@morojs/moro 1.7.30 → 1.8.1

package/dist/core/http/http-server.js

@@ -1,9 +1,12 @@
 // src/core/http-server.ts
 import { IncomingMessage, ServerResponse, createServer } from 'http';
+import { createServer as createHttpsServer } from 'https';
 import * as zlib from 'zlib';
 import { promisify } from 'util';
 import { randomUUID } from 'crypto';
 import { createFrameworkLogger } from '../logger/index.js';
+import { parseMultipart as parseMultipartBuffer, } from './utils/multipart-parser.js';
+import { parseRawQueryString } from './utils/query-parser.js';
 import { PathMatcher } from '../routing/path-matcher.js';
 import { ObjectPoolManager } from '../pooling/object-pool-manager.js';
 const gzip = promisify(zlib.gzip);
@@ -39,26 +42,9 @@ const TYPE_SHORTHANDS = {
     css: 'text/css; charset=utf-8',
     form: 'application/x-www-form-urlencoded',
 };
-function parseQueryString(queryString) {
-    const result = {};
-    if (!queryString)
-        return result;
-    const pairs = queryString.split('&');
-    const pairsLen = pairs.length;
-    for (let i = 0; i < pairsLen; i++) {
-        const pair = pairs[i];
-        const equalIndex = pair.indexOf('=');
-        if (equalIndex === -1) {
-            result[decodeURIComponent(pair)] = '';
-        }
-        else {
-            const key = decodeURIComponent(pair.substring(0, equalIndex));
-            const value = decodeURIComponent(pair.substring(equalIndex + 1));
-            result[key] = value;
-        }
-    }
-    return result;
-}
+// Canonical query parsing shared with the uWS/engine transports - identical
+// req.query semantics everywhere ('+' as space, malformed escapes tolerated).
+const parseQueryString = parseRawQueryString;
 function parseCookieHeader(cookieHeader) {
     const cookies = {};
     if (!cookieHeader)
@@ -67,6 +53,8 @@ function parseCookieHeader(cookieHeader) {
     const cookiePartsLen = cookieParts.length;
     for (let i = 0; i < cookiePartsLen; i++) {
         const cookie = cookieParts[i];
+        if (cookie === undefined)
+            continue;
         const equalIndex = cookie.indexOf('=');
         if (equalIndex > 0) {
             const name = cookie.substring(0, equalIndex).trim();
@@ -197,7 +185,7 @@ export class MoroIncomingMessage extends IncomingMessage {
         if (v === undefined) {
             const forwardedProto = this.headers['x-forwarded-proto'];
             v = forwardedProto
-                ? forwardedProto.split(',')[0].trim()
+                ? (forwardedProto.split(',')[0] ?? '').trim()
                 : this.socket?.encrypted
                     ? 'https'
                     : 'http';
@@ -277,7 +265,7 @@ export class MoroIncomingMessage extends IncomingMessage {
         const ct = (this.headers['content-type'] || '');
         if (!ct)
             return false;
-        const mime = ct.split(';')[0].trim().toLowerCase();
+        const mime = (ct.split(';')[0] ?? '').trim().toLowerCase();
         const t = type.toLowerCase();
         if (t.indexOf('/') === -1) {
             // e.g. 'json' → match */json or +json suffix
@@ -295,7 +283,7 @@ export class MoroIncomingMessage extends IncomingMessage {
         const wanted = Array.isArray(types) ? types : [types];
         if (accept === '*/*' || accept === '')
             return wanted[0] || false;
-        const acceptTypes = accept.split(',').map(s => s.split(';')[0].trim().toLowerCase());
+        const acceptTypes = accept.split(',').map(s => (s.split(';')[0] ?? '').trim().toLowerCase());
         for (const w of wanted) {
             const wl = w.toLowerCase();
             const wMime = wl.indexOf('/') === -1 ? `application/${wl}` : wl;
@@ -322,7 +310,7 @@ export class MoroIncomingMessage extends IncomingMessage {
             .split(',')
             .map(s => {
             const parts = s.trim().split(';');
-            const tag = parts[0].toLowerCase();
+            const tag = (parts[0] ?? '').toLowerCase();
             const qPart = parts.find(p => p.trim().startsWith('q='));
             const q = qPart ? parseFloat(qPart.trim().slice(2)) : 1;
             return { tag, q: isNaN(q) ? 0 : q };
@@ -485,7 +473,8 @@ export class MoroServerResponse extends ServerResponse {
         }
         const cookieValue = encodeURIComponent(value);
         let cookieString = `${name}=${cookieValue}`;
-        if (options.maxAge)
+        // maxAge: 0 is meaningful (immediate expiry - clearCookie relies on it)
+        if (options.maxAge !== undefined && options.maxAge !== null)
             cookieString += `; Max-Age=${options.maxAge}`;
         if (options.expires)
             cookieString += `; Expires=${options.expires.toUTCString()}`;
@@ -497,8 +486,9 @@ export class MoroServerResponse extends ServerResponse {
             cookieString += `; SameSite=${options.sameSite}`;
         if (options.domain)
             cookieString += `; Domain=${options.domain}`;
-        if (options.path)
-            cookieString += `; Path=${options.path}`;
+        // Path defaults to '/' (Express behavior) so clearCookie() from a nested
+        // route can clear a cookie originally set at the site root.
