@fastify/reply-from 7.0.0

package/index.js

@@ -0,0 +1,262 @@
+'use strict'
+
+const fp = require('fastify-plugin')
+const lru = require('tiny-lru')
+const querystring = require('querystring')
+const Stream = require('stream')
+const createError = require('http-errors')
+const buildRequest = require('./lib/request')
+const {
+  filterPseudoHeaders,
+  copyHeaders,
+  stripHttp1ConnectionHeaders,
+  buildURL
+} = require('./lib/utils')
+
+const { TimeoutError } = buildRequest
+
+module.exports = fp(function from (fastify, opts, next) {
+  const contentTypesToEncode = new Set([
+    'application/json',
+    ...(opts.contentTypesToEncode || [])
+  ])
+
+  const retryMethods = new Set(opts.retryMethods || [
+    'GET', 'HEAD', 'OPTIONS', 'TRACE'
+  ])
+
+  const cache = opts.disableCache ? undefined : lru(opts.cacheURLs || 100)
+  const base = opts.base
+  const { request, close, retryOnError } = buildRequest({
+    http: opts.http,
+    http2: opts.http2,
+    base,
+    undici: opts.undici
+  })
+
+  fastify.decorateReply('from', function (source, opts) {
+    opts = opts || {}
+    const req = this.request.raw
+    const onResponse = opts.onResponse
+    const rewriteHeaders = opts.rewriteHeaders || headersNoOp
+    const rewriteRequestHeaders = opts.rewriteRequestHeaders || requestHeadersNoOp
+    const getUpstream = opts.getUpstream || upstreamNoOp
+    const onError = opts.onError || onErrorDefault
+    const retriesCount = opts.retriesCount || 0
+    const maxRetriesOn503 = opts.maxRetriesOn503 || 10
+
+    if (!source) {
+      source = req.url
+    }
+
+    // we leverage caching to avoid parsing the destination URL
+    const dest = getUpstream(req, base)
+    let url
+    if (cache) {
+      url = cache.get(source) || buildURL(source, dest)
+      cache.set(source, url)
+    } else {
+      url = buildURL(source, dest)
+    }
+
+    const sourceHttp2 = req.httpVersionMajor === 2
+    const headers = sourceHttp2 ? filterPseudoHeaders(req.headers) : req.headers
+    headers.host = url.host
+    const qs = getQueryString(url.search, req.url, opts)
+    let body = ''
+
+    if (opts.body !== undefined) {
+      if (opts.body !== null) {
+        if (typeof opts.body.pipe === 'function') {
+          throw new Error('sending a new body as a stream is not supported yet')
+        }
+
+        if (opts.contentType) {
+          body = opts.body
+        } else {
+          body = JSON.stringify(opts.body)
+          opts.contentType = 'application/json'
+        }
+
+        headers['content-length'] = Buffer.byteLength(body)
+        headers['content-type'] = opts.contentType
+      } else {
+        body = undefined
+        headers['content-length'] = 0
+        delete headers['content-type']
+      }
+    } else if (this.request.body) {
+      if (this.request.body instanceof Stream) {
+        body = this.request.body
+      } else {
+        // Per RFC 7231 §3.1.1.5 if this header is not present we MAY assume application/octet-stream
+        const contentType = req.headers['content-type'] || 'application/octet-stream'
+        // detect if body should be encoded as JSON
+        // supporting extended content-type header formats:
+        // - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+        const lowerCaseContentType = contentType.toLowerCase()
+        const plainContentType = lowerCaseContentType.indexOf(';') > -1
+          ? lowerCaseContentType.slice(0, lowerCaseContentType.indexOf(';'))
+          : lowerCaseContentType
+        const shouldEncodeJSON = contentTypesToEncode.has(plainContentType)
+        // transparently support JSON encoding
+        body = shouldEncodeJSON ? JSON.stringify(this.request.body) : this.request.body
+        // update origin request headers after encoding
+        headers['content-length'] = Buffer.byteLength(body)
+        headers['content-type'] = contentType
+      }
+    }
+
+    // according to https://tools.ietf.org/html/rfc2616#section-4.3
+    // fastify ignore message body when it's a GET or HEAD request
+    // when proxy this request, we should reset the content-length to make it a valid http request
+    // discussion: https://github.com/fastify/fastify/issues/953
+    if (req.method === 'GET' || req.method === 'HEAD') {
+      // body will be populated here only if opts.body is passed.
+      // if we are doing that with a GET or HEAD request is a programmer error
+      // and as such we can throw immediately.
