@jsenv/server 17.1.0 → 17.2.0

package/src/interfacing_with_node/from_node_request.js

@@ -47,6 +47,7 @@ export const fromNodeRequest = (
   });
 
   const headers = headersFromObject(nodeRequest.headers);
+  const cookies = parseRequestCookieHeader(headers["cookie"]);
   // pause the request body stream to let a chance for other parts of the code to subscribe to the stream
   // Without this the request body readable stream
   // might be closed when we'll try to attach "data" and "end" listeners to it
@@ -184,6 +185,7 @@ export const fromNodeRequest = (
     }),
     method: nodeRequest.method,
     headers,
+    cookies,
     body,
     buffer,
     formData,
@@ -387,6 +389,23 @@ export const readRequestBody = (request, { as }) => {
   throw new Error(`unsupported ${as}`);
 };
 
+const parseRequestCookieHeader = (cookieHeader) => {
+  const map = new Map();
+  if (!cookieHeader) {
+    return map;
+  }
+  for (const pair of cookieHeader.split(";")) {
+    const eqIndex = pair.indexOf("=");
+    if (eqIndex === -1) {
+      continue;
+    }
+    const name = pair.slice(0, eqIndex).trim();
+    const value = decodeURIComponent(pair.slice(eqIndex + 1).trim());
+    map.set(name, value);
+  }
+  return map;
+};
+
 export const applyRedirectionToRequest = (
   request,
   { resource, pathname, ...rest },

package/src/internal/headers_composition.js

@@ -56,4 +56,16 @@ const HEADER_NAMES_COMPOSITION = {
   "server-timing": composeTwoCommaSeparatedValues,
   // 'content-type', // https://github.com/ninenines/cowboy/issues/1230
   "vary": composeTwoCommaSeparatedValues,
+  // set-cookie is special: multiple values must be kept as an array
+  "set-cookie": (leftValue, rightValue) => {
+    if (!leftValue) {
+      return rightValue;
+    }
+    if (!rightValue) {
+      return leftValue;
+    }
+    const left = Array.isArray(leftValue) ? leftValue : [leftValue];
+    const right = Array.isArray(rightValue) ? rightValue : [rightValue];
+    return [...left, ...right];
+  },
 };

package/src/plugins/cookies/cookie.js

@@ -0,0 +1,77 @@
+// https://bun.sh/docs/api/cookie
+
+export const COOKIE = {
+  from: (name, value, options = {}) => {
+    return { name, value, options };
+  },
+  parse: (cookieString) => {
+    const parts = cookieString.split("; ");
+    const [nameValue, ...attributes] = parts;
+    const [name, value] = nameValue.split("=");
+    const options = {};
+    for (const attr of attributes) {
+      const [key, val] = attr.split("=");
+      if (key === "expires") {
+        options.expires = new Date(val);
+        continue;
+      }
+      if (key === "path") {
+        options.path = val;
+        continue;
+      }
+      if (key === "domain") {
+        options.domain = val;
+        continue;
+      }
+      if (key === "secure") {
+        options.secure = true;
+        continue;
+      }
+      if (key === "httponly") {
+        options.httpOnly = true;
+        continue;
+      }
+    }
+
+    return { name, value, options };
+  },
+  stringify: ({ name, value, options }) => {
+    let str = `${name}=${value}`;
+    if (options.expires) {
+      str += `; Expires=${options.expires.toUTCString()}`;
+    }
+    if (options.maxAge !== undefined) {
+      str += `; Max-Age=${options.maxAge}`;
+    }
+    if (options.path) {
+      str += `; Path=${options.path}`;
+    }
+    if (options.domain) {
+      str += `; Domain=${options.domain}`;
+    }
+    if (options.sameSite) {
+      str += `; SameSite=${options.sameSite}`;
+    }
+    if (options.secure) {
+      str += "; Secure";
+    }
+    if (options.httpOnly) {
+      str += "; HttpOnly";
+    }
+    return str;
+  },
+  toSetCookieHeaders: (cookies) => {
+    const headers = {};
+    for (const cookie of cookies) {
+      const value = COOKIE.stringify(cookie);
+      if (headers["set-cookie"] === undefined) {
+        headers["set-cookie"] = value;
+      } else if (Array.isArray(headers["set-cookie"])) {
+        headers["set-cookie"].push(value);
+      } else {
+        headers["set-cookie"] = [headers["set-cookie"], value];
+      }
+    }
+    return headers;
+  },
+};

