@mojojs/core 1.26.18 → 2.0.0

package/lib/server.js

@@ -2,11 +2,11 @@ import cluster from 'node:cluster';
 import http from 'node:http';
 import https from 'node:https';
 import os from 'node:os';
-import { Stream } from 'node:stream';
+import { pipeline, Stream } from 'node:stream';
 import { URL } from 'node:url';
-import { ServerRequest } from './server/request.js';
-import { ServerResponse } from './server/response.js';
-import { WebSocket } from './websocket.js';
+import { ServerRequest } from "./server/request.js";
+import { ServerResponse } from "./server/response.js";
+import { WebSocket } from "./websocket.js";
 import Path from '@mojojs/path';
 import { termEscape } from '@mojojs/util';
 import { WebSocketServer } from 'ws';
@@ -22,16 +22,52 @@ const devKey = certs.child('development.key').toString();
  * HTTP and WebSocket server class.
  */
 export class Server {
+    /**
+     * Application this server handles.
+     */
+    app;
+    /**
+     * Limit the amount of time the parser will wait to receive the complete HTTP headers, defaults to `60000`
+     * (60 seconds).
+     */
+    headersTimeout;
+    /**
+     * Limit the amount of time of inactivity a server needs to wait for additional incoming data, after it has finished
+     * writing the last response, before a socket will be destroyed, defaults to `5000` (5 seconds).
+     */
+    keepAliveTimeout;
+    /**
+     * Maximum number of requests socket can handle before closing keep alive connection, defaults to `0`.
+     */
+    maxRequestsPerSocket;
+    /**
+     * Maximum WebSocket message size in bytes, defaults to `262144` (256 KiB). Connections exceeding the limit are closed
+     * with status `1009`.
+     */
+    maxWebSocketSize;
+    /**
+     * Limit the amount of time for receiving the entire request from the client, defaults to `300000` (300 seconds).
+     */
+    requestTimeout;
+    /**
+     * Reverse proxy mode.
+     */
+    reverseProxy;
+    /**
+     * Server URLs.
+     */
+    urls = [];
+    _cluster;
+    _listen;
+    _servers = [];
+    _quiet;
+    _workers;
     constructor(app, options = {}) {
-        /**
-         * Server URLs.
-         */
-        this.urls = [];
-        this._servers = [];
         this.app = app;
         this.headersTimeout = options.headersTimeout;
         this.keepAliveTimeout = options.keepAliveTimeout;
         this.maxRequestsPerSocket = options.maxRequestsPerSocket;
+        this.maxWebSocketSize = options.maxWebSocketSize ?? 256 * 1024;
         this.requestTimeout = options.requestTimeout;
         this.reverseProxy = options.reverseProxy ?? false;
         this._cluster = options.cluster ?? false;
@@ -72,6 +108,7 @@ export class Server {
                 cluster.fork();
         }
         else {
+            await app.warmup();
             for (const location of this._listen) {
                 await this._createServer(location);
             }
@@ -100,8 +137,7 @@ export class Server {
             options.key = await new Path(searchParams.get('key') ?? devKey).readFile();
