@getsoda/core 0.1.1 → 0.2.1

package/src/http/arguments.ts

@@ -16,18 +16,21 @@
  * called by the framework before the method instead of by the method itself.
  */
 
+import type { FormFields, FormLimits } from './body.ts'
+import type { ContextKey } from './context-key.ts'
 import type { Context, ParamNameOf } from './context.ts'
 import type { Parsed, ValueParser } from './parsers.ts'
+import { isStandardSchema } from './schema.ts'
 import type { InferOutput, StandardSchemaV1 } from './schema.ts'
 
-export type ArgumentKind = 'param' | 'query' | 'header' | 'body' | 'context'
+export type ArgumentKind = 'param' | 'query' | 'header' | 'cookie' | 'body' | 'context' | 'value'
 
 /**
  * One argument of a handler: where it comes from and how it is read.
  */
 export interface Argument<T, K extends ArgumentKind = ArgumentKind, N extends string = string> {
   readonly kind: K
-  /** Parameter, query or header name; empty for `body` and `context`. */
+  /** Parameter, query, header or cookie name; the key description for `value`; empty for `body` and `context`. */
   readonly name: N
   readonly read: (ctx: Context) => T | Promise<T>
 }
@@ -78,6 +81,17 @@ export function header(name: string, parser?: ValueParser<unknown>): Argument<un
   }
 }
 
+/** Cookie. Like `@Cookies('session')` with `cookie-parser`; `signed(signer)` checks a signed one. */
+export function cookie(name: string): Argument<string | undefined, 'cookie'>
+export function cookie<V extends ValueParser<unknown>>(name: string, parser: V): Argument<Parsed<V>, 'cookie'>
+export function cookie(name: string, parser?: ValueParser<unknown>): Argument<unknown, 'cookie'> {
+  return {
+    kind: 'cookie',
+    name,
+    read: parser === undefined ? (ctx) => ctx.cookie(name) : (ctx) => ctx.cookie(name, parser),
+  }
+}
+
 /** JSON body, validated by `schema`. Like `@Body() dto: CreateUserDto` with a validation pipe. */
 export function body(): Argument<unknown, 'body'>
 export function body<S extends StandardSchemaV1>(schema: S): Argument<InferOutput<S>, 'body'>
@@ -91,3 +105,29 @@ export function body(schema?: StandardSchemaV1): Argument<unknown, 'body'> {
 
 /** The context itself, for what no other argument covers. Like `@Req()`. */
 export const context = (): Argument<Context, 'context'> => ({ kind: 'context', name: '', read: (ctx) => ctx })
+
+/**
+ * Value a guard or an interceptor attached to the request. Like a custom Nest
+ * parameter decorator such as `@User()`.
+ *
+ * ```ts
+ * @Get('me', [value(USER)])
+ * me(user: User) {}
+ * ```
+ */
+export const value = <T>(key: ContextKey<T>): Argument<T, 'value'> => ({
+  kind: 'value',
+  name: key.description,
+  read: (ctx) => ctx.get(key),
+})
+
+/** Form body, validated by `schema` when given, within `limits`. Like `@Body()` on a form, or Nest's file interceptors with multer limits. */
+export function form(limits?: FormLimits): Argument<FormFields, 'body'>
+export function form<S extends StandardSchemaV1>(schema: S, limits?: FormLimits): Argument<InferOutput<S>, 'body'>
+export function form(schemaOrLimits?: StandardSchemaV1 | FormLimits, limits?: FormLimits): Argument<unknown, 'body'> {
+  return {
+    kind: 'body',
+    name: '',
+    read: isStandardSchema(schemaOrLimits) ? (ctx) => ctx.form(schemaOrLimits, limits) : (ctx) => ctx.form(schemaOrLimits),
+  }
+}

