@jsenv/server 17.6.0 → 17.6.2

package/dist/ws/ws.js

@@ -418,7 +418,9 @@ function requirePermessageDeflate () {
 	            (typeof opts.serverMaxWindowBits === 'number' &&
 	              opts.serverMaxWindowBits > params.server_max_window_bits))) ||
 	        (typeof opts.clientMaxWindowBits === 'number' &&
-	          !params.client_max_window_bits)
+	          (typeof params.client_max_window_bits === 'number'
+	            ? opts.clientMaxWindowBits > params.client_max_window_bits
+	            : !params.client_max_window_bits))
 	      ) {
 	        return false;
 	      }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/server",
-  "version": "17.6.0",
+  "version": "17.6.2",
   "type": "module",
   "description": "A modern Node.js HTTP server with declarative routing, content negotiation, and WebSocket support",
   "repository": {
@@ -54,11 +54,11 @@
     "@jsenv/url-pattern": "../../tooling/url-pattern",
     "@jsenv/urls": "../../tooling/urls",
     "@jsenv/utils": "../../tooling/utils",
-    "eventsource": "4.1.0",
+    "eventsource": "5.1.1",
     "formidable": "3.5.4",
-    "playwright": "1.61.1",
-    "undici": "8.8.0",
-    "ws": "8.21.1"
+    "playwright": "1.62.1",
+    "undici": "8.10.0",
+    "ws": "8.21.3"
   },
   "publishConfig": {
     "access": "public"

package/src/content_negotiation/pick_content_encoding.js

@@ -1,6 +1,16 @@
-import { parseMultipleHeader } from "../internal/multiple-header.js";
+import { parseMultipleHeader } from "../internal/multiple_header.js";
 import { pickAcceptedContent } from "./pick_accepted_content.js";
 
+/**
+ * Pick, among the encodings the server can produce, the one the request
+ * prefers according to its `accept-encoding` header (`br` and `brotli` are
+ * synonyms).
+ *
+ * @param {{ headers: Object }} request - Anything carrying lowercased `headers`.
+ * @param {Array<string>} availableEncodings - In order of server preference: on a tie the first one wins.
+ * @returns {string|null} The encoding to respond with, `null` when the request
+ *   accepts none of them or has no `accept-encoding` header.
+ */
 export const pickContentEncoding = (request, availableEncodings) => {
   const { headers = {} } = request;
   const requestAcceptEncodingHeader = headers["accept-encoding"];

package/src/content_negotiation/pick_content_language.js

@@ -1,6 +1,16 @@
-import { parseMultipleHeader } from "../internal/multiple-header.js";
+import { parseMultipleHeader } from "../internal/multiple_header.js";
 import { pickAcceptedContent } from "./pick_accepted_content.js";
 
+/**
+ * Pick, among the languages the server can produce, the one the request
+ * prefers according to its `accept-language` header. An exact match
+ * (`fr-FR`) scores higher than a primary language match (`fr` for `fr-CA`).
+ *
+ * @param {{ headers: Object }} request - Anything carrying lowercased `headers`.
+ * @param {Array<string>} availableLanguages - In order of server preference: on a tie the first one wins.
+ * @returns {string|null} The language to respond with, `null` when the request
+ *   accepts none of them or has no `accept-language` header.
+ */
 export const pickContentLanguage = (request, availableLanguages) => {
   const { headers = {} } = request;
   const requestAcceptLanguageHeader = headers["accept-language"];

package/src/content_negotiation/pick_content_type.js

@@ -1,6 +1,16 @@
-import { parseMultipleHeader } from "../internal/multiple-header.js";
+import { parseMultipleHeader } from "../internal/multiple_header.js";
 import { pickAcceptedContent } from "./pick_accepted_content.js";
 
