@loopbacktools/server 0.0.0-stage → 0.4.1

package/dist/src/generated/app.gen.js

@@ -0,0 +1,400 @@
+// GENERATED by typespec-hono from the TypeSpec service definition. DO NOT EDIT.
+// Regenerate with: pnpm generate
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { parse as parseJson } from "secure-json-parse";
+import { z } from "zod";
+import { UndeclaredStatusError, headersOf, servedBody, servedBytes } from "./runtime.gen.js";
+import { Asks_listQuery, Asks_readPath, Asks_replyPath, Files_readPath, Uploads_storeHeader, Uploads_storePath, askPageSchema, askSchema, eventTicketSchema, problemSchema, replySchema, snapshotSchema, uploadReceiptSchema, whoamiSchema, } from "./schemas.gen.js";
+/**
+ * Parse, and treat input nested deeper than this runtime's stack as a refusal rather than a crash.
+ *
+ * **`safeParse` not throwing is the contract everything here rests on, and a deep enough value
+ * breaks it.** Zod recurses once per level, so a recursive model meets a `RangeError` that is not a
+ * validation failure and escapes to `app.onError` indistinguishable from a bug in the application's
+ * own code. Measured on `workerd`: a 40.5 KB body, about 1,925 levels, which Ajv on the published
+ * document calls VALID.
+ *
+ * It cannot be served, so it is refused - through `deps.invalid` like every other bad request, with
+ * an issue that says which limit was met rather than a generic failure. Anything that is not a
+ * `RangeError` is rethrown: a bug here must still look like one.
+ */
+function parsed(schema, value) {
+    try {
+        return schema.safeParse(value);
+    }
+    catch (error) {
+        if (!(error instanceof RangeError))
+            throw error;
+        return {
+            success: false,
+            error: new z.ZodError([
+                {
+                    code: "custom",
+                    path: [],
+                    message: "input is nested too deeply for this runtime to validate",
+                },
+            ]),
+        };
+    }
+}
+/** Parse synchronously: nothing emitted here is async, and the async path costs 3.4x. */
+const SYNC = { validationFunction: (schema, value) => parsed(schema, value) };
+/**
+ * A body that is not what its content type claims.
+ *
+ * **BOTH readers can fail.** Hono's own validator catches in both branches and throws
+ * `HTTPException` - which is what escapes the app's envelope. Catching here is what lets the failure
+ * be reported like any other. Measured: an unreadable multipart body answered 500 while the JSON case
+ * answered 400, from the same missing `try`.
+ */
+const UNREADABLE = Symbol("a body that is not what its content type claims");
+/**
+ * Reads a body in the form its target names.
+ *
+ * **JSON naming the object prototype is unreadable.** Zod strips a `__proto__` key unread
+ * (colinhacks/zod#6386), so `Record<boolean>` accepted `{"__proto__": 1}`, which the document
+ * refuses. Fastify and hapi refuse such a body by default, at the parser, through
+ * `secure-json-parse` - a `__proto__` key, or `constructor.prototype`, anywhere in it - and so
+ * does this reader. A body the document would accept is refused with it, as theirs is.
+ */
+async function readBody(c, target, parts = []) {
+    try {
+        if (target === "form")
+            return await readForm(c, parts);
+        // A text body IS the text: it is validated as the string the caller sent, not parsed first.
+        if (target === "text")
+            return await c.req.text();
+        return parseJson(await c.req.text());
+    }
+    catch {
+        return UNREADABLE;
+    }
+}
+/**
+ * **A form, each part the document reads from text handed over as its text.** A client may send such
+ * a part with a filename - `curl -F 'r=@data.json;type=application/json'` - and `parseBody` then
+ * hands it over as a file, which the part's schema, reading text, refused: the part's media type says
+ * what it is, not the filename. A file part and raw bytes are left as they arrive.
+ *
+ * **A JSON part naming the object prototype is unreadable**, as a JSON body is - see `readBody`. Its
+ * JSON is parsed by the part's schema, which `secure-json-parse` never saw, so `{"__proto__": 1}`
+ * reached a `Record<boolean>` part and was accepted, the key dropped. A part that may be text or
+ * JSON is read as either by its schema, and its text stays text.