package/src/plugins/cookies/server_plugin_response_cookies.js

@@ -0,0 +1,30 @@
+import { COOKIE } from "./cookie.js";
+
+export const serverPluginResponseCookies = () => {
+  return {
+    name: "jsenv:response_cookies",
+    augmentRouteFetchSecondArg: (request, fetchSecondArg) => {
+      const responseCookies = {
+        set: (name, value, options = {}) => {
+          fetchSecondArg.injectResponseHeader(
+            "set-cookie",
+            COOKIE.stringify(COOKIE.from(name, value, options)),
+          );
+        },
+        delete: (name, options = {}) => {
+          fetchSecondArg.injectResponseHeader(
+            "set-cookie",
+            COOKIE.stringify(
+              COOKIE.from(name, "", {
+                ...options,
+                expires: new Date(0),
+              }),
+            ),
+          );
+        },
+      };
+
+      return { responseCookies };
+    },
+  };
+};

package/src/plugins/cors/server_plugin_cors.js

@@ -75,17 +75,32 @@ const generateAccessControlHeaders = ({
 } = {}) => {
   const vary = [];
 
-  const allowedOriginArray = [...accessControlAllowedOrigins];
-  if (accessControlAllowRequestOrigin) {
-    if ("origin" in headers && headers.origin !== "null") {
-      allowedOriginArray.push(headers.origin);
+  // Access-Control-Allow-Origin must be a single value (not a list).
+  // We reflect back the request's origin if it is in the allowed list.
+  // If no origin matches we fall back to "*" (only when not using credentials).
+  let allowOrigin = null;
+
+  const requestOrigin =
+    "origin" in headers && headers.origin !== "null"
+      ? headers.origin
+      : "referer" in headers
+        ? new URL(headers.referer).origin
+        : null;
+
+  if (requestOrigin) {
+    if (accessControlAllowedOrigins.includes(requestOrigin)) {
+      allowOrigin = requestOrigin;
+      vary.push("origin");
+    } else if (accessControlAllowRequestOrigin) {
+      allowOrigin = requestOrigin;
       vary.push("origin");
-    } else if ("referer" in headers) {
-      allowedOriginArray.push(new URL(headers.referer).origin);
-      vary.push("referer");
-    } else {
-      allowedOriginArray.push("*");
     }
+  } else if (accessControlAllowRequestOrigin) {
+    allowOrigin = "*";
+  }
+
+  if (allowOrigin === null) {
+    allowOrigin = accessControlAllowedOrigins[0] ?? "*";
   }
 
   const allowedMethodArray = [...accessControlAllowedMethods];
@@ -119,16 +134,14 @@ const generateAccessControlHeaders = ({
   }
 
   return {
-    "access-control-allow-origin": allowedOriginArray.join(", "),
+    "access-control-allow-origin": allowOrigin,
     "access-control-allow-methods": allowedMethodArray.join(", "),
     "access-control-allow-headers": allowedHeaderArray.join(", "),
     ...(accessControlAllowCredentials
       ? { "access-control-allow-credentials": true }
       : {}),
     "access-control-max-age": accessControlMaxAge,
-    ...(timingAllowOrigin
-      ? { "timing-allow-origin": allowedOriginArray.join(", ") }
-      : {}),
+    ...(timingAllowOrigin ? { "timing-allow-origin": allowOrigin } : {}),
     ...(vary.length ? { vary: vary.join(", ") } : {}),
   };
 };

package/src/plugins/route_inspector/client/code_block.js

@@ -113,7 +113,9 @@
     }
   }
 
-  customElements.define("clipboard-copy", ClipboardCopy);
+  if (!customElements.get("clipboard-copy")) {
+    customElements.define("clipboard-copy", ClipboardCopy);
+  }
 
   const addToClipboard = async (text) => {
     const type = "text/plain";

package/src/plugins/route_inspector/client/route_inspector.html

@@ -42,6 +42,13 @@
         --border-color: #e0e0e0;
         --primary-color: #1976d2;
         --secondary-color: #f5f5f5;
+        --forbidden-bg-color: #fff8f0;
+        --forbidden-border-color: #cc8800;
+        --forbidden-badge-bg: #fff3cc;
+        --forbidden-badge-color: #7a5000;
+        --admin-badge-bg: #f0f4ff;
+        --admin-badge-border-color: #5c7cfa;
+        --admin-badge-color: #2a4bbf;
       }
       :root[data-theme="dark"] {
         --background-color: #121212;
@@ -49,6 +56,13 @@
         --border-color: #333;
         --primary-color: #4f9eff;
         --secondary-color: #1e1e1e;
+        --forbidden-bg-color: #1e1500;
+        --forbidden-border-color: #8a6000;
+        --forbidden-badge-bg: #3a2800;
+        --forbidden-badge-color: #f0c060;
+        --admin-badge-bg: #0d1a3a;
+        --admin-badge-border-color: #3b5bdb;
+        --admin-badge-color: #91a7ff;
       }
 