+/**
+ * Pick, among the media types the server can produce, the one the request
+ * prefers according to its `accept` header (quality values honored, `text/*`
+ * style wildcards understood).
+ *
+ * @param {{ headers: Object }} request - Anything carrying lowercased `headers`.
+ * @param {Array<string>} availableContentTypes - In order of server preference: on a tie the first one wins.
+ * @returns {string|null} The media type to respond with, `null` when the request
+ *   accepts none of them or has no `accept` header.
+ */
 export const pickContentType = (request, availableContentTypes) => {
   const { headers = {} } = request;
   const requestAcceptHeader = headers.accept;

package/src/content_negotiation/pick_content_version.js

@@ -1,4 +1,4 @@
-import { parseMultipleHeader } from "../internal/multiple-header.js";
+import { parseMultipleHeader } from "../internal/multiple_header.js";
 import { pickAcceptedContent } from "./pick_accepted_content.js";
 
 export const pickContentVersion = (request, availableVersions) => {

package/src/interfacing_with_node/from_node_request.js

@@ -1,3 +1,15 @@
+/*
+ * Builds the `request` object handed to routes from a node request (http or
+ * http2 compat api). It is frozen: a plugin wanting another request returns
+ * new properties from "redirectRequest" and gets a copy (see
+ * applyRedirectionToRequest). The shape is described in
+ * docs/handling_requests.md.
+ *
+ * The values read from headers (`forwarded`, `cookie`...) come from the
+ * network: the parsers must never throw on garbage, a request that cannot
+ * be read would otherwise escape the request handler.
+ */
+
 import { Abort } from "@jsenv/abort";
 import { createDetailedMessage } from "@jsenv/humanize";
 import { CONTENT_TYPE } from "@jsenv/utils/src/content_type/content_type.js";
@@ -5,14 +17,14 @@ import { parse } from "node:querystring";
 import {
   colorizeResponseStatus,
   statusToType,
-} from "../internal/colorizeResponseStatus.js";
-import { headersFromObject } from "../internal/headersFromObject.js";
-import { parseSingleHeaderWithAttributes } from "../internal/multiple-header.js";
+} from "../internal/colorize_response_status.js";
+import { headersFromObject } from "../internal/headers_from_object.js";
+import { parseSingleHeaderWithAttributes } from "../internal/multiple_header.js";
 import { observableFromNodeStream } from "./observable_from_node_stream.js";
 
 export const fromNodeRequest = (
   nodeRequest,
-  { serverOrigin, signal, requestBodyLifetime, logger, nagle },
+  { serverOrigin, signal, logger, requestBodyMaxSize = Infinity },
 ) => {
   const requestLogger = createRequestLogger(nodeRequest, (type, value) => {
     const logFunction = logger[type];
@@ -52,12 +64,7 @@ export const fromNodeRequest = (
   // Without this the request body readable stream
   // might be closed when we'll try to attach "data" and "end" listeners to it
   nodeRequest.pause();
-  if (!nagle) {
-    nodeRequest.connection.setNoDelay(true);
-  }
-  const body = observableFromNodeStream(nodeRequest, {
-    readableLifetime: requestBodyLifetime,
-  });
+  const body = observableFromNodeStream(nodeRequest);
 
   let requestOrigin;
   if (nodeRequest.upgrade) {
@@ -76,15 +83,15 @@ export const fromNodeRequest = (
 
