@mojojs/core 1.26.18 → 2.0.0

package/README.md

@@ -41,7 +41,7 @@ If you want to stay up to date on the
 
 ## Installation
 
-All you need is Node.js 20.0.0 (or newer).
+All you need is Node.js 22.18.0 (or newer).
 
 ```
 $ npm install @mojojs/core

package/lib/app.d.ts

@@ -1,19 +1,19 @@
-import type { Route } from './router/route.js';
-import type { AnyArguments, AppOptions, BackendInfo, UserAgentOptions, MojoAction, MojoContext, MojoModels, NestedHelpers, RouteArguments, ServerOptions, TestUserAgentOptions } from './types.js';
-import { CLI } from './cli.js';
-import { Hooks } from './hooks.js';
-import { Logger } from './logger.js';
-import { Mime } from './mime.js';
-import { Renderer } from './renderer.js';
-import { Router } from './router.js';
-import { ServerRequest } from './server/request.js';
-import { ServerResponse } from './server/response.js';
-import { Session } from './session.js';
-import { Static } from './static.js';
-import { MockUserAgent } from './user-agent/mock.js';
-import { TestUserAgent } from './user-agent/test.js';
-import { UserAgent } from './user-agent.js';
-import { Validator } from './validator.js';
+import type { Route } from './router/route.ts';
+import type { AnyArguments, AppOptions, BackendInfo, UserAgentOptions, MojoAction, MojoContext, MojoModels, NestedHelpers, RouteArguments, ServerOptions, TestUserAgentOptions } from './types.ts';
+import { CLI } from './cli.ts';
+import { Hooks } from './hooks.ts';
+import { Logger } from './logger.ts';
+import { Mime } from './mime.ts';
+import { Renderer } from './renderer.ts';
+import { Router } from './router.ts';
+import { ServerRequest } from './server/request.ts';
+import { ServerResponse } from './server/response.ts';
+import { Session } from './session.ts';
+import { Static } from './static.ts';
+import { MockUserAgent } from './user-agent/mock.ts';
+import { TestUserAgent } from './user-agent/test.ts';
+import { UserAgent } from './user-agent.ts';
+import { Validator } from './validator.ts';
 import Path from '@mojojs/path';
 type AppHook = (app: App, ...args: any[]) => any;
 type ContextHook = (app: MojoContext, ...args: any[]) => any;
@@ -85,6 +85,14 @@ export declare class App {
      * app.log.debug('It works');
      */
     log: Logger;
+    /**
+     * Maximum request body size in bytes, defaults to `16777216` (16 MiB). Requests exceeding the limit are answered
+     * with `413` when the body is read. Can also be changed for individual requests with `ctx.req.maxMessageSize`.
+     * @example
+     * // Allow larger uploads for the whole application
+     * app.maxRequestSize = 1024 * 1024 * 1024;
+     */
+    maxRequestSize: number;
     /**
      * MIME types.
      * @example
@@ -333,6 +341,13 @@ export declare class App {
      * app.put('/user').to('User#replace');
      */
     put(...args: RouteArguments): Route;
+    /**
+     * Generate route matching only `QUERY` requests.
+     * @example
+     * // Route with destination
+     * app.query('/search').to('Search#index');
+     */
+    query(...args: RouteArguments): Route;
     /**
      * Start the command line interface.
