@mojojs/core 1.27.0 → 2.0.0

package/lib/server.js

@@ -2,11 +2,11 @@ import cluster from 'node:cluster';
 import http from 'node:http';
 import https from 'node:https';
 import os from 'node:os';
-import { Stream } from 'node:stream';
+import { pipeline, Stream } from 'node:stream';
 import { URL } from 'node:url';
-import { ServerRequest } from './server/request.js';
-import { ServerResponse } from './server/response.js';
-import { WebSocket } from './websocket.js';
+import { ServerRequest } from "./server/request.js";
+import { ServerResponse } from "./server/response.js";
+import { WebSocket } from "./websocket.js";
 import Path from '@mojojs/path';
 import { termEscape } from '@mojojs/util';
 import { WebSocketServer } from 'ws';
@@ -22,16 +22,52 @@ const devKey = certs.child('development.key').toString();
  * HTTP and WebSocket server class.
  */
 export class Server {
+    /**
+     * Application this server handles.
+     */
+    app;
+    /**
+     * Limit the amount of time the parser will wait to receive the complete HTTP headers, defaults to `60000`
+     * (60 seconds).
+     */
+    headersTimeout;
+    /**
+     * Limit the amount of time of inactivity a server needs to wait for additional incoming data, after it has finished
+     * writing the last response, before a socket will be destroyed, defaults to `5000` (5 seconds).
+     */
+    keepAliveTimeout;
+    /**
+     * Maximum number of requests socket can handle before closing keep alive connection, defaults to `0`.
+     */
+    maxRequestsPerSocket;
+    /**
+     * Maximum WebSocket message size in bytes, defaults to `262144` (256 KiB). Connections exceeding the limit are closed
+     * with status `1009`.
+     */
+    maxWebSocketSize;
+    /**
+     * Limit the amount of time for receiving the entire request from the client, defaults to `300000` (300 seconds).
+     */
+    requestTimeout;
+    /**
+     * Reverse proxy mode.
+     */
+    reverseProxy;
+    /**
+     * Server URLs.
+     */
+    urls = [];
+    _cluster;
+    _listen;
+    _servers = [];
+    _quiet;
+    _workers;
     constructor(app, options = {}) {
-        /**
-         * Server URLs.
-         */
-        this.urls = [];
-        this._servers = [];
         this.app = app;
         this.headersTimeout = options.headersTimeout;
         this.keepAliveTimeout = options.keepAliveTimeout;
         this.maxRequestsPerSocket = options.maxRequestsPerSocket;
+        this.maxWebSocketSize = options.maxWebSocketSize ?? 256 * 1024;
         this.requestTimeout = options.requestTimeout;
         this.reverseProxy = options.reverseProxy ?? false;
         this._cluster = options.cluster ?? false;
@@ -72,6 +108,7 @@ export class Server {
                 cluster.fork();
         }
         else {
+            await app.warmup();