package/src/http/body.ts

@@ -15,7 +15,7 @@
  *    (`"constructor": "Ford"`) is legitimate and kept.
  */
 
-import { BadRequestException, UnsupportedMediaTypeException } from './exceptions.ts'
+import { BadRequestException, PayloadTooLargeException, UnsupportedMediaTypeException } from './exceptions.ts'
 
 const SUSPECT_PROTO =
   /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*:/
@@ -79,3 +79,144 @@ export const readJsonBody = async (req: Request): Promise<unknown> => {
 
   return parseJson(text)
 }
+
+const FORM_TYPE = /^(?:multipart\/form-data|application\/x-www-form-urlencoded)(?:\s*;|$)/i
+const ARRAY_SUFFIX = '[]'
+
+/** Parsed form data, as `Request.formData()` gives it. */
+type FormBody = Awaited<ReturnType<Request['formData']>>
+
+/** A form value: text, or a file of a multipart body. */
+export type FormValue = string | File
+
+/** Fields of a form; repeated fields and fields named `name[]` are arrays. */
+export type FormFields = Record<string, FormValue | FormValue[]>
+
+/**
+ * Turns form data into an object without prototype.
+ *
+ * ```ts
+ * 'a=1&a=2'      => { a: ['1', '2'] }   // repeated fields are kept, not overwritten
+ * 'tags[]=x'     => { tags: ['x'] }     // `[]` always gives an array, even with one value
+ * 'name=Ann'     => { name: 'Ann' }
+ * ```
+ */
+const toFields = (data: FormBody): FormFields => {
+  const fields: FormFields = Object.create(null)
+
+  for (const [rawKey, value] of data) {
+    const array = rawKey.endsWith(ARRAY_SUFFIX)
+    const key = array ? rawKey.slice(0, -ARRAY_SUFFIX.length) : rawKey
+    const current = fields[key]
+
+    if (current === undefined) {
+      fields[key] = array ? [value] : value
+    } else if (Array.isArray(current)) {
+      current.push(value)
+    } else {
+      fields[key] = [current, value]
+    }
+  }
+
+  return fields
+}
+
+/**
+ * Limits of a form body, beyond the server's `maxRequestBodySize`; each one
+ * exceeded is a `413`. Like the `limits` of multer and `@fastify/multipart`.
+ */
+export interface FormLimits {
+  /** Bytes of the whole body, refused as soon as they are exceeded, before the body is read entirely. */
+  readonly maxBodySize?: number
+  /** Bytes of each file. */
+  readonly maxFileSize?: number
+  /** Number of files. */
+  readonly maxFiles?: number
+  /** Number of fields, files included. */
+  readonly maxFields?: number
+}
+
+/** The body, read up to `max` bytes: `413` as soon as it is larger. */
+const readUpTo = async (req: Request, max: number): Promise<Uint8Array<ArrayBuffer>> => {
+  if (Number(req.headers.get('content-length') ?? 0) > max) {
+    throw new PayloadTooLargeException(`Request body is larger than ${max} bytes`)
+  }
+
+  if (req.body === null) {
+    return new Uint8Array()
+  }
+
+  const chunks: Uint8Array[] = []
+  let size = 0
+
+  for await (const chunk of req.body) {
+    size += chunk.byteLength
+
+    if (size > max) {
+      throw new PayloadTooLargeException(`Request body is larger than ${max} bytes`)
+    }
+
+    chunks.push(chunk)
+  }
+
+  return Buffer.concat(chunks)
+}
+
+/** `413` for the first limit the form exceeds. */
+const checkLimits = (data: FormBody, limits: FormLimits): void => {
+  const { maxFileSize = Infinity, maxFiles = Infinity, maxFields = Infinity } = limits
+  let fields = 0
+  let files = 0
+
+  for (const [name, value] of data) {
+    fields++
+
+    if (fields > maxFields) {
+      throw new PayloadTooLargeException(`Form has more than ${maxFields} fields`)
+    }
+
+    if (typeof value !== 'string') {
+      files++
+
+      if (files > maxFiles) {
+        throw new PayloadTooLargeException(`Form has more than ${maxFiles} files`)
+      }
+
+      if (value.size > maxFileSize) {
+        throw new PayloadTooLargeException(`File "${name}" is larger than ${maxFileSize} bytes`)
+      }
+    }
+  }
+}
+
+/**
+ * Reads a `multipart/form-data` or `application/x-www-form-urlencoded` body:
+ * `415` for another content type, `400` for a malformed body, `413` past a limit.
+ *
+ * Kept apart from JSON on purpose: an HTML form on another site can post a form
+ * without a CORS preflight, a JSON body cannot. A JSON endpoint must not accept forms.
+ *
+ * `File.type` is the type the client declared, not checked against the content.
+ */
+export const readFormBody = async (req: Request, limits: FormLimits = {}): Promise<FormFields> => {
+  const type = req.headers.get('content-type')
+
+  if (type === null || !FORM_TYPE.test(type)) {
+    throw new UnsupportedMediaTypeException(`Expected a form body, got ${type ?? 'no content type'}`)
+  }
+
+  // Parsed from the bytes read so far, as only a whole body can be parsed.
+  const source =
+    limits.maxBodySize === undefined ? req : new Response(await readUpTo(req, limits.maxBodySize), { headers: { 'content-type': type } })
+  let data: FormBody
+
+  try {
+    data = await source.formData()
+  } catch (error) {
+    throw new BadRequestException('Request body is not a valid form', { cause: error })
+  }
+
+  checkLimits(data, limits)
+
+  return toFields(data)
+}