+ */
+async function readForm(c, parts) {
+    const form = await c.req.parseBody({ all: true });
+    for (const [name, json] of parts) {
+        const value = form[name];
+        if (value === undefined)
+            continue;
+        const texts = await Promise.all((Array.isArray(value) ? value : [value]).map((each) => typeof each === "string" ? each : each.text()));
+        if (json && texts.some(namesPrototype))
+            return UNREADABLE;
+        form[name] = Array.isArray(value) ? texts : (texts[0] ?? "");
+    }
+    return form;
+}
+/** JSON that `secure-json-parse` refuses where `JSON.parse` does not: the prototype named. */
+function namesPrototype(text) {
+    try {
+        JSON.parse(text);
+    }
+    catch {
+        // No JSON at all, which the part's schema refuses as such.
+        return false;
+    }
+    try {
+        parseJson(text);
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * The failure an unreadable body produces, in the shape every other rejection has.
+ *
+ * Parsing `undefined` against the body's own schema is what makes a real Zod failure, so
+ * `deps.invalid` receives what it receives for a failed parse rather than a special case it has to
+ * know about. A schema that somehow accepts `undefined` still fails: a body that could not be read
+ * is not a body that validated.
+ */
+function unreadableResult(schema) {
+    const result = parsed(schema, undefined);
+    return result.success ? { success: false } : result;
+}
+/**
+ * Which reader parses the media type the request actually carries.
+ *
+ * A route may declare several request media types needing different parsers, and which one applies is
+ * decided by the caller's `Content-Type` when the request arrives - not when this file was
+ * generated. Parameters (`; charset=utf-8`, `; boundary=...`) are not part of the match, which
+ * matters because a multipart request always carries a boundary.
+ *
+ * **A `Content-Type` matching nothing declared is REFUSED, and used to be parsed anyway.** It fell
+ * through to the first branch, and the comment here claimed the body would then "simply fail to
+ * parse" - which is not what happened: `c.req.json()` reads the bytes whatever the header says, so a
+ * route publishing `application/json` alone answered 200 to the same body sent as `text/plain`, as
+ * `multipart/form-data`, and with no `Content-Type` at all. The document says which media types an
+ * operation accepts, and a server that accepts others is not serving that document.
+ *
+ * `undefined` means "nothing declared covers this", and the caller refuses it through
+ * `deps.invalid` like any other bad request. No status is invented that the document does not
+ * describe, which is also what `@typespec/http-server-js` does with the identical case.
+ */
+function bodyBranch(c, branches) {
+    const declared = (c.req.header("content-type") ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+    if (declared === "")
+        return undefined;
+    /**
+     * A declared media RANGE matches the types inside it, which a string comparison cannot do.
+     * `@typespec/http` reports a bare `string`-typed `contentType` as the wildcard range, and an author
+     * may write a subtype wildcard such as text-slash-star outright. Comparing the range TEXT refuses
+     * every real request, because no caller sends the range itself as its `Content-Type`. This is the
+     * request-side counterpart of `mediaTypeWithin` in the runtime module, inlined because the branch
+     * list is emitted here.
+     */
+    const covers = (range) => {
+        if (range === "*/*")
+            return true;
+        if (!range.endsWith("/*"))
+            return false;
+        const slash = declared.indexOf("/");
+        return slash > 0 && declared.slice(0, slash) === range.slice(0, -2);
+    };
+    return branches.find(([mediaType]) => {
+        const lowered = mediaType.toLowerCase();
+        return lowered === declared || covers(lowered);
+    });
+}
+/**
+ * The failure an undeclared media type produces, in the shape every other rejection has.
+ *
+ * Reported as an issue on the body rather than a bare `{ success: false }`, so an application's
+ * `invalid` hook can tell a caller WHICH thing was wrong - the same reason `unreadableResult` parses
+ * `undefined` rather than inventing a result.
+ */
+function unsupportedMediaTypeResult(branches) {
+    return {
+        success: false,
+        error: new z.ZodError([
+            {
+                code: "custom",
+                path: ["content-type"],
+                message: `this operation accepts ${branches.map(([type]) => type).join(", ")}`,
+            },
+        ]),
+    };
+}
+/**
+ * Validate a REQUIRED request body, whatever media type it arrives as.
+ *
+ * The validated value is published under `"json"` whichever reader produced it: `ValidationTargets`
+ * is a closed union in Hono, so there is no name to coin for "the body", and using one slot is what
+ * makes every route the same shape downstream.
