@lovrozagar/honey 0.6.8 → 0.7.0

package/src/client-go/sse.go

@@ -5,6 +5,7 @@ package sdk
 import (
 	"bufio"
 	"context"
+	"errors"
 	"io"
 	"iter"
 	"net/http"
@@ -12,7 +13,8 @@ import (
 	"strings"
 )
 
-// SSEEvent represents a single server-sent event.
+// SSEEvent represents a single server-sent event. ID is the last event ID seen
+// on the stream so far (the spec's sticky "last event ID buffer").
 type SSEEvent struct {
 	Data  string
 	Event string
@@ -20,130 +22,138 @@ type SSEEvent struct {
 	Retry int
 }
 
-const sseMaxBuffer = 1024 * 1024
+// sseMaxLine caps one line, and sseMaxEvent the data of one event.
+const (
+	sseMaxLine  = 1024 * 1024
+	sseMaxEvent = 8 * 1024 * 1024
+)
+
+// ErrSSELineTooLong is returned when a single SSE line exceeds the cap.
+var ErrSSELineTooLong = errors.New("honey: sse line exceeds 1 MiB")
 
 // parseSSEStream returns an iter.Seq2 that yields SSEEvent values read from resp.Body.
 // On non-2xx response it yields a typed error immediately then terminates.
 // The response body is closed when the iterator returns.
-//
-// Ported from public/honey/core/src/client/sse.ts:62-102 — bufio.Scanner with
-// double-newline split mirrors the TextDecoder+split(/\r\n\r\n|…/) approach.
 func parseSSEStream(ctx context.Context, resp *http.Response) iter.Seq2[SSEEvent, error] {
 	return func(yield func(SSEEvent, error) bool) {
 		defer resp.Body.Close()
 
 		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-			body, _ := io.ReadAll(resp.Body)
-			apiErr := raiseForStatus(resp, body)
-			yield(SSEEvent{}, apiErr)
+			body, _ := readBody(resp.Body, 64<<10)
+			yield(SSEEvent{}, raiseForStatus(resp, body))
 			return
 		}
 
-		scanner := bufio.NewScanner(resp.Body)
-		scanner.Buffer(make([]byte, 0, 4096), sseMaxBuffer)
-		scanner.Split(splitDoubleNewline)
-
-		for scanner.Scan() {
+		for ev, err := range parseSSE(resp.Body) {
 			if ctx.Err() != nil {
 				return
 			}
-			block := scanner.Text()
-			if strings.TrimSpace(block) == "" {
-				continue
-			}
-			ev, ok := parseSSEBlock(block)
-			if !ok {
-				continue
-			}
-			if !yield(ev, nil) {
+			if !yield(ev, err) || err != nil {
 				return
 			}
 		}
-
-		if err := scanner.Err(); err != nil {
-			yield(SSEEvent{}, err)
-		}
 	}
 }
 