package/src/http/context-key.ts

@@ -0,0 +1,35 @@
+/**
+ * @module
+ * Typed keys for values attached to a request: what a guard found (the user,
+ * the tenant), read later by interceptors and the handler.
+ *
+ * Like Angular's `HttpContextToken`: the key is an object, so two keys can
+ * never collide, and it carries the value type. Unlike it, a default is
+ * optional: reading a key nobody set and that has no default is a programming
+ * error (a guard missing on the route), reported as such.
+ *
+ * ```ts
+ * export const USER = new ContextKey<User>('user')
+ *
+ * // guard
+ * ctx.set(USER, await this.#auth.verify(ctx.header('authorization')))
+ *
+ * // handler
+ * const user = ctx.get(USER)
+ * ```
+ */
+
+/**
+ * Key of a value attached to a request.
+ */
+export class ContextKey<T> {
+  constructor(
+    readonly description: string,
+    /** Value of the key when nothing was set. Without it, reading an unset key throws. */
+    readonly defaultValue?: () => T
+  ) {}
+
+  toString(): string {
+    return `ContextKey(${this.description})`
+  }
+}

package/src/http/context.ts

@@ -4,11 +4,13 @@
  */
 
 import type { Constructor } from '../di/index.ts'
-import { readJsonBody } from './body.ts'
+import { readFormBody, readJsonBody } from './body.ts'
+import type { FormFields, FormLimits } from './body.ts'
+import type { ContextKey } from './context-key.ts'
 import type { MetadataDecorator } from './enhancers.ts'
 import { applyParser } from './parsers.ts'
 import type { Parsed, ValueParser } from './parsers.ts'
-import { validate } from './schema.ts'
+import { isStandardSchema, validate } from './schema.ts'
 import type { InferOutput, StandardSchemaV1 } from './schema.ts'
 import type { AnyParams, PathParams } from './types.ts'
 