             for (const location of this._listen) {
                 await this._createServer(location);
             }
@@ -100,8 +137,7 @@ export class Server {
             options.key = await new Path(searchParams.get('key') ?? devKey).readFile();
             isHttps = true;
         }
-        await this.app.warmup();
-        const wss = new WebSocketServer({ noServer: true });
+        const wss = new WebSocketServer({ maxPayload: this.maxWebSocketSize, noServer: true });
         const server = (isHttps ? https : http).createServer(options, this._handleRequest.bind(this));
         this._servers.push(server);
         if (this.maxRequestsPerSocket !== undefined)
@@ -118,9 +154,9 @@ export class Server {
                 const stderr = process.stderr;
                 socket.on('data', (chunk) => stderr.write(termEscape(`-- Server <<< Client\n${chunk}`)));
                 const write = socket.write;
-                socket.write = (chunk, cb) => {
+                socket.write = (chunk, ...args) => {
                     stderr.write(termEscape(`-- Server >>> Client\n${chunk}`));
-                    return write.apply(socket, [chunk, cb]);
+                    return write.apply(socket, [chunk, ...args]);
                 };
             });
         }
@@ -202,11 +238,18 @@ function sendHeaders(res, raw) {
     const statusCode = res.statusCode;
     const statusMessage = res.statusMessage;
     const headers = res.headers.toArray();
-    if (statusMessage === null) {
-        raw.writeHead(statusCode, headers);
+    try {
+        if (statusMessage === null) {
+            raw.writeHead(statusCode, headers);
+        }
+        else {
+            raw.writeHead(statusCode, statusMessage, headers);
+        }
     }
-    else {
-        raw.writeHead(statusCode, statusMessage, headers);
+    catch (error) {
+        // The response counts as sent already, so close the connection instead of letting the client wait forever
+        raw.destroy();
+        throw error;
     }
 }
 function sendResponse(res, body, raw) {
@@ -217,7 +260,15 @@ function sendResponse(res, body, raw) {
     }
     else if (body instanceof Stream) {
         sendHeaders(res, raw);
-        body.pipe(raw);
+        // Both streams need to be cleaned up, and only aborted connections are expected
+        pipeline(body, raw, error => {
+            if (error === undefined ||
+                error === null ||
+                error.code === 'ERR_STREAM_PREMATURE_CLOSE') {
+                return;
+            }
+            res._ctx?.deref()?.log.error(`Response stream failed: ${error.stack}`);
+        });
     }
     else {
         sendHeaders(res, raw);
@@ -227,4 +278,3 @@ function sendResponse(res, body, raw) {
 function urlToSocketPath(url) {
     return url.host + url.pathname;
 }
-//# sourceMappingURL=server.js.map

