@moonsjs/vite 0.1.12 → 0.1.14

package/src/server/node-server.ts

@@ -1,10 +1,18 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
+import { gzipSync } from "node:zlib";
 import { createServer, type Server } from "node:http";
 import { extname, join, resolve, sep } from "node:path";
-import type { PrerenderStorage } from "@moonsjs/core";
+import { DEFAULT_BODY_LIMIT_BYTES, MoonsError, type PrerenderStorage } from "@moonsjs/core";
 import { revalidatePrerendered, shouldRevalidate } from "./isr";
 import { contentTypeForPathname } from "./storage";
-import { sendNodeResponse, toWebRequest } from "./node";
+import {
+  BodyLimitError,
+  DEFAULT_SECURITY_HEADERS,
+  InvalidRequestError,
+  resolveRequestUrl,
+  sendNodeResponse,
+  toWebRequest,
+} from "./node";
 import type { PluginRuntime } from "./plugins";
 import { installGracefulShutdown } from "./shutdown";
 
@@ -52,6 +60,10 @@ export interface NodeServerOptions {
    * memakai storage ini; default: file sistem lokal.
    */
   storage?: PrerenderStorage;
+  /** Addendum J.1: percayai `x-forwarded-proto`/`x-forwarded-host` (default false). */
+  trustProxy?: boolean;
+  /** Addendum J.2: batas body RPC di transport (default `DEFAULT_BODY_LIMIT_BYTES`). */
+  bodyLimitBytes?: number;
 }
 
 /**
@@ -67,9 +79,21 @@ export function startNodeServer(
 
   const server = createServer((req, res) => {
     void (async () => {
+      let url: URL;
       try {
-        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        // Addendum J.1: URL/Origin mengikuti `x-forwarded-*` bila trustProxy aktif;
+        // request malformed → 400 (bukan 500 + stack).
+        url = resolveRequestUrl(req, { trustProxy: options.trustProxy === true });
+      } catch (error) {
+        if (error instanceof InvalidRequestError) {
+          console.warn(`[moons] ${error.message} — 400`);
+          respondBadRequest(res);
+          return;
+        }
+        throw error;
+      }
 
+      try {
         if (req.method === "GET" || req.method === "HEAD") {
           // Addendum I: storage bersama (bila dikonfigurasi) menggantikan file lokal.
           if (options.storage !== undefined) {
@@ -85,11 +109,7 @@ export function startNodeServer(
               });
               res.statusCode = 200;
               res.setHeader("content-type", contentTypeForPathname(url.pathname));
-              for (const [name, value] of Object.entries(options.headers ?? {})) {
-                if (!res.hasHeader(name)) {
-                  res.setHeader(name, value);
-                }
-              }
+              applyStaticHeaders(res, url.pathname, options.headers);
               res.end(req.method === "HEAD" ? undefined : Buffer.from(entry.body));
               return;
             }
@@ -105,22 +125,73 @@ export function startNodeServer(
                 clientDir,
               });
               const body = readFileSync(staticFile);
+              const stat = statSync(staticFile);
               res.statusCode = 200;
               res.setHeader("content-type", MIME_TYPES[extname(staticFile).toLowerCase()] ?? "application/octet-stream");
-              for (const [name, value] of Object.entries(options.headers ?? {})) {
-                if (!res.hasHeader(name)) {
-                  res.setHeader(name, value);
-                }
+              applyStaticHeaders(res, url.pathname, options.headers);
+
+              // Addendum K.5: ETag + 304.
+              const etag = `W/"${stat.size}-${Math.floor(stat.mtimeMs)}"`;
+              res.setHeader("etag", etag);
+              const ifNoneMatch = req.headers["if-none-match"];
+              if (
+                typeof ifNoneMatch === "string" &&
+                ifNoneMatch.split(",").some((value) => value.trim() === etag)
+              ) {
+                res.statusCode = 304;
+                res.end();
+                return;
+              }
+
+              // Addendum K.5: gzip untuk aset teks (cache per mtime).
+              let payload: Buffer = body;
+              if (
+                req.method === "GET" &&
+                COMPRESSIBLE_FILE.test(staticFile) &&
+                body.byteLength >= GZIP_MIN_BYTES &&
+                acceptsGzip(req)
+              ) {
+                payload = gzipCached(staticFile, stat.mtimeMs, body);
+                res.setHeader("content-encoding", "gzip");
+                appendVary(res, "accept-encoding");
               }
-              res.end(req.method === "HEAD" ? undefined : body);
+              res.end(req.method === "HEAD" ? undefined : payload);
               return;
             }
           }
         }
 
