@jsenv/server 17.6.1 → 17.6.2

package/src/interfacing_with_node/observable_from_node_stream.js

@@ -1,70 +1,34 @@
 // https://github.com/jamestalmage/stream-to-observable/blob/master/index.js
-import { Readable } from "node:stream";
 import { createObservable } from "./observable.js";
 
-export const observableFromNodeStream = (
-  nodeStream,
-  { readableLifetime } = {},
-) => {
-  const observable = createObservable(
-    ({ next, error, complete, addTeardown }) => {
-      const errorEventCallback = (e) => {
-        error(e);
-      };
-      const dataEventCallback = (data) => {
-        next(data);
-      };
-      const closeEventCallback = () => {
-        complete();
-      };
-      const endEventCallback = () => {
-        complete();
-      };
-      nodeStream.once("error", errorEventCallback);
-      nodeStream.on("data", dataEventCallback);
-      nodeStream.once("end", endEventCallback);
-      nodeStream.once("close", closeEventCallback); // not sure it's required
-      addTeardown(() => {
-        nodeStream.removeListener("error", errorEventCallback);
-        nodeStream.removeListener("data", dataEventCallback);
-        nodeStream.removeListener("end", endEventCallback);
-        nodeStream.removeListener("close", closeEventCallback); // not sure it's required
-      });
-      if (nodeStream.isPaused()) {
-        nodeStream.resume();
-      } else if (nodeStream.complete) {
-        complete();
-      }
-    },
-  );
-
-  if (readableLifetime && nodeStream instanceof Readable) {
-    const timeout = setTimeout(() => {
-      // disabled for now
-      // process.emitWarning(
-      //   `Readable stream not used after ${readableLifetime / 1000} seconds.`,
-      //   {
-      //     CODE: "READABLE_STREAM_TIMEOUT",
-      //     // url is for http client request
-      //     detail: `path: ${nodeStream.path}, fd: ${nodeStream.fd}, url: ${nodeStream.url}`,
-      //   },
-      // );
-    }, readableLifetime).unref();
-    onceReadableStreamUsedOrClosed(nodeStream, () => {
-      clearTimeout(timeout);
+export const observableFromNodeStream = (nodeStream) => {
+  return createObservable(({ next, error, complete, addTeardown }) => {
+    const errorEventCallback = (e) => {
+      error(e);
+    };
+    const dataEventCallback = (data) => {
+      next(data);
+    };
+    const closeEventCallback = () => {
+      complete();
+    };
+    const endEventCallback = () => {
+      complete();
+    };
+    nodeStream.once("error", errorEventCallback);
+    nodeStream.on("data", dataEventCallback);
+    nodeStream.once("end", endEventCallback);
+    nodeStream.once("close", closeEventCallback); // not sure it's required
+    addTeardown(() => {
+      nodeStream.removeListener("error", errorEventCallback);
+      nodeStream.removeListener("data", dataEventCallback);
+      nodeStream.removeListener("end", endEventCallback);
+      nodeStream.removeListener("close", closeEventCallback); // not sure it's required
     });
-    observable.timeout = timeout;
-  }
-
-  return observable;
-};
-
-const onceReadableStreamUsedOrClosed = (readableStream, callback) => {
-  const dataOrCloseCallback = () => {
-    readableStream.removeListener("data", dataOrCloseCallback);
-    readableStream.removeListener("close", dataOrCloseCallback);
-    callback();
-  };
-  readableStream.on("data", dataOrCloseCallback);
-  readableStream.once("close", dataOrCloseCallback);
+    if (nodeStream.isPaused()) {
+      nodeStream.resume();
+    } else if (nodeStream.complete) {
+      complete();
+    }
+  });
 };