+      if (body) {
+        throw new Error(`Rewriting the body when doing a ${req.method} is not allowed`)
+      }
+    }
+
+    this.request.log.info({ source }, 'fetching from remote server')
+
+    const requestHeaders = rewriteRequestHeaders(req, headers)
+    const contentLength = requestHeaders['content-length']
+    let requestImpl
+    if (retryMethods.has(req.method) && !contentLength) {
+      requestImpl = createRequestRetry(request, this, retriesCount, retryOnError, maxRetriesOn503)
+    } else {
+      requestImpl = request
+    }
+
+    requestImpl({ method: req.method, url, qs, headers: requestHeaders, body }, (err, res) => {
+      if (err) {
+        this.request.log.warn(err, 'response errored')
+        if (!this.sent) {
+          if (err.code === 'ERR_HTTP2_STREAM_CANCEL' || err.code === 'ENOTFOUND') {
+            onError(this, { error: new createError.ServiceUnavailable() })
+          } else if (err instanceof TimeoutError || err.code === 'UND_ERR_HEADERS_TIMEOUT') {
+            onError(this, { error: new createError.GatewayTimeout() })
+          } else {
+            onError(this, { error: createError(500, err) })
+          }
+        }
+        return
+      }
+      this.request.log.info('response received')
+      if (sourceHttp2) {
+        copyHeaders(
+          rewriteHeaders(stripHttp1ConnectionHeaders(res.headers), req),
+          this
+        )
+      } else {
+        copyHeaders(rewriteHeaders(res.headers, req), this)
+      }
+      this.code(res.statusCode)
+      if (onResponse) {
+        onResponse(this.request, this, res.stream)
+      } else {
+        this.send(res.stream)
+      }
+    })
+    return this
+  })
+
+  fastify.addHook('onReady', (done) => {
+    if (isFastifyMultipartRegistered(fastify)) {
+      fastify.log.warn('fastify-reply-from might not behave as expected when used with fastify-multipart')
+    }
+    done()
+  })
+
+  fastify.onClose((fastify, next) => {
+    close()
+    // let the event loop do a full run so that it can
+    // actually destroy those sockets
+    setImmediate(next)
+  })
+
+  next()
+}, '>=3')
+
+function getQueryString (search, reqUrl, opts) {
+  if (typeof opts.queryString === 'function') {
+    return '?' + opts.queryString(search, reqUrl)
+  }
+
+  if (opts.queryString) {
+    return '?' + querystring.stringify(opts.queryString)
+  }
+
+  if (search.length > 0) {
+    return search
+  }
+
+  const queryIndex = reqUrl.indexOf('?')
+
+  if (queryIndex > 0) {
+    return reqUrl.slice(queryIndex)
+  }
+
+  return ''
+}
+
+function headersNoOp (headers, originalReq) {
+  return headers
+}
+
+function requestHeadersNoOp (originalReq, headers) {
+  return headers
+}
+
+function upstreamNoOp (req, base) {
+  return base
+}
+
+function onErrorDefault (reply, { error }) {
+  reply.send(error)
+}
+
+function isFastifyMultipartRegistered (fastify) {
+  return fastify.hasContentTypeParser('multipart') && fastify.hasRequestDecorator('multipart')
+}
+
+function createRequestRetry (requestImpl, reply, retriesCount, retryOnError, maxRetriesOn503) {
+  function requestRetry (req, cb) {
+    let retries = 0
+
+    function run () {
+      requestImpl(req, function (err, res) {
+        // Magic number, so why not 42? We might want to make this configurable.