package/lib/session.d.ts

@@ -1,6 +1,6 @@
-import type { App } from './app.js';
-import type { Context } from './context.js';
-import type { SessionData } from './types.js';
+import type { App } from './app.ts';
+import type { Context } from './context.ts';
+import type { SessionData } from './types.ts';
 /**
  * Session manager class.
  */

package/lib/session.js

@@ -2,42 +2,55 @@ import crypto from 'node:crypto';
 import { promisify } from 'node:util';
 const scrypt = promisify(crypto.scrypt);
 const randomBytes = promisify(crypto.randomBytes);
+// Deriving keys with scrypt is slow on purpose, so it is only done once per secret
+const keys = new Map();
+function deriveKey(secret) {
+    let key = keys.get(secret);
+    if (key === undefined) {
+        key = scrypt(secret, 'salt', 32);
+        keys.set(secret, key);
+        // Do not cache failures
+        key.catch(() => keys.delete(secret));
+    }
+    return key;
+}
 /**
  * Session manager class.
  */
 export class Session {
+    /**
+     * Name for session cookies, defaults to `mojo`.
+     */
+    cookieName = 'mojo';
+    /**
+     * Path for session cookies, defaults to `/`.
+     */
+    cookiePath = '/';
+    /**
+     * Default time for sessions to expire in seconds from now, defaults to `3600`. The expiration timeout gets refreshed
+     * for every request. Setting the value to `0` will allow sessions to persist until the browser window is closed,
+     * this can have security implications though.
+     */
+    expiration = 3600;
+    /**
+     * Set the `HttpOnly` value on all session cookies.
+     */
+    httpOnly = true;
+    /**
+     * Set the `Partitioned` value on all session cookies, to be used in accordance with the CHIPS amendment to RFC 6265.
+     * Note that this property is EXPERIMENTAL and might change without warning!
+     */
+    partitioned = false;
+    /**
+     * Set the `SameSite` value on all session cookies, defaults to `lax`.
+     */
+    sameSite = 'lax';
+    /**
+     * Set the secure flag on all session cookies, so that browsers send them only over HTTPS connections.
+     */
+    secure = false;
+    _app;
     constructor(app) {
-        /**
-         * Name for session cookies, defaults to `mojo`.
-         */
-        this.cookieName = 'mojo';
-        /**
-         * Path for session cookies, defaults to `/`.
-         */
-        this.cookiePath = '/';
-        /**
-         * Default time for sessions to expire in seconds from now, defaults to `3600`. The expiration timeout gets refreshed
-         * for every request. Setting the value to `0` will allow sessions to persist until the browser window is closed,
-         * this can have security implications though.
-         */
-        this.expiration = 3600;
-        /**
-         * Set the `HttpOnly` value on all session cookies.
-         */
-        this.httpOnly = true;
-        /**
-         * Set the `Partitioned` value on all session cookies, to be used in accordance with the CHIPS amendment to RFC 6265.
-         * Note that this property is EXPERIMENTAL and might change without warning!
-         */
-        this.partitioned = false;
-        /**
-         * Set the `SameSite` value on all session cookies, defaults to `lax`.
-         */
-        this.sameSite = 'lax';
-        /**
-         * Set the secure flag on all session cookies, so that browsers send them only over HTTPS connections.
-         */
-        this.secure = false;
         this._app = new WeakRef(app);
     }
     /**
@@ -52,7 +65,7 @@ export class Session {
         const authTag = Buffer.from(match[3], 'base64');
         for (const secret of secrets) {
             try {
-                const key = await scrypt(secret, 'salt', 32);
+                const key = await deriveKey(secret);
                 const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv, { authTagLength: 16 });
                 decipher.setAuthTag(authTag);
                 const decrypted = decipher.update(value, 'base64', 'utf8');
@@ -68,7 +81,7 @@ export class Session {
      * Encrypt cookie.
      */
     static async encrypt(secret, value) {
-        const key = await scrypt(secret, 'salt', 32);
+        const key = await deriveKey(secret);
         const iv = await randomBytes(12);
         const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
         const encrypted = cipher.update(value, 'utf8', 'base64') + cipher.final('base64');
@@ -123,4 +136,3 @@ export class Session {
         });
     }
 }
-//# sourceMappingURL=session.js.map

