@fedify/express 2.2.17 → 2.2.18

package/dist/index.cjs

@@ -20,6 +20,7 @@ function integrateFederation(federation, contextDataFactory) {
 				},
 				onNotAcceptable: () => {
 					notAcceptable = true;
+					installNotAcceptableFallback(req, res);
 					body?.restore();
 					next();
 					return new Response("Not acceptable", {
@@ -31,7 +32,7 @@ function integrateFederation(federation, contextDataFactory) {
 					});
 				}
 			});
-			if (notFound || notAcceptable && req.route != null) return;
+			if (notFound || notAcceptable) return;
 			await setEResponse(res, response);
 			res.end();
 			res.status = () => res;
@@ -157,5 +158,86 @@ function setEResponse(res, response) {
 		});
 	});
 }
+/**
+* Waits for downstream handling to finish before replacing an unsent 404.
+* A matched route can still fall through, and next() does not wait for an
+* asynchronous handler. Already committed responses belong to the application.
+*/
+function installNotAcceptableFallback(req, res) {
+	const end = res.end;
+	const send = res.send;
+	let pending = true;
+	let applicationResponse = false;
+	const wrappedSend = function(body) {
+		applicationResponse = true;
+		return send.call(this, body);
+	};
+	res.send = wrappedSend;
+	const wrapEnd = (end) => function(...args) {
+		if (pending) {
+			Object.defineProperty(this, "end", {
+				configurable: true,
+				enumerable: true,
+				writable: true,
+				value: end
+			});
+			if (this.send === wrappedSend) this.send = send;
+		}
+		if (!pending || applicationResponse || this.headersSent || this.statusCode !== 404 || !isDefaultNotFound(req, this, args[0])) {
+			pending = false;
+			return end.apply(this, args);
+		}
+		pending = false;
+		const callback = args.find((arg) => typeof arg === "function");
+		const body = "Not acceptable";
+		this.statusCode = 406;
+		this.statusMessage = "Not Acceptable";
+		for (const header of [
+			"Content-Encoding",
+			"Content-Language",
+			"Content-Range",
+			"ETag",
+			"Last-Modified",
+			"Transfer-Encoding"
+		]) this.removeHeader(header);
+		this.setHeader("Content-Type", "text/plain; charset=utf-8");
+		this.setHeader("Content-Length", node_buffer.Buffer.byteLength(body));
+		this.vary("Accept");
+		return end.call(this, req.method === "HEAD" ? void 0 : body, "utf8", callback);
+	};
+	let wrappedEnd = wrapEnd(end);
+	Object.defineProperty(res, "end", {
+		configurable: true,
+		enumerable: true,
+		get: () => wrappedEnd,
+		set: (value) => {
+			wrappedEnd = wrapEnd(value);
+		}
+	});
+}
+/**
+* Express offers no public router-exhaustion callback to middleware. Recognize
+* finalhandler's default page, failing safe when its format changes. An app
+* response identical to that default page cannot be distinguished from it.
+*/
+function isDefaultNotFound(req, res, chunk) {
+	if (res.getHeader("Content-Security-Policy") !== "default-src 'none'" || res.getHeader("X-Content-Type-Options") !== "nosniff" || res.getHeader("Content-Type") !== "text/html; charset=utf-8") return false;
+	const encodedPath = (req.originalUrl ?? req.url).split("?")[0].replace(/(^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]|[\uD800-\uDBFF]([^\uDC00-\uDFFF]|$)/g, "$1�$2").replace(/(?:[^\x21\x23-\x3B\x3D\x3F-\x5F\x61-\x7A\x7C\x7E]|%(?:[^0-9A-Fa-f]|[0-9A-Fa-f][^0-9A-Fa-f]|$))+/g, encodeURI);
+	const page = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Error</title>
+</head>
+<body>
+<pre>${`Cannot ${req.method} ${encodedPath}`.replace(/[&<>"']/g, (character) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[character])}</pre>\n</body>\n</html>\n`;
+	return req.method === "HEAD" ? chunk == null && Number(res.getHeader("Content-Length")) === node_buffer.Buffer.byteLength(page) : chunk === page;
+}
 //#endregion
 exports.integrateFederation = integrateFederation;