      * @example

package/lib/app.js

@@ -1,22 +1,22 @@
 import { Readable } from 'node:stream';
-import { CLI } from './cli.js';
-import { Context } from './context.js';
-import { Hooks } from './hooks.js';
-import { Logger } from './logger.js';
-import { Mime } from './mime.js';
-import defaultConditionsPlugin from './plugins/default-conditions.js';
-import defaultHelpersPlugin from './plugins/default-helpers.js';
-import tmplEnginePlugin from './plugins/tmpl-engine.js';
-import { Renderer } from './renderer.js';
-import { Router } from './router.js';
-import { ServerRequest } from './server/request.js';
-import { ServerResponse } from './server/response.js';
-import { Session } from './session.js';
-import { Static } from './static.js';
-import { MockUserAgent } from './user-agent/mock.js';
-import { TestUserAgent } from './user-agent/test.js';
-import { UserAgent } from './user-agent.js';
-import { Validator } from './validator.js';
+import { CLI } from "./cli.js";
+import { Context } from "./context.js";
+import { Hooks } from "./hooks.js";
+import { Logger } from "./logger.js";
+import { Mime } from "./mime.js";
+import defaultConditionsPlugin from "./plugins/default-conditions.js";
+import defaultHelpersPlugin from "./plugins/default-helpers.js";
+import tmplEnginePlugin from "./plugins/tmpl-engine.js";
+import { Renderer } from "./renderer.js";
+import { Router } from "./router.js";
+import { ServerRequest } from "./server/request.js";
+import { ServerResponse } from "./server/response.js";
+import { Session } from "./session.js";
+import { Static } from "./static.js";
+import { MockUserAgent } from "./user-agent/mock.js";
+import { TestUserAgent } from "./user-agent/test.js";
+import { UserAgent } from "./user-agent.js";
+import { Validator } from "./validator.js";
 import Path from '@mojojs/path';
 const ContextWrapper = class extends Context {
 };
@@ -24,111 +24,159 @@ const ContextWrapper = class extends Context {
  * Application class.
  */
 export class App {
+    /**
+     * Command line interface.
+     * @example
+     * // Add another path to load commands from
+     * app.cli.commandPaths.push(app.home.child('cli').toString());
+     */
+    cli = new CLI(this);
+    /**
+     * Application config.
+     * @example
+     * // Remove value
+     * delete app.config.foo;
+     *
+     * // Assign multiple values at once
+     * Object.assign(app.config, {foo: 'test', bar: 23});
+     */
+    config;
+    /**
+     * Default stash values.
+     * @example
+     * // Remove value
+     * delete app.defaults.foo;
+     *
+     * // Assign multiple values at once
+     * Object.assign(app.defaults, {foo: 'test', bar: 23});
+     */
+    defaults = {};
+    /**
+     * Detect if the application has been imported and disable the command line interface if it has.
+     */
+    detectImport;
+    /**
+     * Format for HTTP exceptions ("html", "json", or "txt").
+     * @example
+     * // Change default exception format for whole application
+     * app.exceptionFormat = 'json';
+     */
+    exceptionFormat;
+    /**
+     * Application hooks.
+     * @example
+     * // Run a custom hook
+     * await app.hooks.runHook('my:hook', foo, bar);
+     */
+    hooks = new Hooks();
+    /**
+     * Application home directory.
+     * @example
+     * // Portably generate path relative to home directory
+     * const path = app.home.child('data', 'important.txt');
+     */
+    home = new Path();
+    /**
+     * Application logger.
+     * @example
+     * // Log debug message
+     * app.log.debug('It works');
+     */
+    log;
+    /**
+     * Maximum request body size in bytes, defaults to `16777216` (16 MiB). Requests exceeding the limit are answered
+     * with `413` when the body is read. Can also be changed for individual requests with `ctx.req.maxMessageSize`.
+     * @example
+     * // Allow larger uploads for the whole application
+     * app.maxRequestSize = 1024 * 1024 * 1024;
+     */
+    maxRequestSize = 16 * 1024 * 1024;
+    /**
+     * MIME types.
+     * @example
+     * // Get MIME type for extension
+     * const type = app.mime.extType('txt');
+     */
+    mime = new Mime();
+    /**
+     * Operating mode for application. Defaults to the value of the `NODE_ENV` environment variable or `development`.
+     */
+    mode;
+    // Apps augment MojoModels with required keys they fill in later
+    /**
+     * Storage for user defined models.
+     * @example
+     * // Store database connection
+     * app.models.pg = new Pg('postgres://127.0.0.1:5432/db');
+     */
+    models = {};
+    /**
+     * Application renderer.
