameter.parameter.name : parameter.typePath;
             const accessor = queryPath ? `['` + (queryPath.replace(/\./g, `']['`)) + `']` : '';
-            const queryAccessor = parameter.header ? `_headers${accessor}` : queryPath ? `_query${accessor}` : '_query';
+            // header names are case-insensitive, Node lowercases them in request.headers
+            const headerAccessor = queryPath ? `_headers[${JSON.stringify(queryPath.toLowerCase())}]` : '_headers';
+            const queryAccessor = parameter.header ? headerAccessor : queryPath ? `_query${accessor}` : '_query';
 
             if (isOptional(parameter.parameter.parameter) || hasDefaultValue(parameter.parameter.parameter)) {
                 setParameters.push(`parameters.${parameter.parameter.name} = ${queryAccessor} === undefined ? undefined : ${converterVar}(${queryAccessor}, {loosely: true});`);

package/src/router.ts

@@ -18,7 +18,7 @@ import { MiddlewareRegistry, MiddlewareRegistryEntry } from '@deepkit/app';
 import { HttpMiddlewareConfig, HttpMiddlewareFn } from './middleware.js';
 
 //@ts-ignore
-import qs from 'qs';
+import { parseQueryString } from './query-string.js';
 import { HtmlResponse, JSONResponse, Redirect, Response } from './http.js';
 import { getRequestParserCodeForParameters, ParameterForRequestParser, parseRoutePathToRegex } from './request-parser.js';
 import { HttpConfig } from './module.config.js';
@@ -699,7 +699,7 @@ export class HttpRouter {
         this.buildId = this.registry.getBuildId();
         const compiler = new CompilerContext;
         compiler.context.set('ValidationError', ValidationError);
-        compiler.context.set('qs', qs);
+        compiler.context.set('parseQueryString', parseQueryString);
 
         const code: string[] = [];
 
@@ -715,7 +715,7 @@ export class HttpRouter {
             const _qPosition = _url.indexOf('?');
             let uploadedFiles = {};
             const _path = _qPosition === -1 ? _url : _url.substr(0, _qPosition);
-            const _query = _qPosition === -1 ? {} : qs.parse(_url.substr(_qPosition + 1));
+            const _query = _qPosition === -1 ? {} : parseQueryString(_url.substr(_qPosition + 1));
             ${code.join('\n')}
         `, 'request') as any;
     }