-        const response = await handler(await toWebRequest(req));
+        // Addendum J.2: batas body RPC ditegakkan di transport — lebih awal dari
+        // pipeline, tanpa membaca penuh; `content-length` diperiksa lebih dulu.
+        const isRpc = url.pathname.startsWith("/_moons/fn/");
+        const rpcLimit = options.bodyLimitBytes ?? DEFAULT_BODY_LIMIT_BYTES;
+        if (isRpc) {
+          const contentLength = Number(req.headers["content-length"] ?? "0");
+          if (Number.isFinite(contentLength) && contentLength > rpcLimit) {
+            res.statusCode = 413;
+            res.setHeader("content-type", "text/plain; charset=utf-8");
+            res.end(rpcBodyTooLargeText(rpcLimit, contentLength));
+            res.once("finish", () => req.destroy());
+            return;
+          }
+        }
+
+        const request = await toWebRequest(req, {
+          trustProxy: options.trustProxy === true,
+          ...(isRpc ? { maxBodyBytes: rpcLimit } : {}),
+        });
+        const response = await handler(request);
         await sendNodeResponse(res, response);
       } catch (error) {
+        if (error instanceof BodyLimitError) {
+          const isRpc = url.pathname.startsWith("/_moons/fn/");
+          res.statusCode = 413;
+          res.setHeader("content-type", "text/plain; charset=utf-8");
+          res.end(isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large");
+          // Sisa body tidak perlu dibaca — putuskan setelah respons terkirim.
+          res.once("finish", () => req.destroy());
+          return;
+        }
         console.error("[moons] server error:", error);
         res.statusCode = 500;
         res.setHeader("content-type", "text/plain; charset=utf-8");
@@ -159,6 +230,99 @@ export function startNodeServer(
   return server;
 }
 