+ */
+function validateBody(schema, invalid, branches) {
+    return async (c, next) => {
+        /**
+         * Annotated rather than inlined, and that is what removes a CAST from this file. `Context` is
+         * invariant in its environment and in its `Input`, so passing the outer `c` to a hook typed
+         * against the route's own input needs either an annotation here or an `as never` there.
+         */
+        const parse = async (ctx, proceed) => {
+            const branch = bodyBranch(ctx, branches);
+            const reading = branch?.[2] ?? schema;
+            const raw = branch === undefined ? UNREADABLE : await readBody(ctx, branch[1], branch[3]);
+            const result = branch === undefined
+                ? unsupportedMediaTypeResult(branches)
+                : raw === UNREADABLE
+                    ? unreadableResult(reading)
+                    : parsed(reading, raw);
+            const response = invalid(result, ctx);
+            if (response !== undefined)
+                return response;
+            if (!result.success)
+                return ctx.json(result, 400);
+            ctx.req.addValidatedData("json", ("data" in result ? result.data : undefined) ?? {});
+            await proceed();
+            return undefined;
+        };
+        return parse(c, next);
+    };
+}
+/** Mount every operation the service declares. */
+export function registerRoutes(app, handlersFor, deps) {
+    const contexts = new WeakMap();
+    const contextFor = (authentication) => async (c, next) => {
+        const ctx = deps.context(c, authentication);
+        if (ctx === null)
+            return deps.noContext(c);
+        contexts.set(c, { value: ctx });
+        await next();
+        return undefined;
+    };
+    const contextOf = (c) => {
+        const held = contexts.get(c);
+        if (held === undefined)
+            throw new Error("typespec-hono: no caller context was established for this request");
+        return held.value;
+    };
+    const asksRoutes = new Hono()
+        .get("/", deps.authorize([{ "BearerAuth": [] }]), zValidator("query", Asks_listQuery, deps.invalid, SYNC), contextFor("required"), async (c) => {
+        const result = await handlersFor(c).Asks_list(contextOf(c), {
+            ...c.req.valid("query"),
+        });
+        switch (result.status) {
+            case 200: {
+                return c.json(servedBody(askPageSchema, result.body, "Asks_list", 200), 200);
+            }
+            case 401: {
+                return c.json(servedBody(problemSchema, result.body, "Asks_list", 401), 401);
+            }
+            default:
+                throw new UndeclaredStatusError("Asks_list", result);
+        }
+    })
+        .get("/:id", deps.authorize([{ "BearerAuth": [] }]), zValidator("param", Asks_readPath, deps.invalid, SYNC), contextFor("required"), async (c) => {
+        const result = await handlersFor(c).Asks_read(contextOf(c), {
+            ...c.req.valid("param"),
+        });
+        switch (result.status) {
+            case 200: {
+                return c.json(servedBody(askSchema, result.body, "Asks_read", 200), 200);
+            }
+            case 401: {
+                return c.json(servedBody(problemSchema, result.body, "Asks_read", 401), 401);
+            }
+            case 404: {
+                return c.json(servedBody(problemSchema, result.body, "Asks_read", 404), 404);
+            }
+            default:
+                throw new UndeclaredStatusError("Asks_read", result);
+        }
+    })
+        .post("/:id/reply", deps.authorize([{ "BearerAuth": [] }]), zValidator("param", Asks_replyPath, deps.invalid, SYNC), validateBody(replySchema, deps.invalid, [
+        ["application/json", "json"],
+    ]), contextFor("required"), async (c) => {
+        const result = await handlersFor(c).Asks_reply(contextOf(c), {
+            ...c.req.valid("param"),
+            reply: c.req.valid("json"),
+        });
+        switch (result.status) {
+            case 200: {
+                return c.json(servedBody(askSchema, result.body, "Asks_reply", 200), 200);
+            }
+            case 401: {
+                return c.json(servedBody(problemSchema, result.body, "Asks_reply", 401), 401);
+            }
+            case 404: {
+                return c.json(servedBody(problemSchema, result.body, "Asks_reply", 404), 404);
+            }
+            case 409: {
+                return c.json(servedBody(problemSchema, result.body, "Asks_reply", 409), 409);
+            }
+            case 422: {
+                return c.json(servedBody(problemSchema, result.body, "Asks_reply", 422), 422);
+            }
+            default:
+                throw new UndeclaredStatusError("Asks_reply", result);
+        }