             isHttps = true;
         }
-        await this.app.warmup();
-        const wss = new WebSocketServer({ noServer: true });
+        const wss = new WebSocketServer({ maxPayload: this.maxWebSocketSize, noServer: true });
         const server = (isHttps ? https : http).createServer(options, this._handleRequest.bind(this));
         this._servers.push(server);
         if (this.maxRequestsPerSocket !== undefined)
@@ -118,9 +154,9 @@ export class Server {
                 const stderr = process.stderr;
                 socket.on('data', (chunk) => stderr.write(termEscape(`-- Server <<< Client\n${chunk}`)));
                 const write = socket.write;
-                socket.write = (chunk, cb) => {
+                socket.write = (chunk, ...args) => {
                     stderr.write(termEscape(`-- Server >>> Client\n${chunk}`));
-                    return write.apply(socket, [chunk, cb]);
+                    return write.apply(socket, [chunk, ...args]);
                 };
             });
         }
@@ -159,7 +195,7 @@ export class Server {
         const ctx = app.newContext(this._prepareRequest(req, socket, false), new ServerResponse((res, body) => {
             sendResponse(res, body, raw);
         }), { name: 'server', req, res: raw });
-        raw.on('finish', () => ctx.emit('finish'));
+        raw.on('close', () => ctx.emit('finish'));
         app.handleRequest(ctx).catch(error => ctx.exception(error));
     }
     _handleUpgrade(wss, req, socket, head) {
@@ -202,11 +238,18 @@ function sendHeaders(res, raw) {
     const statusCode = res.statusCode;
     const statusMessage = res.statusMessage;
     const headers = res.headers.toArray();
-    if (statusMessage === null) {
-        raw.writeHead(statusCode, headers);
+    try {
+        if (statusMessage === null) {
+            raw.writeHead(statusCode, headers);
+        }
+        else {
+            raw.writeHead(statusCode, statusMessage, headers);
+        }
     }
-    else {
-        raw.writeHead(statusCode, statusMessage, headers);
+    catch (error) {
+        // The response counts as sent already, so close the connection instead of letting the client wait forever
+        raw.destroy();
+        throw error;
     }
 }
 function sendResponse(res, body, raw) {
@@ -217,7 +260,15 @@ function sendResponse(res, body, raw) {
     }
     else if (body instanceof Stream) {
         sendHeaders(res, raw);
-        body.pipe(raw);
+        // Both streams need to be cleaned up, and only aborted connections are expected
+        pipeline(body, raw, error => {
+            if (error === undefined ||
+                error === null ||
+                error.code === 'ERR_STREAM_PREMATURE_CLOSE') {
+                return;
+            }
+            res._ctx?.deref()?.log.error(`Response stream failed: ${error.stack}`);
+        });
     }
     else {
         sendHeaders(res, raw);
@@ -227,4 +278,3 @@ function sendResponse(res, body, raw) {
 function urlToSocketPath(url) {
     return url.host + url.pathname;
 }
-//# sourceMappingURL=server.js.map

