@jsenv/server 7.3.1 → 8.0.0

package/main.js

@@ -3,31 +3,16 @@
  * Its responsability is to export what is documented
  * Ideally this file should be kept simple to help discovering codebase progressively.
  */
-/* eslint-disable import/max-dependencies */
 
-export { composeResponse } from "./src/composeResponse.js"
-export { convertFileSystemErrorToResponseProperties } from "./src/convertFileSystemErrorToResponseProperties.js"
-export { createSSERoom } from "./src/createSSERoom.js"
-export { fetchUrl } from "./src/fetchUrl.js"
-export { findFreePort } from "./src/findFreePort.js"
-export { headersToObject } from "./src/headersToObject.js"
+export { startServer } from "./src/startServer.js"
 export {
   composeServices,
   composeServicesWithTiming,
   nextService,
-} from "./src/service-composition.js"
-export { jsenvAccessControlAllowedHeaders } from "./src/jsenvAccessControlAllowedHeaders.js"
-export { jsenvAccessControlAllowedMethods } from "./src/jsenvAccessControlAllowedMethods.js"
+} from "./src/service_composition/service_composition.js"
 export { jsenvServerInternalErrorToResponse } from "./src/jsenvServerInternalErrorToResponse.js"
-export { negotiateContentEncoding } from "./src/negotiateContentEncoding.js"
-export { negotiateContentLanguage } from "./src/negotiateContentLanguage.js"
-export { negotiateContentType } from "./src/negotiateContentType.js"
-export { urlToContentType } from "./src/urlToContentType.js"
-export { urlToSearchParamValue } from "./src/urlToSearchParamValue.js"
 export { readRequestBody } from "./src/readRequestBody.js"
 export { serveFile } from "./src/serveFile.js"
-export { timeFunction, timeStart } from "./src/serverTiming.js"
-export { startServer } from "./src/startServer.js"
 export {
   STOP_REASON_INTERNAL_ERROR,
   STOP_REASON_PROCESS_SIGHUP,
@@ -37,3 +22,29 @@ export {
   STOP_REASON_PROCESS_EXIT,
   STOP_REASON_NOT_SPECIFIED,
 } from "./src/stopReasons.js"
+
+// CORS
+export {
+  pluginCORS,
+  jsenvAccessControlAllowedHeaders,
+  jsenvAccessControlAllowedMethods,
+} from "./src/cors/plugin_cors.js"
+
+// server timings
+export { pluginServerTiming } from "./src/server_timing/plugin_server_timing.js"
+export { timeFunction, timeStart } from "./src/server_timing/timing_measure.js"
+
+// SSE
+export { createSSERoom } from "./src/sse/createSSERoom.js"
+
+// content-negotiation
+export { negotiateContentType } from "./src/content_negotiation/negotiateContentType.js"
+export { negotiateContentEncoding } from "./src/content_negotiation/negotiateContentEncoding.js"
+export { negotiateContentLanguage } from "./src/content_negotiation/negotiateContentLanguage.js"
+export { pluginContentNegotiationCheck } from "./src/content_negotiation/plugin_content_negotiation_check.js"
+
+// others
+export { pluginRequestWaitingCheck } from "./src/plugin_request_waiting_check.js"
+export { findFreePort } from "./src/findFreePort.js"
+export { fetchUrl } from "./src/fetchUrl.js"
+export { urlToContentType } from "./src/urlToContentType.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/server",
-  "version": "7.3.1",
+  "version": "8.0.0",
   "description": "Write your Node.js server using pure functions",
   "license": "MIT",
   "author": {
@@ -16,7 +16,8 @@
     "node": ">=14.17.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
   },
   "type": "module",
   "exports": {
@@ -33,7 +34,7 @@
     "eslint-check": "node ./node_modules/eslint/bin/eslint.js . --ext=.js,.mjs",
     "generate-importmap": "node ./script/importmap/generate_importmap.mjs",
     "measure-performances": "node --expose-gc ./script/performance/generate_performance_report.mjs --log",
-    "test": "node ./script/test/test.mjs",
+    "test": "node --unhandled-rejections=strict ./script/test/test.mjs",
     "test-with-coverage": "npm run test -- --coverage",
     "generate-html-snapshots": "node ./test/internal_error/generate_html_snapshot_files.mjs",
     "prettier-format": "node ./script/prettier/prettier_format.mjs",

package/src/{internal → content_negotiation}/checkContentNegotiation.js

@@ -1,6 +1,6 @@
-import { negotiateContentType } from "../negotiateContentType.js"
-import { negotiateContentLanguage } from "../negotiateContentLanguage.js"
-import { negotiateContentEncoding } from "../negotiateContentEncoding.js"
+import { negotiateContentType } from "./negotiateContentType.js"
+import { negotiateContentLanguage } from "./negotiateContentLanguage.js"
+import { negotiateContentEncoding } from "./negotiateContentEncoding.js"
 
 export const checkContentNegotiation = (request, response, { warn }) => {
   const requestAcceptHeader = request.headers.accept

package/src/{negotiateContentEncoding.js → content_negotiation/negotiateContentEncoding.js}

@@ -1,5 +1,5 @@
-import { applyContentNegotiation } from "./internal/applyContentNegotiation.js"
-import { parseMultipleHeader } from "./internal/multiple-header.js"
+import { parseMultipleHeader } from "../internal/multiple-header.js"
+import { applyContentNegotiation } from "./applyContentNegotiation.js"
 
 export const negotiateContentEncoding = (request, availableEncodings) => {
   const { headers = {} } = request

package/src/{negotiateContentLanguage.js → content_negotiation/negotiateContentLanguage.js}