+     * @example
+     * // Disable compression
+     * app.renderer.autoCompress = false;
+     *
+     * // Add another "views" directory
+     * app.renderer.viewPaths.push(app.home.child('views').toString());
+     */
+    renderer = new Renderer();
+    /**
+     * Application router.
+     * @example
+     * // Add routes
+     * const r = app.router;
+     * r.get('/foo/bar').to('test#foo', {title: 'Hello Mojo!'});
+     * r.post('/baz').to('test#baz');
+     *
+     * // Add another path to load controllers from
+     * app.router.controllerPaths.push(app.home.child('more-controllers').toString());
+     */
+    router = new Router();
+    /**
+     * Rotating secret passphrases used for signed cookies and the like.
+     * @example
+     * // Rotate passphrases
+     * app.secrets = ['new_passw0rd', 'old_passw0rd', 'very_old_passw0rd'];
+     */
+    secrets;
+    /**
+     * Encrypted cookie based session manager.
+     * @example
+     * // Change name of cookie used for all sessions
+     * app.sessions.cookieName = 'mysession';
+     *
+     * // Disable SameSite feature
+     * app.sessions.sameSite = 'none';
+     */
+    session = new Session(this);
+    /**
+     * Static file server.
+     * @example
+     * // Add another "public" directory
+     * app.static.publicPaths.push('/home/sri/public');
+     *
+     * // Add another "public" directory with higher precedence
+     * app.static.publicPaths.unshift('/home/sri/themes/blue/public');
+     */
+    static = new Static();
+    /**
+     * HTTP/WebSocket user-agent.
+     * @example
+     * # Perform HTTP request
+     * const res = await app.ua.get('http://example.com');
+     */
+    ua = new UserAgent();
+    /**
+     * JSON schema validator.
+     * @example
+     * // Add a named schema for later use
+     * app.validator.addSchema({type: 'object', properties: {test: {type: 'number'}}}, 'testForm');
+     */
+    validator = new Validator();
+    _contextClass = class extends ContextWrapper {
+    };
+    _nestedHelpers = {};
     constructor(options = {}) {
-        /**
-         * Command line interface.
-         * @example
-         * // Add another path to load commands from
-         * app.cli.commandPaths.push(app.home.child('cli').toString());
-         */
-        this.cli = new CLI(this);
-        /**
-         * Default stash values.
-         * @example
-         * // Remove value
-         * delete app.defaults.foo;
-         *
-         * // Assign multiple values at once
-         * Object.assign(app.defaults, {foo: 'test', bar: 23});
-         */
-        this.defaults = {};
-        /**
-         * Application hooks.
-         * @example
-         * // Run a custom hook
-         * await app.hooks.runHook('my:hook', foo, bar);
-         */
-        this.hooks = new Hooks();
-        /**
-         * Application home directory.
-         * @example
-         * // Portably generate path relative to home directory
-         * const path = app.home.child('data', 'important.txt');
-         */
-        this.home = new Path();
-        /**
-         * MIME types.
-         * @example
-         * // Get MIME type for extension
-         * const type = app.mime.extType('txt');
-         */
-        this.mime = new Mime();
-        /**
-         * Storage for user defined models.
-         * @example
-         * // Store database connection
-         * app.models.pg = new Pg('postgres://127.0.0.1:5432/db');
-         */
-        this.models = {};
-        /**
-         * Application renderer.
-         * @example
-         * // Disable compression
-         * app.renderer.autoCompress = false;
-         *
-         * // Add another "views" directory
-         * app.renderer.viewPaths.push(app.home.child('views').toString());
-         */
-        this.renderer = new Renderer();
-        /**
-         * Application router.
-         * @example
-         * // Add routes
-         * const r = app.router;
-         * r.get('/foo/bar').to('test#foo', {title: 'Hello Mojo!'});
-         * r.post('/baz').to('test#baz');
-         *
-         * // Add another path to load controllers from
-         * app.router.controllerPaths.push(app.home.child('more-controllers').toString());
-         */
-        this.router = new Router();
-        /**
-         * Encrypted cookie based session manager.
