@lovrozagar/honey 0.1.0

package/src/validation.ts

@@ -0,0 +1,300 @@
+import { HoneyError } from "./error.ts"
+import type {
+	FieldError,
+	InputSchemaEntry,
+	InputSchemasDef,
+	NormalizedIssue,
+	StandardSchemaIssue,
+	StandardSchemaLike,
+} from "./types.ts"
+import { EK, SK } from "./types.ts"
+
+type ValidatedInput = {
+	cookies?: unknown
+	form?: unknown
+	headers?: unknown
+	json?: unknown
+	params?: unknown
+	search?: unknown
+}
+
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"])
+
+const CODE_MAP: Record<string, string> = {
+	invalid_format: "field_invalid_format",
+	invalid_value: "field_invalid_enum",
+	not_multiple: "field_not_multiple_of",
+	required: "field_required",
+	too_big: "field_too_big",
+	too_long: "field_too_long",
+	too_short: "field_too_short",
+	too_small: "field_too_small",
+	unrecognized: "field_unrecognized_keys",
+}
+
+export function mapNormalizedCode(code: string): string {
+	return CODE_MAP[code] ?? "field_invalid"
+}
+
+export function selectParser(contentType: string | null): "form" | "json" | null {
+	if (contentType === null) return null
+	if (contentType.startsWith("application/json")) return "json"
+	if (contentType.startsWith("multipart/form-data")) return "form"
+	if (contentType.startsWith("application/x-www-form-urlencoded")) return "form"
+	return null
+}
+
+function tryDecodeCookieValue(value: string): string {
+	try {
+		return decodeURIComponent(value)
+	} catch {
+		return value
+	}
+}
+
+export function parseCookies(header: string): Record<string, string> {
+	const result: Record<string, string> = {}
+	if (header.length === 0) return result
+	for (const pair of header.split(";")) {
+		const trimmed = pair.trim()
+		const eqIdx = trimmed.indexOf("=")
+		if (eqIdx === -1) continue
+		const name = trimmed.slice(0, eqIdx)
+		if (DANGEROUS_KEYS.has(name)) continue
+		let value = trimmed.slice(eqIdx + 1)
+		if (value.indexOf("%") !== -1) value = tryDecodeCookieValue(value)
+		/* RFC 6265: strip surrounding double quotes */
+		if (
+			value.length >= 2 &&
+			value.charCodeAt(0) === 34 &&
+			value.charCodeAt(value.length - 1) === 34
+		) {
+			value = value.slice(1, -1)
+		}
+		result[name] = value
+	}
+	return result
+}
+
+function toPropertyKey(segment: PropertyKey | { readonly key: PropertyKey }): PropertyKey {
+	if (typeof segment === "object" && segment !== null && "key" in segment) {
+		return segment.key
+	}
+	return segment
+}
+
+type VendorIssue = StandardSchemaIssue & { code?: string; type?: string }
+
+function extractVendorCode(issue: StandardSchemaIssue, vendor: string): string {
+	const vi = issue as VendorIssue
+	if (vendor === "zod" || vendor === "arktype") {
+		return typeof vi.code === "string" ? vi.code : "unknown"
+	}
+	if (vendor === "valibot") {
+		return typeof vi.type === "string" ? vi.type : "unknown"
+	}
+	return "unknown"
+}
+
+export function normalizeIssues(
+	issues: ReadonlyArray<StandardSchemaIssue>,
+	vendor: string,
+): NormalizedIssue[] {
+	return issues.map((issue) => {
+		const path = issue.path ? issue.path.map(toPropertyKey) : []
+		return {
+			code: extractVendorCode(issue, vendor),
+			message: issue.message,
+			meta: {
+				field: path.at(-1)?.toString(),
+			},
+			path,
+		}
+	})
+}
+
+export function issuesToFieldErrors(
+	issues: NormalizedIssue[],
+	prefix: string,
+): Record<string, FieldError[]> {
+	const fields: Record<string, FieldError[]> = {}
+	for (const issue of issues) {
+		const fieldName = issue.path.at(-1)?.toString() ?? "unknown"
+		const fullPath = `${prefix}.${issue.path.map(String).join(".")}`