+/**
+ * Addendum J.7: header konfigurasi (menang), default aman, dan
+ * `Cache-Control: immutable` untuk aset ber-hash di `/assets/*`.
+ */
+function applyStaticHeaders(
+  res: import("node:http").ServerResponse,
+  pathname: string,
+  configured: Record<string, string> | undefined,
+): void {
+  for (const [name, value] of Object.entries(configured ?? {})) {
+    if (!res.hasHeader(name)) {
+      res.setHeader(name, value);
+    }
+  }
+  for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
+    if (!res.hasHeader(name)) {
+      res.setHeader(name, value);
+    }
+  }
+  if (pathname.startsWith("/assets/") && !res.hasHeader("cache-control")) {
+    res.setHeader("cache-control", "public, max-age=31536000, immutable");
+  }
+}
+
+const COMPRESSIBLE_FILE = /\.(js|mjs|css|html|json|svg|txt|map|xml)$/i;
+const GZIP_MIN_BYTES = 1024;
+const GZIP_CACHE_MAX = 64;
+const gzipCache = new Map<string, { mtimeMs: number; gzip: Buffer }>();
+
+function acceptsGzip(req: import("node:http").IncomingMessage): boolean {
+  const header = req.headers["accept-encoding"];
+  if (typeof header !== "string") {
+    return false;
+  }
+  return header
+    .toLowerCase()
+    .split(",")
+    .map((part) => part.trim())
+    .some((part) => part === "gzip" || part === "*" || part.startsWith("gzip;"));
+}
+
+/** Varian gzip ter-cache per file+mtime (bounded FIFO) — Addendum K.5. */
+function gzipCached(file: string, mtimeMs: number, body: Buffer): Buffer {
+  const cached = gzipCache.get(file);
+  if (cached !== undefined && cached.mtimeMs === mtimeMs) {
+    return cached.gzip;
+  }
+  const gzip = gzipSync(body);
+  if (gzipCache.size >= GZIP_CACHE_MAX) {
+    const oldest = gzipCache.keys().next().value;
+    if (oldest !== undefined) {
+      gzipCache.delete(oldest);
+    }
+  }
+  gzipCache.set(file, { mtimeMs, gzip });
+  return gzip;
+}
+
+function appendVary(res: import("node:http").ServerResponse, value: string): void {
+  const existing = res.getHeader("vary");
+  if (typeof existing === "string" && existing.length > 0) {
+    if (!existing.toLowerCase().includes(value)) {
+      res.setHeader("vary", `${existing}, ${value}`);
+    }
+    return;
+  }
+  res.setHeader("vary", value);
+}
+
+function respondBadRequest(res: import("node:http").ServerResponse): void {
+  res.statusCode = 400;
+  res.setHeader("content-type", "text/plain; charset=utf-8");
+  res.end("Bad Request");
+}
+
+/** 413 transport dengan format §15 yang sama seperti `rpc.ts` (Addendum J.2). */
+function rpcBodyTooLargeText(limit: number, size: number | null): string {
+  const megabytes = (bytes: number): string => (bytes / 1_000_000).toFixed(1);
+  return new MoonsError({
+    code: "E_RPC_BODY_TOO_LARGE",
+    message:
+      size === null
+        ? `body melebihi limit ${megabytes(limit)} MB`
+        : `body ${megabytes(size)} MB melebihi limit ${megabytes(limit)} MB`,
+    details:
+      "Body melebihi `security.bodyLimitBytes`; pembacaan dihentikan di transport sebelum penuh.",
+    suggestions: [
+      "Kurangi ukuran payload, atau",
+      "Naikkan security.bodyLimitBytes jika memang perlu",
+    ],
+  }).format();
+}
+
 /** Resolve file static dengan proteksi path traversal (+ manifest prerender D.5). */
 export function resolveStaticFile(clientDir: string, pathname: string): string | null {
   const target = staticFileTarget(clientDir, pathname);

package/src/server/node.ts

@@ -1,17 +1,88 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { CLIENT_IP_HEADER } from "@moonsjs/core";
 
-const MAX_BODY_BYTES = 32 * 1024 * 1024; // batas defensif transport; limit RPC §7.3 tetap berlaku
+/** Batas transport default (Addendum J.2); RPC punya batas lebih kecil dari config. */
+export const MAX_TRANSPORT_BODY_BYTES = 32 * 1024 * 1024;
 