@@ -1,5 +1,5 @@
-import { applyContentNegotiation } from "./internal/applyContentNegotiation.js"
-import { parseMultipleHeader } from "./internal/multiple-header.js"
+import { parseMultipleHeader } from "../internal/multiple-header.js"
+import { applyContentNegotiation } from "./applyContentNegotiation.js"
 
 export const negotiateContentLanguage = (request, availableLanguages) => {
   const { headers = {} } = request

package/src/{negotiateContentType.js → content_negotiation/negotiateContentType.js}

@@ -1,5 +1,5 @@
-import { applyContentNegotiation } from "./internal/applyContentNegotiation.js"
-import { parseMultipleHeader } from "./internal/multiple-header.js"
+import { parseMultipleHeader } from "../internal/multiple-header.js"
+import { applyContentNegotiation } from "./applyContentNegotiation.js"
 
 export const negotiateContentType = (request, availableContentTypes) => {
   const { headers = {} } = request

package/src/content_negotiation/plugin_content_negotiation_check.js

@@ -0,0 +1,15 @@
+import { checkContentNegotiation } from "./checkContentNegotiation.js"
+
+export const pluginContentNegotiationCheck = () => {
+  return {
+    content_negotiation_check: {
+      onRequest: (request, { warn }) => {
+        return {
+          onResponse: (response) => {
+            checkContentNegotiation(request, response, { warn })
+          },
+        }
+      },
+    },
+  }
+}

package/src/cors/plugin_cors.js

@@ -0,0 +1,156 @@
+import { urlToOrigin } from "@jsenv/filesystem"
+
+export const jsenvAccessControlAllowedHeaders = ["x-requested-with"]
+
+export const jsenvAccessControlAllowedMethods = [
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "OPTIONS",
+]
+
+export const pluginCORS = ({
+  accessControlAllowedOrigins = [],
+  accessControlAllowedMethods = jsenvAccessControlAllowedMethods,
+  accessControlAllowedHeaders = jsenvAccessControlAllowedHeaders,
+  accessControlAllowRequestOrigin = false,
+  accessControlAllowRequestMethod = false,
+  accessControlAllowRequestHeaders = false,
+  accessControlAllowCredentials = false,
+  // by default OPTIONS request can be cache for a long time, it's not going to change soon ?
+  // we could put a lot here, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+  accessControlMaxAge = 600,
+  timingAllowOrigin,
+} = {}) => {
+  // TODO: we should check access control params to throw or warn if we find strange values
+
+  const corsEnabled =
+    accessControlAllowRequestOrigin || accessControlAllowedOrigins.length
+
+  if (!corsEnabled) {
+    return {
+      cors: {},
+    }
+  }
+
+  return {
+    cors: {
+      onServerParams: ({ plugins }) => {
+        if (timingAllowOrigin === undefined && plugins.server_timings) {
+          timingAllowOrigin = true
+        }
+      },
+
+      onRequest: (request, { shortcircuitResponse }) => {
+        if (request.method === "OPTIONS") {
+          // when request method is "OPTIONS" we must return a 200 without body
+          // So we bypass "requestToResponse" in that scenario using shortcircuitResponse
+          shortcircuitResponse({
+            status: 200,
+            headers: {
+              "content-length": 0,
+            },
+          })
+        }
+
+        return {
+          onResponse: () => {
+            const accessControlHeaders = generateAccessControlHeaders({
+              request,
+              accessControlAllowedOrigins,
+              accessControlAllowRequestOrigin,
+              accessControlAllowedMethods,
+              accessControlAllowRequestMethod,
+              accessControlAllowedHeaders,
+              accessControlAllowRequestHeaders,
+              accessControlAllowCredentials,
+              accessControlMaxAge,
+              timingAllowOrigin,
+            })
+
+            return {
+              headers: accessControlHeaders,
+            }
+          },
+        }
+      },
+    },
+  }
+}
+
+// https://www.w3.org/TR/cors/
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
+const generateAccessControlHeaders = ({
+  request: { headers },
+  accessControlAllowedOrigins,
+  accessControlAllowRequestOrigin,
+  accessControlAllowedMethods,
+  accessControlAllowRequestMethod,
+  accessControlAllowedHeaders,
+  accessControlAllowRequestHeaders,
+  accessControlAllowCredentials,
+  // by default OPTIONS request can be cache for a long time, it's not going to change soon ?
+  // we could put a lot here, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+  accessControlMaxAge = 600,
+  timingAllowOrigin,
+} = {}) => {
+  const vary = []
+
+  const allowedOriginArray = [...accessControlAllowedOrigins]
+  if (accessControlAllowRequestOrigin) {
+    if ("origin" in headers && headers.origin !== "null") {
+      allowedOriginArray.push(headers.origin)
+      vary.push("origin")
+    } else if ("referer" in headers) {
+      allowedOriginArray.push(urlToOrigin(headers.referer))
+      vary.push("referer")
+    } else {
+      allowedOriginArray.push("*")
+    }
+  }
+
+  const allowedMethodArray = [...accessControlAllowedMethods]
+  if (
+    accessControlAllowRequestMethod &&
+    "access-control-request-method" in headers
+  ) {
+    const requestMethodName = headers["access-control-request-method"]
+    if (!allowedMethodArray.includes(requestMethodName)) {
+      allowedMethodArray.push(requestMethodName)
+      vary.push("access-control-request-method")
+    }
+  }
+
+  const allowedHeaderArray = [...accessControlAllowedHeaders]
+  if (
+    accessControlAllowRequestHeaders &&
+    "access-control-request-headers" in headers
+  ) {
+    const requestHeaderNameArray =
+      headers["access-control-request-headers"].split(", ")
+    requestHeaderNameArray.forEach((headerName) => {
+      const headerNameLowerCase = headerName.toLowerCase()
+      if (!allowedHeaderArray.includes(headerNameLowerCase)) {
+        allowedHeaderArray.push(headerNameLowerCase)
+        if (!vary.includes("access-control-request-headers")) {
+          vary.push("access-control-request-headers")
+        }
+      }
+    })
+  }
+
+  return {
+    "access-control-allow-origin": allowedOriginArray.join(", "),
+    "access-control-allow-methods": allowedMethodArray.join(", "),
+    "access-control-allow-headers": allowedHeaderArray.join(", "),
+    ...(accessControlAllowCredentials
+      ? { "access-control-allow-credentials": true }
+      : {}),
+    "access-control-max-age": accessControlMaxAge,
+    ...(timingAllowOrigin
+      ? { "timing-allow-origin": allowedOriginArray.join(", ") }
+      : {}),
+    ...(vary.length ? { vary: vary.join(", ") } : {}),
+  }
+}