+		const error: FieldError = {
+			error_key: mapNormalizedCode(issue.code),
+			message: issue.message,
+			path: fullPath,
+		}
+		if (fields[fieldName] === undefined) {
+			fields[fieldName] = []
+		}
+		fields[fieldName].push(error)
+	}
+	return fields
+}
+
+async function runSchema(
+	schema: StandardSchemaLike,
+	data: unknown,
+	prefix: string,
+): Promise<unknown> {
+	const result = await schema["~standard"].validate(data)
+	if (result.issues) {
+		const normalized = normalizeIssues(result.issues, schema["~standard"].vendor)
+		const fields = issuesToFieldErrors(normalized, prefix)
+		throw new HoneyError({
+			errorKey: EK.validation_failed,
+			fields,
+			status: SK.bad_request,
+		})
+	}
+	return result.value
+}
+
+function parseSearchParams(url: string): Record<string, string | string[]> {
+	const searchParams = new URL(url).searchParams
+	const result: Record<string, string | string[]> = {}
+	for (const [key, value] of searchParams) {
+		const existing = result[key]
+		if (existing === undefined) {
+			result[key] = value
+		} else if (Array.isArray(existing)) {
+			existing.push(value)
+		} else {
+			result[key] = [existing, value]
+		}
+	}
+	return result
+}
+
+function headersToRecord(headers: Headers): Record<string, string> {
+	const result: Record<string, string> = {}
+	headers.forEach((value, key) => {
+		result[key] = value
+	})
+	return result
+}
+
+type ResolvedSchema = {
+	mode: "readableStream" | "standard"
+	schema: StandardSchemaLike
+}
+
+function resolveSchema(entry: InputSchemaEntry): ResolvedSchema {
+	if ("_tag" in entry) {
+		return {
+			mode: "readableStream",
+			schema: entry.schema as StandardSchemaLike,
+		}
+	}
+	return { mode: "standard", schema: entry }
+}
+
+function formDataToRecord(formData: FormData): Record<string, unknown> {
+	const record: Record<string, unknown> = {}
+	formData.forEach((value, key) => {
+		if (DANGEROUS_KEYS.has(key)) return
+		record[key] = value
+	})
+	return record
+}
+
+function urlEncodedToRecord(body: string): Record<string, string> {
+	const params = new URLSearchParams(body)
+	const record: Record<string, string> = {}
+	params.forEach((value, key) => {
+		if (DANGEROUS_KEYS.has(key)) return
+		record[key] = value
+	})
+	return record
+}
+
+export async function validateInput(
+	schemas: InputSchemasDef,
+	req: Request,
+	params: Record<string, string>,
+): Promise<ValidatedInput> {
+	const result: ValidatedInput = {}
+
+	/* params */
+	if (schemas.params) {
+		const { mode, schema } = resolveSchema(schemas.params)
+		result.params = mode === "readableStream" ? params : await runSchema(schema, params, "params")
+	}
+
+	/* search */
+	if (schemas.search) {
+		const { mode, schema } = resolveSchema(schemas.search)
+		const parsed = parseSearchParams(req.url)
+		result.search = mode === "readableStream" ? parsed : await runSchema(schema, parsed, "search")
+	}
+
+	/* headers */
+	if (schemas.headers) {
+		const { mode, schema } = resolveSchema(schemas.headers)
+		const headerRecord = headersToRecord(req.headers)
+		result.headers =
+			mode === "readableStream" ? headerRecord : await runSchema(schema, headerRecord, "headers")
+	}
+
+	/* cookies */
+	if (schemas.cookies) {
+		const { mode, schema } = resolveSchema(schemas.cookies)
+		const cookieHeader = req.headers.get("cookie") ?? ""
+		const parsed = parseCookies(cookieHeader)
+		result.cookies = mode === "readableStream" ? parsed : await runSchema(schema, parsed, "cookies")
+	}
+
+	/* body-based: json or form — skip for methods without a request body */