-/** Konversi request Node → Web `Request` (body diteruskan untuk non-GET/HEAD, §7.3). */
-export async function toWebRequest(req: IncomingMessage): Promise<Request> {
-  const host = req.headers.host ?? "localhost";
-  const url = `http://${host}${req.url ?? "/"}`;
+/** Request tidak valid (Host/URL malformed) → dipetakan ke 400 oleh server. */
+export class InvalidRequestError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "InvalidRequestError";
+  }
+}
+
+/** Body melebihi batas → dipetakan ke 413; pembacaan dihentikan saat melewati. */
+export class BodyLimitError extends Error {
+  readonly limit: number;
+  constructor(limit: number) {
+    super(`request body melebihi batas ${limit} byte`);
+    this.name = "BodyLimitError";
+    this.limit = limit;
+  }
+}
+
+export interface ToWebRequestOptions {
+  /** Addendum J.1: percayai `x-forwarded-proto`/`x-forwarded-host` (default false). */
+  trustProxy?: boolean;
+  /** Batas pembacaan body (byte). Default: `MAX_TRANSPORT_BODY_BYTES`. */
+  maxBodyBytes?: number;
+}
+
+/**
+ * Rekonstruksi URL request (Addendum J.1). Tanpa `trustProxy`, origin/host
+ * murni dari header `Host` (perilaku lama, kebal spoofing `x-forwarded-*`).
+ * Malformed → `InvalidRequestError` (server memetakan ke 400).
+ */
+export function resolveRequestUrl(
+  req: IncomingMessage,
+  options: ToWebRequestOptions = {},
+): URL {
+  const hostHeader = req.headers.host ?? "localhost";
+  const trustProxy = options.trustProxy === true;
+  const proto = trustProxy ? forwardedProtocol(req.headers["x-forwarded-proto"]) : null;
+  const forwardedHostValue = trustProxy ? forwardedHost(req.headers["x-forwarded-host"]) : null;
+  const host = forwardedHostValue ?? hostHeader;
+  try {
+    return new URL(`${proto ?? "http"}://${host}${req.url ?? "/"}`);
+  } catch {
+    throw new InvalidRequestError(`header Host tidak valid: ${JSON.stringify(hostHeader)}`);
+  }
+}
+
+/** IP klien tepercaya (Addendum J.1): XFF (hanya bila trustProxy) → socket. */
+export function resolveClientIp(req: IncomingMessage, trustProxy: boolean): string | null {
+  if (trustProxy) {
+    const forwarded = firstHeaderValue(req.headers["x-forwarded-for"]);
+    if (forwarded !== null && isPlausibleIp(forwarded)) {
+      return normalizeIp(forwarded);
+    }
+  }
+  const remote = req.socket?.remoteAddress ?? null;
+  return remote === null ? null : normalizeIp(remote);
+}
+
+/** `::ffff:127.0.0.1` → `127.0.0.1`; buang zone id (`%eth0`). */
+function normalizeIp(value: string): string {
+  const withoutZone = stripZoneId(value);
+  return withoutZone.startsWith("::ffff:") ? withoutZone.slice(7) : withoutZone;
+}
+
+/** Konversi request Node → Web `Request` (body diteruskan untuk non-GET/HEAD, §7.3 + J.1/J.2). */
+export async function toWebRequest(
+  req: IncomingMessage,
+  options: ToWebRequestOptions = {},
+): Promise<Request> {
+  const url = resolveRequestUrl(req, options);
   const method = req.method ?? "GET";
 
   const headers = new Headers();
   for (const [key, value] of Object.entries(req.headers)) {
-    if (value === undefined || key === "content-length") {
+    if (value === undefined || key === "content-length" || key === CLIENT_IP_HEADER) {
       // content-length tidak disalin; fetch menghitung ulang dari body.
+      // x-moons-client-ip selalu ditimpa nilai tepercaya di bawah.
       continue;
     }
     if (Array.isArray(value)) {
@@ -23,34 +94,69 @@ export async function toWebRequest(req: IncomingMessage): Promise<Request> {
     }
   }
 
+  const clientIp = resolveClientIp(req, options.trustProxy === true);
+  if (clientIp !== null) {
+    headers.set(CLIENT_IP_HEADER, clientIp);
+  }
+
   if (method === "GET" || method === "HEAD") {
     return new Request(url, { method, headers });
   }
 
-  const body = await readBody(req);
-  return new Request(url, { method, headers, body: new Uint8Array(body) });
+  const body = await readBody(req, options.maxBodyBytes ?? MAX_TRANSPORT_BODY_BYTES);
+  // View zero-copy (bukan salinan) — Buffer selalu di atas ArrayBuffer biasa.
+  const view = new Uint8Array(body.buffer as ArrayBuffer, body.byteOffset, body.byteLength);
+  return new Request(url, { method, headers, body: view });
 }
 