package/dist/index.js

@@ -19,6 +19,7 @@ function integrateFederation(federation, contextDataFactory) {
 				},
 				onNotAcceptable: () => {
 					notAcceptable = true;
+					installNotAcceptableFallback(req, res);
 					body?.restore();
 					next();
 					return new Response("Not acceptable", {
@@ -30,7 +31,7 @@ function integrateFederation(federation, contextDataFactory) {
 					});
 				}
 			});
-			if (notFound || notAcceptable && req.route != null) return;
+			if (notFound || notAcceptable) return;
 			await setEResponse(res, response);
 			res.end();
 			res.status = () => res;
@@ -156,5 +157,86 @@ function setEResponse(res, response) {
 		});
 	});
 }
+/**
+* Waits for downstream handling to finish before replacing an unsent 404.
+* A matched route can still fall through, and next() does not wait for an
+* asynchronous handler. Already committed responses belong to the application.
+*/
+function installNotAcceptableFallback(req, res) {
+	const end = res.end;
+	const send = res.send;
+	let pending = true;
+	let applicationResponse = false;
+	const wrappedSend = function(body) {
+		applicationResponse = true;
+		return send.call(this, body);
+	};
+	res.send = wrappedSend;
+	const wrapEnd = (end) => function(...args) {
+		if (pending) {
+			Object.defineProperty(this, "end", {
+				configurable: true,
+				enumerable: true,
+				writable: true,
+				value: end
+			});
+			if (this.send === wrappedSend) this.send = send;
+		}
+		if (!pending || applicationResponse || this.headersSent || this.statusCode !== 404 || !isDefaultNotFound(req, this, args[0])) {
+			pending = false;
+			return end.apply(this, args);
+		}
+		pending = false;
+		const callback = args.find((arg) => typeof arg === "function");
+		const body = "Not acceptable";
+		this.statusCode = 406;
+		this.statusMessage = "Not Acceptable";
+		for (const header of [
+			"Content-Encoding",
+			"Content-Language",
+			"Content-Range",
+			"ETag",
+			"Last-Modified",
+			"Transfer-Encoding"
+		]) this.removeHeader(header);
+		this.setHeader("Content-Type", "text/plain; charset=utf-8");
+		this.setHeader("Content-Length", Buffer.byteLength(body));
+		this.vary("Accept");
+		return end.call(this, req.method === "HEAD" ? void 0 : body, "utf8", callback);
+	};
+	let wrappedEnd = wrapEnd(end);
+	Object.defineProperty(res, "end", {
+		configurable: true,
+		enumerable: true,
+		get: () => wrappedEnd,
+		set: (value) => {
+			wrappedEnd = wrapEnd(value);
+		}
+	});
+}
+/**
+* Express offers no public router-exhaustion callback to middleware. Recognize
+* finalhandler's default page, failing safe when its format changes. An app
+* response identical to that default page cannot be distinguished from it.
+*/
+function isDefaultNotFound(req, res, chunk) {
+	if (res.getHeader("Content-Security-Policy") !== "default-src 'none'" || res.getHeader("X-Content-Type-Options") !== "nosniff" || res.getHeader("Content-Type") !== "text/html; charset=utf-8") return false;
+	const encodedPath = (req.originalUrl ?? req.url).split("?")[0].replace(/(^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]|[\uD800-\uDBFF]([^\uDC00-\uDFFF]|$)/g, "$1�$2").replace(/(?:[^\x21\x23-\x3B\x3D\x3F-\x5F\x61-\x7A\x7C\x7E]|%(?:[^0-9A-Fa-f]|[0-9A-Fa-f][^0-9A-Fa-f]|$))+/g, encodeURI);
+	const page = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Error</title>
+</head>
+<body>
+<pre>${`Cannot ${req.method} ${encodedPath}`.replace(/[&<>"']/g, (character) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[character])}</pre>\n</body>\n</html>\n`;
+	return req.method === "HEAD" ? chunk == null && Number(res.getHeader("Content-Length")) === Buffer.byteLength(page) : chunk === page;
+}
 //#endregion
 export { integrateFederation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/express",
-  "version": "2.2.17",
+  "version": "2.2.18",
   "description": "Integrate Fedify with Express",
   "keywords": [
     "Fedify",
@@ -49,13 +49,14 @@
   ],
   "peerDependencies": {
     "express": ">=4.0.0",
-    "@fedify/fedify": "^2.2.17"
+    "@fedify/fedify": "^2.2.18"
   },
   "devDependencies": {
     "@types/express": "^4.0.0",
     "@types/node": "^22.17.0",
     "tsdown": "^0.21.6",
-    "typescript": "^6.0.0"
+    "typescript": "^6.0.0",
+    "@fedify/fixture": "2.0.0"
   },
   "scripts": {
     "build:self": "tsdown",