-// splitDoubleNewline is a bufio.SplitFunc that splits on \r\n\r\n, \n\n, or \r\r.
-func splitDoubleNewline(data []byte, atEOF bool) (advance int, token []byte, err error) {
-	delimiters := []string{"\r\n\r\n", "\n\n", "\r\r"}
-	for _, d := range delimiters {
-		db := []byte(d)
-		for i := 0; i <= len(data)-len(db); i++ {
-			match := true
-			for j := range db {
-				if data[i+j] != db[j] {
-					match = false
-					break
+// parseSSE implements the WHATWG event-stream parser: lines end in CRLF, LF or
+// CR; a blank line dispatches; a final event without its blank line is
+// discarded; the id is sticky across events; retry needs only ASCII digits.
+func parseSSE(r io.Reader) iter.Seq2[SSEEvent, error] {
+	return func(yield func(SSEEvent, error) bool) {
+		br := bufio.NewReaderSize(r, 64*1024)
+		var (
+			data      strings.Builder
+			hasData   bool
+			event     string
+			lastID    string
+			retry     int
+			firstLine = true
+		)
+		for {
+			line, err := readSSELine(br)
+			if err != nil {
+				if !errors.Is(err, io.EOF) {
+					yield(SSEEvent{}, err)
+				}
+				return
+			}
+			if firstLine {
+				line = strings.TrimPrefix(line, string(rune(0xFEFF)))
+				firstLine = false
+			}
+			if line == "" {
+				if hasData {
+					ev := SSEEvent{Data: data.String(), Event: event, ID: lastID, Retry: retry}
+					if !yield(ev, nil) {
+						return
+					}
 				}
+				data.Reset()
+				hasData = false
+				event = ""
+				retry = 0
+				continue
+			}
+			if strings.HasPrefix(line, ":") {
+				continue
 			}
-			if match {
-				return i + len(db), data[:i], nil
+			field, value := line, ""
+			if i := strings.IndexByte(line, ':'); i >= 0 {
+				field, value = line[:i], strings.TrimPrefix(line[i+1:], " ")
+			}
+			switch field {
+			case "data":
+				if hasData {
+					data.WriteByte('\n')
+				}
+				if data.Len()+len(value) > sseMaxEvent {
+					yield(SSEEvent{}, errors.New("honey: sse event exceeds 8 MiB"))
+					return
+				}
+				data.WriteString(value)
+				hasData = true
+			case "event":
+				event = value
+			case "id":
+				if !strings.ContainsRune(value, 0) {
+					lastID = value
+				}
+			case "retry":
+				if value != "" && strings.Trim(value, "0123456789") == "" {
+					if n, convErr := strconv.Atoi(value); convErr == nil {
+						retry = n
+					}
+				}
 			}
 		}
 	}
-	if atEOF && len(data) > 0 {
-		return len(data), data, nil
-	}
-	return 0, nil, nil
 }
 
-func parseSSEBlock(block string) (SSEEvent, bool) {
-	lines := strings.Split(block, "\n")
-	isComment := true
-	var data string
-	hasData := false
-	var event string
-	var id string
-	retry := 0
-
-	for _, rawLine := range lines {
-		line := strings.TrimRight(rawLine, "\r")
-		if strings.HasPrefix(line, ":") {
-			continue
-		}
-		isComment = false
-
-		colonIdx := strings.IndexByte(line, ':')
-		var field, val string
-		if colonIdx == -1 {
-			field = line
-			val = ""
-		} else {
-			field = line[:colonIdx]
-			val = line[colonIdx+1:]
-			if strings.HasPrefix(val, " ") {
-				val = val[1:]
+// readSSELine reads one line without its terminator. A CR may be followed by
+// an LF that belongs to the same terminator. io.EOF is returned only when no
+// complete line remains, so a truncated final line is never parsed.
+func readSSELine(br *bufio.Reader) (string, error) {
+	var b strings.Builder
+	for {
+		c, err := br.ReadByte()
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return "", io.EOF
 			}
+			return "", err
 		}
-
-		switch field {
-		case "data":
-			if !hasData {
-				data = val
-			} else {
-				data = data + "\n" + val
-			}
-			hasData = true
-		case "event":
-			event = val
-		case "id":
-			/* per spec: id containing null byte must be ignored */
-			if !strings.ContainsRune(val, 0) {
-				id = val
-			}
-		case "retry":
-			if n, err := strconv.Atoi(val); err == nil && n >= 0 {
-				retry = n
+		switch c {
+		case '\n':
+			return b.String(), nil
+		case '\r':
+			if next, peekErr := br.Peek(1); peekErr == nil && next[0] == '\n' {
+				_, _ = br.ReadByte()
 			}
+			return b.String(), nil
 		}
+		if b.Len() >= sseMaxLine {
+			return "", ErrSSELineTooLong
+		}
+		b.WriteByte(c)
 	}
-
-	if isComment || !hasData {
-		return SSEEvent{}, false
-	}
-
-	return SSEEvent{Data: data, Event: event, ID: id, Retry: retry}, true
 }

package/src/client-go/transport.go

@@ -12,6 +12,7 @@ import (
 	"net/url"
 	"strings"
 	"sync"
+	"time"
 