package/src/interfacing_with_node/write_node_response.js

@@ -2,27 +2,15 @@ import { raceCallbacks } from "@jsenv/abort";
 import http from "node:http";
 import { Http2ServerResponse } from "node:http2";
 import { Socket } from "node:net";
+import { asReasonPhrase } from "../internal/reason_phrase.js";
 import { getObservableValueType } from "./get_observable_value_type.js";
 import { observableFromValue } from "./observable_from.js";
 
 export const writeNodeResponse = async (
   responseStream,
-  { status, statusText, headers, body, bodyEncoding },
+  { status, statusText, headers, body },
   { signal, ignoreBody, onAbort, onError, onHeadersSent, onEnd } = {},
 ) => {
-  const isNetSocket = responseStream instanceof Socket;
-  if (
-    body &&
-    body.isObservableBody &&
-    headers["connection"] === undefined &&
-    headers["content-length"] === undefined
-  ) {
-    headers["transfer-encoding"] = "chunked";
-  }
-  // if (body && headers["content-length"] === undefined) {
-  //   headers["transfer-encoding"] = "chunked";
-  // }
-
   const bodyObservableType = getObservableValueType(body);
   const destroyBody = () => {
     if (bodyObservableType === "file_handle") {
@@ -66,46 +54,8 @@ export const writeNodeResponse = async (
     return;
   }
 
-  if (bodyEncoding && !isNetSocket) {
-    responseStream.setEncoding(bodyEncoding);
-  }
-
   await new Promise((resolve) => {
-    const observable = observableFromValue(body);
     const abortController = new AbortController();
-    signal.addEventListener("abort", () => {
-      abortController.abort();
-    });
-    observable.subscribe(
-      {
-        next: (data) => {
-          try {
-            responseStream.write(data);
-          } catch (e) {
-            // Something inside Node.js sometimes puts stream
-            // in a state where .write() throw despites nodeResponse.destroyed
-            // being undefined and "close" event not being emitted.
-            // I have tested if we are the one calling destroy
-            // (I have commented every .destroy() call)
-            // but issue still occurs
-            // For the record it's "hard" to reproduce but can be by running
-            // a lot of tests against a browser in the context of @jsenv/core testing
-            if (e.code === "ERR_HTTP2_INVALID_STREAM") {
-              return;
-            }
-            responseStream.emit("error", e);
-          }
-        },
-        error: (value) => {
-          responseStream.emit("error", value);
-        },
-        complete: () => {
-          responseStream.end();
-        },
-      },
-      { signal: abortController.signal },
-    );
-
     raceCallbacks(
       {
         abort: (cb) => {
@@ -166,6 +116,46 @@ export const writeNodeResponse = async (
         raceEffects[winner.name](winner.data);
       },
     );
+
+    // a string or a buffer is written and ended in one go
+    if (typeof body === "string" || body instanceof Uint8Array) {
+      responseStream.end(body);
+      return;
+    }
+
+    const observable = observableFromValue(body);
+    signal.addEventListener("abort", () => {
+      abortController.abort();
+    });
+    observable.subscribe(
+      {
+        next: (data) => {
+          try {
+            responseStream.write(data);
+          } catch (e) {
+            // Something inside Node.js sometimes puts stream
+            // in a state where .write() throw despites nodeResponse.destroyed
+            // being undefined and "close" event not being emitted.
+            // I have tested if we are the one calling destroy
+            // (I have commented every .destroy() call)
+            // but issue still occurs
+            // For the record it's "hard" to reproduce but can be by running
+            // a lot of tests against a browser in the context of @jsenv/core testing
+            if (e.code === "ERR_HTTP2_INVALID_STREAM") {
+              return;
+            }
+            responseStream.emit("error", e);
+          }
+        },
+        error: (value) => {
+          responseStream.emit("error", value);
+        },
+        complete: () => {
+          responseStream.end();
+        },
+      },
+      { signal: abortController.signal },
+    );
   });
 };
 