package/src/findFreePort.js

@@ -1,5 +1,6 @@
-import { createServer } from "net"
+import { createServer } from "node:net"
 import { createCancellationToken } from "@jsenv/cancellation"
+
 import { listen } from "./internal/listen.js"
 
 export const findFreePort = async (

package/src/{composeResponse.js → internal/composeResponse.js}

@@ -1,5 +1,5 @@
-import { compositionMappingToComposeStrict } from "./internal/compositionMappingToComposeStrict.js"
-import { composeResponseHeaders } from "./internal/composeResponseHeaders.js"
+import { compositionMappingToComposeStrict } from "./compositionMappingToComposeStrict.js"
+import { composeResponseHeaders } from "./composeResponseHeaders.js"
 
 const responseCompositionMapping = {
   status: (prevStatus, status) => status,

package/src/internal/nodeRequestToRequest.js

@@ -47,7 +47,7 @@ export const nodeRequestToRequest = (
 const nodeRequestToCancellationToken = (nodeRequest) => {
   const { cancel, token } = createCancellationSource()
   nodeRequest.on("abort", () => {
-    cancel("request aborted")
+    cancel("request aborted by client")
   })
   nodeRequest.on("close", () => {
     cancel("request closed")

package/src/jsenvServerInternalErrorToResponse.js

@@ -1,4 +1,4 @@
-import { negotiateContentType } from "./negotiateContentType.js"
+import { negotiateContentType } from "./content_negotiation/negotiateContentType.js"
 
 export const jsenvServerInternalErrorToResponse = (
   serverInternalError,

package/src/plugin_request_waiting_check.js

@@ -0,0 +1,34 @@
+import { createDetailedMessage } from "@jsenv/logger"
+
+export const pluginRequestWaitingCheck = ({
+  requestWaitingMs = 20000,
+  requestWaitingCallback = ({ request, logger, requestWaitingMs }) => {
+    logger.warn(
+      createDetailedMessage(
+        `still no response found for request after ${requestWaitingMs} ms`,
+        {
+          "request url": `${request.origin}${request.ressource}`,
+          "request headers": JSON.stringify(request.headers, null, "  "),
+        },
+      ),
+    )
+  },
+} = {}) => {
+  return {
+    plugin_request_waiting_check: {
+      init: () => {},
+
+      onRequest: (request, { logger }) => {
+        const timeout = setTimeout(
+          () => requestWaitingCallback({ request, logger, requestWaitingMs }),
+          requestWaitingMs,
+        )
+        return {
+          onResponse: () => {
+            clearTimeout(timeout)
+          },
+        }
+      },
+    },
+  }
+}

package/src/serveFile.js

@@ -1,4 +1,3 @@
-/* eslint-disable import/max-dependencies */
 import { createReadStream, statSync } from "node:fs"
 import {
   assertAndNormalizeDirectoryUrl,
@@ -12,16 +11,15 @@ import {
 } from "@jsenv/filesystem"
 import { createOperation } from "@jsenv/cancellation"
 
-import { negotiateContentType } from "./negotiateContentType.js"
-import { timeFunction } from "./serverTiming.js"
-import { convertFileSystemErrorToResponseProperties } from "./convertFileSystemErrorToResponseProperties.js"
-import { urlToContentType } from "./urlToContentType.js"
+import { composeResponse } from "./internal/composeResponse.js"
+import { convertFileSystemErrorToResponseProperties } from "./internal/convertFileSystemErrorToResponseProperties.js"
 import { jsenvContentTypeMap } from "./jsenvContentTypeMap.js"
-import { composeResponse } from "./composeResponse.js"
-import { negotiateContentEncoding } from "./negotiateContentEncoding.js"
+import { timeFunction } from "./server_timing/timing_measure.js"
+import { negotiateContentType } from "./content_negotiation/negotiateContentType.js"
+import { negotiateContentEncoding } from "./content_negotiation/negotiateContentEncoding.js"
+import { urlToContentType } from "./urlToContentType.js"
 