 	"nhooyr.io/websocket"
 )
@@ -28,6 +29,9 @@ const (
 
 // TransportOpts is handed to each Transport.Connect call. Mirrors the TS
 // TransportOpts plus per-language extras (HTTPClient for SSE/longpoll dial).
+//
+// MaxMessageBytes caps one inbound WebSocket message (zero means 16 MiB).
+// PollTimeout bounds one long-poll request (zero means 60s).
 type TransportOpts struct {
 	ReconnectToken       string
 	LastEventID          string
@@ -36,6 +40,20 @@ type TransportOpts struct {
 	ReconnectDelayMs     int
 	Protocols            []string
 	HTTPClient           *http.Client
+	MaxMessageBytes      int64
+	PollTimeout          time.Duration
+}
+
+const (
+	defaultMaxMessageBytes = 16 << 20
+	defaultPollTimeout     = 60 * time.Second
+)
+
+func (o *TransportOpts) maxMessageBytes() int64 {
+	if o == nil || o.MaxMessageBytes <= 0 {
+		return defaultMaxMessageBytes
+	}
+	return o.MaxMessageBytes
 }
 
 // TransportConn is the live per-transport connection object. Each built-in
@@ -106,6 +124,7 @@ func (t *WsTransport) Connect(ctx context.Context, rawURL string, opts *Transpor
 		if len(opts.Headers) > 0 {
 			dialOpts.HTTPHeader = opts.Headers.Clone()
 		}
+		dialOpts.HTTPClient = opts.HTTPClient
 	}
 	if dialOpts.Subprotocols == nil && len(t.Subprotocols) > 0 {
 		dialOpts.Subprotocols = t.Subprotocols
@@ -114,6 +133,7 @@ func (t *WsTransport) Connect(ctx context.Context, rawURL string, opts *Transpor
 	if err != nil {
 		return nil, err
 	}
+	conn.SetReadLimit(opts.maxMessageBytes())
 	return &wsConn{conn: conn}, nil
 }
 
@@ -155,6 +175,7 @@ func (c *wsConn) Close() error {
 	return c.conn.Close(websocket.StatusNormalClosure, "client close")
 }
 
+// toWsURL swaps the scheme only; a URL inside the query string is untouched.
 func toWsURL(u string) string {
 	if strings.HasPrefix(u, "https://") {
 		return "wss://" + u[len("https://"):]
@@ -199,8 +220,13 @@ func (t *SseTransport) Connect(ctx context.Context, rawURL string, opts *Transpo
 		}
 		u = u + sep + "reconnect_token=" + url.QueryEscape(opts.ReconnectToken)
 	}
-	req, err := http.NewRequestWithContext(ctx, "GET", u, nil)
+	/* ctx bounds the open only; the stream lives until Close cancels streamCtx */
+	streamCtx, cancel := context.WithCancel(context.Background())
+	stop := context.AfterFunc(ctx, cancel)
+	req, err := http.NewRequestWithContext(streamCtx, "GET", u, nil)
 	if err != nil {
+		stop()
+		cancel()
 		return nil, err
 	}
 	req.Header.Set("Accept", "text/event-stream")
@@ -218,19 +244,34 @@ func (t *SseTransport) Connect(ctx context.Context, rawURL string, opts *Transpo
 		req.Header.Set("X-Request-Id", newUUIDv4())
 	}
 	resp, err := client.Do(req)
+	opened := stop()
 	if err != nil {
+		cancel()
 		return nil, err
 	}
+	if !opened {
+		/* ctx ended while the headers arrived */
+		_ = resp.Body.Close()
+		cancel()
+		return nil, ctx.Err()
+	}
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		_ = resp.Body.Close()
+		cancel()
 		return nil, fmt.Errorf("honey: sse transport: status %d", resp.StatusCode)
 	}
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(strings.ToLower(ct), "text/event-stream") {
+		_ = resp.Body.Close()
+		cancel()
+		return nil, fmt.Errorf("honey: sse transport: unexpected content type %q", ct)
+	}
 	sc := &sseConn{
-		resp: resp,
-		next: make(chan sseResult, 1),
-		done: make(chan struct{}),
+		resp:   resp,
+		next:   make(chan sseResult, 1),
+		done:   make(chan struct{}),
+		cancel: cancel,
 	}
-	go sc.run(ctx)
+	go sc.run(streamCtx)
 	return sc, nil
 }
 