-function readBody(req: IncomingMessage): Promise<Buffer> {
+/**
+ * Baca body dengan batas tegas (Addendum J.2): begitu melewati `maxBytes`,
+ * pembacaan dihentikan (pause) dan `BodyLimitError` dilempar — tidak pernah
+ * seluruh body besar masuk memori, dan hanya satu salinan buffer dibuat.
+ */
+export function readBody(req: IncomingMessage, maxBytes: number): Promise<Buffer> {
   return new Promise((resolvePromise, reject) => {
     const chunks: Buffer[] = [];
     let size = 0;
+    let settled = false;
+
+    const fail = (error: Error): void => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      req.pause();
+      reject(error);
+    };
 
     req.on("data", (chunk: Buffer) => {
+      if (settled) {
+        return;
+      }
       size += chunk.length;
-      if (size > MAX_BODY_BYTES) {
-        req.destroy();
-        reject(new Error("request body melebihi batas transport"));
+      if (size > maxBytes) {
+        fail(new BodyLimitError(maxBytes));
         return;
       }
       chunks.push(chunk);
     });
-    req.on("end", () => resolvePromise(Buffer.concat(chunks)));
-    req.on("error", (error) => reject(error));
+    req.on("end", () => {
+      if (!settled) {
+        settled = true;
+        resolvePromise(Buffer.concat(chunks));
+      }
+    });
+    req.on("error", (error) => fail(error));
   });
 }
 
-/** Tulis Web `Response` ke `ServerResponse` Node. */
+/** Addendum J.7: default aman runtime; `config.headers` tetap menang (cek hasHeader). */
+export const DEFAULT_SECURITY_HEADERS: Record<string, string> = {
+  "x-content-type-options": "nosniff",
+  "referrer-policy": "strict-origin-when-cross-origin",
+};
+
+/** Tulis Web `Response` ke `ServerResponse` Node (streaming bila ada body). */
 export async function sendNodeResponse(res: ServerResponse, response: Response): Promise<void> {
   res.statusCode = response.status;
   response.headers.forEach((value, key) => {
@@ -73,6 +179,65 @@ export async function sendNodeResponse(res: ServerResponse, response: Response):
       res.setHeader("set-cookie", single);
     }
   }
-  const body = Buffer.from(await response.arrayBuffer());
-  res.end(body);
+
+  for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
+    if (!res.hasHeader(name)) {
+      res.setHeader(name, value);
+    }
+  }
+
+  if (response.body === null || res.req?.method === "HEAD") {
+    res.end();
+    return;
+  }
+
+  // Addendum J.2: stream langsung — tidak ada `arrayBuffer()` penuh di memori.
+  await pipeline(
+    Readable.fromWeb(response.body as unknown as import("node:stream/web").ReadableStream),
+    res,
+  );
+}
+
+function firstHeaderValue(value: string | string[] | undefined): string | null {
+  if (value === undefined) {
+    return null;
+  }
+  const raw = Array.isArray(value) ? value[0] : value;
+  if (raw === undefined) {
+    return null;
+  }
+  const first = raw.split(",")[0]?.trim() ?? "";
+  return first.length === 0 ? null : first;
+}
+
+function forwardedProtocol(value: string | string[] | undefined): "http" | "https" | null {
+  const first = firstHeaderValue(value)?.toLowerCase() ?? null;
+  if (first === "https") {
+    return "https";
+  }
+  if (first === "http") {
+    return "http";
+  }
+  return null;
+}
+
+function forwardedHost(value: string | string[] | undefined): string | null {
+  const first = firstHeaderValue(value);
+  if (first === null || first.length === 0 || first.length > 255) {
+    return null;
+  }
+  // hostname[:port] — tolak karakter di luar himpunan aman (spasi, CRLF, /, @, ?).
+  if (!/^[A-Za-z0-9.\-[\]:]+$/.test(first)) {
+    return null;
+  }
+  return first;
+}
+
+function isPlausibleIp(value: string): boolean {
+  return value.length <= 64 && /^[0-9a-fA-F:.]+$/.test(value);
+}
+
+function stripZoneId(value: string): string {
+  const index = value.indexOf("%");
+  return index === -1 ? value : value.slice(0, index);
 }