@@ -49,18 +51,54 @@ export interface RouteInfo {
  * }
  * ```
  *
- * The URL is parsed only when `url` or `query()` is used; the body is read at most once.
+ * The URL is parsed only when `url` or `query()` is used; the body is read at
+ * most once; the storage of `set()` is created on the first `set()`.
  */
 export class Context<P extends string = string> {
   #url: URL | undefined
-  #body: Promise<unknown> | undefined
+  #body: { readonly kind: 'JSON' | 'form'; readonly value: Promise<unknown> } | undefined
+  #values: Map<ContextKey<unknown>, unknown> | undefined
 
   constructor(
-    readonly req: Request,
+    readonly req: Bun.BunRequest,
     readonly params: ContextParams<P>,
     readonly route: RouteInfo
   ) {}
 
+  /** Attaches a value to this request, for the guards, interceptors and handler that follow. */
+  set<T>(key: ContextKey<T>, value: T): void {
+    this.#values ??= new Map()
+    this.#values.set(key, value)
+  }
+
+  /**
+   * Value attached to this request under `key`, or its default. Throws if
+   * nothing was set and the key has no default: a guard is missing on the route.
+   */
+  get<T>(key: ContextKey<T>): T {
+    if (this.#values?.has(key) === true) {
+      return this.#values.get(key) as T
+    }
+
+    if (key.defaultValue === undefined) {
+      throw new Error(
+        `${key.toString()} is not set for ${this.route.controller.name}.${this.route.handler}: ` +
+          'is the guard or interceptor that sets it applied to this route?'
+      )
+    }
+
+    const value = key.defaultValue()
+
+    this.set(key, value)
+
+    return value
+  }
+
+  /** `true` if a value was set under `key` for this request. */
+  has(key: ContextKey<unknown>): boolean {
+    return this.#values?.has(key) === true
+  }
+
   /**
    * Custom metadata of the route, the method's value over the class's.
    * Like Nest's `reflector.getAllAndOverride(Roles, [handler, class])`.
@@ -102,6 +140,28 @@ export class Context<P extends string = string> {
     return parser === undefined ? value : applyParser(parser, value, name)
   }
 
+  /**
+   * Cookies of the request: Bun's `CookieMap`. What `set()` and `delete()`
+   * change is sent with the response as `Set-Cookie`, whatever the response is.
+   *
+   * ```ts
+   * ctx.cookies.set('theme', 'dark', { maxAge: 60 * 60 * 24 * 365 })
+   * ctx.cookies.delete('session')
+   * ```
+   */
+  get cookies(): Bun.CookieMap {
+    return this.req.cookies
+  }
+
+  /** Cookie, decoded; converted and checked when a parser is given, such as `signed()`. */
+  cookie(name: string): string | undefined
+  cookie<V extends ValueParser<unknown>>(name: string, parser: V): Parsed<V>
+  cookie(name: string, parser?: ValueParser<unknown>): unknown {
+    const value = this.req.cookies.get(name) ?? undefined
+
+    return parser === undefined ? value : applyParser(parser, value, name)
+  }
+
   /**
    * JSON body, validated by `schema` when given. `415` for a non-JSON body,
    * `400` for invalid JSON or a failed validation.
@@ -109,10 +169,36 @@ export class Context<P extends string = string> {
   body(): Promise<unknown>
   body<S extends StandardSchemaV1>(schema: S): Promise<InferOutput<S>>
   async body(schema?: StandardSchemaV1): Promise<unknown> {
-    this.#body ??= readJsonBody(this.req)
-
-    const value = await this.#body
+    const value = await this.#read('JSON', readJsonBody)
 
     return schema === undefined ? value : validate(schema, value, '')
   }
+
+  /**
+   * Form body (`multipart/form-data` or `application/x-www-form-urlencoded`),
+   * validated by `schema` when given. `415` for another content type.
+   * Repeated fields and fields named `name[]` are arrays; files are `File`s
+   * whose `type` is what the client declared, not checked against the content.