   // check the following parsers if we want to support more request body content types
   // https://github.com/node-formidable/formidable/tree/master/src/parsers
-  const buffer = async () => {
+  // Every reader below buffers the body in memory: past maxSize it throws an
+  // error the server answers with 413 (see RequestBodyTooLargeError).
+  const buffer = async ({ maxSize = requestBodyMaxSize } = {}) => {
     // here we don't really need to warn, one might want to read anything as binary
-    // const contentType = headers["content-type"];
-    // if (!CONTENT_TYPE.isBinary(contentType)) {
-    //   console.warn(
-    //     `buffer() called on a request with content-type: "${contentType}". A binary content-type was expected.`,
-    //   );
-    // }
-    const requestBodyBuffer = await readBody(body, { as: "buffer" });
+    const requestBodyBuffer = await readBody(body, {
+      as: "buffer",
+      maxSize,
+      headers,
+    });
     return requestBodyBuffer;
   };
   // maybe we could use https://github.com/form-data/form-data
@@ -98,40 +105,52 @@ export const fromNodeRequest = (
     }
     const { formidable } = await import("formidable");
     const form = formidable({});
-    nodeRequest.resume(); // was paused in line #53
+    nodeRequest.resume(); // paused above, formidable reads the node stream directly
     const [fields, files] = await form.parse(nodeRequest);
     const requestBodyFormData = { fields, files };
     return requestBodyFormData;
   };
-  const text = async () => {
+  const text = async ({ maxSize = requestBodyMaxSize } = {}) => {
     const contentType = headers["content-type"];
     if (!CONTENT_TYPE.isTextual(contentType)) {
       console.warn(
         `text() called on a request with content-type "${contentType}". A textual content-type was expected.`,
       );
     }
-    const requestBodyString = await readBody(body, { as: "string" });
+    const requestBodyString = await readBody(body, {
+      as: "string",
+      maxSize,
+      headers,
+    });
     return requestBodyString;
   };
-  const json = async () => {
+  const json = async ({ maxSize = requestBodyMaxSize } = {}) => {
     const contentType = headers["content-type"];
     if (!CONTENT_TYPE.isJson(contentType)) {
       console.warn(
         `json() called on a request with content-type "${contentType}". A json content-type was expected.`,
       );
     }
-    const requestBodyString = await readBody(body, { as: "string" });
+    const requestBodyString = await readBody(body, {
+      as: "string",
+      maxSize,
+      headers,
+    });
     const requestBodyJSON = JSON.parse(requestBodyString);
     return requestBodyJSON;
   };
-  const queryString = async () => {
+  const queryString = async ({ maxSize = requestBodyMaxSize } = {}) => {
     const contentType = headers["content-type"];
     if (contentType !== "application/x-www-form-urlencoded") {
       console.warn(
         `queryString() called on a request with content-type "${contentType}". application/x-www-form-urlencoded was expected.`,
       );
     }
-    const requestBodyString = await readBody(body, { as: "string" });
+    const requestBodyString = await readBody(body, {
+      as: "string",
+      maxSize,
+      headers,
+    });
     const requestBodyQueryStringParsed = parse(requestBodyString);
     return requestBodyQueryStringParsed;
   };
@@ -139,6 +158,7 @@ export const fromNodeRequest = (
   // request.ip          -> request ip as received by the server
   // request.ipForwarded -> ip of the client before proxying, undefined when there is no proxy
   // same applies on request.proto and request.host
+  // These forwarded values are what the headers say: any client can send them.
   let ip = nodeRequest.socket.remoteAddress;
   let proto = requestOrigin.startsWith("http:") ? "http" : "https";
   let host = headers["host"];
@@ -157,7 +177,7 @@ export const fromNodeRequest = (
     const forwardedHost = headers["x-forwarded-host"];
     if (forwardedFor) {
       // format is <client-ip>, <proxy1>, <proxy2>
-      ipForwarded = forwardedFor.split(",")[0];
+      ipForwarded = forwardedFor.split(",")[0].trim();
     }
     if (forwardedProto) {
       protoForwarded = forwardedProto;
@@ -195,52 +215,27 @@ export const fromNodeRequest = (
   });
 };
 
+// Handling a request is asynchronous: its logs are buffered until the
+// response headers are sent (or the request is dropped) so that the logs of
+// concurrent requests do not interleave.
 const createRequestLogger = (nodeRequest, write) => {
-  // Handling request is asynchronous, we buffer logs for that request
-  // until we know what happens with that request
-  // It delays logs until we know of the request will be handled
-  // but it's mandatory to make logs readable.
-
   const logArray = [];
-  const childArray = [];
-  const add = ({ type, value }) => {
+  const add = (type, value) => {
     logArray.push({ type, value });
   };
 
