@grest-ts/http 0.0.51 → 0.0.55

package/src/_dedupCheck.ts

@@ -12,7 +12,7 @@
 const __KEY = Symbol.for("grest-ts:dedup:@grest-ts/http");
 const __slot = globalThis as Record<symbol, unknown>;
 const __existing = __slot[__KEY] as { path: string; version: string } | undefined;
-const __here = { path: import.meta.url, version: "0.0.51" };
+const __here = { path: import.meta.url, version: "0.0.55" };
 // Same path + same version means the same physical package is being
 // re-evaluated by a different ESM runner (e.g. vitest projects share one
 // process but each project has its own module cache). That isn't a true

package/src/client/GGContextKeySynchronizer.ts

@@ -16,6 +16,24 @@ const GG_SYNC_CONTROLLERS = new GGContextKey<Map<string, ControllerEntry>>(
     IsAny as unknown as GGSchema<Map<string, ControllerEntry>>
 )
 
+// Backstop so a stuck recover() can't hang every gated request forever. A recover() that
+// never settles - e.g. a credential whose refresh endpoint is itself gated by the same wire,
+// so the refresh call waits on the recover that is waiting on it (circular wait) - would
+// otherwise block the outbound read with no request ever issued. Bounded well above a healthy
+// recover (lock acquire 20s + request 15s) so only a truly stuck one trips; on timeout the
+// waiter rejects and the caller fails/retries instead of freezing.
+const RECOVER_TIMEOUT_MS = 45_000
+
+function withRecoverTimeout(recover: Promise<void>, name: string): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+        const timer = setTimeout(
+            () => reject(new Error(`Credential recover for "${name}" timed out after ${RECOVER_TIMEOUT_MS}ms (stuck/circular refresh?)`)),
+            RECOVER_TIMEOUT_MS,
+        )
+        recover.then(resolve, reject).finally(() => clearTimeout(timer))
+    })
+}
+
 export class GGContextKeySynchronizer {
 
     static provide(key: GGContextKey<any>, controller: GGKeyController): void {
@@ -30,7 +48,7 @@ export class GGContextKeySynchronizer {
     static async waitFor(key: GGContextKey<any>): Promise<void> {
         const entry = GG_SYNC_CONTROLLERS.get()?.get(key.name)
         if (entry === undefined || !entry.controller.isStale()) return
-        entry.inflight ??= entry.controller.recover().finally(() => {
+        entry.inflight ??= withRecoverTimeout(entry.controller.recover(), key.name).finally(() => {
             entry.inflight = undefined
         })
         await entry.inflight

package/src/client/GGHttpSchema.createClient.ts

@@ -67,6 +67,8 @@ export function createClient<TContract extends GGContractApiDefinition, TContext
     config ??= {};
     config.timeout ??= 15000;
 
+    const contract = httpSchema.contract;
+
     // A custom transport implies "I take over the wire layer" — discovery is
     // off the table (the transport knows how to find the target), and the
     // default base URL becomes "" so the transport sees just the request path.
@@ -84,7 +86,7 @@ export function createClient<TContract extends GGContractApiDefinition, TContext
     const transportImplementation: any = {}
     for (const methodName of Object.keys(httpSchema.codec)) {
 
-        const contractFunction = httpSchema.contract.methods[methodName];
+        const contractFunction = contract.methods[methodName];
         const noValidation = config?.noValidation === true;
 
         const codec: GGHttpCodec = httpSchema.codec[methodName];
@@ -96,7 +98,7 @@ export function createClient<TContract extends GGContractApiDefinition, TContext
 
         const implementation = async (data?: unknown): Promise<OK<unknown> | ANY_ERROR> => {
             try {
-                let baseUrl: string = config.url;
+                let baseUrl: string | undefined = config.url;
                 if (baseUrl === undefined) {
                     try {
                         const {GG_DISCOVERY} = await import(/* @vite-ignore */ '@grest-ts/discovery');
@@ -149,7 +151,7 @@ export function createClient<TContract extends GGContractApiDefinition, TContext
 