@@ -243,8 +284,10 @@ type sseConn struct {
 	resp   *http.Response
 	next   chan sseResult
 	done   chan struct{}
+	cancel context.CancelFunc
 	mu     sync.Mutex
 	closed bool
+	once   sync.Once
 }
 
 func (c *sseConn) Kind() TransportKind { return TransportSse }
@@ -303,21 +346,11 @@ func (c *sseConn) Send(ctx context.Context, data any) error {
 }
 
 func (c *sseConn) Close() error {
-	c.mu.Lock()
-	alreadyClosed := c.closed
-	c.mu.Unlock()
-	/* signal producer, then close body — parseSSEStream closes body on its own
-	 * iterator exit, but bodyClose here is idempotent for the already-closed
-	 * case via Body.Close()'s stdlib contract. */
-	select {
-	case <-c.done:
-	default:
+	c.once.Do(func() {
 		close(c.done)
-	}
-	if !alreadyClosed {
-		return c.resp.Body.Close()
-	}
-	return nil
+		c.cancel()
+	})
+	return c.resp.Body.Close()
 }
 
 /* ──────────────────────────── Longpoll adapter ─────────────────────────── */
@@ -346,9 +379,13 @@ func (t *LongpollTransport) Connect(ctx context.Context, rawURL string, opts *Tr
 		client = http.DefaultClient
 	}
 	lp := &longpollConn{
-		client:  client,
-		url:     rawURL,
-		headers: http.Header{},
+		client:      client,
+		url:         rawURL,
+		headers:     http.Header{},
+		pollTimeout: defaultPollTimeout,
+	}
+	if opts != nil && opts.PollTimeout > 0 {
+		lp.pollTimeout = opts.PollTimeout
 	}
 	if opts != nil {
 		lp.reconnectToken = opts.ReconnectToken
@@ -361,6 +398,7 @@ func (t *LongpollTransport) Connect(ctx context.Context, rawURL string, opts *Tr
 }
 
 type longpollConn struct {
+	pollTimeout    time.Duration
 	client         *http.Client
 	url            string
 	headers        http.Header
@@ -398,7 +436,9 @@ func (c *longpollConn) Recv(ctx context.Context) (any, error) {
 		}
 		u = u + sep + q.Encode()
 	}
-	req, err := http.NewRequestWithContext(ctx, "GET", u, nil)
+	pollCtx, cancel := context.WithTimeout(ctx, c.pollTimeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(pollCtx, "GET", u, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -412,13 +452,13 @@ func (c *longpollConn) Recv(ctx context.Context) (any, error) {
 		return nil, err
 	}
 	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, err
-	}
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return nil, fmt.Errorf("honey: longpoll transport: status %d", resp.StatusCode)
 	}
+	body, err := readBody(resp.Body, defaultMaxMessageBytes)
+	if err != nil {
+		return nil, err
+	}
 	var v any
 	if jsonErr := json.Unmarshal(body, &v); jsonErr != nil {
 		v = string(body)

package/src/client-go/ws.go

@@ -5,6 +5,7 @@ package sdk
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"sync"
 
 	"nhooyr.io/websocket"
@@ -19,31 +20,35 @@ const WSStatusGoingAway = websocket.StatusGoingAway
 // WSStatusProtocolError is the protocol error close code (1002).
 const WSStatusProtocolError = websocket.StatusProtocolError
 