package/lib/sse.d.ts

@@ -1,4 +1,4 @@
-import type { SSEEvent } from './types.js';
+import type { SSEEvent } from './types.ts';
 /**
  * Build Server-Sent Event. Note that this function is EXPERIMENTAL and might change without warning!
  */

package/lib/sse.js

@@ -60,4 +60,3 @@ function splitLines(value) {
         lines.pop();
     return lines;
 }
-//# sourceMappingURL=sse.js.map

package/lib/static.d.ts

@@ -1,4 +1,4 @@
-import type { MojoContext } from './types.js';
+import type { MojoContext } from './types.ts';
 import Path from '@mojojs/path';
 type AssetIndex = Record<string, string>;
 /**

package/lib/static.js

@@ -1,23 +1,21 @@
-import crypto from 'node:crypto';
 import Path from '@mojojs/path';
 /**
  * Static file server class.
  */
 export class Static {
-    constructor() {
-        /**
-         * Subdirectory used for all static assets.
-         */
-        this.assetDir = 'assets';
-        /**
-         * Prefix to use for all static files.
-         */
-        this.prefix = '/static';
-        /**
-         * Directories to serve static files from, first one has the highest precedence.
-         */
-        this.publicPaths = [Path.currentFile().sibling('..', 'vendor', 'public').toString()];
-    }
+    /**
+     * Subdirectory used for all static assets.
+     */
+    assetDir = 'assets';
+    /**
+     * Prefix to use for all static files.
+     */
+    prefix = '/static';
+    /**
+     * Directories to serve static files from, first one has the highest precedence.
+     */
+    publicPaths = [Path.currentFile().sibling('..', 'vendor', 'public').toString()];
+    _assets;
     /**
      * Get static asset path.
      */
@@ -79,9 +77,10 @@ export class Static {
         // If-None-Match
         const ifNoneMatch = req.get('If-None-Match');
         if (etag !== undefined && ifNoneMatch !== null) {
-            const etags = ifNoneMatch.split(/,\s+/).map(value => value.replaceAll('"', ''));
+            // Weak comparison, because proxies like nginx turn ETags into weak ones when compressing responses
+            const etags = ifNoneMatch.split(/\s*,\s*/).map(value => value.replace(/^W\//, '').replaceAll('"', ''));
             for (const match of etags) {
-                if (match === etag)
+                if (match === etag || match === '*')
                     return true;
             }
         }
@@ -91,7 +90,8 @@ export class Static {
             const epoch = Date.parse(ifModifiedSince);
             if (isNaN(epoch))
                 return false;
-            if (epoch > options.lastModified.getTime())
+            // HTTP dates have no milliseconds
+            if (epoch >= Math.floor(options.lastModified.getTime() / 1000) * 1000)
                 return true;
         }
         return false;
@@ -113,7 +113,8 @@ export class Static {
         const { res } = ctx;
         res.set('Accept-Ranges', 'bytes');
         const lastModified = stat.mtime;
-        const etag = crypto.createHash('md5').update(lastModified.getTime().toString()).digest('hex');
+        // Size too, because reproducible builds often give all files the same modification time
+        const etag = `${lastModified.getTime()}-${length}`;
         if (this.isFresh(ctx, { etag, lastModified })) {
             await res.status(304).send();
             return;
@@ -131,10 +132,15 @@ export class Static {
         if (bytes === null)
             return await this._rangeNotSatisfiable(ctx);
         let start = parseInt(bytes[1]);
+        let end = parseInt(bytes[2]);
+        // Suffix range for the last bytes of the file
+        if (isNaN(start) && isNaN(end) === false) {
+            start = Math.max(length - end, 0);
+            end = length - 1;
+        }
         if (isNaN(start))
             start = 0;
-        let end = parseInt(bytes[2]);
-        if (isNaN(end))
+        if (isNaN(end) || end >= length)
             end = length - 1;
         if (start > end)
             return await this._rangeNotSatisfiable(ctx);
@@ -175,4 +181,3 @@ export class Static {
         await ctx.res.status(416).send();
     }
 }
-//# sourceMappingURL=static.js.map

package/lib/types.d.ts

@@ -1,8 +1,8 @@
-import type { App } from './app.js';
-import type { Context } from './context.js';
-import type { Route } from './router/route.js';
-import type { SafeString } from './util.js';
-import type { ValidatorResult } from './validator/result.js';
+import type { App } from './app.ts';
+import type { Context } from './context.ts';
+import type { Route } from './router/route.ts';
+import type { SafeString } from './util.ts';
+import type { ValidatorResult } from './validator/result.ts';
 import type { Agent } from 'node:http';
 import type { Readable, Stream } from 'node:stream';
 import type { URL } from 'node:url';
@@ -156,6 +156,7 @@ export interface ServerOptions {
     keepAliveTimeout?: number;
     listen?: string[];
     maxRequestsPerSocket?: number;
+    maxWebSocketSize?: number;
     quiet?: boolean;
     requestTimeout?: number;
     reverseProxy?: boolean;

package/lib/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/lib/user-agent/cookie-jar.d.ts

@@ -1,5 +1,5 @@
 import { type URL } from 'node:url';
-import tough from 'tough-cookie';
+import { CookieJar as ToughCookieJar } from 'tough-cookie';
 /**
  * Cookie jar class.
  */
@@ -7,7 +7,7 @@ export declare class CookieJar {
     /**
      * Cookie storage.
      */
-    storage: tough.CookieJar;
+    storage: ToughCookieJar;
     /**
      * Load cookies from storage.
      */