-         * @example
-         * // Change name of cookie used for all sessions
-         * app.sessions.cookieName = 'mysession';
-         *
-         * // Disable SameSite feature
-         * app.sessions.sameSite = 'none';
-         */
-        this.session = new Session(this);
-        /**
-         * Static file server.
-         * @example
-         * // Add another "public" directory
-         * app.static.publicPaths.push('/home/sri/public');
-         *
-         * // Add another "public" directory with higher precedence
-         * app.static.publicPaths.unshift('/home/sri/themes/blue/public');
-         */
-        this.static = new Static();
-        /**
-         * HTTP/WebSocket user-agent.
-         * @example
-         * # Perform HTTP request
-         * const res = await app.ua.get('http://example.com');
-         */
-        this.ua = new UserAgent();
-        /**
-         * JSON schema validator.
-         * @example
-         * // Add a named schema for later use
-         * app.validator.addSchema({type: 'object', properties: {test: {type: 'number'}}}, 'testForm');
-         */
-        this.validator = new Validator();
-        this._contextClass = class extends ContextWrapper {
-        };
-        this._nestedHelpers = {};
         this.config = options.config ?? {};
         this.detectImport = options.detectImport ?? true;
         this.exceptionFormat = options.exceptionFormat ?? 'html';
@@ -194,10 +242,9 @@ export class App {
                 this._nestedHelpers[getterName] = {};
                 this.decorateContext(getterName, {
                     get: function () {
-                        var _a;
-                        return ((_a = this._nestedHelpersCache)[getterName] ?? (_a[getterName] = Object.create(this.app._nestedHelpers[getterName], {
+                        return (this._nestedHelpersCache[getterName] ??= Object.create(this.app._nestedHelpers[getterName], {
                             _ctx: { value: this }
-                        })));
+                        }));
                     }
                 });
             }
@@ -399,6 +446,15 @@ export class App {
     put(...args) {
         return this.router.put(...args);
     }
+    /**
+     * Generate route matching only `QUERY` requests.
+     * @example
+     * // Route with destination
+     * app.query('/search').to('Search#index');
+     */
+    query(...args) {
+        return this.router.query(...args);
+    }
     /**
      * Start the command line interface.
      * @example
@@ -445,4 +501,3 @@ export class App {
         return this.router.websocket(...args);
     }
 }
-//# sourceMappingURL=app.js.map

package/lib/body/params.js

@@ -27,4 +27,3 @@ export class Params extends URLSearchParams {
         return Object.fromEntries(this);
     }
 }
-//# sourceMappingURL=params.js.map

package/lib/body.d.ts

@@ -1,7 +1,7 @@
-import type { JSONValue, UploadOptions } from './types.js';
-import type { Readable, Writable } from 'node:stream';
-import { Params } from './body/params.js';
-import { Headers } from './headers.js';
+import type { JSONValue, UploadOptions } from './types.ts';
+import { type Readable, type Writable } from 'node:stream';
+import { Params } from './body/params.ts';
+import { Headers } from './headers.ts';
 import DOM from '@mojojs/dom';
 interface FileUpload {
     fieldname: string;
@@ -10,7 +10,11 @@ interface FileUpload {
     encoding: string;
     mimetype: string;
 }
-type FormIterator = AsyncIterableIterator<[string, Readable, string, string, string]>;
+type FormIterator = AsyncIterableIterator<[string, Readable, {
+    filename: string;
+    encoding: string;
+    mimeType: string;
+}]>;
 /**
  * HTTP message body base class.
  */
@@ -23,6 +27,10 @@ export declare class Body {
      * HTTP headers.
      */
     headers: Headers;
+    /**
+     * Maximum message body size in bytes, after decompression, unlimited by default.