-const ETAG_CACHE = new Map()
-const ETAG_CACHE_MAX_SIZE = 500
+const ETAG_MEMORY_MAP = new Map()
 
 export const serveFile = async (
   request,
@@ -29,7 +27,8 @@ export const serveFile = async (
     rootDirectoryUrl,
     contentTypeMap = jsenvContentTypeMap,
     etagEnabled = false,
-    etagCacheDisabled = false,
+    etagMemory = true,
+    etagMemoryMaxSize = 1000,
     mtimeEnabled = false,
     compressionEnabled = false,
     compressionSizeThreshold = 1024,
@@ -179,7 +178,8 @@ export const serveFile = async (
 
     const clientCacheResponse = await getClientCacheResponse(request, {
       etagEnabled,
-      etagCacheDisabled,
+      etagMemory,
+      etagMemoryMaxSize,
       mtimeEnabled,
       sourceStat,
       sourceUrl,
@@ -263,7 +263,14 @@ export const serveFile = async (
 
 const getClientCacheResponse = async (
   request,
-  { etagEnabled, etagCacheDisabled, mtimeEnabled, sourceStat, sourceUrl },
+  {
+    etagEnabled,
+    etagMemory,
+    etagMemoryMaxSize,
+    mtimeEnabled,
+    sourceStat,
+    sourceUrl,
+  },
 ) => {
   // here you might be tempted to add || headers["cache-control"] === "no-cache"
   // but no-cache means ressource can be cache but must be revalidated (yeah naming is strange)
@@ -280,7 +287,8 @@ const getClientCacheResponse = async (
 
   if (etagEnabled) {
     return getEtagResponse(request, {
-      etagCacheDisabled,
+      etagMemory,
+      etagMemoryMaxSize,
       sourceStat,
       sourceUrl,
     })
@@ -297,11 +305,17 @@ const getClientCacheResponse = async (
 
 const getEtagResponse = async (
   request,
-  { etagCacheDisabled, sourceUrl, sourceStat },
+  { etagMemory, etagMemoryMaxSize, sourceUrl, sourceStat },
 ) => {
   const [computeEtagTiming, fileContentEtag] = await timeFunction(
     "file service>generate file etag",
-    () => computeEtag(request, { etagCacheDisabled, sourceUrl, sourceStat }),
+    () =>
+      computeEtag(request, {
+        etagMemory,
+        etagMemoryMaxSize,
+        sourceUrl,
+        sourceStat,
+      }),
   )
 
   const { headers = {} } = request
@@ -327,15 +341,15 @@ const getEtagResponse = async (
 
 const computeEtag = async (
   request,
-  { etagCacheDisabled, sourceUrl, sourceStat },
+  { etagMemory, etagMemoryMaxSize, sourceUrl, sourceStat },
 ) => {
-  if (!etagCacheDisabled) {
-    const etagCacheEntry = ETAG_CACHE.get(sourceUrl)
+  if (etagMemory) {
+    const etagMemoryEntry = ETAG_MEMORY_MAP.get(sourceUrl)
     if (
-      etagCacheEntry &&
-      fileStatAreTheSame(etagCacheEntry.sourceStat, sourceStat)
+      etagMemoryEntry &&
+      fileStatAreTheSame(etagMemoryEntry.sourceStat, sourceStat)
     ) {
-      return etagCacheEntry.eTag
+      return etagMemoryEntry.eTag
     }
   }
   const fileContentAsBuffer = await createOperation({
@@ -343,12 +357,12 @@ const computeEtag = async (
     start: () => readFile(sourceUrl, { as: "buffer" }),
   })
   const eTag = bufferToEtag(fileContentAsBuffer)
-  if (!etagCacheDisabled) {
-    if (ETAG_CACHE.size >= ETAG_CACHE_MAX_SIZE) {
-      const firstKey = Array.from(ETAG_CACHE.keys())[0]
-      ETAG_CACHE.delete(firstKey)
+  if (etagMemory) {
+    if (ETAG_MEMORY_MAP.size >= etagMemoryMaxSize) {
+      const firstKey = Array.from(ETAG_MEMORY_MAP.keys())[0]
+      ETAG_MEMORY_MAP.delete(firstKey)
     }
-    ETAG_CACHE.set(sourceUrl, { sourceStat, eTag })
+    ETAG_MEMORY_MAP.set(sourceUrl, { sourceStat, eTag })
   }
   return eTag
 }

package/src/server_timing/plugin_server_timing.js

@@ -0,0 +1,28 @@
+// https://www.w3.org/TR/server-timing/
+
+import { performance } from "node:perf_hooks"
+
+import { timingToServerTimingResponseHeaders } from "./timing_header.js"
+
+export const pluginServerTiming = () => {
+  return {
+    server_timing: {
+      onRequest: () => {
+        const requestStartEvent = performance.now()
+        return {
+          onResponse: (response) => {
+            const responseEndEvent = performance.now()
+            const timeToCreateResponse = responseEndEvent - requestStartEvent
+            const serverTiming = {
+              ...response.timing,
+              "time to start responding": timeToCreateResponse,
+            }
+            return {
+              headers: timingToServerTimingResponseHeaders(serverTiming),
+            }
+          },
+        }
+      },
+    },
+  }
+}

package/src/{serverTiming.js → server_timing/timing_header.js}

@@ -1,33 +1,7 @@
-import { performance } from "perf_hooks"
 import {
   parseMultipleHeader,
   stringifyMultipleHeader,
-} from "./internal/multiple-header.js"
-
-export const timeStart = (name) => {
-  // as specified in https://w3c.github.io/server-timing/#the-performanceservertiming-interface
-  // duration is a https://www.w3.org/TR/hr-time-2/#sec-domhighrestimestamp
-  const startTimestamp = performance.now()
-  const timeEnd = () => {
-    const endTimestamp = performance.now()
-    const timing = {
-      [name]: endTimestamp - startTimestamp,
-    }
-    return timing
-  }
-  return timeEnd
-}
-
-export const timeFunction = (name, fn) => {
-  const timeEnd = timeStart(name)
-  const returnValue = fn()
-  if (returnValue && typeof returnValue.then === "function") {
-    return returnValue.then((value) => {
-      return [timeEnd(), value]
-    })
-  }
-  return [timeEnd(), returnValue]
-}
+} from "../internal/multiple-header.js"
 