   const requestLogger = {
-    logArray,
-    childArray,
-    hasPushChild: false,
-    forPush: () => {
-      const childLogBuffer = createRequestLogger(nodeRequest, write);
-      childLogBuffer.isChild = true;
-      childArray.push(childLogBuffer);
-      requestLogger.hasPushChild = true;
-      return childLogBuffer;
-    },
     debug: (value) => {
-      add({
-        type: "debug",
-        value,
-      });
+      add("debug", value);
     },
     info: (value) => {
-      add({
-        type: "info",
-        value,
-      });
+      add("info", value);
     },
     warn: (value) => {
-      add({
-        type: "warn",
-        value,
-      });
+      add("warn", value);
     },
     error: (value) => {
-      add({
-        type: "error",
-        value,
-      });
+      add("error", value);
     },
     onHeadersSent: ({ status, statusText }) => {
       const isFaviconNotFound =
@@ -256,8 +251,8 @@ const createRequestLogger = (nodeRequest, write) => {
       if (statusText) {
         message += ` ${statusText}`;
       }
-      add({
-        type: isFaviconNotFound
+      add(
+        isFaviconNotFound
           ? "debug"
           : {
               information: "info",
@@ -266,8 +261,8 @@ const createRequestLogger = (nodeRequest, write) => {
               client_error: "warn",
               server_error: "error",
             }[statusType] || "error",
-        value: message,
-      });
+        message,
+      );
     },
     ended: false,
     end: () => {
@@ -275,19 +270,24 @@ const createRequestLogger = (nodeRequest, write) => {
         return;
       }
       requestLogger.ended = true;
-      if (requestLogger.isChild) {
-        // keep buffering until root request write logs for everyone
+      if (logArray.length === 0) {
         return;
       }
-      const prefixLines = (string, prefix) => {
-        return string.replace(/^(?!\s*$)/gm, prefix);
-      };
-      const writeLog = (
-        { type, value },
-        { someLogIsError, someLogIsWarn, depth },
-      ) => {
-        if (depth > 0) {
-          value = prefixLines(value, "  ".repeat(depth));
+      let someLogIsError = false;
+      let someLogIsWarn = false;
+      for (const log of logArray) {
+        if (log.type === "error") {
+          someLogIsError = true;
+        }
+        if (log.type === "warn") {
+          someLogIsWarn = true;
+        }
+      }
+      // every info log of a request that went wrong is written at the
+      // warn/error level, so that it shows up next to what went wrong
+      const writeLog = ({ type, value }, { indent }) => {
+        if (indent) {
+          value = prefixLines(value, "  ");
         }
         if (type === "info") {
           if (someLogIsError) {
@@ -298,83 +298,86 @@ const createRequestLogger = (nodeRequest, write) => {
         }
         write(type, value);
       };
-      const writeLogs = (loggerToWrite, depth) => {
-        const logArray = loggerToWrite.logArray;
-        if (logArray.length === 0) {
-          return;
-        }
-        let someLogIsError = false;
-        let someLogIsWarn = false;
-        for (const log of loggerToWrite.logArray) {
-          if (log.type === "error") {
-            someLogIsError = true;
-          }
-          if (log.type === "warn") {
-            someLogIsWarn = true;
-          }
-        }
-        const firstLog = logArray.shift();
-        const lastLog = logArray.pop();
-        const middleLogs = logArray;
-        writeLog(firstLog, {
-          someLogIsError,
-          someLogIsWarn,
-          depth,
-        });
-        for (const middleLog of middleLogs) {
-          writeLog(middleLog, {
-            someLogIsError,
-            someLogIsWarn,
-            depth,
-          });
-        }
-        for (const childLoggerToWrite of loggerToWrite.childArray) {
-          writeLogs(childLoggerToWrite, depth + 1);
-        }
-        if (lastLog) {
-          writeLog(lastLog, {
-            someLogIsError,
-            someLogIsWarn,
-            depth: depth + 1,
-          });
-        }
-      };
-      writeLogs(requestLogger, 0);
+      // the last log is the response status, shown under the request line
+      const lastLog = logArray.length > 1 ? logArray.pop() : null;
+      for (const log of logArray) {
+        writeLog(log, { indent: false });
+      }
+      if (lastLog) {
+        writeLog(lastLog, { indent: true });
+      }
     },
   };
 
   return requestLogger;
 };
 
