@jsenv/server 17.6.8 → 17.7.0

package/dist/jsenv_server.js

@@ -5899,37 +5899,36 @@ const createResourcePattern = (pattern) => {
     });
   }
 
-  const patternEndsWithSlash = pathnamePatternString.endsWith("/");
+  // "/docs/*" also answers the directory itself ("/docs/" and "/docs") with an
+  // empty star, so one route serves a directory and its index. Only a star
+  // widens a pattern: "/docs/" is that one path and "/" the home page.
+  const directoryPattern = pathnamePatternString.endsWith("/*")
+    ? PATTERN.create(pathnamePatternString.slice(0, -1), {
+        namedGroupDelimiter: "/",
+      })
+    : null;
   // a pattern constraining nothing: every resource matches it, so whoever uses
   // it cannot name the resource that matched
   const matchesEveryResource =
     !searchPattern &&
     !hashPattern &&
-    (pathnamePatternString === "*" ||
-      pathnamePatternString === "/" ||
-      pathnamePatternString === "/*");
+    (pathnamePatternString === "*" || pathnamePatternString === "/*");
 
   return {
     matchesEveryResource,
     match: (resource) => {
       const [pathname, search, hash] = resourceToParts(resource);
       let decodedPathname = decodeURIComponent(pathname);
-      let result;
-      if (patternEndsWithSlash && !searchPattern && !hashPattern) {
-        // also match the path without trailing slash (e.g. /foo matches /foo/)
-        const pathnamePatternWithoutSlash = pathnamePatternString.slice(0, -1);
-        if (decodedPathname === pathnamePatternWithoutSlash) {
-          result = { named: {}, stars: [""] };
-        } else if (!decodedPathname.startsWith(pathnamePatternString)) {
-          return null;
-        } else {
-          result = {
-            named: {},
-            stars: [decodedPathname.slice(pathnamePatternString.length)],
-          };
+      let result = pathnamePattern.match(decodedPathname);
+      if (!result && directoryPattern) {
+        result = directoryPattern.match(
+          decodedPathname.endsWith("/")
+            ? decodedPathname
+            : `${decodedPathname}/`,
+        );
+        if (result) {
+          result.stars = [...(result.stars || []), ""];
         }
-      } else {
-        result = pathnamePattern.match(decodedPathname);
       }
       if (!result) {
         return null;
@@ -6553,7 +6552,7 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
         }
         if (!route.matchMethod(request.method)) {
           // a 405 asserts the resource exists with other methods: a route
-          // matching every resource ("GET *", "GET /") names no resource, so
+          // matching every resource ("GET *", "GET /*") names no resource, so
           // it cannot make that assertion and an unknown address stays a 404
           if (!route.isFallback && !route.matchesEveryResource) {
             wouldHaveMatched.methodSet.add(route.method);
@@ -7318,7 +7317,10 @@ const TIMING_NOOP = () => {
  *   - `endpoint` {string} — Required. `"GET /users/:id"`: an http method (or `*` for any)
  *     and a resource pattern. `:name` captures a segment and `*` a run of segments, both
  *     land in `request.params`; `?page=:page` captures a search param. `"*"` alone
- *     matches everything. An endpoint ending in `.websocket` marks a websocket route.
+ *     matches everything. Only `*` widens a pattern: `GET /` is the root alone and
+ *     `GET /docs/` that one path, while `GET /docs/*` answers `/docs`, `/docs/` and
+ *     everything under it (`request.params[0]` is `""` for the first two): declare the
+ *     routes it covers before it. An endpoint ending in `.websocket` marks a websocket route.
  *   - `fetch` {Function} — Required. `(request, helpers) => response`, async or not.
  *     Returns a `Response`, a plain `{ status, statusText, statusMessage, headers, body,
  *     timing }` object (`status` defaults to 404, `statusMessage` feeds the body of 4xx/5xx
@@ -7358,8 +7360,10 @@ const TIMING_NOOP = () => {
  *   host is answered 403: a page served elsewhere cannot read the responses by rebinding
  *   its DNS name to this machine. `true` disables the check.
  * @param {Object|false} [params.https=false] - `{ certificate, privateKey }` (PEM strings) to serve https.
- * @param {boolean} [params.redirectHttpToHttps] - With https, answer http requests with a 301
- *   to the https origin. Defaults to true unless `allowHttpRequestOnHttps` is set.
+ * @param {boolean|Function} [params.redirectHttpToHttps] - With https, answer http requests
+ *   with a 301 to https, on the host the request was sent to. Defaults to true unless
+ *   `allowHttpRequestOnHttps` is set. `({ resource }) => boolean` redirects only the requests
+ *   it returns true for; the others are served over http.
  * @param {boolean} [params.allowHttpRequestOnHttps=false] - With https, also serve plain http
  *   requests on the same port (`request.origin` tells them apart).
  * @param {boolean} [params.http2=false] - Serve http2 (needs `https`, http/1.1 clients are still
@@ -8053,6 +8057,10 @@ const startServer = async ({
   };
 