+    });
+    const basePathRoutes = new Hono()
+        .get("/whoami", deps.authorize([{ "BearerAuth": [] }]), contextFor("required"), async (c) => {
+        const result = await handlersFor(c).Session_whoami(contextOf(c), {});
+        switch (result.status) {
+            case 200: {
+                return c.json(servedBody(whoamiSchema, result.body, "Session_whoami", 200), 200);
+            }
+            case 401: {
+                return c.json(servedBody(problemSchema, result.body, "Session_whoami", 401), 401);
+            }
+            default:
+                throw new UndeclaredStatusError("Session_whoami", result);
+        }
+    })
+        .post("/events/tickets", deps.authorize([{ "BearerAuth": [] }]), contextFor("required"), async (c) => {
+        const result = await handlersFor(c).EventTickets_issue(contextOf(c), {});
+        switch (result.status) {
+            case 201: {
+                return c.json(servedBody(eventTicketSchema, result.body, "EventTickets_issue", 201), 201);
+            }
+            case 401: {
+                return c.json(servedBody(problemSchema, result.body, "EventTickets_issue", 401), 401);
+            }
+            default:
+                throw new UndeclaredStatusError("EventTickets_issue", result);
+        }
+    })
+        .get("/snapshot", deps.authorize([{ "BearerAuth": [] }]), contextFor("required"), async (c) => {
+        const result = await handlersFor(c).Snapshots_read(contextOf(c), {});
+        switch (result.status) {
+            case 200: {
+                return c.json(servedBody(snapshotSchema, result.body, "Snapshots_read", 200), 200);
+            }
+            case 401: {
+                return c.json(servedBody(problemSchema, result.body, "Snapshots_read", 401), 401);
+            }
+            default:
+                throw new UndeclaredStatusError("Snapshots_read", result);
+        }
+    })
+        .get("/files/:uploadId", deps.authorize([{ "BearerAuth": [] }]), zValidator("param", Files_readPath, deps.invalid, SYNC), contextFor("required"), async (c) => {
+        const result = await handlersFor(c).Files_read(contextOf(c), {
+            ...c.req.valid("param"),
+        });
+        switch (result.status) {
+            case 200: {
+                switch (result.contentType) {
+                    case "image/png":
+                        return c.body(servedBytes(result.body), 200, headersOf({ "Content-Type": result.contentType }));
+                    case "image/jpeg":
+                        return c.body(servedBytes(result.body), 200, headersOf({ "Content-Type": result.contentType }));
+                    case "image/webp":
+                        return c.body(servedBytes(result.body), 200, headersOf({ "Content-Type": result.contentType }));
+                    case "image/gif":
+                        return c.body(servedBytes(result.body), 200, headersOf({ "Content-Type": result.contentType }));
+                }
+                throw new UndeclaredStatusError("Files_read", result);
+            }
+            case 401: {
+                return c.json(servedBody(problemSchema, result.body, "Files_read", 401), 401);
+            }
+            case 404: {
+                return c.json(servedBody(problemSchema, result.body, "Files_read", 404), 404);
+            }
+            default:
+                throw new UndeclaredStatusError("Files_read", result);
+        }
+    })
+        .put("/uploads/:spaceId/:token", zValidator("param", Uploads_storePath, deps.invalid, SYNC), zValidator("header", Uploads_storeHeader, deps.invalid, SYNC), contextFor("none"), async (c) => {
+        const result = await handlersFor(c).Uploads_store(contextOf(c), {
+            ...c.req.valid("param"),
+            ...c.req.valid("header"),
+            body: c.req.raw.body,
+        });
+        switch (result.status) {
+            case 201: {
+                return c.json(servedBody(uploadReceiptSchema, result.body, "Uploads_store", 201), 201);
+            }
+            case 404: {
+                return c.json(servedBody(problemSchema, result.body, "Uploads_store", 404), 404);
+            }
+            case 410: {
+                return c.json(servedBody(problemSchema, result.body, "Uploads_store", 410), 410);
+            }
+            case 413: {
+                return c.json(servedBody(problemSchema, result.body, "Uploads_store", 413), 413);
+            }
+            case 422: {
+                return c.json(servedBody(problemSchema, result.body, "Uploads_store", 422), 422);
+            }
+            default:
+                throw new UndeclaredStatusError("Uploads_store", result);
+        }
+    })
+        .route("/asks", asksRoutes);
+    return app
+        .route("/api/v1", basePathRoutes);
+}