+   * `limits` bound the body, the files and the fields: `413` past them.
+   */
+  form(limits?: FormLimits): Promise<FormFields>
+  form<S extends StandardSchemaV1>(schema: S, limits?: FormLimits): Promise<InferOutput<S>>
+  async form(schemaOrLimits?: StandardSchemaV1 | FormLimits, limits?: FormLimits): Promise<unknown> {
+    if (isStandardSchema(schemaOrLimits)) {
+      return validate(schemaOrLimits, await this.#read('form', (req) => readFormBody(req, limits)), '')
+    }
+
+    return this.#read('form', (req) => readFormBody(req, schemaOrLimits))
+  }
+
+  /** Reads the body once; reading it again in another format is a programming error. */
+  #read(kind: 'JSON' | 'form', read: (req: Request) => Promise<unknown>): Promise<unknown> {
+    if (this.#body === undefined) {
+      this.#body = { kind, value: read(this.req) }
+    } else if (this.#body.kind !== kind) {
+      throw new TypeError(`The body of this request was already read as ${this.#body.kind}, it cannot be read as ${kind}`)
+    }
+
+    return this.#body.value
+  }
 }

package/src/http/cookies.ts

@@ -0,0 +1,96 @@
+/**
+ * @module
+ * Signed cookies. Reading and writing cookies is Bun's: `ctx.cookies` is the
+ * request's `CookieMap`, whose changes Bun sends with the response as
+ * `Set-Cookie`. This module adds what `@fastify/cookie` and `cookie-signature`
+ * add on top: values signed with HMAC-SHA256, so the client can read them but
+ * not forge them.
+ *
+ * ```ts
+ * const signer = new CookieSigner(process.env.COOKIE_SECRET!)
+ *
+ * ctx.cookies.set('session', signer.sign(id), { httpOnly: true, secure: true })
+ *
+ * @Get('me', [cookie('session', signed(signer))])
+ * me(id: string) {}
+ * ```
+ *
+ * A signature proves the value was set by the server, not that it is secret
+ * or recent: store secrets server-side, and limit the lifetime with `maxAge`.
+ */
+
+import { timingSafeEqual } from 'node:crypto'
+import { failure } from './parsers.ts'
+import type { Parser, ParserOptions } from './parsers.ts'
+
+const hmac = (secret: string, value: string): string =>
+  new Bun.CryptoHasher('sha256', secret).update(value).digest('base64url')
+
+/**
+ * Signs cookie values as `value.signature` and checks them. Several secrets
+ * allow rotation: the first signs, every one verifies.
+ *
+ * ```ts
+ * new CookieSigner([process.env.COOKIE_SECRET!, process.env.OLD_COOKIE_SECRET!])
+ * ```
+ */
+export class CookieSigner {
+  readonly #secrets: readonly string[]
+
+  /** Secrets should be random and long: `openssl rand -base64 32`. */
+  constructor(secrets: string | readonly string[]) {
+    const list = typeof secrets === 'string' ? [secrets] : [...secrets]
+
+    if (list.length === 0 || list.includes('')) {
+      throw new TypeError('CookieSigner needs at least one secret, and no empty ones')
+    }
+
+    this.#secrets = list
+  }
+
+  /** `value` followed by `.` and its signature, in base64url. */
+  sign(value: string): string {
+    return `${value}.${hmac(this.#secrets[0]!, value)}`
+  }
+
+  /** The value of a signed string, or `undefined` if it is not signed by one of the secrets. */
+  unsign(signed: string): string | undefined {
+    const dot = signed.lastIndexOf('.')
+
+    if (dot === -1) {
+      return undefined
+    }
+
+    const value = signed.slice(0, dot)
+    const signature = Buffer.from(signed.slice(dot + 1))
+
+    for (const secret of this.#secrets) {
+      const expected = Buffer.from(hmac(secret, value))
+
+      if (expected.length === signature.length && timingSafeEqual(expected, signature)) {
+        return value
+      }
+    }
+
+    return undefined
+  }
+}
+
+type Result<O extends ParserOptions> = O extends { readonly optional: true } ? string | undefined : string
+