+	const hasBody =
+		req.method !== "DELETE" &&
+		req.method !== "GET" &&
+		req.method !== "HEAD" &&
+		req.method !== "OPTIONS"
+	if (hasBody && (schemas.json || schemas.form)) {
+		const contentType = req.headers.get("content-type")
+		const parser = selectParser(contentType)
+
+		if (schemas.json && parser === "json") {
+			const { mode, schema } = resolveSchema(schemas.json)
+			if (mode === "readableStream") {
+				/* body untouched — handler reads ctx.req.body directly */
+			} else {
+				const body: unknown = await req.json()
+				result.json = await runSchema(schema, body, "json")
+			}
+		} else if (schemas.form && parser === "form") {
+			const { mode, schema } = resolveSchema(schemas.form)
+			if (mode === "readableStream") {
+				/* body untouched — handler reads ctx.req.body directly */
+			} else if (contentType?.startsWith("multipart/form-data")) {
+				result.form = await runSchema(schema, formDataToRecord(await req.formData()), "form")
+			} else {
+				result.form = await runSchema(schema, urlEncodedToRecord(await req.text()), "form")
+			}
+		} else {
+			throw new HoneyError({
+				errorKey: EK.unsupported_media_type,
+				status: SK.unsupported_media_type,
+			})
+		}
+	}
+
+	return result
+}
+
+export async function validateOutput(
+	schema: StandardSchemaLike,
+	statusKey: string,
+	data: unknown,
+): Promise<void> {
+	const result = await schema["~standard"].validate(data)
+	if (result.issues) {
+		throw new HoneyError({
+			errorKey: EK.output_validation_failed,
+			status: SK.internal_server_error,
+			vars: { statusKey },
+		})
+	}
+}

package/src/ws/bun.ts

@@ -0,0 +1,89 @@
+export {
+	type RawSocket,
+	type WSAdapter,
+	type WSContext,
+	WSContextImpl,
+	type WSHandler,
+} from "./cloudflare.ts"
+
+import type { WSAdapter, WSContext, WSHandler } from "./cloudflare.ts"
+import { WSContextImpl } from "./cloudflare.ts"
+
+type BunRawSocket = {
+	close(code?: number, reason?: string): void
+	data: BunWSData
+	readyState: number
+	send(data: ArrayBufferLike | ArrayBufferView | string, compress?: boolean): number
+}
+
+type BunWSData = {
+	handler: WSHandler<unknown>
+	socket: WSContext
+}
+
+type BunServer = {
+	upgrade<T>(req: Request, opts?: { data?: T }): boolean
+}
+
+export type BunWSAdapter = WSAdapter & {
+	websocket: {
+		close(ws: BunRawSocket, code: number, reason: string): void
+		message(ws: BunRawSocket, data: ArrayBufferView | string): void
+		open(ws: BunRawSocket): void
+	}
+}
+
+/**
+ * Bun WebSocket adapter.
+ * Returns adapter + websocket handler object for Bun.serve().
+ * Bun has no onError callback (noted limitation).
+ * Keepalive is not supported — Bun's WS API lacks ping/pong control.
+ * Use nodeWebSocket() for keepalive support.
+ */
+export function bunWebSocket(): BunWSAdapter {
+	return {
+		upgrade(req: Request, env: unknown, handler: WSHandler<unknown>) {
+			const server = (env as Record<string, unknown>).server as BunServer
+			/*
+			 * Socket is undefined here — Bun creates it lazily in the open callback.
+			 * WSContext cast is safe: actual socket is assigned in open/message/close
+			 * before any user code accesses it.
+			 */
+			const success = server.upgrade<BunWSData>(req, {
+				data: { handler, socket: undefined as unknown as WSContext },
+			})
+			if (!success) {
+				return {
+					response: new Response("WebSocket upgrade failed", { status: 500 }),
+					socket: undefined as unknown as WSContext,
+				}
+			}
+			/* Node's Response rejects status 101 (Fetch spec: 200-599 only).