-const readBody = (body, { as }) => {
+const prefixLines = (string, prefix) => {
+  return string.replace(/^(?!\s*$)/gm, prefix);
+};
+
+const readBody = (body, { as, maxSize, headers }) => {
   return new Promise((resolve, reject) => {
+    const contentLength = headers["content-length"];
+    if (contentLength !== undefined && Number(contentLength) > maxSize) {
+      reject(new RequestBodyTooLargeError({ maxSize }));
+      return;
+    }
     const bufferArray = [];
-    body.subscribe({
-      error: reject,
-      next: (buffer) => {
-        bufferArray.push(buffer);
-      },
-      complete: () => {
-        const bodyAsBuffer = Buffer.concat(bufferArray);
-        if (as === "buffer") {
-          resolve(bodyAsBuffer);
-          return;
-        }
-        if (as === "string") {
-          const bodyAsString = bodyAsBuffer.toString();
-          resolve(bodyAsString);
-          return;
-        }
-        if (as === "json") {
-          const bodyAsString = bodyAsBuffer.toString();
-          const bodyAsJSON = JSON.parse(bodyAsString);
-          resolve(bodyAsJSON);
-          return;
-        }
+    let length = 0;
+    const abortController = new AbortController();
+    body.subscribe(
+      {
+        error: reject,
+        next: (buffer) => {
+          length += buffer.length;
+          if (length > maxSize) {
+            abortController.abort();
+            reject(new RequestBodyTooLargeError({ maxSize }));
+            return;
+          }
+          bufferArray.push(buffer);
+        },
+        complete: () => {
+          const bodyAsBuffer = Buffer.concat(bufferArray);
+          if (as === "buffer") {
+            resolve(bodyAsBuffer);
+            return;
+          }
+          if (as === "string") {
+            const bodyAsString = bodyAsBuffer.toString();
+            resolve(bodyAsString);
+            return;
+          }
+          if (as === "json") {
+            const bodyAsString = bodyAsBuffer.toString();
+            const bodyAsJSON = JSON.parse(bodyAsString);
+            resolve(bodyAsJSON);
+            return;
+          }
+        },
       },
-    });
+      { signal: abortController.signal },
+    );
   });
 };
+
+class RequestBodyTooLargeError extends Error {
+  constructor({ maxSize }) {
+    super(`request body exceeds ${maxSize} bytes`);
+    this.name = "RequestBodyTooLargeError";
+    this.code = "REQUEST_BODY_TOO_LARGE";
+    this.maxSize = maxSize;
+  }
+
+  asResponse() {
+    return {
+      status: 413,
+      statusText: "Payload Too Large",
+      statusMessage: `The request body exceeds ${this.maxSize} bytes.`,
+    };
+  }
+}
 // exported for unit tests
 export const readRequestBody = (request, { as }) => {
   if (as === "string") {
@@ -400,12 +403,22 @@ const parseRequestCookieHeader = (cookieHeader) => {
       continue;
     }
     const name = pair.slice(0, eqIndex).trim();
-    const value = decodeURIComponent(pair.slice(eqIndex + 1).trim());
+    const value = decodeCookieValue(pair.slice(eqIndex + 1).trim());
     map.set(name, value);
   }
   return map;
 };
 
+// a cookie value is not necessarily percent-encoded: a malformed sequence
+// keeps the raw value
+const decodeCookieValue = (value) => {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
+
 export const applyRedirectionToRequest = (
   request,
   { resource, pathname, ...rest },
@@ -443,40 +456,3 @@ const getPropertiesFromPathname = ({ pathname, baseUrl }) => {
     baseUrl,
   });
 };
-
-export const createPushRequest = (
-  request,
-  { signal, pathname, method, logger },
-) => {
-  const pushRequest = Object.freeze({
-    ...request,
-    logger,
-    parent: request,
-    signal,
-    http2: true,
-    ...(pathname
-      ? getPropertiesFromPathname({
-          pathname,
-          baseUrl: request.url,
-        })
-      : {}),
-    method: method || request.method,
-    headers: getHeadersInheritedByPushRequest(request),
-    body: undefined,
-  });
-  return pushRequest;
-};
-
-const getHeadersInheritedByPushRequest = (request) => {
-  const headersInherited = { ...request.headers };
-  // mtime sent by the client in request headers concerns the main request
-  // Time remains valid for request to other resources so we keep it
-  // in child requests
-  // delete childHeaders["if-modified-since"]
-
-  // eTag sent by the client in request headers concerns the main request
-  // A request made to an other resource must not inherit the eTag
-  delete headersInherited["if-none-match"];
-
-  return headersInherited;
-};

package/src/interfacing_with_node/observable_from_file_handle.js

@@ -1,4 +1,3 @@
-import { createReadStream } from "node:fs";
 import { observableFromNodeStream } from "./observable_from_node_stream.js";
 
 export const isFileHandle = (value) => {
@@ -10,21 +9,5 @@ export const observableFromFileHandle = (fileHandle) => {
 };
 
 export const fileHandleToReadableStream = (fileHandle) => {
-  const fileReadableStream =
-    typeof fileHandle.createReadStream === "function"
-      ? fileHandle.createReadStream()
-      : createReadStream(
-          "/toto", // is it ok to pass a fake path like this?
-          {
-            fd: fileHandle.fd,
-            emitClose: true,
-            // autoClose: true
-          },
-        );
-  // I suppose it's required only when doing fs.createReadStream()
-  // and not fileHandle.createReadStream()
-  // fileReadableStream.on("end", () => {
-  //   fileHandle.close()
-  // })
-  return fileReadableStream;
+  return fileHandle.createReadStream();
 };