package/lib/session.d.ts

@@ -1,6 +1,6 @@
-import type { App } from './app.js';
-import type { Context } from './context.js';
-import type { SessionData } from './types.js';
+import type { App } from './app.ts';
+import type { Context } from './context.ts';
+import type { SessionData } from './types.ts';
 /**
  * Session manager class.
  */
@@ -23,6 +23,11 @@ export declare class Session {
      * Set the `HttpOnly` value on all session cookies.
      */
     httpOnly: boolean;
+    /**
+     * Set the `Partitioned` value on all session cookies, to be used in accordance with the CHIPS amendment to RFC 6265.
+     * Note that this property is EXPERIMENTAL and might change without warning!
+     */
+    partitioned: boolean;
     /**
      * Set the `SameSite` value on all session cookies, defaults to `lax`.
      */

package/lib/session.js

@@ -2,37 +2,55 @@ import crypto from 'node:crypto';
 import { promisify } from 'node:util';
 const scrypt = promisify(crypto.scrypt);
 const randomBytes = promisify(crypto.randomBytes);
+// Deriving keys with scrypt is slow on purpose, so it is only done once per secret
+const keys = new Map();
+function deriveKey(secret) {
+    let key = keys.get(secret);
+    if (key === undefined) {
+        key = scrypt(secret, 'salt', 32);
+        keys.set(secret, key);
+        // Do not cache failures
+        key.catch(() => keys.delete(secret));
+    }
+    return key;
+}
 /**
  * Session manager class.
  */
 export class Session {
+    /**
+     * Name for session cookies, defaults to `mojo`.
+     */
+    cookieName = 'mojo';
+    /**
+     * Path for session cookies, defaults to `/`.
+     */
+    cookiePath = '/';
+    /**
+     * Default time for sessions to expire in seconds from now, defaults to `3600`. The expiration timeout gets refreshed
+     * for every request. Setting the value to `0` will allow sessions to persist until the browser window is closed,
+     * this can have security implications though.
+     */
+    expiration = 3600;
+    /**
+     * Set the `HttpOnly` value on all session cookies.
+     */
+    httpOnly = true;
+    /**
+     * Set the `Partitioned` value on all session cookies, to be used in accordance with the CHIPS amendment to RFC 6265.
+     * Note that this property is EXPERIMENTAL and might change without warning!
+     */
+    partitioned = false;
+    /**
+     * Set the `SameSite` value on all session cookies, defaults to `lax`.
+     */
+    sameSite = 'lax';
+    /**
+     * Set the secure flag on all session cookies, so that browsers send them only over HTTPS connections.
+     */
+    secure = false;
+    _app;
     constructor(app) {
-        /**
-         * Name for session cookies, defaults to `mojo`.
-         */
-        this.cookieName = 'mojo';
-        /**
-         * Path for session cookies, defaults to `/`.
-         */
-        this.cookiePath = '/';
-        /**
-         * Default time for sessions to expire in seconds from now, defaults to `3600`. The expiration timeout gets refreshed
-         * for every request. Setting the value to `0` will allow sessions to persist until the browser window is closed,
-         * this can have security implications though.
-         */
-        this.expiration = 3600;
-        /**
-         * Set the `HttpOnly` value on all session cookies.
-         */
-        this.httpOnly = true;
-        /**
-         * Set the `SameSite` value on all session cookies, defaults to `lax`.
-         */
-        this.sameSite = 'lax';
-        /**
-         * Set the secure flag on all session cookies, so that browsers send them only over HTTPS connections.
-         */
-        this.secure = false;
         this._app = new WeakRef(app);
     }
     /**
@@ -47,7 +65,7 @@ export class Session {
         const authTag = Buffer.from(match[3], 'base64');
         for (const secret of secrets) {
             try {
-                const key = await scrypt(secret, 'salt', 32);
+                const key = await deriveKey(secret);
                 const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv, { authTagLength: 16 });
                 decipher.setAuthTag(authTag);
                 const decrypted = decipher.update(value, 'base64', 'utf8');
@@ -63,7 +81,7 @@ export class Session {
      * Encrypt cookie.
      */
     static async encrypt(secret, value) {
-        const key = await scrypt(secret, 'salt', 32);
+        const key = await deriveKey(secret);
         const iv = await randomBytes(12);
         const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
         const encrypted = cipher.update(value, 'utf8', 'base64') + cipher.final('base64');
@@ -111,10 +129,10 @@ export class Session {
         ctx.res.setCookie(this.cookieName, encrypted, {
             expires: expires === undefined ? undefined : new Date(expires * 1000),
             httpOnly: this.httpOnly,
+            partitioned: this.partitioned,
             path: this.cookiePath,
             sameSite: this.sameSite,
             secure: this.secure
         });
     }
 }
-//# sourceMappingURL=session.js.map

package/lib/sse.d.ts

@@ -0,0 +1,10 @@
+import type { SSEEvent } from './types.ts';
+/**
+ * Build Server-Sent Event. Note that this function is EXPERIMENTAL and might change without warning!
+ */
+export declare function buildEvent(event: SSEEvent): Buffer;
+/**
+ * Parse Server-Sent Event, returns the event (or `null` if no complete event was found) and the remaining buffer. Note
+ * that this function is EXPERIMENTAL and might change without warning!
+ */
+export declare function parseEvent(buffer: string): [SSEEvent | null, string];