@@ -176,38 +166,23 @@ const writeHead = (
   const responseIsNetSocket = responseStream instanceof Socket;
   const responseIsHttp2ServerResponse =
     responseStream instanceof Http2ServerResponse;
-  const responseIsServerHttp2Stream =
-    responseStream.constructor.name === "ServerHttp2Stream";
-  let nodeHeaders = headersToNodeHeaders(headers, {
+  const nodeHeaders = headersToNodeHeaders(headers, {
     // https://github.com/nodejs/node/blob/79296dc2d02c0b9872bbfcbb89148ea036a546d0/lib/internal/http2/compat.js#L112
-    ignoreConnectionHeader:
-      responseIsHttp2ServerResponse || responseIsServerHttp2Stream,
+    ignoreConnectionHeader: responseIsHttp2ServerResponse,
   });
-  if (statusText === undefined) {
-    statusText = statusTextFromStatus(status);
-  } else {
-    statusText = statusText.replace(/\n/g, "").replaceAll("✅", "");
-  }
-  if (responseIsServerHttp2Stream) {
-    nodeHeaders = {
-      ...nodeHeaders,
-      ":status": status,
-    };
-    responseStream.respond(nodeHeaders);
-    onHeadersSent({ nodeHeaders, status, statusText });
-    return;
-  }
-  // nodejs strange signature for writeHead force this
-  // https://nodejs.org/api/http.html#http_response_writehead_statuscode_statusmessage_headers
-  if (
-    // https://github.com/nodejs/node/blob/79296dc2d02c0b9872bbfcbb89148ea036a546d0/lib/internal/http2/compat.js#L97
-    responseIsHttp2ServerResponse
-  ) {
+  statusText =
+    statusText === undefined
+      ? statusTextFromStatus(status)
+      : asReasonPhrase(statusText);
+  if (responseIsHttp2ServerResponse) {
+    // http2 has no reason phrase: statusText only reaches the logs
     responseStream.writeHead(status, nodeHeaders);
     onHeadersSent({ nodeHeaders, status, statusText });
     return;
   }
   if (responseIsNetSocket) {
+    // a websocket upgrade request answered with something else than 101:
+    // the response is written by hand on the socket
     const headersString = Object.keys(nodeHeaders)
       .map((h) => `${h}: ${nodeHeaders[h]}`)
       .join("\r\n");
@@ -217,20 +192,7 @@ const writeHead = (
     onHeadersSent({ nodeHeaders, status, statusText });
     return;
   }
-
-  try {
-    responseStream.writeHead(status, statusText, nodeHeaders);
-  } catch (e) {
-    if (
-      e.code === "ERR_INVALID_CHAR" &&
-      e.message.includes("Invalid character in statusMessage")
-    ) {
-      throw new Error(`Invalid character in statusMessage
---- status message ---
-${statusText}`);
-    }
-    throw e;
-  }
+  responseStream.writeHead(status, statusText, nodeHeaders);
   onHeadersSent({ nodeHeaders, status, statusText });
 };
 
@@ -239,17 +201,11 @@ const statusTextFromStatus = (status) =>
 
 const headersToNodeHeaders = (headers, { ignoreConnectionHeader }) => {
   const nodeHeaders = {};
-
-  Object.keys(headers).forEach((name) => {
-    if (name === "connection" && ignoreConnectionHeader) return;
-    const nodeHeaderName = name in mapping ? mapping[name] : name;
-    nodeHeaders[nodeHeaderName] = headers[name];
-  });
-
+  for (const name of Object.keys(headers)) {
+    if (name === "connection" && ignoreConnectionHeader) {
+      continue;
+    }
+    nodeHeaders[name] = headers[name];
+  }
   return nodeHeaders;
 };
-
-const mapping = {
-  // "content-type": "Content-Type",
-  // "last-modified": "Last-Modified",
-};