   {
+    const shouldRedirectHttpToHttps =
+      typeof redirectHttpToHttps === "function"
+        ? redirectHttpToHttps
+        : () => redirectHttpToHttps;
     const requestEventHandler = async (nodeRequest, nodeResponse) => {
       const requestTarget = readRequestTarget(nodeRequest.url);
       if (!requestTarget) {
@@ -8070,9 +8078,17 @@ const startServer = async ({
         nodeResponse.end("Host not allowed");
         return;
       }
-      if (redirectHttpToHttps && !nodeRequest.connection.encrypted) {
+      if (
+        !nodeRequest.connection.encrypted &&
+        shouldRedirectHttpToHttps(requestTarget)
+      ) {
         nodeResponse.writeHead(301, {
-          location: `${serverOrigin}${requestTarget.resource}`,
+          location: httpsUrlFromHttpRequest({
+            requestHost,
+            resource: requestTarget.resource,
+            port,
+            serverOrigin,
+          }),
         });
         nodeResponse.end();
         return;
@@ -8316,6 +8332,25 @@ const createNodeServer = async ({
   return createServer();
 };
 
+// http and https share the port (see server_polyglot.js): only the scheme
+// changes, the host stays the one the client used. The server origin would
+// send a phone that typed the network ip to its own loopback.
+const httpsUrlFromHttpRequest = ({
+  requestHost,
+  resource,
+  port,
+  serverOrigin,
+}) => {
+  const httpsUrlString = `https://${requestHost}`;
+  // no host header (http/1.0), or any host at all with `allowedHosts: true`
+  if (requestHost === undefined || !URL.canParse(httpsUrlString)) {
+    return `${serverOrigin}${resource}`;
+  }
+  const httpsUrl = new URL(httpsUrlString);
+  httpsUrl.port = port;
+  return `${httpsUrl.origin}${resource}`;
+};
+
 const REQUEST_BODY_LINGER_MS = 5_000;
 
 const PROCESS_TEARDOWN_EVENTS_MAP = {

package/dist/ws/ws.js

@@ -2902,11 +2902,24 @@ function requireWebsocket () {
 	      this._redirects = 0;
 
 	      if (protocols === undefined) {
-	        protocols = [];
+	        if (!options || options.protocols === undefined) {
+	          protocols = [];
+	        } else if (Array.isArray(options.protocols)) {
+	          protocols = options.protocols;
+	        } else {
+	          protocols = [options.protocols];
+	        }
 	      } else if (!Array.isArray(protocols)) {
 	        if (typeof protocols === 'object' && protocols !== null) {
 	          options = protocols;
-	          protocols = [];
+
+	          if (options.protocols === undefined) {
+	            protocols = [];
+	          } else if (Array.isArray(options.protocols)) {
+	            protocols = options.protocols;
+	          } else {
+	            protocols = [options.protocols];
+	          }
 	        } else {
 	          protocols = [protocols];
 	        }
@@ -3145,7 +3158,6 @@ function requireWebsocket () {
 	      return;
 	    }
 
-	    this._readyState = WebSocket.CLOSING;
 	    this._sender.close(code, data, !this._isServer, (err) => {
 	      //
 	      // This error is handled by the `'error'` listener on the socket. We only
@@ -3163,6 +3175,7 @@ function requireWebsocket () {
 	      }
 	    });
 
+	    this._readyState = WebSocket.CLOSING;
 	    setCloseTimer(this);
 	  }
 
@@ -3508,6 +3521,7 @@ function requireWebsocket () {
 	    socketPath: undefined,
 	    hostname: undefined,
 	    protocol: undefined,
+	    protocols: undefined,
 	    timeout: undefined,
 	    method: 'GET',
 	    host: undefined,

package/docs/handling_requests.md

@@ -19,16 +19,19 @@ await startServer({
 
 `endpoint` is an http method (or `*`) followed by a resource pattern:
 