package/lib/sse.js

@@ -0,0 +1,62 @@
+const SPLIT_RE = /\r\n|(?<!\r)\n|\r(?!\n)/;
+const EVENT_RE = /^([\s\S]*?)(?:\r\n|(?<!\r)\n|\r(?!\n)){2}/;
+/**
+ * Build Server-Sent Event. Note that this function is EXPERIMENTAL and might change without warning!
+ */
+export function buildEvent(event) {
+    const data = splitLines(event.text);
+    const comment = splitLines(event.comment);
+    const parts = [];
+    if (comment.length > 0) {
+        for (const line of comment)
+            parts.push(`: ${line}`);
+    }
+    else {
+        if (event.type !== undefined)
+            parts.push(`event: ${event.type}`);
+        for (const line of data)
+            parts.push(`data: ${line}`);
+        if (event.id !== undefined && event.id !== null)
+            parts.push(`id: ${event.id}`);
+    }
+    return Buffer.from([...parts, '', ''].join('\r\n'));
+}
+/**
+ * Parse Server-Sent Event, returns the event (or `null` if no complete event was found) and the remaining buffer. Note
+ * that this function is EXPERIMENTAL and might change without warning!
+ */
+export function parseEvent(buffer) {
+    const event = { id: null, type: 'message', text: '' };
+    for (let match = buffer.match(EVENT_RE); match !== null; match = buffer.match(EVENT_RE)) {
+        buffer = buffer.slice(match[0].length);
+        // Skip comments
+        const lines = match[1];
+        if (/^\s*:/.test(lines) === true)
+            continue;
+        let first = true;
+        for (const line of lines.split(SPLIT_RE)) {
+            let field;
+            if ((field = line.match(/^event(?::\s*(\S.*))?$/)) !== null) {
+                event.type = field[1] ?? 'message';
+            }
+            else if ((field = line.match(/^data(?::\s*(.*))?$/)) !== null) {
+                event.text += (first === true ? '' : '\n') + (field[1] ?? '');
+                first = false;
+            }
+            else if ((field = line.match(/^id(?::\s*(.*))?$/)) !== null) {
+                event.id = field[1] ?? null;
+            }
+        }
+        return [event, buffer];
+    }
+    return [null, buffer];
+}
+// Split like Perl, without trailing empty lines
+function splitLines(value) {
+    if (value === undefined)
+        return [];
+    const lines = value.split(SPLIT_RE);
+    while (lines.length > 0 && lines[lines.length - 1] === '')
+        lines.pop();
+    return lines;
+}

package/lib/static.d.ts

@@ -1,4 +1,4 @@
-import type { MojoContext } from './types.js';
+import type { MojoContext } from './types.ts';
 import Path from '@mojojs/path';
 type AssetIndex = Record<string, string>;
 /**