+        let retryAfter = 42 * Math.random() * (retries + 1)
+
+        if (res && res.headers['retry-after']) {
+          retryAfter = res.headers['retry-after']
+        }
+        if (!reply.sent) {
+          // always retry on 503 errors
+          if (res && res.statusCode === 503 && req.method === 'GET') {
+            if (retriesCount === 0 && retries < maxRetriesOn503) {
+              // we should stop at some point
+              return retry(retryAfter)
+            }
+          } else if (retriesCount > retries && err && err.code === retryOnError) {
+            return retry(retryAfter)
+          }
+        }
+        cb(err, res)
+      })
+    }
+
+    function retry (after) {
+      retries += 1
+      setTimeout(run, after)
+    }
+
+    run()
+  }
+
+  return requestRetry
+}

package/lib/request.js

@@ -0,0 +1,288 @@
+'use strict'
+const semver = require('semver')
+const http = require('http')
+const https = require('https')
+const querystring = require('querystring')
+const eos = require('end-of-stream')
+const pump = require('pump')
+const undici = require('undici')
+const { stripHttp1ConnectionHeaders } = require('./utils')
+const http2 = require('http2')
+
+class TimeoutError extends Error {}
+
+function shouldUseUndici (opts) {
+  if (opts.undici === false || opts.http || opts.http2) {
+    return false
+  }
+  return true
+}
+
+function isUndiciInstance (obj) {
+  return obj instanceof undici.Pool ||
+    obj instanceof undici.Client ||
+    obj instanceof undici.Dispatcher
+}
+
+function buildRequest (opts) {
+  const isHttp2 = !!opts.http2
+  const hasUndiciOptions = shouldUseUndici(opts)
+  const requests = {
+    'http:': http,
+    'https:': https,
+    'unix+http:': { base: http, request: unixRequest },
+    'unix+https:': { base: https, request: unixRequest }
+  }
+  const http2Opts = getHttp2Opts(opts)
+  const httpOpts = getHttpOpts(opts)
+  const baseUrl = opts.base && new URL(opts.base).origin
+  const undiciOpts = opts.undici || {}
+  let http2Client
+  let undiciAgent
+  let undiciInstance
+  let agents
+
+  if (isHttp2) {
+    if (semver.lt(process.version, '9.0.0')) {
+      throw new Error('Http2 support requires Node version >= 9.0.0')
+    }
+    if (!opts.base) throw new Error('Option base is required when http2 is true')
+    if (opts.base.startsWith('unix+')) {
+      throw new Error('Unix socket destination is not supported when http2 is true')
+    }
+  } else {
+    agents = httpOpts.agents || {
+      'http:': new http.Agent(httpOpts.agentOptions),
+      'https:': new https.Agent(httpOpts.agentOptions)
+    }
+  }
+
+  if (isHttp2) {
+    return { request: handleHttp2Req, close, retryOnError: 'ECONNRESET' }
+  } else if (hasUndiciOptions) {
+    if (opts.base && opts.base.startsWith('unix+')) {
+      const undiciOpts = getUndiciOptions(opts.undici)
+      undiciOpts.socketPath = decodeURIComponent(new URL(opts.base).host)
+      const protocol = opts.base.startsWith('unix+https') ? 'https' : 'http'
+      undiciInstance = new undici.Pool(protocol + '://localhost', undiciOpts)
+    } else if (isUndiciInstance(opts.undici)) {
+      undiciInstance = opts.undici
+    } else {
+      undiciAgent = new undici.Agent(getUndiciOptions(opts.undici))
+    }
+    return { request: handleUndici, close, retryOnError: 'UND_ERR_SOCKET' }
+  } else {
+    return { request: handleHttp1Req, close, retryOnError: 'ECONNRESET' }
+  }
+
+  function close () {
+    if (hasUndiciOptions) {
+      undiciAgent && undiciAgent.destroy()
+      undiciInstance && undiciInstance.destroy()
+    } else if (!isHttp2) {
+      agents['http:'].destroy()
+      agents['https:'].destroy()
+    } else if (http2Client) {
+      http2Client.destroy()
+    }
+  }
+
+  function handleHttp1Req (opts, done) {
+    const req = requests[opts.url.protocol].request({
+      method: opts.method,
+      port: opts.url.port,
+      path: opts.url.pathname + opts.qs,
+      hostname: opts.url.hostname,
+      headers: opts.headers,
+      agent: agents[opts.url.protocol.replace(/^unix:/, '')],
+      ...httpOpts.requestOptions
+    })
+    req.on('error', done)
+    req.on('response', res => {
+      done(null, { statusCode: res.statusCode, headers: res.headers, stream: res })
+    })
+    req.once('timeout', () => {
+      const err = new TimeoutError('HTTP request timed out')
+      req.abort()
+      done(err)
