@jongleberry/api-server 1.0.0 → 1.0.3

package/README.md

@@ -47,10 +47,11 @@ app.route("/").get((ctx) => ctx.json({ ok: true }));
 - **Compression** — `br` / `gzip` / `deflate` negotiation; 1 KB threshold; `SYNC_FLUSH` for streams
 - **Server-Timing** — response latency as a `Server-Timing` header (buffered) or trailer (streaming)
 - **Abort signals** — `ctx.signal` / `ctx.abortController` wired to client disconnect
+- **Request body limits** — `ctx.request.buffer()` and `.json()` use a safe 1 MB default, with per-call overrides
 - **AsyncLocalStorage** — per-request store via `app.setAsyncLocalStorage(als)`
 - **Cookies** — `ctx.cookies.get()` / `.set()` with full `Set-Cookie` options
 - **Cache-Control** — `ctx.cacheControl(visibility, maxAge)` helper
-- **Trusted client IP** — Cloudflare/AWS ALB-aware helper for Node, Deno, and Bun
+- **Trusted client IP** — proxy headers are opt-in via `trustProxy`; standalone helpers support Node, Deno, and Bun
 - **Dev logger** — concurrent-request bar, color-coded status codes, timing thresholds; silent in `NODE_ENV=production` and `NODE_ENV=test`
 - **Error safety net** — error handlers that throw or return without a response still guarantee the client receives a response
 
@@ -86,7 +87,7 @@ See [docs/](docs/README.md) for full API reference:
 
 - No middleware stack. Routes are registered directly on the application; request processing runs top-to-bottom in a single async function per request.
 - No magic. `ctx.req` and `ctx.res` are the raw Node.js `IncomingMessage` and `ServerResponse` objects.
-- Body is pull-based. `ctx.request.buffer()` and `ctx.request.json()` are explicit calls; the body is never automatically parsed.
+- Body is pull-based. `ctx.request.buffer()` and `ctx.request.json()` are explicit calls; the body is never automatically parsed and defaults to a 1 MB limit.
 - Responses are explicit. You choose buffered or streaming; the library doesn't buffer a stream or stream a buffer behind your back.
 
 ## License

package/dist/application.d.mts

@@ -14,6 +14,8 @@ export declare class Application extends EventEmitter {
     private extensions;
     private contextClass;
     private logger;
+    private bodyLimit;
+    private trustProxy;
     constructor(options?: ApplicationOptions);
     route(path: string): RouteBuilder;
     errorHandler(fn: ErrorHandler): void;

package/dist/application.mjs

@@ -4,7 +4,7 @@ import { createRouteBuilder } from "./router.mjs";
 import Router from "find-my-way";
 import { ServerTiming } from "./server-timing.mjs";
 import { Logger } from "./logger.mjs";
-import { getFallbackStatus, sendFallback } from "./fallback-response.mjs";
+import { getFallbackBody, getFallbackStatus, sendFallback } from "./fallback-response.mjs";
 export class Application extends EventEmitter {
     router = Router();
     errorHandlerFn = null;
@@ -13,9 +13,13 @@ export class Application extends EventEmitter {
     extensions = {};
     contextClass = Context;
     logger;
+    bodyLimit;
+    trustProxy;
     constructor(options) {
         super();
         this.logger = new Logger(options?.logger);
+        this.bodyLimit = options?.bodyLimit ?? "1mb";
+        this.trustProxy = options?.trustProxy ?? false;
     }
     route(path) {
         return createRouteBuilder(this.router, path);
@@ -74,7 +78,7 @@ export class Application extends EventEmitter {
             }
         });
         const { onWriteHead, onFinish } = this.logger.onRequestStart(req);
-        const ctx = new ContextClass(req, res, {}, timing, this.asyncLocalStorage, abortController, onWriteHead);
+        const ctx = new ContextClass(req, res, {}, timing, this.asyncLocalStorage, abortController, this.bodyLimit, this.trustProxy, onWriteHead);
         // Security headers
         res.setHeader("X-XSS-Protection", "0");
         res.setHeader("X-Frame-Options", "SAMEORIGIN");
@@ -124,8 +128,9 @@ export class Application extends EventEmitter {
                 }
             }
             else if (!res.headersSent) {
-                res.writeHead(getFallbackStatus(error));
-                res.end(error.message);
+                const status = getFallbackStatus(error);
+                res.writeHead(status);
+                res.end(getFallbackBody(error, status));
             }
             onFinish(res.statusCode);
         }