     }
     // Per-client stub — doesn't belong in the callOn registry (server's impl does).
-    httpSchema.contract.implement(transportImplementation as GGContractImplementation<TContract>, {skipLocatorRegistration: true})
+    contract.implement(transportImplementation as GGContractImplementation<TContract>, {skipLocatorRegistration: true})
     return transportImplementation;
 }
 

package/src/rpc/RpcResponse/GGRpcResponseBuilder.ts

@@ -47,7 +47,7 @@ export class GGRpcResponseBuilder {
             "}";
     }
 
-    private makeDataStr(schema: GGSchema<any>, data: OK<any> | ANY_ERROR): string {
+    private makeDataStr(schema: GGSchema<any> | undefined, data: OK<any> | ANY_ERROR): string {
         if (schema) {
             GGContractExecutor.assertResponse(schema, data);
             const dataStr = schema.unsafeStringify(data.data)
@@ -57,7 +57,7 @@ export class GGRpcResponseBuilder {
         }
     }
 
-    private makeErrorCtx(ctx: GGErrorData, debugContext?: GGDebugData): string {
+    private makeErrorCtx(ctx: GGErrorData | undefined, debugContext?: GGDebugData): string {
         if (ctx) {
             let str = "";
             str += ctx?.displayMessage ? '"displayMessage":' + JSON.stringify(ctx.displayMessage) + '' : "";

package/src/schema/GGCookie.ts

@@ -142,8 +142,9 @@ function _readCookie(rawCookieHeader: string | undefined, name: string): string
 
 function _serializeSetCookie(name: string, value: string | undefined, options?: CookieOptions): string {
     const o = {...SAFE_DEFAULTS, ...options}
-    const secure = o.sameSite === "none" ? true : o.secure
-    const sameSite = `${o.sameSite.charAt(0).toUpperCase()}${o.sameSite.slice(1)}`
+    const sameSiteValue = o.sameSite ?? "lax"
+    const secure = sameSiteValue === "none" ? true : o.secure
+    const sameSite = `${sameSiteValue.charAt(0).toUpperCase()}${sameSiteValue.slice(1)}`
     const attrs = `; Path=${o.path}${o.domain ? `; Domain=${o.domain}` : ""}; SameSite=${sameSite}${secure ? "; Secure" : ""}${o.httpOnly ? "; HttpOnly" : ""}`
     return value
         ? `${name}=${encodeURIComponent(value)}${o.maxAgeSec !== undefined ? `; Max-Age=${Math.trunc(o.maxAgeSec)}` : ""}${attrs}`

package/src/schema/GGHttpPermissionsChecker.ts

@@ -15,7 +15,7 @@ export class GGHttpPermissionsChecker {
         Object.freeze(this.middlewaresWithPermissions)
     }
 
-    public async assert(schema: string, method: string, required: GGPermission): Promise<ReadonlyArray<ReadonlyArray<string>>> {
+    public async assert(schema: string, method: string, required: GGPermission | undefined): Promise<ReadonlyArray<ReadonlyArray<string>>> {
         const scopes: Array<readonly string[]> = [];
         for (let i = 0; i < this.middlewaresWithPermissions.length; i++) {
             scopes.push(await this.middlewaresWithPermissions[i].getGrantedPermissions())
@@ -24,7 +24,8 @@ export class GGHttpPermissionsChecker {
         return Object.freeze(scopes) as readonly string[][]
     }
 