-// TypedWebSocket wraps a nhooyr.io/websocket connection with a buffered send
-// queue (pre-OPEN) and an event fanout system that mirrors the TS client's .on()
-// escape hatch.
-//
-// Pre-OPEN buffering: sends before the first read are queued in sendBuffer and
-// flushed on the first successful read via sync.Once — matches TS client.ws.ts.
+// defaultWSReadLimit replaces nhooyr's 32 KiB default, which closes the
+// connection on any larger frame.
+const defaultWSReadLimit = 16 << 20
+
+// TypedWebSocket wraps a nhooyr.io/websocket connection with an event fanout
+// system that mirrors the TS client's .on() escape hatch.
 type TypedWebSocket struct {
-	conn        *websocket.Conn
-	sendBuffer  []byte
-	once        sync.Once
-	mu          sync.Mutex
-	handlers    map[string][]func(data []byte)
-	dialOptions websocket.DialOptions
+	conn     *websocket.Conn
+	mu       sync.Mutex
+	handlers map[string][]func(data []byte)
+	closed   bool
 }
 
 // newTypedWebSocket constructs a TypedWebSocket from an already-dialled conn.
 func newTypedWebSocket(conn *websocket.Conn) *TypedWebSocket {
+	conn.SetReadLimit(defaultWSReadLimit)
 	return &TypedWebSocket{
 		conn:     conn,
 		handlers: make(map[string][]func(data []byte)),
 	}
 }
 
-// Send serialises data to JSON when it is a struct or map, passes []byte and
-// string through as-is. Sends are buffered until the first Read call flushes them.
+// SetReadLimit sets the largest inbound message, in bytes (default 16 MiB).
+func (w *TypedWebSocket) SetReadLimit(n int64) {
+	w.conn.SetReadLimit(n)
+}
+
+// Send serialises data to JSON when it is a struct or map, and passes []byte
+// (binary frame) and string (text frame) through as-is.
 func (w *TypedWebSocket) Send(ctx context.Context, data interface{}) error {
 	switch v := data.(type) {
 	case []byte:
@@ -60,28 +65,35 @@ func (w *TypedWebSocket) Send(ctx context.Context, data interface{}) error {
 }
 
 // Close sends a WebSocket close frame with the given status code and reason.
+// A reason over 123 bytes is truncated to fit the frame.
 func (w *TypedWebSocket) Close(code websocket.StatusCode, reason string) error {
-	return w.conn.Close(code, reason)
+	if len(reason) > 123 {
+		reason = reason[:123]
+	}
+	err := w.conn.Close(code, reason)
+	w.fireClose(int(code), reason)
+	return err
 }
 
-// Read reads the next message from the connection.
-// On the first call, any pre-OPEN buffered send is flushed via sync.Once.
+// Read reads the next message from the connection. On a close frame it fires
+// "close" handlers (data is the close reason); on any other failure it fires
+// "error" handlers (data is the error text).
 func (w *TypedWebSocket) Read(ctx context.Context) ([]byte, error) {
-	w.once.Do(func() {
-		if len(w.sendBuffer) > 0 {
-			_ = w.conn.Write(ctx, websocket.MessageText, w.sendBuffer)
-			w.sendBuffer = nil
-		}
-	})
 	_, msg, err := w.conn.Read(ctx)
 	if err != nil {
+		var ce websocket.CloseError
+		if errors.As(err, &ce) {
+			w.fireClose(int(ce.Code), ce.Reason)
+		} else {
+			w.fanout("error", []byte(err.Error()))
+		}
 		return nil, err
 	}
 	w.fanout("message", msg)
 	return msg, nil
 }
 
-// On registers an event handler. Supported events: "message", "close", "error", "open".
+// On registers an event handler. Supported events: "message", "close", "error".
 // The handler receives the raw message bytes; callers unmarshal as needed.
 // This is an escape hatch — prefer ranging over Read for typed message dispatch.
 func (w *TypedWebSocket) On(event string, handler func(data []byte)) {
@@ -90,9 +102,21 @@ func (w *TypedWebSocket) On(event string, handler func(data []byte)) {
 	w.handlers[event] = append(w.handlers[event], handler)
 }
 