+    })
+
+    end(req, opts.body, done)
+  }
+
+  function handleUndici (opts, done) {
+    const req = {
+      origin: baseUrl || opts.url.origin,
+      path: opts.url.pathname + opts.qs,
+      method: opts.method,
+      headers: Object.assign({}, opts.headers),
+      body: opts.body,
+      headersTimeout: undiciOpts.headersTimeout,
+      bodyTimeout: undiciOpts.bodyTimeout
+    }
+
+    let pool
+
+    if (undiciInstance) {
+      pool = undiciInstance
+    } else if (!baseUrl && opts.url.protocol.startsWith('unix')) {
+      done(new Error('unix socket not supported with undici yet'))
+      return
+    } else {
+      pool = undiciAgent
+    }
+
+    // remove forbidden headers
+    req.headers.connection = undefined
+    req.headers['transfer-encoding'] = undefined
+
+    pool.request(req, function (err, res) {
+      if (err) {
+        done(err)
+        return
+      }
+
+      // using delete, otherwise it will render as an empty string
+      delete res.headers['transfer-encoding']
+
+      done(null, { statusCode: res.statusCode, headers: res.headers, stream: res.body })
+    })
+  }
+
+  function handleHttp2Req (opts, done) {
+    let cancelRequest
+    let sessionTimedOut = false
+
+    if (!http2Client || http2Client.destroyed) {
+      http2Client = http2.connect(baseUrl, http2Opts.sessionOptions)
+      http2Client.once('error', done)
+      // we might enqueue a large number of requests in this connection
+      // before it's connected
+      http2Client.setMaxListeners(0)
+      http2Client.setTimeout(http2Opts.sessionTimeout, function () {
+        if (cancelRequest) {
+          cancelRequest()
+          cancelRequest = undefined
+          sessionTimedOut = true
+        }
+        http2Client.destroy()
+      })
+      http2Client.once('connect', () => {
+        // reset the max listener to 10 on connect
+        http2Client.setMaxListeners(10)
+        http2Client.removeListener('error', done)
+      })
+    }
+    const req = http2Client.request({
+      ':method': opts.method,
+      ':path': opts.url.pathname + opts.qs,
+      ...stripHttp1ConnectionHeaders(opts.headers)
+    }, http2Opts.requestOptions)
+    const isGet = opts.method === 'GET' || opts.method === 'get'
+    if (!isGet) {
+      end(req, opts.body, done)
+    }
+    req.setTimeout(http2Opts.requestTimeout, () => {
+      const err = new TimeoutError('HTTP/2 request timed out')
+      req.close(http2.constants.NGHTTP2_CANCEL)
+      done(err)
+    })
+    req.once('close', () => {
+      if (sessionTimedOut) {
+        const err = new TimeoutError('HTTP/2 session timed out')
+        done(err)
+      }
+    })
+    cancelRequest = eos(req, err => {
+      if (err) done(err)
+    })
+    req.on('response', headers => {
+      const statusCode = headers[':status']
+      done(null, { statusCode, headers, stream: req })
+    })
+  }
+}
+
+module.exports = buildRequest
+module.exports.TimeoutError = TimeoutError
+
+function unixRequest (opts) {
+  delete opts.port
+  opts.socketPath = querystring.unescape(opts.hostname)
+  delete opts.hostname
+  return this.base.request(opts)
+}
+
+function end (req, body, cb) {
+  if (!body || typeof body === 'string' || body instanceof Uint8Array) {
+    req.end(body)
+  } else if (body.pipe) {
+    pump(body, req, err => {
+      if (err) cb(err)
+    })
+  } else {
+    cb(new Error(`type unsupported for body: ${body.constructor}`))
+  }
+}
+
+function getHttp2Opts (opts) {
+  if (!opts.http2) {
+    return {}
+  }
+
+  let http2Opts = opts.http2
+  if (typeof http2Opts === 'boolean') {
+    http2Opts = {}
+  }
+  http2Opts.sessionOptions = http2Opts.sessionOptions || {}
+
+  if (!http2Opts.sessionTimeout) {
+    http2Opts.sessionTimeout = opts.sessionTimeout || 6000
+  }
+  if (!http2Opts.requestTimeout) {
+    http2Opts.requestTimeout = 10000
+  }
+  http2Opts.sessionOptions.rejectUnauthorized = http2Opts.sessionOptions.rejectUnauthorized || false
+
+  return http2Opts
+}
+
+function getHttpOpts (opts) {
+  const httpOpts = typeof opts.http === 'object' ? opts.http : {}
+  httpOpts.requestOptions = httpOpts.requestOptions || {}
+
+  if (!httpOpts.requestOptions.timeout) {
+    httpOpts.requestOptions.timeout = 10000
+  }
+
+  httpOpts.requestOptions.rejectUnauthorized = httpOpts.requestOptions.rejectUnauthorized || false
+
+  httpOpts.agentOptions = getAgentOptions(opts)