-    public assertGrants(schema: string, method: string, granted: undefined | ReadonlyArray<ReadonlyArray<string>>, required: GGPermission): void {
+    public assertGrants(schema: string, method: string, granted: undefined | ReadonlyArray<ReadonlyArray<string>>, required: GGPermission | undefined): void {
+        if (required === undefined) return
         if (!GGPermissionChecker.satisfies(required, granted)) {
             throw new FORBIDDEN({
                 debugMessage: `${schema + (method ? "." + method : "")} requires ${GGPermissionChecker.describePermission(required)} - caller scopes did not satisfy`

package/src/schema/GGHttpSchema.ts

@@ -10,7 +10,7 @@ export class GGHttpSchema<TContract extends GGContractApiDefinition, TContext> {
     public readonly pathPrefix: string
     public readonly apiMiddlewares: readonly GGTransportMiddleware[]
     public readonly codec: Record<keyof TContract, GGHttpCodec>
-    public readonly contract: GGContractClass<TContract> | null = null
+    public readonly contract: GGContractClass<TContract>
 
     constructor(
         pathPrefix: string,

package/src/server/GGHttpSchema.startServer.ts

@@ -84,12 +84,14 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
     }
 
     server.onStart(() => {
+        const port = server.port;
+        if (port === undefined) throw new Error("HTTP server port is not set; onStart ran before listen completed.");
         GG_DISCOVERY.tryGet()?.registerRoutes([{
             runtime: scope.serviceName,
             api: httpSchema.name,
             pathPrefix: pathPrefix,
             protocol: "http",
-            port: server.port
+            port: port
         }]);
     })
 
@@ -103,7 +105,8 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
         if (!codec) throw new Error(`Contract for "${httpSchema.name}.${methodName}" is missing wire format!`)
 
         // Implementation function
-        const implFn = implementation[methodName]?.bind(implementation)
+        const implMethod = implementation[methodName] as ((data?: unknown) => Promise<unknown>) | undefined
+        const implFn = implMethod?.bind(implementation)
         if (!implFn) throw new Error(`Implementation for "${httpSchema.name}.${methodName}" is missing implementation method!`)
 
         // Input schema
@@ -120,10 +123,10 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
             scope.ensureEntered();
             return new GGContext("REQ", parentContext, true).run(async () => {
                 GG_TRACE.init();
-                GG_HTTP_REQUEST.set({port: server.port, method: req.method, path: req.url});
+                GG_HTTP_REQUEST.set({port: server.port ?? 0, method: req.method ?? "", path: req.url ?? ""});
                 GG_COOKIE_WRITES.set(cookieWriteNames);
                 const startTime = performance.now()
-                let rpcResult: ERROR<string, unknown> | OK<unknown>
+                let rpcResult: ERROR<string, unknown> | OK<unknown> | undefined
                 try {
                     const rawInput = await requestParser.readRequest(req)
                     await permissionsChecker.assert(httpSchema.name, methodName, contractFunctionSchema.permission)
@@ -150,7 +153,7 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
 }
 
 function metrics(
-    resultType: string,
+    resultType: string | undefined,
     apiName: string,
     method: HttpMethod,
     pathPrefix: string,
@@ -163,7 +166,7 @@ function metrics(
             api: apiName,
             method: pathSuffix,
             path: path,
-            result: resultType
+            result: resultType ?? "unknown"
         });
         GGHttpMetrics.requestDuration.observe(performance.now() - startTime, {
             api: apiName,

package/src/server/GGHttpServer.ts

@@ -122,7 +122,7 @@ export class GGHttpServer {
                     res.writeHead(204);
                     res.end();
                 } else {
-                    const resolved = this.router.find(req.method as HTTPMethod, req.url)
+                    const resolved = this.router.find(req.method as HTTPMethod, req.url ?? "")
                     if (resolved) {
                         await (resolved.handler as unknown as GGHttpRequestCallback)(req, res);
                     } else {
@@ -131,7 +131,7 @@ export class GGHttpServer {
                     }
                 }
             } catch (error) {
-                GGLog.error(this, error);
+                GGLog.error(this, error instanceof Error ? error : new Error(String(error)));
                 res.writeHead(500);
                 res.end();
             } finally {