package/src/internal/allowed_hosts.js

@@ -0,0 +1,85 @@
+import { hostname as osHostname, networkInterfaces } from "node:os";
+
+// The Host header of a request is compared to the names the server can
+// legitimately be reached at. Without this a page served by another site
+// reads the responses once its DNS name is rebound to this machine (DNS
+// rebinding): the request then comes from the developer's own browser, so
+// listening on localhost does not help, only the Host name tells.
+export const createHostChecker = ({
+  allowedHosts,
+  hostname,
+  serverOrigins,
+  acceptAnyIp,
+}) => {
+  if (allowedHosts === true) {
+    return () => true;
+  }
+
+  const allowedHostSet = new Set();
+  const allowedHostSuffixes = [];
+  const allow = (host) => {
+    if (host.startsWith(".")) {
+      // ".example.com" allows example.com and every subdomain
+      allowedHostSuffixes.push(host.toLowerCase());
+      allowedHostSet.add(host.slice(1).toLowerCase());
+      return;
+    }
+    const hostNormalized = normalizeHost(host);
+    if (hostNormalized) {
+      allowedHostSet.add(hostNormalized);
+    }
+  };
+
+  allow("localhost");
+  allow("127.0.0.1");
+  allow("[::1]");
+  allow(hostname);
+  for (const origin of Object.values(serverOrigins)) {
+    allow(new URL(origin).hostname);
+  }
+  // the name other machines use for this one (mDNS gives "name.local")
+  const machineName = osHostname();
+  allow(machineName);
+  if (!machineName.endsWith(".local")) {
+    allow(`${machineName}.local`);
+  }
+  if (acceptAnyIp) {
+    for (const addresses of Object.values(networkInterfaces())) {
+      for (const { address, family } of addresses) {
+        allow(family === "IPv6" || family === 6 ? `[${address}]` : address);
+      }
+    }
+  }
+  for (const allowedHost of allowedHosts) {
+    allow(allowedHost);
+  }
+
+  return (host) => {
+    if (host === undefined) {
+      // an http/1.0 client; a browser always sends the header
+      return true;
+    }
+    const hostNormalized = normalizeHost(host);
+    if (hostNormalized === null) {
+      return false;
+    }
+    if (allowedHostSet.has(hostNormalized)) {
+      return true;
+    }
+    for (const suffix of allowedHostSuffixes) {
+      if (hostNormalized.endsWith(suffix)) {
+        return true;
+      }
+    }
+    return false;
+  };
+};
+
+// "example.com:3456" or "[::1]:3456": the port is not part of the name
+const normalizeHost = (host) => {
+  const url = `http://${host}`;
+  if (!URL.canParse(url)) {
+    return null;
+  }
+  return new URL(url).hostname.toLowerCase();
+};

package/src/internal/escape_html.js

@@ -0,0 +1,11 @@
+const HTML_ESCAPES = {
+  "&": "&",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;",
+};
+
+export const escapeHtml = (value) => {
+  return String(value).replace(/[&<>"']/g, (char) => HTML_ESCAPES[char]);
+};

package/src/internal/{headersFromObject.js → headers_from_object.js}

@@ -3,8 +3,8 @@ https://developer.mozilla.org/en-US/docs/Web/API/Headers
 https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch
 */
 
-import { normalizeHeaderName } from "./normalizeHeaderName.js";
-import { normalizeHeaderValue } from "./normalizeHeaderValue.js";
+import { normalizeHeaderName } from "./normalize_header_name.js";
+import { normalizeHeaderValue } from "./normalize_header_value.js";
 
 export const headersFromObject = (headersObject) => {
   const headers = {};

package/src/internal/listen.js

@@ -31,6 +31,19 @@ const listen = async ({
   }
 };
 