 // to predict order in chrome devtools we should put a,b,c,d,e or something
 // because in chrome dev tools they are shown in alphabetic order
@@ -50,35 +24,6 @@ export const timingToServerTimingResponseHeaders = (timing) => {
   return { "server-timing": serverTimingHeaderString }
 }
 
-const letters = [
-  "a",
-  "b",
-  "c",
-  "d",
-  "e",
-  "f",
-  "g",
-  "h",
-  "i",
-  "j",
-  "k",
-  "l",
-  "m",
-  "n",
-  "o",
-  "p",
-  "q",
-  "r",
-  "s",
-  "t",
-  "u",
-  "v",
-  "w",
-  "x",
-  "y",
-  "z",
-]
-
 export const parseServerTimingHeader = (serverTimingHeaderString) => {
   const serverTimingHeaderObject = parseMultipleHeader(
     serverTimingHeaderString,
@@ -121,3 +66,32 @@ const validateServerTimingName = (name) => {
   }
   return true
 }
+
+const letters = [
+  "a",
+  "b",
+  "c",
+  "d",
+  "e",
+  "f",
+  "g",
+  "h",
+  "i",
+  "j",
+  "k",
+  "l",
+  "m",
+  "n",
+  "o",
+  "p",
+  "q",
+  "r",
+  "s",
+  "t",
+  "u",
+  "v",
+  "w",
+  "x",
+  "y",
+  "z",
+]

package/src/server_timing/timing_measure.js

@@ -0,0 +1,26 @@
+import { performance } from "perf_hooks"
+
+export const timeStart = (name) => {
+  // as specified in https://w3c.github.io/server-timing/#the-performanceservertiming-interface
+  // duration is a https://www.w3.org/TR/hr-time-2/#sec-domhighrestimestamp
+  const startTimestamp = performance.now()
+  const timeEnd = () => {
+    const endTimestamp = performance.now()
+    const timing = {
+      [name]: endTimestamp - startTimestamp,
+    }
+    return timing
+  }
+  return timeEnd
+}
+
+export const timeFunction = (name, fn) => {
+  const timeEnd = timeStart(name)
+  const returnValue = fn()
+  if (returnValue && typeof returnValue.then === "function") {
+    return returnValue.then((value) => {
+      return [timeEnd(), value]
+    })
+  }
+  return [timeEnd(), returnValue]
+}

package/src/{service-composition.js → service_composition/service_composition.js}

@@ -1,6 +1,7 @@
 import { firstOperationMatching } from "@jsenv/cancellation"
-import { timeFunction } from "./serverTiming.js"
-import { composeResponse } from "./composeResponse.js"
+
+import { timeFunction } from "@jsenv/server/src/server_timing/timing_measure.js"
+import { composeResponse } from "@jsenv/server/src/internal/composeResponse.js"
 
 const nextSymbol = Symbol("next")
 

package/src/{createSSERoom.js → sse/createSSERoom.js}

@@ -1,8 +1,9 @@
 import { createLogger } from "@jsenv/logger"
+
 import {
   createObservable,
   createCompositeProducer,
-} from "./internal/observable.js"
+} from "@jsenv/server/src/internal/observable.js"
 
 // https://www.html5rocks.com/en/tutorials/eventsource/basics/
 export const createSSERoom = ({

package/src/startServer.js

@@ -1,5 +1,3 @@
-/* eslint-disable import/max-dependencies */
-
 import http from "node:http"
 import {
   createCancellationToken,
@@ -14,20 +12,22 @@ import {
   unadvisedCrashSignal,
   teardownSignal,
 } from "@jsenv/node-signals"
-import { memoize, urlToOrigin } from "@jsenv/filesystem"
-import { createLogger } from "@jsenv/logger"
+import { memoize } from "@jsenv/filesystem"
+import { createDetailedMessage, createLogger } from "@jsenv/logger"
 
 import { createTracker } from "./internal/createTracker.js"
 import { createPolyglotServer } from "./internal/server-polyglot.js"
 import { trackServerPendingConnections } from "./internal/trackServerPendingConnections.js"
 import { trackServerPendingRequests } from "./internal/trackServerPendingRequests.js"
 import { nodeRequestToRequest } from "./internal/nodeRequestToRequest.js"
-import { composeResponseHeaders } from "./internal/composeResponseHeaders.js"
 import { populateNodeResponse } from "./internal/populateNodeResponse.js"
 import { colorizeResponseStatus } from "./internal/colorizeResponseStatus.js"
 import { getServerOrigins } from "./internal/getServerOrigins.js"
 import { listen, stopListening } from "./internal/listen.js"
-import { composeResponse } from "./composeResponse.js"
+import { composeResponse } from "./internal/composeResponse.js"
+import { listenRequest } from "./internal/listenRequest.js"
+import { listenServerConnectionError } from "./internal/listenServerConnectionError.js"
+import { jsenvServerInternalErrorToResponse } from "./jsenvServerInternalErrorToResponse.js"
 import {
   STOP_REASON_INTERNAL_ERROR,
   STOP_REASON_PROCESS_SIGHUP,
@@ -37,16 +37,6 @@ import {
   STOP_REASON_PROCESS_EXIT,
   STOP_REASON_NOT_SPECIFIED,
 } from "./stopReasons.js"
-import { jsenvAccessControlAllowedHeaders } from "./jsenvAccessControlAllowedHeaders.js"
-import { jsenvAccessControlAllowedMethods } from "./jsenvAccessControlAllowedMethods.js"
-import { listenRequest } from "./internal/listenRequest.js"
-import {
-  timeFunction,
-  timingToServerTimingResponseHeaders,
-} from "./serverTiming.js"
-import { jsenvServerInternalErrorToResponse } from "./jsenvServerInternalErrorToResponse.js"
-import { checkContentNegotiation } from "./internal/checkContentNegotiation.js"
-import { listenServerConnectionError } from "./internal/listenServerConnectionError.js"
 
