@hypequery/serve 0.24.0 → 0.24.2

package/dist/adapters/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,MAAM,CAAC;AAG/E,OAAO,KAAK,EAEV,YAAY,EAGZ,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAoIrB,eAAO,MAAM,iBAAiB,GAC5B,SAAS,YAAY,EACrB,UAAS,kBAAuB,MAKlB,KAAK,eAAe,EAAE,KAAK,cAAc,kBAwCxD,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,SAAS,YAAY,EACrB,UAAS,kBAAuB;;gBA0BP,OAAO,CAAC,IAAI,CAAC;EAiEvC,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,MAAM,CAAC;AAG/E,OAAO,KAAK,EAEV,YAAY,EAGZ,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAmLrB,eAAO,MAAM,iBAAiB,GAC5B,SAAS,YAAY,EACrB,UAAS,kBAAuB,MAKlB,KAAK,eAAe,EAAE,KAAK,cAAc,kBAwCxD,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,SAAS,YAAY,EACrB,UAAS,kBAAuB;;gBA0BP,OAAO,CAAC,IAAI,CAAC;EAiEvC,CAAC"}

package/dist/adapters/node.js

@@ -2,9 +2,15 @@ import { createServer } from "http";
 import { once } from "node:events";
 import { normalizeHeaders, parseQueryParams, parseRequestBody, serializeResponseBody, } from "./utils.js";
 import { adapterErrorHeaders } from "../utils/error-headers.js";
+import { declaresRequestBody, isNodeBodyConsumed, readPreParsedBody, resolveNodeRequestUrl, } from "../utils/node-request.js";
 const DEFAULT_REQUEST_TIMEOUT = 30_000; // 30 seconds
 const DEFAULT_BODY_LIMIT = 1_048_576; // 1 MB
 const DEFAULT_GRACEFUL_SHUTDOWN_TIMEOUT = 10_000; // 10 seconds
+const payloadTooLarge = () => {
+    const error = new Error("Request body too large");
+    error.code = "PAYLOAD_TOO_LARGE";
+    return error;
+};
 const readRequestBody = async (req, bodyLimit) => {
     const chunks = [];
     let totalLength = 0;
@@ -12,21 +18,49 @@ const readRequestBody = async (req, bodyLimit) => {
         const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         totalLength += buf.length;
         if (bodyLimit > 0 && totalLength > bodyLimit) {
-            const error = new Error("Request body too large");
-            error.code = "PAYLOAD_TOO_LARGE";
-            throw error;
+            throw payloadTooLarge();
         }
         chunks.push(buf);
     }
     return Buffer.concat(chunks);
 };
+const resolveRequestBody = async (req, bodyLimit, contentType) => {
+    if (!isNodeBodyConsumed(req)) {
+        return parseRequestBody(await readRequestBody(req, bodyLimit), contentType);
+    }
+    // A body parser (express.json(), NestJS, koa-bodyparser, ...) already read
+    // the stream. Use what it left on req.body; it has applied its own limit.
+    const preParsed = readPreParsedBody(req, bodyLimit);
+    if (preParsed.kind === "too-large")
+        throw payloadTooLarge();
+    if (preParsed.kind === "parsed")
+        return preParsed.value;
+    if (preParsed.kind === "raw") {
+        return parseRequestBody(preParsed.buffer, contentType);
+    }
+    if (declaresRequestBody(req)) {
+        // The body is gone and nothing exposed it. Fail loudly rather than
+        // validating an empty body and returning a misleading 400.
+        throw {
+            status: 500,
+            body: {
+                error: {
+                    type: "INTERNAL_SERVER_ERROR",
+                    message: "The request body was consumed before the hypequery handler ran. " +
+                        "Register the handler before body-parsing middleware, or set " +
+                        "req.body to the parsed body (for Fastify: request.raw.body = request.body).",
+                },
+            },
+        };
+    }
+    return undefined;
+};
 const buildServeRequest = async (req, bodyLimit) => {
     const method = (req.method ?? "GET").toUpperCase();
-    const url = new URL(req.url ?? "/", "http://localhost");
-    const bodyBuffer = await readRequestBody(req, bodyLimit);
+    const url = new URL(resolveNodeRequestUrl(req), "http://localhost");
     const headers = normalizeHeaders(req.headers);
     const contentType = headers["content-type"] ?? headers["Content-Type"];
-    const body = await parseRequestBody(bodyBuffer, contentType);
+    const body = await resolveRequestBody(req, bodyLimit, contentType);
     return {
         method,
         path: url.pathname,