       :root[data-theme="dark"] a {
@@ -467,6 +481,42 @@
         --method-color: var(--method-delete-color);
       }
 
+      .route_details[data-forbidden] {
+        background: var(--forbidden-bg-color);
+        border-color: var(--forbidden-border-color);
+        opacity: 0.85;
+      }
+      .route_details[data-forbidden] .route_method {
+        opacity: 0.7;
+        filter: grayscale(60%);
+      }
+      .route_forbidden_badge {
+        margin-right: 6px;
+        padding: 3px 8px;
+        color: var(--forbidden-badge-color);
+        font-weight: 600;
+        font-size: 12px;
+        white-space: nowrap;
+        background: var(--forbidden-badge-bg);
+        border: 1px solid var(--forbidden-border-color);
+        border-radius: 4px;
+      }
+      .route_admin_badge {
+        margin-right: 6px;
+        padding: 3px 8px;
+        color: var(--admin-badge-color);
+        font-weight: 600;
+        font-size: 12px;
+        white-space: nowrap;
+        background: var(--admin-badge-bg);
+        border: 1px solid var(--admin-badge-border-color);
+        border-radius: 4px;
+      }
+      .route_forbidden_content {
+        color: var(--forbidden-badge-color);
+        font-style: italic;
+      }
+
       .route_owner_name {
         padding: 4px 8px;
         color: #666;
@@ -1388,6 +1438,8 @@
         websocket,
         clientCodeExample,
         declarationSource,
+        forbidden,
+        visibleBecauseAdmin,
       }) => {
         const [selectedMethod] = useUrlStringParam("method");
         const [selectedPackageName] = usePackageUrlStringParam();
@@ -1400,11 +1452,16 @@
           return null;
         }
 
-        return html`<details class="route_details" data-method="${method}">
+        return html`<details
+            class="route_details"
+            data-method="${method}"
+            data-forbidden="${forbidden || undefined}"
+            data-admin-visible="${visibleBecauseAdmin || undefined}"
+          >
             <summary class="route_summary_container">
               <span class="route_method">${method}</span>
               <p class="route_resource">${resource}</p>
-              ${method === "GET"
+              ${method === "GET" && !forbidden
                 ? html`<a
                       style="display:inline-flex; margin-left: 5px;"
                       href="${resource}"
@@ -1412,25 +1469,45 @@
                     /></a>`
                 : null}
               <span style="flex:1"></span>
+              ${visibleBecauseAdmin
+                ? html`<span
+                      class="route_admin_badge"
+                      title="This route is only visible because the server was started with canExposeSensitiveData"
+                      >&#128274; admin only</span
+                    >`
+                : null}
+              ${forbidden && !visibleBecauseAdmin
+                ? html`<span class="route_forbidden_badge"
+                      >&#128274; access denied</span
+                    >`
+                : null}
               <${RouteBadge} meta="${meta}" />
               <span class="summary_marker">
                 <${ArrowDown} />
               </span>
             </summary>
-            <${RouteDetailsContent}
-              method="${method}"
-              resource="${resource}"
-              description="${description}"
-              availableMediaTypes="${availableMediaTypes}"
-              availableLanguages="${availableLanguages}"
-              availableVersions="${availableVersions}"
-              availableEncodings="${availableEncodings}"
-              acceptedMediaTypes="${acceptedMediaTypes}"
-              websocket="${websocket}"
-              clientCodeExample="${clientCodeExample}"
-              declarationSource="${declarationSource}"
-              meta="${meta}"
-            />
+            ${!forbidden
+              ? html`<${RouteDetailsContent}
+                    method="${method}"
+                    resource="${resource}"
+                    description="${description}"
+                    availableMediaTypes="${availableMediaTypes}"
+                    availableLanguages="${availableLanguages}"
+                    availableVersions="${availableVersions}"
+                    availableEncodings="${availableEncodings}"
+                    acceptedMediaTypes="${acceptedMediaTypes}"
+                    websocket="${websocket}"
+                    clientCodeExample="${clientCodeExample}"
+                    declarationSource="${declarationSource}"
+                    meta="${meta}"
+                  />`
+              : html`<div class="route_details_content route_forbidden_content">
+                    <p>
+                      ${visibleBecauseAdmin
+                        ? "This route is only visible because the server was started with canExposeSensitiveData. Access is denied with the current permissions."
+                        : "You do not have the required permissions to access this route."}
+                    </p>
+                  </div>`}
           </details>`;
       };
 