 export const startServer = async ({
   cancellationToken = createCancellationToken(),
@@ -73,36 +63,11 @@ export const startServer = async ({
   stopOnCrash = false,
   keepProcessAlive = true,
   requestToResponse = () => null,
+  plugins = {},
 
-  accessControlAllowedOrigins = [],
-  accessControlAllowedMethods = jsenvAccessControlAllowedMethods,
-  accessControlAllowedHeaders = jsenvAccessControlAllowedHeaders,
-  accessControlAllowRequestOrigin = false,
-  accessControlAllowRequestMethod = false,
-  accessControlAllowRequestHeaders = false,
-  accessControlAllowCredentials = false,
-  // by default OPTIONS request can be cache for a long time, it's not going to change soon ?
-  // we could put a lot here, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
-  accessControlMaxAge = 600,
-
-  // https://www.w3.org/TR/server-timing/
-  sendServerTiming = false,
   sendServerInternalErrorDetails = false,
   serverInternalErrorToResponse = jsenvServerInternalErrorToResponse,
 
-  requestWaitingMs = 20000,
-  requestWaitingCallback = (request, { logger }) => {
-    logger.warn(
-      `still no response found for request after ${requestWaitingMs} ms
---- request url ---
-${request.origin}${request.ressource}
---- request headers ---
-${JSON.stringify(request.headers, null, "  ")}
-`,
-    )
-  },
-  contentNegotiationWarnings = true,
-
   startedCallback = () => {},
   stoppedCallback = () => {},
   errorIsCancellation = () => false,
@@ -296,85 +261,169 @@ ${JSON.stringify(request.headers, null, "  ")}
         serverCancellationToken,
         serverOrigin,
       })
-      nodeRequest.on("error", (error) => {
-        logger[
-          error.message === "aborted" ? "debug" : "error"
-        ](`error on request.
---- request ressource ---
-${request.ressource}
---- error stack ---
-${error.stack}`)
+
+      // Handling request is asynchronous, we buffer logs for that request
+      // until we know what happens with that request
+      // It delays logs until we know of the request will be handled
+      // but it's mandatory to make logs readable.
+      let requestLogs = []
+      const releaseRequestLogs = () => {
+        requestLogs.forEach(({ type, value }) => {
+          logger[type](value)
+        })
+        requestLogs.length = 0
+      }
+      const warn = (value) => {
+        requestLogs.push({
+          type: "warn",
+          value,
+        })
+      }
+      requestLogs.push({
+        type: "info",
+        value: `${request.method} ${request.origin}${request.ressource}`,
       })
 
-      const [startRespondingTiming, { response, error }] = await timeFunction(
-        "time to start responding",
-        () => generateResponseDescription(request),
-      )
-      if (sendServerTiming) {
-        const serverTiming = {
-          ...response.timing,
-          ...startRespondingTiming,
+      nodeRequest.on("error", (error) => {
+        if (error.message === "aborted") {
+          requestLogs.push({
+            type: "debug",
+            value: createDetailedMessage(`request aborted by client`, {
+              "error message": error.message,
+            }),
+          })
+        } else {
+          requestLogs.push({
+            type: "error",
+            value: createDetailedMessage(`"error" event emitted on request`, {
+              "error stack": error.stack,
+            }),
+          })
         }
-        response.headers = composeResponseHeaders(
-          timingToServerTimingResponseHeaders(serverTiming),
-          response.headers,
-        )
+      })
 
-        if (contentNegotiationWarnings) {
-          checkContentNegotiation(request, response, { warn: logger.warn })
-        }
+      const requestPlugins = []
+      let responseFromShortcircuit
+      const shortcircuitResponse = (value) => {
+        responseFromShortcircuit = value
       }
+      Object.keys(plugins).forEach((pluginName) => {
+        const { onRequest } = plugins[pluginName]
+        if (onRequest) {
+          const returnValue = onRequest(request, { warn, shortcircuitResponse })
+          if (returnValue) {
+            requestPlugins.push(returnValue)
+          }
+        }
+      })
+      let { error, responseProperties } = responseFromShortcircuit
+        ? { responseProperties: responseFromShortcircuit }
+        : await generateResponseDescription({
+            requestToResponse,
+            request,
+          })
 