+/**
+ * Find a port nobody listens to on the given hostname, trying `initialPort`
+ * first then the following ones.
+ *
+ * @param {number} [initialPort=1] - First port to try.
+ * @param {Object} [options]
+ * @param {AbortSignal} [options.signal]
+ * @param {string} [options.hostname="127.0.0.1"] - Interface the port must be free on.
+ * @param {number} [options.min=1]
+ * @param {number} [options.max=65534] - Give up (throw) past this port.
+ * @param {(port: number) => number} [options.next] - How to pick the next port to try.
+ * @returns {Promise<number>}
+ */
 export const findFreePort = async (
   initialPort = 1,
   {
@@ -93,20 +106,34 @@ const portIsFree = async (port, hostname) => {
 
 const startListening = ({ server, port, hostname }) => {
   return new Promise((resolve, reject) => {
-    server.on("error", reject);
-    server.on("listening", () => {
+    const onError = (error) => {
+      server.removeListener("listening", onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.removeListener("error", onError);
       // in case port is 0 (randomly assign an available port)
       // https://nodejs.org/api/net.html#net_server_listen_port_host_backlog_callback
       resolve(server.address().port);
-    });
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
     server.listen(port, hostname);
   });
 };
 
 export const stopListening = (server) => {
   return new Promise((resolve, reject) => {
-    server.on("error", reject);
-    server.on("close", resolve);
+    const onError = (error) => {
+      server.removeListener("close", onClose);
+      reject(error);
+    };
+    const onClose = () => {
+      server.removeListener("error", onError);
+      resolve();
+    };
+    server.once("error", onError);
+    server.once("close", onClose);
     server.close();
   });
 };

package/src/internal/{listenRequest.js → listen_request.js}

@@ -1,4 +1,4 @@
-import { listenEvent } from "./listenEvent.js";
+import { listenEvent } from "./listen_event.js";
 
 export const listenRequest = (nodeServer, requestCallback) => {
   if (nodeServer._httpServer) {

package/src/internal/{listenServerConnectionError.js → listen_server_connection_error.js}

@@ -1,4 +1,4 @@
-import { listenEvent } from "./listenEvent.js";
+import { listenEvent } from "./listen_event.js";
 
 export const listenServerConnectionError = (
   nodeServer,

package/src/internal/{multiple-header.js → multiple_header.js}

@@ -32,17 +32,31 @@ export const parseMultipleHeader = (
   return multipleHeader;
 };
 
+// "for=192.0.2.60;proto=http;by=203.0.113.43", the shape of a Forwarded
+// header element (RFC 7239). Several elements, one per proxy, can be joined
+// with a comma: only the first one, the closest to the client, is read.
+// Attributes without "=" are ignored, values may be quoted.
 export const parseSingleHeaderWithAttributes = (
   string,
   { validateAttribute = () => true } = {},
 ) => {
   const props = {};
-  const attributes = string.split(";");
-  for (const attr of attributes) {
-    let [name, value] = attr.split("=");
-    name = name.trim();
-    value = value.trim();
-    if (validateAttribute({ name, value })) {
+  const [firstElement] = string.split(",");
+  for (const attribute of firstElement.split(";")) {
+    const equalIndex = attribute.indexOf("=");
+    if (equalIndex === -1) {
+      continue;
+    }
+    const name = attribute.slice(0, equalIndex).trim();
+    let value = attribute.slice(equalIndex + 1).trim();
+    if (
+      value.length > 1 &&
+      value[0] === '"' &&
+      value[value.length - 1] === '"'
+    ) {
+      value = value.slice(1, -1);
+    }
+    if (name && validateAttribute({ name, value })) {
       props[name] = value;
     }
   }
@@ -52,10 +66,15 @@ export const parseSingleHeaderWithAttributes = (
 const parseHeaderProperties = (headerProperties, { validateProperty }) => {
   const properties = {};
   for (const propertySource of headerProperties) {
-    const [propertyName, propertyValueString] = propertySource
-      .trim()
-      .split("=");
-    const propertyValue = parseHeaderPropertyValue(propertyValueString);
+    const equalIndex = propertySource.indexOf("=");
+    // "text/html;foo": a property without value is kept as a flag
+    const propertyName = (
+      equalIndex === -1 ? propertySource : propertySource.slice(0, equalIndex)
+    ).trim();
+    const propertyValue =
+      equalIndex === -1
+        ? true
+        : parseHeaderPropertyValue(propertySource.slice(equalIndex + 1).trim());
     const property = { name: propertyName, value: propertyValue };
     const propertyValidation = validateProperty(property);
     if (!propertyValidation) {
@@ -67,6 +86,9 @@ const parseHeaderProperties = (headerProperties, { validateProperty }) => {
 };
 