package/dist/utils/node-request.d.ts

@@ -0,0 +1,34 @@
+import type { IncomingMessage } from "http";
+/**
+ * The URL the client actually requested. Express and Connect strip the mount
+ * prefix from `req.url` inside `app.use('/prefix', handler)` but keep the full
+ * URL in `req.originalUrl`; routing needs the full path to match `basePath`.
+ */
+export declare const resolveNodeRequestUrl: (req: IncomingMessage) => string;
+/**
+ * True when something upstream (a body parser) has already read the request
+ * stream, so reading it again would yield nothing.
+ */
+export declare const isNodeBodyConsumed: (req: IncomingMessage) => boolean;
+/** True when the request headers announce a body. */
+export declare const declaresRequestBody: (req: IncomingMessage) => boolean;
+export type PreParsedBody = {
+    kind: "none";
+} | {
+    kind: "too-large";
+} | {
+    kind: "raw";
+    buffer: Buffer;
+} | {
+    kind: "parsed";
+    value: unknown;
+};
+/**
+ * The body an upstream parser left on `req.body`, held to *bodyLimit* bytes
+ * (0 for none) before any of it is parsed. Buffers and strings
+ * (express.raw(), express.text()) are raw bytes for the adapter's own
+ * content-type parsing, except a string on a JSON request that a JSON parser
+ * already decoded (`readJsonString`); anything else is used as-is.
+ */
+export declare const readPreParsedBody: (req: IncomingMessage, bodyLimit?: number) => PreParsedBody;
+//# sourceMappingURL=node-request.d.ts.map

package/dist/utils/node-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-request.d.ts","sourceRoot":"","sources":["../../src/utils/node-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAc5C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,KAAK,eAAe,KAAG,MAM5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,eAAe,KAAG,OACK,CAAC;AAEhE,qDAAqD;AACrD,eAAO,MAAM,mBAAmB,GAAI,KAAK,eAAe,KAAG,OAI1D,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAqDvC;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,eAAe,EAAE,kBAAa,KAAG,aAgBvE,CAAC"}