package/lib/static.js

@@ -1,23 +1,21 @@
-import crypto from 'node:crypto';
 import Path from '@mojojs/path';
 /**
  * Static file server class.
  */
 export class Static {
-    constructor() {
-        /**
-         * Subdirectory used for all static assets.
-         */
-        this.assetDir = 'assets';
-        /**
-         * Prefix to use for all static files.
-         */
-        this.prefix = '/static';
-        /**
-         * Directories to serve static files from, first one has the highest precedence.
-         */
-        this.publicPaths = [Path.currentFile().sibling('..', 'vendor', 'public').toString()];
-    }
+    /**
+     * Subdirectory used for all static assets.
+     */
+    assetDir = 'assets';
+    /**
+     * Prefix to use for all static files.
+     */
+    prefix = '/static';
+    /**
+     * Directories to serve static files from, first one has the highest precedence.
+     */
+    publicPaths = [Path.currentFile().sibling('..', 'vendor', 'public').toString()];
+    _assets;
     /**
      * Get static asset path.
      */
@@ -79,9 +77,10 @@ export class Static {
         // If-None-Match
         const ifNoneMatch = req.get('If-None-Match');
         if (etag !== undefined && ifNoneMatch !== null) {
-            const etags = ifNoneMatch.split(/,\s+/).map(value => value.replaceAll('"', ''));
+            // Weak comparison, because proxies like nginx turn ETags into weak ones when compressing responses
+            const etags = ifNoneMatch.split(/\s*,\s*/).map(value => value.replace(/^W\//, '').replaceAll('"', ''));
             for (const match of etags) {
-                if (match === etag)
+                if (match === etag || match === '*')
                     return true;
             }
         }
@@ -91,7 +90,8 @@ export class Static {
             const epoch = Date.parse(ifModifiedSince);
             if (isNaN(epoch))
                 return false;
-            if (epoch > options.lastModified.getTime())
+            // HTTP dates have no milliseconds
+            if (epoch >= Math.floor(options.lastModified.getTime() / 1000) * 1000)
                 return true;
         }
         return false;
@@ -113,7 +113,8 @@ export class Static {
         const { res } = ctx;
         res.set('Accept-Ranges', 'bytes');
         const lastModified = stat.mtime;
-        const etag = crypto.createHash('md5').update(lastModified.getTime().toString()).digest('hex');
+        // Size too, because reproducible builds often give all files the same modification time
+        const etag = `${lastModified.getTime()}-${length}`;
         if (this.isFresh(ctx, { etag, lastModified })) {
             await res.status(304).send();
             return;
@@ -131,10 +132,15 @@ export class Static {
         if (bytes === null)
             return await this._rangeNotSatisfiable(ctx);
         let start = parseInt(bytes[1]);
+        let end = parseInt(bytes[2]);
+        // Suffix range for the last bytes of the file
+        if (isNaN(start) && isNaN(end) === false) {
+            start = Math.max(length - end, 0);
+            end = length - 1;
+        }
         if (isNaN(start))
             start = 0;
-        let end = parseInt(bytes[2]);
-        if (isNaN(end))
+        if (isNaN(end) || end >= length)
             end = length - 1;
         if (start > end)
             return await this._rangeNotSatisfiable(ctx);
@@ -175,4 +181,3 @@ export class Static {
         await ctx.res.status(416).send();
     }
 }
-//# sourceMappingURL=static.js.map

package/lib/types.d.ts

@@ -1,8 +1,8 @@
-import type { App } from './app.js';
-import type { Context } from './context.js';
-import type { Route } from './router/route.js';
-import type { SafeString } from './util.js';
-import type { ValidatorResult } from './validator/result.js';
+import type { App } from './app.ts';
+import type { Context } from './context.ts';
+import type { Route } from './router/route.ts';
+import type { SafeString } from './util.ts';
+import type { ValidatorResult } from './validator/result.ts';
 import type { Agent } from 'node:http';
 import type { Readable, Stream } from 'node:stream';
 import type { URL } from 'node:url';
@@ -123,6 +123,7 @@ export interface CookieOptions {
     expires?: Date;
     httpOnly?: boolean;
     maxAge?: number;
+    partitioned?: boolean;
     path?: string;
     sameSite?: 'lax' | 'strict' | 'none';
     secure?: boolean;
@@ -155,6 +156,7 @@ export interface ServerOptions {
     keepAliveTimeout?: number;
     listen?: string[];
     maxRequestsPerSocket?: number;
+    maxWebSocketSize?: number;
     quiet?: boolean;
     requestTimeout?: number;
     reverseProxy?: boolean;
@@ -170,6 +172,12 @@ export interface ServerRequestOptions {
     reverseProxy: boolean;
     url?: string;
 }
+export interface SSEEvent {
+    comment?: string;
+    id?: string | number | null;
+    text?: string;
+    type?: string;
+}
 export type ServerResponseBody = string | Buffer | Stream | undefined;
 export interface UploadOptions {
     limits?: {

package/lib/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/lib/user-agent/cookie-jar.d.ts