+			   Create a valid Response and override status for the sentinel check. */
+			const response = new Response(null)
+			Object.defineProperty(response, "status", { value: 101 })
+			return {
+				response,
+				socket: undefined as unknown as WSContext,
+			}
+		},
+
+		websocket: {
+			close(ws: BunRawSocket, code: number, reason: string) {
+				if (!ws.data.socket) ws.data.socket = new WSContextImpl(ws)
+				ws.data.handler.onClose?.(undefined, ws.data.socket, code, reason)
+			},
+			message(ws: BunRawSocket, data: ArrayBufferView | string) {
+				if (!ws.data.socket) ws.data.socket = new WSContextImpl(ws)
+				/* Bun passes Buffer (Uint8Array) for binary — normalize to ArrayBuffer for WSHandler */
+				const normalized =
+					typeof data === "string" ? data : ((data as Uint8Array).buffer as ArrayBuffer)
+				ws.data.handler.onMessage?.(undefined, ws.data.socket, normalized)
+			},
+			open(ws: BunRawSocket) {
+				if (!ws.data.socket) ws.data.socket = new WSContextImpl(ws)
+				ws.data.handler.onOpen?.(undefined, ws.data.socket)
+			},
+		},
+	}
+}

package/src/ws/cloudflare.ts

@@ -0,0 +1,133 @@
+import type { WSReadyState } from "../types.ts"
+
+export const WS_SEND_BUFFER_MAX = 32
+
+export type WSContext<T = unknown> = {
+	close(code?: number, reason?: string): void
+	raw: T
+	readyState: WSReadyState
+	send(data: ArrayBuffer | Uint8Array | object | string): void
+}
+
+export type WSHandler<TCtx = unknown> = {
+	onClose?(ctx: TCtx, ws: WSContext, code: number, reason: string): Promise<void> | void
+	onError?(ctx: TCtx, ws: WSContext, error: unknown): Promise<void> | void
+	onMessage?(ctx: TCtx, ws: WSContext, data: ArrayBuffer | string): Promise<void> | void
+	onOpen?(ctx: TCtx, ws: WSContext): Promise<void> | void
+	onReconnect?(ctx: TCtx, ws: WSContext, token: string): Promise<void> | void
+}
+
+export type WSPreUpgrade = {
+	response: Response
+	socket: WSContext
+	/** Run `fn` now if the socket is already open, otherwise on the next open. */
+	whenOpen(fn: () => void): void
+}
+
+export type WSAdapter = {
+	upgrade(
+		req: Request,
+		env: unknown,
+		handler: WSHandler<unknown>,
+	): Promise<{ response: Response; socket: WSContext }> | { response: Response; socket: WSContext }
+	/**
+	 * Deno requires `Deno.upgradeWebSocket` in the same turn as the serve
+	 * callback. When present, Honey calls this synchronously from `fetch`
+	 * and returns `response` before any middleware Promise.
+	 */
+	preUpgrade?(req: Request): WSPreUpgrade | undefined
+}
+
+export type RawSocket = {
+	close(code?: number, reason?: string): void
+	readyState: number
+	send(data: ArrayBuffer | Uint8Array | string): void
+}
+
+export class WSContextImpl<T extends RawSocket = RawSocket> implements WSContext<T> {
+	raw: T
+	private sendBuffer: Array<ArrayBuffer | Uint8Array | string> = []
+
+	constructor(raw: T) {
+		this.raw = raw
+		const target = raw as T & { addEventListener?(type: string, listener: () => void): void }
+		if (raw.readyState !== 1 && typeof target.addEventListener === "function") {
+			target.addEventListener("open", () => {
+				for (const msg of this.sendBuffer) this.raw.send(msg)
+				this.sendBuffer = []
+			})
+		}
+	}
+
+	get readyState(): WSReadyState {
+		return this.raw.readyState as WSReadyState
+	}
+
+	close(code?: number, reason?: string): void {
+		this.sendBuffer = []
+		this.raw.close(code, reason)
+	}
+
+	send(data: ArrayBuffer | Uint8Array | object | string): void {
+		const payload =
+			typeof data === "string" || data instanceof ArrayBuffer || data instanceof Uint8Array
+				? data
+				: JSON.stringify(data)
+		if (this.raw.readyState === 1) {
+			this.raw.send(payload)
+			return
+		}
+		if (this.sendBuffer.length >= WS_SEND_BUFFER_MAX) this.sendBuffer.shift()
+		this.sendBuffer.push(payload)
+	}
+}
+
+/**
+ * Cloudflare Workers WebSocket adapter.
+ * Uses WebSocketPair + server.accept() + addEventListener.