package/dist/utils/node-request.js

@@ -0,0 +1,97 @@
+/**
+ * The URL the client actually requested. Express and Connect strip the mount
+ * prefix from `req.url` inside `app.use('/prefix', handler)` but keep the full
+ * URL in `req.originalUrl`; routing needs the full path to match `basePath`.
+ */
+export const resolveNodeRequestUrl = (req) => {
+    const { originalUrl } = req;
+    if (typeof originalUrl === "string" && originalUrl.length > 0) {
+        return originalUrl;
+    }
+    return req.url ?? "/";
+};
+/**
+ * True when something upstream (a body parser) has already read the request
+ * stream, so reading it again would yield nothing.
+ */
+export const isNodeBodyConsumed = (req) => req.readableEnded || req._body === true;
+/** True when the request headers announce a body. */
+export const declaresRequestBody = (req) => {
+    if (req.headers["transfer-encoding"] !== undefined)
+        return true;
+    const length = Number(req.headers["content-length"]);
+    return Number.isFinite(length) && length > 0;
+};
+/**
+ * How to read a string `req.body` on a JSON request: as raw text, or as a JSON
+ * value a parser already decoded (`express.json({ strict: false })` turns
+ * `"123"` into the string `123`) and must not be parsed again.
+ *
+ * Raw text has exactly the byte length the client declared, and a decoded
+ * JSON string is at least two bytes shorter because its quotes are gone, so
+ * the lengths decide whenever they can be compared. A chunked body declares no
+ * length, and a compressed one declares the compressed length; then the text
+ * decides: raw text that is a JSON object or array is what an endpoint takes
+ * (and is returned already parsed), while a decoded string is kept as a
+ * string, so `"123"` never becomes `123`.
+ *
+ * Supported limitation: without a comparable length, raw text that is a bare
+ * JSON primitive (`express.text()` given `123`, `true` or `null`) cannot be
+ * told from a decoded string and stays a string. An endpoint taking a
+ * primitive behind `express.text()` should receive a declared-length body, or
+ * sit behind `express.json()` instead.
+ */
+const readJsonString = (req, body, byteLength) => {
+    const encoding = req.headers["content-encoding"];
+    const declared = req.headers["content-length"];
+    const comparable = (encoding === undefined || encoding.trim().toLowerCase() === "identity") &&
+        declared !== undefined &&
+        /^\d+$/.test(declared);
+    if (comparable) {
+        return Number(declared) === byteLength
+            ? { kind: "raw", buffer: Buffer.from(body, "utf8") }
+            : { kind: "parsed", value: body };
+    }
+    const value = parseJsonObjectText(body);
+    return { kind: "parsed", value: value === undefined ? body : value };
+};
+/** The object or array *text* encodes as JSON, or undefined for anything else. */
+const parseJsonObjectText = (text) => {
+    const first = text.trimStart()[0];
+    if (first !== "{" && first !== "[")
+        return undefined;
+    try {
+        const value = JSON.parse(text);
+        return typeof value === "object" && value !== null ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * The body an upstream parser left on `req.body`, held to *bodyLimit* bytes
+ * (0 for none) before any of it is parsed. Buffers and strings
+ * (express.raw(), express.text()) are raw bytes for the adapter's own
+ * content-type parsing, except a string on a JSON request that a JSON parser
+ * already decoded (`readJsonString`); anything else is used as-is.
+ */
+export const readPreParsedBody = (req, bodyLimit = 0) => {
+    const { body } = req;
+    if (body === undefined)
+        return { kind: "none" };
+    if (Buffer.isBuffer(body)) {
+        return bodyLimit > 0 && body.length > bodyLimit
+            ? { kind: "too-large" }
+            : { kind: "raw", buffer: body };
+    }
+    if (typeof body !== "string")
+        return { kind: "parsed", value: body };
+    const byteLength = Buffer.byteLength(body, "utf8");
+    if (bodyLimit > 0 && byteLength > bodyLimit)
+        return { kind: "too-large" };
+    const contentType = req.headers["content-type"];
+    if (typeof contentType === "string" && contentType.includes("application/json")) {
+        return readJsonString(req, body, byteLength);
+    }
+    return { kind: "raw", buffer: Buffer.from(body, "utf8") };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/serve",
-  "version": "0.24.0",
+  "version": "0.24.2",
   "description": "Code-first TypeScript runtime for validated ClickHouse analytics APIs, OpenAPI, auth, and tenancy",
   "keywords": [
     "clickhouse",
@@ -34,11 +34,11 @@
     "dist"
   ],
   "dependencies": {
-    "jose": "^5.9.6",
+    "jose": "^6.2.13",
     "openapi-typescript": "^7.13.0",
     "zod": "^4.6.6",
     "zod-to-json-schema": "^3.25.2",
-    "@hypequery/datasets": "^0.27.0"
+    "@hypequery/datasets": "^0.28.0"
   },
   "peerDependencies": {
     "tsx": "^4.0.0",
@@ -53,8 +53,11 @@
     }
   },
   "devDependencies": {
+    "@types/express": "^5.0.6",
     "@types/node": "^20.11.30",
     "@vitest/coverage-v8": "^5.0.5",
+    "express": "^5.2.1",
+    "fastify": "^5.12.7",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",
     "vitest": "^5.0.5"