package/dist/compression.mjs

@@ -5,6 +5,7 @@ import Negotiator from "negotiator";
 import compressibleFn from "compressible";
 const SUPPORTED_ENCODINGS = ["br", "gzip", "deflate"];
 const COMPRESSION_THRESHOLD = 1024;
+const MAX_SYNC_COMPRESSION_BYTES = 1024 * 1024;
 export function negotiateEncoding(req) {
     const negotiator = new Negotiator(req);
     const encoding = negotiator.encoding(SUPPORTED_ENCODINGS);
@@ -38,6 +39,8 @@ export function compressSync(encoding, buffer) {
 export function shouldCompress(req, res, contentType, bodyLength) {
     if (bodyLength < COMPRESSION_THRESHOLD)
         return null;
+    if (Number.isFinite(bodyLength) && bodyLength > MAX_SYNC_COMPRESSION_BYTES)
+        return null;
     if (res.getHeader("Content-Encoding"))
         return null;
     const cacheControl = req.headers["cache-control"];

package/dist/context.d.mts

@@ -17,7 +17,8 @@ export declare class Context {
     assert: typeof httpAssert;
     private queryCache;
     private asyncLocalStorage;
-    constructor(req: IncomingMessage, res: ServerResponse, params: Record<string, string | undefined>, timing: ServerTiming, als: AsyncLocalStorage<unknown> | null, abortController: AbortController, onWriteHead?: () => void);
+    private trustProxy;
+    constructor(req: IncomingMessage, res: ServerResponse, params: Record<string, string | undefined>, timing: ServerTiming, als: AsyncLocalStorage<unknown> | null, abortController: AbortController, bodyLimit: string | number | false, trustProxy: boolean, onWriteHead?: () => void);
     get query(): Record<string, string | string[]>;
     get store(): unknown;
     get ip(): string | undefined;

package/dist/context.mjs

@@ -25,17 +25,19 @@ export class Context {
     assert;
     queryCache = null;
     asyncLocalStorage;
-    constructor(req, res, params, timing, als, abortController, onWriteHead) {
+    trustProxy;
+    constructor(req, res, params, timing, als, abortController, bodyLimit, trustProxy, onWriteHead) {
         this.req = req;
         this.res = res;
         this.params = params;
-        this.request = new Request(req, res);
+        this.request = new Request(req, res, bodyLimit);
         this.response = new Response(req, res, timing, onWriteHead);
         this.cookies = new Cookies(req, res);
         this.abortController = abortController;
         this.signal = abortController.signal;
         this.assert = httpAssert;
         this.asyncLocalStorage = als;
+        this.trustProxy = trustProxy;
     }
     get query() {
         if (this.queryCache)
@@ -48,10 +50,18 @@ export class Context {
         }
         const queryString = url.slice(questionMark + 1);
         const params = new URLSearchParams(queryString);
-        const result = {};
-        for (const key of params.keys()) {
-            const values = params.getAll(key);
-            result[key] = values.length === 1 ? values[0] : values;
+        const result = Object.create(null);
+        for (const [key, value] of params) {
+            const current = result[key];
+            if (current === undefined) {
+                result[key] = value;
+            }
+            else if (Array.isArray(current)) {
+                current.push(value);
+            }
+            else {
+                result[key] = [current, value];
+            }
         }
         this.queryCache = result;
         return this.queryCache;
@@ -61,7 +71,7 @@ export class Context {
     }
     get ip() {
         return resolveTrustedClientIp({
-            headers: this.req.headers,
+            headers: this.trustProxy ? this.req.headers : undefined,
             socketRemoteAddress: this.req.socket?.remoteAddress,
         });
     }

package/dist/fallback-response.d.mts

@@ -1,3 +1,4 @@
 import type { ServerResponse } from "node:http";
 export declare function sendFallback(res: ServerResponse): void;
 export declare function getFallbackStatus(error: unknown): number;
+export declare function getFallbackBody(error: unknown, status: number): string;