@@ -1,5 +1,5 @@
 import { type URL } from 'node:url';
-import tough from 'tough-cookie';
+import { CookieJar as ToughCookieJar } from 'tough-cookie';
 /**
  * Cookie jar class.
  */
@@ -7,7 +7,7 @@ export declare class CookieJar {
     /**
      * Cookie storage.
      */
-    storage: tough.CookieJar;
+    storage: ToughCookieJar;
     /**
      * Load cookies from storage.
      */

package/lib/user-agent/cookie-jar.js

@@ -1,15 +1,13 @@
 import { format } from 'node:url';
-import tough from 'tough-cookie';
+import { Cookie, CookieJar as ToughCookieJar } from 'tough-cookie';
 /**
  * Cookie jar class.
  */
 export class CookieJar {
-    constructor() {
-        /**
-         * Cookie storage.
-         */
-        this.storage = new tough.CookieJar();
-    }
+    /**
+     * Cookie storage.
+     */
+    storage = new ToughCookieJar();
     /**
      * Load cookies from storage.
      */
@@ -24,7 +22,7 @@ export class CookieJar {
      */
     async storeCookies(url, headers) {
         const cookieURL = this._cookieURL(url);
-        for (const cookie of headers.map(value => tough.Cookie.parse(value))) {
+        for (const cookie of headers.map(value => Cookie.parse(value))) {
             if (cookie !== undefined)
                 await this.storage.setCookie(cookie, cookieURL);
         }
@@ -33,4 +31,3 @@ export class CookieJar {
         return format(currentURL, { auth: false, fragment: false, search: false });
     }
 }
-//# sourceMappingURL=cookie-jar.js.map

package/lib/user-agent/mock.d.ts

@@ -1,7 +1,7 @@
-import type { App } from '../app.js';
-import type { ServerOptions, UserAgentOptions } from '../types.js';
-import { Server } from '../server.js';
-import { UserAgent } from '../user-agent.js';
+import type { App } from '../app.ts';
+import type { ServerOptions, UserAgentOptions } from '../types.ts';
+import { Server } from '../server.ts';
+import { UserAgent } from '../user-agent.ts';
 /**
  * Mock user-agent class.
  */

package/lib/user-agent/mock.js

@@ -1,15 +1,15 @@
-import { Server } from '../server.js';
-import { UserAgent } from '../user-agent.js';
+import { Server } from "../server.js";
+import { UserAgent } from "../user-agent.js";
 /**
  * Mock user-agent class.
  */
 export class MockUserAgent extends UserAgent {
+    /**
+     * Server to use for mock requests.
+     */
+    server = undefined;
     constructor(options) {
         super(options);
-        /**
-         * Server to use for mock requests.
-         */
-        this.server = undefined;
         this.server = undefined;
     }
     async [Symbol.asyncDispose]() {
@@ -41,4 +41,3 @@ export class MockUserAgent extends UserAgent {
             return await this.server.stop();
     }
 }
-//# sourceMappingURL=mock.js.map

package/lib/user-agent/response.d.ts

@@ -1,5 +1,6 @@
+import type { SSEEvent } from '../types.ts';
 import type { Readable } from 'node:stream';
-import { Body } from '../body.js';
+import { Body } from '../body.ts';
 interface UserAgentResponseOptions {
     body: Readable;
     headers: string[];
@@ -44,6 +45,16 @@ export declare class UserAgentResponse extends Body {
      * Check if response has a `2xx` response status code.
      */
     get isSuccess(): boolean;
+    /**
+     * Get async iterator for Server-Sent Events from response body. Note that this method is EXPERIMENTAL and might
+     * change without warning!
+     * @example
+     * // Iterate over events
+     * for await (const {id, type, text} of res.sse()) {
+     *   console.log(`${type}: ${text}`);
+     * }
+     */
+    sse(): AsyncIterableIterator<SSEEvent>;
     /**
      * Get `Content-Type` header value.
      */