@@ -1561,26 +1638,26 @@
           const websocketScheme =
             self.location.protocol === "https:" ? "wss" : "ws";
           const websocketOrigin = `${websocketScheme}://${self.location.host}`;
-          jsSource = /*js */ `
-                const websocket = new WebSocket("${websocketOrigin}${resource}");
-                websocket.onerror = () => {
-                  console.error("Failed to connect to websocket endpoint");
-                };
-                websocket.onopen = () => {
-                  console.info("Connected to websocket endpoint")
-                };
-                websocket.onmessage = (event) => {
-                  console.log("Received message", event.data);
-                };
-                `;
+          jsSource = `
+const websocket = new WebSocket("${websocketOrigin}${resource}");
+websocket.onerror = () => {
+  console.error("Failed to connect to websocket endpoint");
+};
+websocket.onopen = () => {
+  console.info("Connected to websocket endpoint");
+};
+websocket.onmessage = (event) => {
+  console.log("Received message", event.data);
+};
+          `;
         } else {
           let fetchLine;
           if (method === "GET") {
             fetchLine = `const response = await window.fetch("${resource}");`;
           } else {
             fetchLine = `const response = await window.fetch("${resource}", {
-        method: "${method}",
-      }`;
+  method: "${method}",
+}`;
           }
           let readResponseLine;
           if (availableMediaTypes.includes("application/json")) {
@@ -1589,10 +1666,10 @@
             readResponseLine = `const text = await response.text();`;
           }
 
-          jsSource = /*js */ `
-      ${fetchLine}
-      ${readResponseLine}
-                `;
+          jsSource = `
+${fetchLine};
+${readResponseLine};
+          `;
         }
 
         return html`<code-block lang="js" data-escaped data-copy-button

package/src/plugins/route_inspector/server_plugin_route_inspector.js

@@ -28,9 +28,10 @@ export const serverPluginRouteInspector = ({ canExposeSensitiveData }) => {
         availableMediaTypes: ["application/json"],
         description: "Get the routes available on this server in JSON.",
         declarationSource: import.meta.url,
-        fetch: (request, helpers) => {
-          const routeJSON = helpers.router.inspect({
+        fetch: async (request, helpers) => {
+          const routeJSON = await helpers.router.inspect({
             canExposeSensitiveData,
+            fetchSecondArg: helpers,
           });
           return Response.json(routeJSON);
         },

package/src/plugins/server_plugins_controller.js

@@ -9,6 +9,7 @@ export const createServerPluginsController = async (serverPlugins) => {
         serverListening: { type: "hook" },
         redirectRequest: { type: "hook" },
         augmentRouteFetchSecondArg: { type: "hook" },
+        grantPermissions: { type: "hook" },
         handleError: { type: "hook" },
         onResponsePush: { type: "hook" },
         injectResponseProperties: { type: "hook" },

package/src/plugins_controller.js

@@ -297,6 +297,42 @@ export const createPluginsController = async ({
     callHooksUntil,
     callAsyncHooks,
     callAsyncHooksUntil,
+    // callAsyncHooksWhile(hookName, info, callback)
+    // Calls hooks one by one, passing each return value to callback.
+    // Stops as soon as callback returns false.
+    callAsyncHooksWhile: async (hookName, info, callback) => {
+      const hookSet = hookSetMap.get(hookName);
+      if (!hookSet) {
+        return;
+      }
+      for (const hook of hookSet) {
+        const returnValue = await callAsyncHook(hook, info);
+        const shouldContinue = await callback(returnValue);
+        if (!shouldContinue) {
+          return;
+        }
+      }
+    },
+
+    // createAsyncHookIterator(hookName, info)
+    // Returns an async function that calls the next hook on each invocation.
+    // Returns { done: true } when all hooks have been called.
+    // Allows callers to maintain a shared cursor across multiple consumers.
+    createAsyncHookIterator: (hookName, info) => {
+      const hookSet = hookSetMap.get(hookName);
+      if (!hookSet) {
+        return async () => ({ done: true, value: undefined });
+      }
+      const iterator = hookSet.values();
+      return async () => {
+        const { done, value: hook } = iterator.next();
+        if (done) {
+          return { done: true, value: undefined };
+        }
+        const value = await callAsyncHook(hook, info);
+        return { done: false, value };
+      };
+    },
 
     getPluginMeta: (pluginName) => meta[pluginName],
     getMeta: () => meta,