 const parseHeaderPropertyValue = (headerPropertyValueString) => {
+  if (headerPropertyValueString === "") {
+    return "";
+  }
   const firstChar = headerPropertyValueString[0];
   const lastChar =
     headerPropertyValueString[headerPropertyValueString.length - 1];

package/src/internal/reason_phrase.js

@@ -0,0 +1,17 @@
+// An HTTP/1.1 reason phrase allows HTAB, SP, VCHAR and obs-text (0x80-0xFF),
+// see RFC 9112 section 4. Node's writeHead and the Response constructor both
+// throw on anything else. A status text often echoes a request (a file path
+// decoded from the url for instance), so the characters outside that set are
+// percent-encoded rather than dropped: the text stays readable and reversible.
+export const asReasonPhrase = (value) => {
+  return String(value).replace(/[^\t\x20-\x7e\x80-\xff]/g, encodeChar);
+};
+
+const encodeChar = (char) => {
+  try {
+    return encodeURIComponent(char);
+  } catch {
+    // lone surrogate
+    return "%3F";
+  }
+};

package/src/internal/response_composition.js

@@ -8,12 +8,22 @@ const asResponseProperties = (value) => {
       statusText: value.statusText,
       headers: Object.fromEntries(value.headers),
       body: value.body,
-      bodyEncoding: value.bodyEncoding,
     };
   }
   return value;
 };
 
+/**
+ * Merge two responses into one. Each can be a `Response` instance or a plain
+ * `{ status, statusText, statusMessage, headers, body, timing }` object.
+ * The second response wins for status, statusText, statusMessage and body;
+ * headers are composed (list headers such as `vary` or `allow` accumulate
+ * their values, `set-cookie` becomes an array) and `timing` objects are merged.
+ *
+ * @param {Response|Object} firstResponse
+ * @param {Response|Object} secondResponse
+ * @returns {Object} Plain response properties.
+ */
 export const composeTwoResponses = (firstResponse, secondResponse) => {
   firstResponse = asResponseProperties(firstResponse);
   secondResponse = asResponseProperties(secondResponse);
@@ -30,7 +40,6 @@ const RESPONSE_KEYS_COMPOSITION = {
   statusMessage: (prevStatusMessage, statusMessage) => statusMessage,
   headers: composeTwoHeaders,
   body: (prevBody, body) => body,
-  bodyEncoding: (prevEncoding, encoding) => encoding,
   // measures a response hands back, merged into the server-timing header when
   // the server has serverTiming enabled (see finalizeResponseProperties)
   timing: (prevTiming, timing) => ({ ...prevTiming, ...timing }),

package/src/internal/secure_server.js

@@ -0,0 +1,22 @@
+// The imports are dynamic so that "node:http2" / "node:https" are only parsed
+// when a secure server is actually created.
+export const createSecureServer = async ({
+  certificate,
+  privateKey,
+  http2,
+  http1Allowed,
+}) => {
+  if (http2) {
+    const { createSecureServer } = await import("node:http2");
+    return createSecureServer({
+      cert: certificate,
+      key: privateKey,
+      allowHTTP1: http1Allowed,
+    });
+  }
+  const { createServer } = await import("node:https");
+  return createServer({
+    cert: certificate,
+    key: privateKey,
+  });
+};