+func (w *TypedWebSocket) fireClose(code int, reason string) {
+	w.mu.Lock()
+	if w.closed {
+		w.mu.Unlock()
+		return
+	}
+	w.closed = true
+	w.mu.Unlock()
+	_ = code
+	w.fanout("close", []byte(reason))
+}
+
 func (w *TypedWebSocket) fanout(event string, data []byte) {
 	w.mu.Lock()
-	handlers := w.handlers[event]
+	handlers := append([]func([]byte){}, w.handlers[event]...)
 	w.mu.Unlock()
 	for _, h := range handlers {
 		h(data)

package/src/client-info.ts

@@ -0,0 +1,79 @@
+import { canonicalIp } from "./ip.ts"
+
+/**
+ * Who sent a request, and over what, as the core sees it without `app.trustProxy()`: the peer
+ * the runtime reports is the client, and forwarding headers are client-controlled text. Trusting
+ * reverse proxies (hop counts, CIDR lists) lives in `trust.ts`, which `trustProxy()` loads.
+ */
+export type ClientInfo = {
+	/** Canonical client address, or `null` when it is unknown or a trusted header holds garbage. */
+	ip: string | null
+	/** Host the client asked for (`host[:port]`), or `null`. */
+	host: string | null
+	protocol: "http" | "https"
+}
+
+/**
+ * The app's compiled `trustProxy()` setting. Anything but `off` carries its own resolver, so
+ * the core never imports the hop and range logic.
+ */
+export type TrustSetting =
+	| { readonly kind: "off" }
+	| {
+			readonly kind: "hops" | "ranges"
+			readonly resolve: (req: Request, peer: string | null) => ClientInfo
+	  }
+
+export const TRUST_OFF: TrustSetting = Object.freeze({ kind: "off" })
+
+const HOST = /^(?:\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?\.?)(?::\d{1,5})?$/
+
+/** `host[:port]` as RFC 9110 allows it in `Host`; nothing that could change a URL's meaning. */
+export function isValidHost(host: string): boolean {
+	if (!HOST.test(host)) return false
+	const colon = host.lastIndexOf(":")
+	if (colon !== -1 && host.lastIndexOf("]") < colon) {
+		const port = Number(host.slice(colon + 1))
+		if (port > 65535) return false
+	}
+	return true
+}
+
+/**
+ * Bun before 1.4 builds `request.url` by concatenating `Host` and the request target, so a
+ * `Host: x/admin?` picks the routed path. Later versions hand over the target alone.
+ */
+export const BUN_URL_FROM_HOST: boolean = (() => {
+	const version = (globalThis as { Bun?: { version?: string } }).Bun?.version
+	if (version === undefined) return false
+	const [major = 0, minor = 0] = version.split(".").map(Number)
+	return major < 1 || (major === 1 && minor < 4)
+})()
+
+/** `false` when the request carries a `Host` header that is not `host[:port]`. */
+export function hasValidHost(req: Request): boolean {
+	const host = req.headers.get("host")
+	return host === null || isValidHost(host)
+}
+
+function hostOfUrl(url: string): string | null {
+	const start = url.indexOf("//")
+	if (start === -1) return null
+	let end = url.indexOf("/", start + 2)
+	if (end === -1) end = url.length
+	const host = url.slice(start + 2, end)
+	return host === "" ? null : host
+}
+
+/** The client as the connection shows it: the peer, the URL's host, the transport's scheme. */
+export function directClientInfo(req: Request, peer: string | null): ClientInfo {
+	return {
+		host: hostOfUrl(req.url),
+		ip: peer === null ? null : canonicalIp(peer),
+		protocol: req.url.startsWith("https:") ? "https" : "http",
+	}
+}
+
+export function resolveClient(trust: TrustSetting, req: Request, peer: string | null): ClientInfo {
+	return trust.kind === "off" ? directClientInfo(req, peer) : trust.resolve(req, peer)
+}