-      logger.info(`${request.method} ${request.origin}${request.ressource}`)
-
-      if (
-        error &&
-        isCancelError(error) &&
-        internalCancellationToken.cancellationRequested
-      ) {
-        logger.info("ignored because server closing")
-        nodeResponse.destroy()
-        return
+      if (error && isCancelError(error)) {
+        if (internalCancellationToken.cancellationRequested) {
+          requestLogs.push({
+            type: "info",
+            value: `aborted because server closing`,
+          })
+          releaseRequestLogs()
+          nodeResponse.destroy()
+          return
+        }
+        if (request.cancellationToken.cancellationRequested) {
+          requestLogs.push({
+            type: "info",
+            value: `aborted because request aborted by client`,
+          })
+          releaseRequestLogs()
+          nodeResponse.destroy()
+          return
+        }
+        // unknown cancel error, never supposed to happen
       }
 
-      if (
-        error &&
-        isCancelError(error) &&
-        request.cancellationToken.cancellationRequested
-      ) {
-        logger.info("ignored because request canceled")
-        nodeResponse.destroy()
-        return
+      // internal error, create 500 response
+      if (error) {
+        const propertiesFromError = await serverInternalErrorToResponse(error, {
+          request,
+          sendServerInternalErrorDetails,
+        })
+        responseProperties = composeResponse(
+          {
+            status: 500,
+            statusText: statusToStatusText(500),
+            headers: {
+              // ensure error are not cached
+              "cache-control": "no-store",
+              "content-type": "text/plain",
+            },
+            body: "",
+          },
+          propertiesFromError,
+        )
+        requestLogs.push({
+          type: "error",
+          value: createDetailedMessage(
+            `internal error while handling request`,
+            {
+              "error stack": error.stack,
+            },
+          ),
+        })
+      } else {
+        const {
+          status = 501,
+          statusText = statusToStatusText(status),
+          headers = {},
+          body = "",
+          ...rest
+        } = responseProperties || {}
+        responseProperties = {
+          status,
+          statusText,
+          headers,
+          body,
+          ...rest,
+        }
       }
 
-      if (request.aborted) {
-        logger.info(`request aborted by client`)
-        nodeResponse.destroy()
-        return
-      }
+      // call every plugin "onResponse" hook
+      requestPlugins.forEach((requestPlugin) => {
+        const { onResponse } = requestPlugin
+        if (onResponse) {
+          const returnValue = onResponse(responseProperties)
+          if (returnValue) {
+            responseProperties = composeResponse(
+              responseProperties,
+              returnValue,
+            )
+          }
+        }
+      })
 
       if (
         request.method !== "HEAD" &&
-        response.headers["content-length"] > 0 &&
-        response.body === ""
+        responseProperties.headers["content-length"] > 0 &&
+        responseProperties.body === ""
       ) {
-        logger.warn(
-          `content-length header is ${response.headers["content-length"]} but body is empty`,
-        )
+        requestLogs.push({
+          type: "warn",
+          value: `content-length header is ${responseProperties.headers["content-length"]} but body is empty`,
+        })
       }
 
-      if (error) {
-        logger.error(`internal error while handling request.
---- error stack ---
-${error.stack}
---- request ---
-${request.method} ${request.origin}${request.ressource}`)
-      }
-      logger.info(
-        `${colorizeResponseStatus(response.status)} ${response.statusText}`,
-      )
+      requestLogs.push({
+        type: "info",
+        value: `${colorizeResponseStatus(responseProperties.status)} ${
+          responseProperties.statusText
+        }`,
+      })
+      releaseRequestLogs()
 
-      populateNodeResponse(nodeResponse, response, {
+      populateNodeResponse(nodeResponse, responseProperties, {
         cancellationToken: request.cancellationToken,
         ignoreBody: request.method === "HEAD",
         // https://github.com/nodejs/node/blob/79296dc2d02c0b9872bbfcbb89148ea036a546d0/lib/internal/http2/compat.js#L97
@@ -384,12 +433,12 @@ ${request.method} ${request.origin}${request.ressource}`)
       })
 
       if (
-        stopOnInternalError &&
+        error &&
         // stopOnInternalError stops server only if requestToResponse generated
         // a non controlled error (internal error).
         // if requestToResponse gracefully produced a 500 response (it did not throw)
         // then we can assume we are still in control of what we are doing
-        error
+        stopOnInternalError
       ) {
         // il faudrais pouvoir stop que les autres response ?
         stop(STOP_REASON_INTERNAL_ERROR)
@@ -405,98 +454,6 @@ ${request.method} ${request.origin}${request.ressource}`)
     )
     startedCallback({ origin: serverOrigin })
 
-    const corsEnabled =
-      accessControlAllowRequestOrigin || accessControlAllowedOrigins.length
-    // here we check access control options to throw or warn if we find strange values
-
-    const generateResponseDescription = async (request) => {
-      const responsePropertiesToResponse = ({
-        status = 501,
-        statusText = statusToStatusText(status),
-        headers = {},
-        body = "",
-        bodyEncoding,
-        timing,
-      }) => {
-        if (corsEnabled) {
-          const accessControlHeaders = generateAccessControlHeaders({
-            request,
-            accessControlAllowedOrigins,
-            accessControlAllowRequestOrigin,
-            accessControlAllowedMethods,
-            accessControlAllowRequestMethod,
-            accessControlAllowedHeaders,
-            accessControlAllowRequestHeaders,
-            accessControlAllowCredentials,
-            accessControlMaxAge,
-            sendServerTiming,
-          })
-
-          return {
-            status,
-            statusText,
-            headers: composeResponseHeaders(headers, accessControlHeaders),
-            body,
-            bodyEncoding,
-            timing,
-          }
-        }
-
-        return {
-          status,
-          statusText,
-          headers,
-          body,
-          bodyEncoding,
-          timing,
-        }
-      }
-
-      let timeout
-      try {
-        if (corsEnabled && request.method === "OPTIONS") {
-          return {
-            response: responsePropertiesToResponse({
-              status: 200,
-              headers: {
-                "content-length": 0,
-              },
-            }),
-          }
-        }
-
-        timeout = setTimeout(
-          () => requestWaitingCallback(request, { logger, requestWaitingMs }),
-          requestWaitingMs,
-        )
-
-        const responseProperties = await requestToResponse(request)
-        clearTimeout(timeout)
-        return {
-          response: responsePropertiesToResponse(responseProperties || {}),
-        }
-      } catch (error) {
-        clearTimeout(timeout)
-        return {
-          response: composeResponse(
-            responsePropertiesToResponse({
-              status: 500,
-              headers: {
-                // ensure error are not cached
-                "cache-control": "no-store",
-                "content-type": "text/plain",
-              },
-            }),
-            await serverInternalErrorToResponse(error, {
-              request,
-              sendServerInternalErrorDetails,
-            }),
-          ),
-          error,
-        }
-      }
-    }
-
     return {
       getStatus: () => status,
       origin: serverOrigin,
@@ -536,85 +493,22 @@ const createNodeServer = async ({
   })
 }
 