+/**
+ * Parser of a signed cookie: its value, `400` when it is missing or its
+ * signature is wrong. With `{ optional: true }`, both give `undefined`, as a
+ * forged cookie is no better than none.
+ */
+export const signed = <const O extends ParserOptions = {}>(signer: CookieSigner, options?: O): Parser<Result<O>> => ({
+  parse: (value, name) => {
+    const unsigned = value === undefined ? undefined : signer.unsign(value)
+
+    if (unsigned === undefined && options?.optional !== true) {
+      throw failure(name, 'signed cookie')
+    }
+
+    return unsigned as Result<O>
+  },
+})

package/src/http/cors.ts

@@ -0,0 +1,143 @@
+/**
+ * @module
+ * CORS middleware.
+ *
+ * Follows Hono's `cors()` and the `cors` package Nest uses, with two differences:
+ *
+ * - only a real preflight (`OPTIONS` with `Access-Control-Request-Method`, as
+ *   the Fetch spec defines it) is answered here; other `OPTIONS` requests reach
+ *   the application and its own `OPTIONS` routes;
+ * - `credentials: true` with `origin: '*'` is rejected when the middleware is
+ *   created: browsers refuse that pair, so it could never work.
+ *
+ * Response headers are set in place: Bun's responses always have mutable headers.
+ *
+ * ```ts
+ * cors({ origin: ['https://app.example.com'], credentials: true, maxAge: 600 })
+ * ```
+ */
+
+import type { MiddlewareFunction } from './middleware.ts'
+
+export interface CorsOptions {
+  /**
+   * Allowed origins: `'*'` (default), one origin, a list, or a predicate.
+   * An allowed origin is echoed back; a refused one gets no CORS headers, so the browser blocks the response.
+   */
+  readonly origin?: '*' | string | readonly string[] | ((origin: string, req: Request) => boolean)
+  /** Methods announced to preflights. */
+  readonly methods?: readonly string[]
+  /** Headers announced to preflights. Defaults to the ones the preflight asks for. */
+  readonly allowedHeaders?: readonly string[]
+  /** Response headers the browser exposes to scripts. */
+  readonly exposedHeaders?: readonly string[]
+  /** Allows cookies and `Authorization`; needs explicit origins. */
+  readonly credentials?: boolean
+  /** Seconds a browser may cache a preflight. */
+  readonly maxAge?: number
+}
+
+const DEFAULT_METHODS = ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE']
+
+const createOriginCheck = (origin: NonNullable<CorsOptions['origin']>): ((origin: string, req: Request) => boolean) => {
+  if (typeof origin === 'function') {
+    return origin
+  }
+
+  if (typeof origin === 'string') {
+    return (requested) => requested === origin
+  }
+
+  const allowed = new Set(origin)
+
+  return (requested) => allowed.has(requested)
+}
+
+const appendVary = (headers: Headers, value: string): void => {
+  const current = headers.get('vary')
+
+  if (current === null) {
+    headers.set('vary', value)
+  } else if (current !== '*' && !current.toLowerCase().split(/\s*,\s*/).includes(value.toLowerCase())) {
+    headers.set('vary', `${current}, ${value}`)
+  }
+}
+
+/**
+ * Creates the CORS middleware. Throws a `TypeError` for options browsers would refuse.
+ */
+export const cors = (options: CorsOptions = {}): MiddlewareFunction => {
+  const origin = options.origin ?? '*'
+  const any = origin === '*'
+
+  if (any && options.credentials === true) {
+    throw new TypeError(
+      "cors(): credentials cannot be used with origin '*', browsers reject that combination; list the allowed origins instead"
+    )
+  }
+
+  const isAllowed = any ? () => true : createOriginCheck(origin)
+  const methods = (options.methods ?? DEFAULT_METHODS).join(', ')
+  const allowedHeaders = options.allowedHeaders?.join(', ')
+  const exposedHeaders = options.exposedHeaders?.join(', ')