+ */
+export function cfWebSocket(): WSAdapter {
+		return {
+			upgrade(_req: Request, _env: unknown, handler: WSHandler<unknown>) {
+				type CFWebSocket = RawSocket & { accept(): void }
+				const Ctor = (globalThis as Record<string, unknown>)["WebSocketPair"] as new () => [
+					CFWebSocket,
+					CFWebSocket,
+				]
+			const [client, server] = new Ctor()
+			server.accept()
+			const socket = new WSContextImpl(server)
+
+			const raw = server as unknown as EventTarget & RawSocket
+			if ("addEventListener" in raw) {
+				raw.addEventListener("message", (evt: Event) => {
+					const data = (evt as MessageEvent).data
+					handler.onMessage?.(undefined, socket, data)
+				})
+				raw.addEventListener("close", (evt: Event) => {
+					const closeEvt = evt as CloseEvent
+					handler.onClose?.(undefined, socket, closeEvt.code, closeEvt.reason)
+					/* echo close frame so the client handshake completes */
+					try {
+						server.close(closeEvt.code, closeEvt.reason)
+					} catch {
+						/* already closed */
+					}
+				})
+				raw.addEventListener("error", (evt: Event) => {
+					handler.onError?.(undefined, socket, evt)
+				})
+			}
+			handler.onOpen?.(undefined, socket)
+
+				return {
+					response: new Response(null, {
+						headers: { upgrade: "websocket" },
+						status: 101,
+						webSocket: client,
+					} as unknown as ResponseInit),
+					socket,
+				}
+			},
+	}
+}

package/src/ws/deno.ts

@@ -0,0 +1,109 @@
+export {
+	type RawSocket,
+	type WSAdapter,
+	type WSContext,
+	type WSPreUpgrade,
+	WSContextImpl,
+	type WSHandler,
+} from "./cloudflare.ts";
+
+import type { WSAdapter, WSHandler, WSPreUpgrade } from "./cloudflare.ts";
+import { WSContextImpl } from "./cloudflare.ts";
+
+type DenoNs = {
+	Deno: {
+		upgradeWebSocket(req: Request): {
+			response: Response;
+			socket: {
+				addEventListener(
+					type: string,
+					listener: (...args: never[]) => void,
+				): void;
+			} & DenoRawSocket;
+		};
+	};
+};
+
+type DenoRawSocket = {
+	close(code?: number, reason?: string): void;
+	readyState: number;
+	send(data: ArrayBuffer | Uint8Array | string): void;
+};
+
+type DenoSocket = {
+	addEventListener(type: string, listener: (...args: never[]) => void): void
+} & DenoRawSocket
+
+function bindHandlers(rawSocket: DenoSocket, socket: WSContextImpl<DenoRawSocket>, handler: WSHandler<unknown>): void {
+	rawSocket.addEventListener("open", () => {
+		handler.onOpen?.(undefined, socket);
+	});
+	rawSocket.addEventListener(
+		"message",
+		(evt: { data: ArrayBuffer | string }) => {
+			handler.onMessage?.(undefined, socket, evt.data);
+		},
+	);
+	rawSocket.addEventListener(
+		"close",
+		(evt: { code: number; reason: string }) => {
+			handler.onClose?.(undefined, socket, evt.code, evt.reason);
+		},
+	);
+	rawSocket.addEventListener("error", (evt: unknown) => {
+		handler.onError?.(undefined, socket, evt);
+	});
+}
+
+/**
+ * Deno WebSocket adapter.
+ * Uses Deno.upgradeWebSocket() and addEventListener for event binding.
+ * Keepalive is not supported — Deno's WebSocket lacks a ping() method.
+ * Use nodeWebSocket() for keepalive support.
+ *
+ * `preUpgrade` calls `Deno.upgradeWebSocket` in the same turn as the serve
+ * callback (Deno rejects upgrades performed after the first await).
+ */
+export function denoWebSocket(): WSAdapter {
+	const pending = new WeakMap<Request, { pre: WSPreUpgrade; raw: DenoSocket }>()
+
+	return {
+		preUpgrade(req: Request): WSPreUpgrade {
+			const denoNs = globalThis as unknown as DenoNs;
+			const { response, socket: rawSocket } = denoNs.Deno.upgradeWebSocket(req);
+			const socket = new WSContextImpl(rawSocket as DenoRawSocket);
+			const pre: WSPreUpgrade = {
+				response,
+				socket,
+				whenOpen(fn: () => void) {
+					if (rawSocket.readyState === 1) {
+						fn()
+						return
+					}
+					rawSocket.addEventListener("open", () => fn())
+				},
+			}
+			pending.set(req, { pre, raw: rawSocket })
+			return pre
+		},
+		upgrade(req: Request, _env: unknown, handler: WSHandler<unknown>) {
+			const held = pending.get(req)
+			if (held) {
+				pending.delete(req)
+				bindHandlers(held.raw, held.pre.socket as WSContextImpl<DenoRawSocket>, handler)
+				/* handshake may have completed before listeners were attached */
+				if (held.raw.readyState === 1) {
+					handler.onOpen?.(undefined, held.pre.socket)
+				}
+				return held.pre
+			}
+
+			/* globalThis cast: Deno namespace only exists at runtime on Deno — no way to type it statically */
+			const denoNs = globalThis as unknown as DenoNs;
+			const { response, socket: rawSocket } = denoNs.Deno.upgradeWebSocket(req);
+			const socket = new WSContextImpl(rawSocket as DenoRawSocket);
+			bindHandlers(rawSocket, socket, handler)
+			return { response, socket };
+		},
+	};
+}