package/dist/fallback-response.mjs

@@ -1,9 +1,10 @@
-const FALLBACK_STATUS = 404;
 const FALLBACK_BODY = "Not Found";
+const ERROR_STATUS = 500;
+const ERROR_BODY = "Internal Server Error";
 export function sendFallback(res) {
     try {
-        res.writeHead(FALLBACK_STATUS);
-        res.end(FALLBACK_BODY);
+        res.writeHead(ERROR_STATUS);
+        res.end(ERROR_BODY);
     }
     catch {
         // Socket may already be destroyed; nothing more we can do.
@@ -11,8 +12,14 @@ export function sendFallback(res) {
 }
 export function getFallbackStatus(error) {
     const status = error?.status;
-    if (typeof status === "number" && Number.isInteger(status) && status >= 100 && status < 600) {
+    if (typeof status === "number" && Number.isInteger(status) && status >= 400 && status < 600) {
         return status;
     }
-    return FALLBACK_STATUS;
+    return ERROR_STATUS;
+}
+export function getFallbackBody(error, status) {
+    if (status >= 500)
+        return ERROR_BODY;
+    const message = error?.message;
+    return typeof message === "string" && message ? message : FALLBACK_BODY;
 }

package/dist/request.d.mts

@@ -3,8 +3,9 @@ export declare class Request {
     private req;
     private res;
     private bodyPromise;
-    constructor(req: IncomingMessage, res: ServerResponse);
+    private defaultLimit;
+    constructor(req: IncomingMessage, res: ServerResponse, defaultLimit?: string | number | false);
     is(type: string | string[]): string | false | null;
-    buffer(limit?: string | number): Promise<Buffer>;
-    json<T = unknown>(limit?: string | number): Promise<T>;
+    buffer(limit?: string | number | false): Promise<Buffer>;
+    json<T = unknown>(limit?: string | number | false): Promise<T>;
 }

package/dist/request.mjs

@@ -7,19 +7,22 @@ export class Request {
     req;
     res;
     bodyPromise = null;
-    constructor(req, res) {
+    defaultLimit;
+    constructor(req, res, defaultLimit = "1mb") {
         this.req = req;
         this.res = res;
+        this.defaultLimit = defaultLimit;
     }
     is(type) {
         return typeIs(this.req, Array.isArray(type) ? type : [type]);
     }
     buffer(limit) {
         if (!this.bodyPromise) {
+            const effectiveLimit = limit ?? this.defaultLimit;
             if (this.req.headers.expect === "100-continue") {
                 this.res.writeContinue();
             }
-            this.bodyPromise = readBody(this.req, limit);
+            this.bodyPromise = readBody(this.req, effectiveLimit);
         }
         return this.bodyPromise;
     }
@@ -33,9 +36,18 @@ export class Request {
         }
     }
 }
+function parseLimit(limit) {
+    if (limit === false)
+        return Infinity;
+    const parsed = typeof limit === "number" ? limit : bytes.parse(limit);
+    if (parsed === null || parsed === undefined || !Number.isFinite(parsed) || parsed < 0) {
+        throw new TypeError(`Invalid request body limit: ${String(limit)}`);
+    }
+    return parsed;
+}
 function readBody(req, limit) {
     return new Promise((resolve, reject) => {
-        const maxBytes = limit !== undefined ? (bytes.parse(limit) ?? Infinity) : Infinity;
+        const maxBytes = parseLimit(limit);
         const chunks = [];
         let totalLength = 0;
         function cleanup() {

package/dist/types.d.mts

@@ -9,5 +9,7 @@ export interface CookieOptions {
     maxAge?: number;
 }
 export interface ApplicationOptions {
+    bodyLimit?: string | number | false;
     logger?: LoggerOptions;
+    trustProxy?: boolean;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jongleberry/api-server",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "A Node.js HTTP server library",
   "license": "MIT",
   "author": "Jonathan Ong",
@@ -76,10 +76,10 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/jongleberry/api-server.git"
+    "url": "git+https://github.com/jonathanong/api-server.git"
   },
   "bugs": {
-    "url": "https://github.com/jongleberry/api-server/issues"
+    "url": "https://github.com/jonathanong/api-server/issues"
   },
-  "homepage": "https://github.com/jongleberry/api-server"
+  "homepage": "https://github.com/jonathanong/api-server"
 }