+
+  return httpOpts
+}
+
+function getAgentOptions (opts) {
+  return {
+    keepAlive: true,
+    keepAliveMsecs: 60 * 1000, // 1 minute
+    maxSockets: 2048,
+    maxFreeSockets: 2048,
+    ...(opts.http && opts.http.agentOptions)
+  }
+}
+
+function getUndiciOptions (opts = {}) {
+  const res = {
+    pipelining: 1,
+    connections: 128,
+    tls: {},
+    ...(opts)
+  }
+
+  res.tls.rejectUnauthorized = res.tls.rejectUnauthorized || false
+
+  return res
+}
+
+module.exports.getUndiciOptions = getUndiciOptions

package/lib/utils.js

@@ -0,0 +1,81 @@
+function filterPseudoHeaders (headers) {
+  const dest = {}
+  const headersKeys = Object.keys(headers)
+  let header
+  let i
+  for (i = 0; i < headersKeys.length; i++) {
+    header = headersKeys[i]
+    if (header.charCodeAt(0) !== 58) { // fast path for indexOf(':') === 0
+      dest[header.toLowerCase()] = headers[header]
+    }
+  }
+  return dest
+}
+
+function copyHeaders (headers, reply) {
+  const headersKeys = Object.keys(headers)
+
+  let header
+  let i
+
+  for (i = 0; i < headersKeys.length; i++) {
+    header = headersKeys[i]
+    if (header.charCodeAt(0) !== 58) { // fast path for indexOf(':') === 0
+      reply.header(header, headers[header])
+    }
+  }
+}
+
+function stripHttp1ConnectionHeaders (headers) {
+  const headersKeys = Object.keys(headers)
+  const dest = {}
+
+  let header
+  let i
+
+  for (i = 0; i < headersKeys.length; i++) {
+    header = headersKeys[i].toLowerCase()
+
+    switch (header) {
+      case 'connection':
+      case 'upgrade':
+      case 'http2-settings':
+      case 'te':
+      case 'transfer-encoding':
+      case 'proxy-connection':
+      case 'keep-alive':
+      case 'host':
+        break
+      default:
+        dest[header] = headers[header]
+        break
+    }
+  }
+  return dest
+}
+
+// issue ref: https://github.com/fastify/fast-proxy/issues/42
+function buildURL (source, reqBase) {
+  let baseOrigin = reqBase ? new URL(reqBase).href : undefined
+  const dest = new URL(source, reqBase)
+
+  // if base is specified, source url should not override it
+  if (baseOrigin) {
+    if (!baseOrigin.endsWith('/') && dest.href.length > baseOrigin.length) {
+      baseOrigin = baseOrigin + '/'
+    }
+
+    if (!dest.href.startsWith(baseOrigin)) {
+      throw new Error('source must be a relative path string')
+    }
+  }
+
+  return dest
+}
+
+module.exports = {
+  copyHeaders,
+  stripHttp1ConnectionHeaders,
+  filterPseudoHeaders,
+  buildURL
+}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@fastify/reply-from",
+  "version": "7.0.0",
+  "description": "forward your HTTP request to another server, for fastify",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "scripts": {
+    "coverage": "tap -j8 test/*.js --cov --coverage-report=html",
+    "lint:fix": "standard --fix",
+    "test": "standard | snazzy && tap test/*.js && npm run typescript",
+    "test:ci": "standard | snazzy && tap test/*.js --coverage-report=lcovonly && npm run typescript",
+    "typescript": "tsd"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fastify/fastify-reply-from.git"
+  },
+  "keywords": [
+    "fastify",
+    "http",
+    "forward",
+    "proxy"
+  ],
+  "author": "Matteo Collina <hello@matteocollina.com>",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/fastify/fastify-reply-from/issues"
+  },
+  "engines": {
+    "node": ">=12.18"
+  },
+  "homepage": "https://github.com/fastify/fastify-reply-from#readme",
+  "devDependencies": {
+    "@sinonjs/fake-timers": "^9.0.0",
+    "@types/node": "^17.0.0",
+    "@types/tap": "^15.0.3",
+    "fastify": "^3.17.0",
+    "fastify-formbody": "^5.0.0",
+    "fastify-multipart": "^5.0.0",
+    "form-data": "^4.0.0",
+    "got": "^11.8.2",
+    "h2url": "^0.2.0",
+    "msgpack5": "^6.0.0",
+    "nock": "^13.1.0",
+    "pre-commit": "^1.2.2",
+    "proxyquire": "^2.1.3",
+    "simple-get": "^4.0.0",
+    "snazzy": "^9.0.0",
+    "split2": "^4.0.0",
+    "standard": "^17.0.0",
+    "tap": "^16.0.0",
+    "tsd": "^0.20.0",
+    "typescript": "^4.3.2"
+  },
+  "dependencies": {
+    "end-of-stream": "^1.4.4",
+    "fastify-plugin": "^3.0.0",
+    "http-errors": "^2.0.0",
+    "pump": "^3.0.0",
+    "semver": "^7.3.5",
+    "tiny-lru": "^8.0.1",
+    "undici": "^5.0.0"
+  },
+  "tsd": {
+    "directory": "test"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}