+  const maxAge = options.maxAge === undefined ? undefined : String(options.maxAge)
+
+  /** Headers every CORS response of an allowed origin gets. */
+  const applyCommon = (headers: Headers, requested: string | null, req: Request): void => {
+    if (requested !== null && isAllowed(requested, req)) {
+      headers.set('access-control-allow-origin', any ? '*' : requested)
+
+      if (options.credentials === true) {
+        headers.set('access-control-allow-credentials', 'true')
+      }
+    }
+
+    // The response depends on Origin as soon as it is not the same for every origin.
+    if (!any) {
+      appendVary(headers, 'Origin')
+    }
+  }
+
+  return async (req, next) => {
+    const requested = req.headers.get('origin')
+    const preflight = req.method === 'OPTIONS' && requested !== null && req.headers.has('access-control-request-method')
+
+    if (preflight) {
+      const headers = new Headers()
+
+      applyCommon(headers, requested, req)
+
+      if (headers.has('access-control-allow-origin')) {
+        headers.set('access-control-allow-methods', methods)
+
+        const requestedHeaders = req.headers.get('access-control-request-headers')
+        const allowHeaders = allowedHeaders ?? requestedHeaders ?? ''
+
+        if (allowHeaders !== '') {
+          headers.set('access-control-allow-headers', allowHeaders)
+        }
+
+        if (allowedHeaders === undefined && requestedHeaders !== null) {
+          appendVary(headers, 'Access-Control-Request-Headers')
+        }
+
+        if (maxAge !== undefined) {
+          headers.set('access-control-max-age', maxAge)
+        }
+      }
+
+      return new Response(null, { status: 204, headers })
+    }
+
+    const response = await next()
+    const headers = response.headers
+
+    applyCommon(headers, requested, req)
+
+    if (exposedHeaders !== undefined && headers.has('access-control-allow-origin')) {
+      headers.set('access-control-expose-headers', exposedHeaders)
+    }
+
+    return response
+  }
+}

package/src/http/index.ts

@@ -3,9 +3,11 @@
  * HTTP layer for Soda: controllers, route decorators, request context, validation, exceptions.
  */
 
-export { body, context, header, param, query } from './arguments.ts'
+export { body, context, cookie, form, header, param, query, value } from './arguments.ts'
 export type { Argument, ArgumentFor, ArgumentKind, ArgumentValues } from './arguments.ts'
 export { Context } from './context.ts'
+export { CookieSigner, signed } from './cookies.ts'
+export { ContextKey } from './context-key.ts'
 export type { ContextParams, ParamNameOf } from './context.ts'
 export { All, Controller, Delete, Get, Head, Header, HttpCode, Options, Patch, Post, Put, Route } from './decorators.ts'
 export type {
@@ -36,7 +38,7 @@ export type { HttpExceptionBody, HttpExceptionOptions } from './exceptions.ts'
 export { boolean, int, number, uuid } from './parsers.ts'
 export type { Parsed, Parser, ParserOptions, ValueParser } from './parsers.ts'
 export { buildRoutes, controllerRoutes } from './routes.ts'
-export type { BuiltRoutes, ControllerRoutesOptions } from './routes.ts'
+export type { BuiltRoutes, ControllerRoutesOptions, MappedController } from './routes.ts'
 export type { InferOutput, StandardSchemaV1 } from './schema.ts'
 export type { AnyParams, PathParams } from './types.ts'
 export { Catch, createDecorator, UseFilters, UseGuards, UseInterceptors } from './enhancers.ts'
@@ -56,3 +58,7 @@ export type {
   MetadataDecorator,
 } from './enhancers.ts'
 export type { RouteInfo } from './context.ts'
+export { cors } from './cors.ts'
+export type { CorsOptions } from './cors.ts'
+export type { Middleware, MiddlewareFunction, NestMiddleware, Next } from './middleware.ts'
+export type { FormFields, FormLimits, FormValue } from './body.ts'