package/lib/user-agent/cookie-jar.js

@@ -1,15 +1,13 @@
 import { format } from 'node:url';
-import tough from 'tough-cookie';
+import { Cookie, CookieJar as ToughCookieJar } from 'tough-cookie';
 /**
  * Cookie jar class.
  */
 export class CookieJar {
-    constructor() {
-        /**
-         * Cookie storage.
-         */
-        this.storage = new tough.CookieJar();
-    }
+    /**
+     * Cookie storage.
+     */
+    storage = new ToughCookieJar();
     /**
      * Load cookies from storage.
      */
@@ -24,7 +22,7 @@ export class CookieJar {
      */
     async storeCookies(url, headers) {
         const cookieURL = this._cookieURL(url);
-        for (const cookie of headers.map(value => tough.Cookie.parse(value))) {
+        for (const cookie of headers.map(value => Cookie.parse(value))) {
             if (cookie !== undefined)
                 await this.storage.setCookie(cookie, cookieURL);
         }
@@ -33,4 +31,3 @@ export class CookieJar {
         return format(currentURL, { auth: false, fragment: false, search: false });
     }
 }
-//# sourceMappingURL=cookie-jar.js.map

package/lib/user-agent/mock.d.ts

@@ -1,7 +1,7 @@
-import type { App } from '../app.js';
-import type { ServerOptions, UserAgentOptions } from '../types.js';
-import { Server } from '../server.js';
-import { UserAgent } from '../user-agent.js';
+import type { App } from '../app.ts';
+import type { ServerOptions, UserAgentOptions } from '../types.ts';
+import { Server } from '../server.ts';
+import { UserAgent } from '../user-agent.ts';
 /**
  * Mock user-agent class.
  */

package/lib/user-agent/mock.js

@@ -1,15 +1,15 @@
-import { Server } from '../server.js';
-import { UserAgent } from '../user-agent.js';
+import { Server } from "../server.js";
+import { UserAgent } from "../user-agent.js";
 /**
  * Mock user-agent class.
  */
 export class MockUserAgent extends UserAgent {
+    /**
+     * Server to use for mock requests.
+     */
+    server = undefined;
     constructor(options) {
         super(options);
-        /**
-         * Server to use for mock requests.
-         */
-        this.server = undefined;
         this.server = undefined;
     }
     async [Symbol.asyncDispose]() {
@@ -41,4 +41,3 @@ export class MockUserAgent extends UserAgent {
             return await this.server.stop();
     }
 }
-//# sourceMappingURL=mock.js.map

package/lib/user-agent/response.d.ts

@@ -1,6 +1,6 @@
-import type { SSEEvent } from '../types.js';
+import type { SSEEvent } from '../types.ts';
 import type { Readable } from 'node:stream';
-import { Body } from '../body.js';
+import { Body } from '../body.ts';
 interface UserAgentResponseOptions {
     body: Readable;
     headers: string[];

package/lib/user-agent/response.js

@@ -1,9 +1,21 @@
-import { Body } from '../body.js';
-import { parseEvent } from '../sse.js';
+import { Body } from "../body.js";
+import { parseEvent } from "../sse.js";
 /**
  * User-agent response class.
  */
 export class UserAgentResponse extends Body {
+    /**
+     * HTTP version.
+     */
+    httpVersion;
+    /**
+     * Response status code.
+     */
+    statusCode;
+    /**
+     * Response status message.
+     */
+    statusMessage;
     constructor(options) {
         super(options.headers, options.body);
         this.httpVersion = options.httpVersion;
@@ -73,4 +85,3 @@ export class UserAgentResponse extends Body {
         return this.get('Content-Type');
     }
 }
-//# sourceMappingURL=response.js.map

package/lib/user-agent/test.d.ts

@@ -1,10 +1,10 @@
-import type { UserAgentResponse } from './response.js';
-import type { App } from '../app.js';
-import type { JSONValue, SSEEvent, ServerOptions, TestContext, TestUserAgentOptions, UserAgentRequestOptions, UserAgentWebSocketOptions } from '../types.js';
-import type { WebSocket } from '../websocket.js';
+import type { UserAgentResponse } from './response.ts';
+import type { App } from '../app.ts';
+import type { JSONValue, SSEEvent, ServerOptions, TestContext, TestUserAgentOptions, UserAgentRequestOptions, UserAgentWebSocketOptions } from '../types.ts';
+import type { WebSocket } from '../websocket.ts';
 import type { URL } from 'node:url';
 import assert from 'node:assert/strict';
-import { MockUserAgent } from './mock.js';
+import { MockUserAgent } from './mock.ts';
 import DOM from '@mojojs/dom';
 import StackUtils from 'stack-utils';
 type SkipFunction = (...args: any[]) => any;