+     */
+    maxMessageSize: number | undefined;
     _form: Params | undefined;
     _stream: Readable;
     constructor(headers: string[], stream: Readable);

package/lib/body.js

@@ -1,7 +1,9 @@
 import { on } from 'node:events';
+import { Transform } from 'node:stream';
 import zlib from 'node:zlib';
-import { Params } from './body/params.js';
-import { Headers } from './headers.js';
+import { Params } from "./body/params.js";
+import { Headers } from "./headers.js";
+import { HTTPError } from "./util.js";
 import DOM from '@mojojs/dom';
 import busboy from 'busboy';
 import * as yaml from 'js-yaml';
@@ -9,12 +11,21 @@ import * as yaml from 'js-yaml';
  * HTTP message body base class.
  */
 export class Body {
+    /**
+     * Automatically decompress message body if necessary.
+     */
+    autoDecompress = true;
+    /**
+     * HTTP headers.
+     */
+    headers;
+    /**
+     * Maximum message body size in bytes, after decompression, unlimited by default.
+     */
+    maxMessageSize = undefined;
+    _form = undefined;
+    _stream;
     constructor(headers, stream) {
-        /**
-         * Automatically decompress message body if necessary.
-         */
-        this.autoDecompress = true;
-        this._form = undefined;
         this._stream = stream;
         this.headers = new Headers(headers);
     }
@@ -34,11 +45,27 @@ export class Body {
         const stream = this._stream;
         if (stream.readableEnded === true)
             throw new Error('Request body has already been consumed');
-        if (this.autoDecompress !== true || this.get('content-encoding') !== 'gzip')
-            return stream;
-        const gunzip = zlib.createGunzip();
-        stream.pipe(gunzip);
-        return gunzip;
+        const max = this.maxMessageSize;
+        if (max !== undefined && parseInt(this.get('Content-Length') ?? '0') > max)
+            throw messageTooLarge();
+        let body = stream;
+        if (this.autoDecompress === true && this.get('content-encoding') === 'gzip') {
+            const gunzip = zlib.createGunzip();
+            stream.on('error', error => gunzip.destroy(error));
+            body = stream.pipe(gunzip);
+        }
+        if (max === undefined)
+            return body;
+        // Count after decompression, so small gzip bodies cannot unpack to huge ones
+        let size = 0;
+        const limit = new Transform({
+            transform(chunk, encoding, cb) {
+                size += chunk.length;
+                cb(size > max ? messageTooLarge() : null, chunk);
+            }
+        });
+        body.on('error', error => limit.destroy(error));
+        return body.pipe(limit);
     }
     /**
      * Get async iterator for uploaded files from message body.
@@ -57,9 +84,8 @@ export class Body {
         if (this._isForm() === false)
             return;
         try {
-            for await (const [fieldname, file, name, encoding, mimetype] of this._formIterator(options)) {
-                const filename = name.filename;
-                yield { fieldname, file, filename, encoding, mimetype };
+            for await (const [fieldname, file, { filename, encoding, mimeType }] of this._formIterator(options)) {
+                yield { fieldname, file, filename, encoding, mimetype: mimeType };
             }
         }
         catch (error) {
@@ -155,7 +181,9 @@ export class Body {
         bb.on('field', (fieldname, val) => params.append(fieldname, val));
         bb.on('end', () => ac.abort()).on('close', () => ac.abort());
         const files = on(bb, 'file', { signal: ac.signal });
-        this._stream.pipe(bb);
+        this.createReadStream()
+            .on('error', error => bb.destroy(error))
+            .pipe(bb);
         return files;
     }
     _isForm() {
@@ -170,4 +198,6 @@ export class Body {
         return this._form;
     }
 }
-//# sourceMappingURL=body.js.map
+function messageTooLarge() {
+    return new HTTPError(413, 'Maximum message size exceeded');
+}

package/lib/cache.d.ts

@@ -6,8 +6,7 @@ export declare class Cache<T> {
      * Maximum number of values in cache, defaults to `100`.
      */
     max: number;
-    _cache: Record<string, T>;
-    _queue: string[];
+    _cache: Map<string, T>;
     /**
      * Get cached value.