-| endpoint               | matches                                                             |
-| ---------------------- | ------------------------------------------------------------------- |
-| `GET /`                | exactly `/`                                                         |
-| `GET /users/:id`       | `/users/42`, with `request.params.id === "42"`                      |
-| `GET /assets/*`        | `/assets/css/main.css`, with `request.params[0] === "css/main.css"` |
-| `GET /search?q=:query` | `/search?q=hello`, with `request.params.query === "hello"`          |
-| `* /api/*`             | any method                                                          |
-| `GET *`                | anything: a catch-all, put it last                                  |
-
-Routes are tried in order. `fetch` can be async; returning `null` or `undefined` declines the request and the next route is tried.
+| endpoint               | matches                                                                                                 |
+| ---------------------- | ------------------------------------------------------------------------------------------------------- |
+| `GET /`                | `/` alone, whatever its search (`/?page=2`): the home page                                              |
+| `GET /users/:id`       | `/users/42`, with `request.params.id === "42"`                                                          |
+| `GET /docs/`           | `/docs/` alone                                                                                          |
+| `GET /docs/*`          | `/docs/intro`, with `request.params[0] === "intro"`, and the directory itself: `/docs`, `/docs/` (`""`) |
+| `GET /assets/*`        | `/assets/css/main.css`, with `request.params[0] === "css/main.css"`                                     |
+| `GET /search?q=:query` | `/search?q=hello`, with `request.params.query === "hello"`                                              |
+| `* /api/*`             | any method                                                                                              |
+| `GET /*`               | anything, with the path in `request.params[0]`                                                          |
+| `GET *`                | anything: a catch-all, put it last                                                                      |
+
+Only `*` widens a pattern. Routes are tried in order, so a route covering others (`GET /docs/*`, `GET *`) goes after them. `fetch` can be async; returning `null` or `undefined` declines the request and the next route is tried.
 
 When no route answers, the router builds the response from what almost matched:
 

package/docs/https.md

@@ -20,7 +20,7 @@ const server = await startServer({
 server.origin.startsWith("https://"); // true
 ```
 
-Without certificate files, [@jsenv/https-local](https://github.com/jsenv/core/tree/main/packages/tooling/https-local) generates one for localhost, signed by an authority it can install on the machine:
+Without certificate files, [@jsenv/https-local](https://github.com/jsenv/core/tree/main/packages/tooling/https-local) generates one valid for every name of the machine (localhost, its network ips, its name), signed by an authority it can install on the machine:
 
 ```js
 import { requestCertificate } from "@jsenv/https-local";
@@ -32,7 +32,18 @@ await startServer({ https: { certificate, privateKey } });
 