-const statusToStatusText = (status) =>
-  http.STATUS_CODES[status] || "not specified"
-
-// https://www.w3.org/TR/cors/
-// https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
-const generateAccessControlHeaders = ({
-  request: { headers },
-  accessControlAllowedOrigins,
-  accessControlAllowRequestOrigin,
-  accessControlAllowedMethods,
-  accessControlAllowRequestMethod,
-  accessControlAllowedHeaders,
-  accessControlAllowRequestHeaders,
-  accessControlAllowCredentials,
-  // by default OPTIONS request can be cache for a long time, it's not going to change soon ?
-  // we could put a lot here, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
-  accessControlMaxAge = 600,
-  sendServerTiming,
-} = {}) => {
-  const vary = []
-
-  const allowedOriginArray = [...accessControlAllowedOrigins]
-  if (accessControlAllowRequestOrigin) {
-    if ("origin" in headers && headers.origin !== "null") {
-      allowedOriginArray.push(headers.origin)
-      vary.push("origin")
-    } else if ("referer" in headers) {
-      allowedOriginArray.push(urlToOrigin(headers.referer))
-      vary.push("referer")
-    } else {
-      allowedOriginArray.push("*")
+const generateResponseDescription = async ({ requestToResponse, request }) => {
+  try {
+    const returnValue = await requestToResponse(request)
+    return {
+      responseProperties: returnValue,
     }
-  }
-
-  const allowedMethodArray = [...accessControlAllowedMethods]
-  if (
-    accessControlAllowRequestMethod &&
-    "access-control-request-method" in headers
-  ) {
-    const requestMethodName = headers["access-control-request-method"]
-    if (!allowedMethodArray.includes(requestMethodName)) {
-      allowedMethodArray.push(requestMethodName)
-      vary.push("access-control-request-method")
+  } catch (error) {
+    return {
+      error,
     }
   }
-
-  const allowedHeaderArray = [...accessControlAllowedHeaders]
-  if (
-    accessControlAllowRequestHeaders &&
-    "access-control-request-headers" in headers
-  ) {
-    const requestHeaderNameArray =
-      headers["access-control-request-headers"].split(", ")
-    requestHeaderNameArray.forEach((headerName) => {
-      const headerNameLowerCase = headerName.toLowerCase()
-      if (!allowedHeaderArray.includes(headerNameLowerCase)) {
-        allowedHeaderArray.push(headerNameLowerCase)
-        if (!vary.includes("access-control-request-headers")) {
-          vary.push("access-control-request-headers")
-        }
-      }
-    })
-  }
-
-  return {
-    "access-control-allow-origin": allowedOriginArray.join(", "),
-    "access-control-allow-methods": allowedMethodArray.join(", "),
-    "access-control-allow-headers": allowedHeaderArray.join(", "),
-    ...(accessControlAllowCredentials
-      ? { "access-control-allow-credentials": true }
-      : {}),
-    "access-control-max-age": accessControlMaxAge,
-    ...(sendServerTiming
-      ? { "timing-allow-origin": allowedOriginArray.join(", ") }
-      : {}),
-    ...(vary.length ? { vary: vary.join(", ") } : {}),
-  }
 }
 
+const statusToStatusText = (status) =>
+  http.STATUS_CODES[status] || "not specified"
+
 const composePredicate = (previousPredicate, predicate) => {
   return (value) => {
     return previousPredicate(value) || predicate(value)

package/src/urlToContentType.js

@@ -1,6 +1,7 @@
 // https://github.com/jshttp/mime-db/blob/master/src/apache-types.json
 
-import { extname } from "path"
+import { extname } from "node:path"
+
 import { jsenvContentTypeMap } from "./jsenvContentTypeMap.js"
 
 export const urlToContentType = (

package/src/jsenvAccessControlAllowedHeaders.js

@@ -1 +0,0 @@
-export const jsenvAccessControlAllowedHeaders = ["x-requested-with"]

package/src/jsenvAccessControlAllowedMethods.js

@@ -1,7 +0,0 @@
-export const jsenvAccessControlAllowedMethods = [
-  "GET",
-  "POST",
-  "PUT",
-  "DELETE",
-  "OPTIONS",
-]

package/src/urlToSearchParamValue.js

@@ -1,3 +0,0 @@
-export const urlToSearchParamValue = (url, searchParamName) => {
-  return new URL(url).searchParams.get(searchParamName)
-}