package/lib/user-agent/test.js

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { on } from 'node:events';
-import { MockUserAgent } from './mock.js';
+import { MockUserAgent } from "./mock.js";
 import DOM from '@mojojs/dom';
 import { jsonPointer } from '@mojojs/util';
 import * as yaml from 'js-yaml';
@@ -18,21 +18,21 @@ function addNodeAssertMethods(tapInstance) {
  * Test user-agent class.
  */
 export class TestUserAgent extends MockUserAgent {
+    /**
+     * Current HTTP response content.
+     */
+    body = Buffer.from('');
+    _assert = undefined;
+    _dom = undefined;
+    _finished = undefined;
+    _messages = undefined;
+    _res = undefined;
+    _sse = undefined;
+    _sseEvents = undefined;
+    _stack = new StackUtils();
+    _ws = undefined;
     constructor(options = {}) {
         super(options);
-        /**
-         * Current HTTP response content.
-         */
-        this.body = Buffer.from('');
-        this._assert = undefined;
-        this._dom = undefined;
-        this._finished = undefined;
-        this._messages = undefined;
-        this._res = undefined;
-        this._sse = undefined;
-        this._sseEvents = undefined;
-        this._stack = new StackUtils();
-        this._ws = undefined;
         if (options.tap !== undefined)
             this._prepareTap(options.tap);
     }
@@ -472,4 +472,3 @@ export class TestUserAgent extends MockUserAgent {
         });
     }
 }
-//# sourceMappingURL=test.js.map

package/lib/user-agent/transport/http.d.ts

@@ -1,7 +1,7 @@
-import type { UserAgentRequestOptions } from '../../types.js';
+import type { UserAgentRequestOptions } from '../../types.ts';
 import type { URL } from 'node:url';
 import http from 'node:http';
-import { UserAgentResponse } from '../response.js';
+import { UserAgentResponse } from '../response.ts';
 /**
  * HTTP transport class.
  */

package/lib/user-agent/transport/http.js

@@ -1,17 +1,15 @@
 import http from 'node:http';
 import Stream from 'node:stream';
-import { UserAgentResponse } from '../response.js';
+import { UserAgentResponse } from "../response.js";
 import { termEscape } from '@mojojs/util';
 /**
  * HTTP transport class.
  */
 export class HTTPTransport {
-    constructor() {
-        /**
-         * HTTP agent.
-         */
-        this.agent = new http.Agent();
-    }
+    /**
+     * HTTP agent.
+     */
+    agent = new http.Agent();
     /**
      * Destroy active keep-alive connections.
      */
@@ -40,9 +38,9 @@ export class HTTPTransport {
                     const stderr = process.stderr;
                     socket.on('data', (chunk) => stderr.write(termEscape(`-- Client <<< Server\n${chunk}`)));
                     const write = socket.write;
-                    socket.write = (chunk, cb) => {
+                    socket.write = (chunk, ...args) => {
                         stderr.write(termEscape(`-- Client >>> Server\n${chunk}`));
-                        return write.apply(socket, [chunk, cb]);
+                        return write.apply(socket, [chunk, ...args]);
                     };
                 });
             }
@@ -75,4 +73,3 @@ export class HTTPTransport {
         return http.request(url, options, cb);
     }
 }
-//# sourceMappingURL=http.js.map

package/lib/user-agent/transport/https.d.ts

@@ -1,8 +1,8 @@
-import type { UserAgentRequestOptions } from '../../types.js';
+import type { UserAgentRequestOptions } from '../../types.ts';
 import type http from 'node:http';
 import type { URL } from 'node:url';
 import https from 'node:https';
-import { HTTPTransport } from './http.js';
+import { HTTPTransport } from './http.ts';
 /**
  * HTTPS transport class.
  */