 ## Http requests on an https server
 
-By default an https server also accepts http on the same port and redirects it (301) to the https origin. `redirectHttpToHttps: false` refuses http instead. To serve both:
+By default an https server also accepts http on the same port and redirects it (301) to https, on the host the request was sent to: a phone that typed `http://192.168.1.12:3000/app` lands on `https://192.168.1.12:3000/app`. `server.origin` would not do, with `acceptAnyIp` it is the loopback, which for the phone is the phone itself. `redirectHttpToHttps: false` refuses http instead.
+
+A function picks what is redirected, the rest is served over http. It receives the request target (`resource` is the path and the search) before the request is read. The case for it is a page that must load before the device trusts the certificate: over https it would show the very warning it is there to remove.
+
+```js
+await startServer({
+  https: { certificate, privateKey },
+  redirectHttpToHttps: ({ resource }) => !resource.startsWith("/trust/"),
+});
+```
+
+To serve both everywhere:
 
 ```js
 await startServer({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/server",
-  "version": "17.6.8",
+  "version": "17.7.0",
   "type": "module",
   "description": "A modern Node.js HTTP server with declarative routing, content negotiation, and WebSocket support",
   "repository": {
@@ -59,7 +59,7 @@
     "formidable": "3.5.4",
     "playwright": "1.63.0",
     "undici": "8.11.2",
-    "ws": "8.21.3"
+    "ws": "8.22.0"
   },
   "publishConfig": {
     "access": "public"

package/src/router/router.js

@@ -356,7 +356,7 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
         }
         if (!route.matchMethod(request.method)) {
           // a 405 asserts the resource exists with other methods: a route
-          // matching every resource ("GET *", "GET /") names no resource, so
+          // matching every resource ("GET *", "GET /*") names no resource, so
           // it cannot make that assertion and an unknown address stays a 404
           if (!route.isFallback && !route.matchesEveryResource) {
             wouldHaveMatched.methodSet.add(route.method);

package/src/start_server.js

@@ -59,7 +59,10 @@ const TIMING_NOOP = () => {
  *   - `endpoint` {string} — Required. `"GET /users/:id"`: an http method (or `*` for any)
  *     and a resource pattern. `:name` captures a segment and `*` a run of segments, both
  *     land in `request.params`; `?page=:page` captures a search param. `"*"` alone
- *     matches everything. An endpoint ending in `.websocket` marks a websocket route.
+ *     matches everything. Only `*` widens a pattern: `GET /` is the root alone and
+ *     `GET /docs/` that one path, while `GET /docs/*` answers `/docs`, `/docs/` and
+ *     everything under it (`request.params[0]` is `""` for the first two): declare the
+ *     routes it covers before it. An endpoint ending in `.websocket` marks a websocket route.
  *   - `fetch` {Function} — Required. `(request, helpers) => response`, async or not.
  *     Returns a `Response`, a plain `{ status, statusText, statusMessage, headers, body,
  *     timing }` object (`status` defaults to 404, `statusMessage` feeds the body of 4xx/5xx
@@ -99,8 +102,10 @@ const TIMING_NOOP = () => {
  *   host is answered 403: a page served elsewhere cannot read the responses by rebinding
  *   its DNS name to this machine. `true` disables the check.
  * @param {Object|false} [params.https=false] - `{ certificate, privateKey }` (PEM strings) to serve https.
- * @param {boolean} [params.redirectHttpToHttps] - With https, answer http requests with a 301
- *   to the https origin. Defaults to true unless `allowHttpRequestOnHttps` is set.
+ * @param {boolean|Function} [params.redirectHttpToHttps] - With https, answer http requests
+ *   with a 301 to https, on the host the request was sent to. Defaults to true unless
+ *   `allowHttpRequestOnHttps` is set. `({ resource }) => boolean` redirects only the requests
+ *   it returns true for; the others are served over http.
  * @param {boolean} [params.allowHttpRequestOnHttps=false] - With https, also serve plain http
  *   requests on the same port (`request.origin` tells them apart).
  * @param {boolean} [params.http2=false] - Serve http2 (needs `https`, http/1.1 clients are still
@@ -794,6 +799,10 @@ export const startServer = async ({
   };
 
   request: {
+    const shouldRedirectHttpToHttps =
+      typeof redirectHttpToHttps === "function"
+        ? redirectHttpToHttps
+        : () => redirectHttpToHttps;
     const requestEventHandler = async (nodeRequest, nodeResponse) => {
       const requestTarget = readRequestTarget(nodeRequest.url);
       if (!requestTarget) {
@@ -811,9 +820,17 @@ export const startServer = async ({
         nodeResponse.end("Host not allowed");
         return;
       }
-      if (redirectHttpToHttps && !nodeRequest.connection.encrypted) {
+      if (
+        !nodeRequest.connection.encrypted &&
+        shouldRedirectHttpToHttps(requestTarget)
+      ) {
         nodeResponse.writeHead(301, {
-          location: `${serverOrigin}${requestTarget.resource}`,
+          location: httpsUrlFromHttpRequest({
+            requestHost,
+            resource: requestTarget.resource,
+            port,
+            serverOrigin,
+          }),
         });
         nodeResponse.end();
         return;
@@ -1062,6 +1079,25 @@ const createNodeServer = async ({
   return createServer();
 };
 
+// http and https share the port (see server_polyglot.js): only the scheme
+// changes, the host stays the one the client used. The server origin would
+// send a phone that typed the network ip to its own loopback.
+const httpsUrlFromHttpRequest = ({
+  requestHost,
+  resource,
+  port,
+  serverOrigin,
+}) => {
+  const httpsUrlString = `https://${requestHost}`;
+  // no host header (http/1.0), or any host at all with `allowedHosts: true`
+  if (requestHost === undefined || !URL.canParse(httpsUrlString)) {
+    return `${serverOrigin}${resource}`;
+  }
+  const httpsUrl = new URL(httpsUrlString);
+  httpsUrl.port = port;
+  return `${httpsUrl.origin}${resource}`;
+};
+
 const REQUEST_BODY_LINGER_MS = 5_000;
 
 const PROCESS_TEARDOWN_EVENTS_MAP = {