      */

package/lib/cache.js

@@ -2,19 +2,17 @@
  * Cache class.
  */
 export class Cache {
-    constructor() {
-        /**
-         * Maximum number of values in cache, defaults to `100`.
-         */
-        this.max = 100;
-        this._cache = {};
-        this._queue = [];
-    }
+    /**
+     * Maximum number of values in cache, defaults to `100`.
+     */
+    max = 100;
+    // Maps keep insertion order, so the first key is always the oldest
+    _cache = new Map();
     /**
      * Get cached value.
      */
     get(key) {
-        return this._cache[key];
+        return this._cache.get(key);
     }
     /**
      * Add value to the cache.
@@ -24,22 +22,15 @@ export class Cache {
         if (max <= 0)
             return;
         const cache = this._cache;
-        const queue = this._queue;
-        while (queue.length >= max) {
-            const key = queue.shift();
-            if (key !== undefined)
-                delete cache[key];
-        }
-        if (cache[key] === undefined) {
-            queue.push(key);
-            cache[key] = value;
-        }
+        while (cache.size >= max)
+            cache.delete(cache.keys().next().value);
+        if (cache.has(key) === false)
+            cache.set(key, value);
     }
     /**
      * Current size of the cache.
      */
     get size() {
-        return this._queue.length;
+        return this._cache.size;
     }
 }
-//# sourceMappingURL=cache.js.map

package/lib/cgi.d.ts

@@ -1,7 +1,7 @@
-import type { MojoApp, ServerResponseBody } from './types.js';
+import type { MojoApp, ServerResponseBody } from './types.ts';
 import { type Readable } from 'node:stream';
-import { ServerRequest } from './server/request.js';
-import { ServerResponse } from './server/response.js';
+import { ServerRequest } from './server/request.ts';
+import { ServerResponse } from './server/response.ts';
 /**
  * CGI class. Is this a joke? Yes. Could you use it in production anyway? Probably.
  */

package/lib/cgi.js

@@ -1,11 +1,13 @@
 import { Stream } from 'node:stream';
-import { ServerRequest } from './server/request.js';
-import { ServerResponse } from './server/response.js';
-import { httpStatusMessages } from './util.js';
+import { ServerRequest } from "./server/request.js";
+import { ServerResponse } from "./server/response.js";
+import { httpStatusMessages } from "./util.js";
+import { decodeURIComponentSafe } from '@mojojs/util';
 /**
  * CGI class. Is this a joke? Yes. Could you use it in production anyway? Probably.
  */
 export class CGI {
+    app;
     constructor(app) {
         this.app = app;
     }
@@ -17,9 +19,15 @@ export class CGI {
         const method = env.REQUEST_METHOD ?? 'GET';
         // URL
         let url = env.PATH_INFO ?? '/';
-        const name = env.SCRIPT_NAME;
-        if (name !== undefined && url.startsWith(name) === true)
-            url = url.replace(name, '');
+        const name = (env.SCRIPT_NAME ?? '').replace(/^\/|\/$/g, '');
+        // Remove SCRIPT_NAME prefix if necessary (unless the server already did it)
+        const uri = decodeURIComponentSafe((env.REQUEST_URI ?? '').replace(/\?.*$/, '')) ?? '';
+        if (name !== '' && uri.startsWith(`/${name}${url}`) === false) {
+            if (url === `/${name}`)
+                url = '/';
+            else if (url.startsWith(`/${name}/`) === true)
+                url = url.slice(name.length + 1);
+        }
         const query = env.QUERY_STRING;
         if (query !== undefined && query !== '')
             url += `?${query}`;
@@ -72,8 +80,8 @@ export class CGI {
         }
         else if (body instanceof Stream) {
             stdout.write(res.headers.toString());
-            body.pipe(stdout);
+            // Not pipeline, because stdout must stay open, and the response is just cut short on errors
+            body.on('error', () => { }).pipe(stdout);
         }
     }
 }
-//# sourceMappingURL=cgi.js.map