+        cookieString += `; Path=${options.path ?? '/'}`;
         const existingCookies = this.getHeader('Set-Cookie') || [];
         // Avoid spread operator - direct array manipulation
         const cookies = Array.isArray(existingCookies) ? existingCookies : [existingCookies];
@@ -708,7 +698,9 @@ export class MoroServerResponse extends ServerResponse {
             return this;
         }
         for (const key in headers) {
-            this.setHeader(key, headers[key]);
+            const value = headers[key];
+            if (value !== undefined)
+                this.setHeader(key, value);
         }
         return this;
     }
@@ -804,10 +796,15 @@ export class MoroServerResponse extends ServerResponse {
             // Set Content-Type from extension if not already set
             if (!this.getHeader('Content-Type')) {
                 // fire-and-forget mime lookup; not awaited to keep signature chainable
-                this._server.getMimeType(filename.substring(filename.lastIndexOf('.'))).then(mime => {
+                void this._server
+                    .getMimeType(filename.substring(filename.lastIndexOf('.')))
+                    .then(mime => {
                     if (!this.getHeader('Content-Type') && !this.headersSent) {
                         this.setHeader('Content-Type', mime);
                     }
+                })
+                    .catch(() => {
+                    // best-effort content-type inference
                 });
             }
         }
@@ -866,6 +863,10 @@ export class MoroServerResponse extends ServerResponse {
 }
 export class MoroHttpServer {
     server;
+    /** Multipart limits threaded to parseMultipart at the call site. */
+    multipartLimits;
+    /** TCP backlog for listen(), when configured. */
+    listenBacklog;
     routes = [];
     globalMiddleware = [];
     /** @internal read by MoroServerResponse prototype methods */
@@ -923,7 +924,23 @@ export class MoroHttpServer {
         BoundResponse.prototype._server = boundServer;
         this.RequestClass = BoundRequest;
         this.ResponseClass = BoundResponse;
-        this.server = createServer({ IncomingMessage: BoundRequest, ServerResponse: BoundResponse }, this.handleRequest.bind(this));
+        const limits = options?.limits;
+        // maxHeaderSize is a createServer option (not a mutable property), so it
+        // must be passed here.
+        const serverOpts = {
+            IncomingMessage: BoundRequest,
+            ServerResponse: BoundResponse,
+            ...(limits?.maxHeaderSize && { maxHeaderSize: limits.maxHeaderSize }),
+        };
+        if (options?.ssl) {
+            // In-process HTTPS. The https ServerOptions extends the http one, so the
+            // IncomingMessage/ServerResponse subclass injection carries over.
+            this.server = createHttpsServer({ ...serverOpts, ...options.ssl }, this.handleRequest.bind(this));
+            this.logger.info('HTTPS server created (in-process TLS)', 'HttpServer');
+        }
+        else {
+            this.server = createServer(serverOpts, this.handleRequest.bind(this));
+        }
         // Configure body size limits from options
         if (options?.maxBodySize) {
             this.maxBodySize = options.maxBodySize;
@@ -931,15 +948,25 @@ export class MoroHttpServer {
         if (options?.maxUploadSize) {
             this.maxUploadSize = options.maxUploadSize;
         }
-        // Optimize server for high performance (conservative settings for compatibility)
-        this.server.keepAliveTimeout = 5000; // 5 seconds
-        this.server.headersTimeout = 6000; // 6 seconds
-        // Socket inactivity timeout stays at Node's default (0 = disabled). A
-        // non-zero value arms/refreshes a timer on every request, which shows up
-        // in CPU profiles (setStreamTimeout + timer churn) under load; slowloris
-        // protection is already covered by headersTimeout + keepAliveTimeout, and
-        // this matches Node's own default connectionTimeout: 0.
-        this.server.timeout = 0;
+        if (limits?.multipart)
+            this.multipartLimits = limits.multipart;
+        // Timeouts: the previous hardcodes (keepAlive 5000, headers 6000) become
+        // the documented defaults; a configured value overrides them. Socket idle
+        // timeout stays 0 (disabled) unless set - a non-zero value arms a
+        // per-request timer that shows up in CPU profiles under load.
+        const t = limits?.timeouts ?? {};
+        this.server.keepAliveTimeout = t.keepAlive ?? 5000;
+        this.server.headersTimeout = t.headers ?? 6000;
+        this.server.timeout = t.idle ?? 0;
+        if (t.request)
+            this.server.requestTimeout = t.request;
+        if (limits?.maxConnections && limits.maxConnections > 0) {
+            this.server.maxConnections = limits.maxConnections;
+        }
+        if (limits?.maxHeaders)
+            this.server.maxHeadersCount = limits.maxHeaders;
+        if (limits?.backlog !== undefined)
+            this.listenBacklog = limits.backlog;
     }
     // Direct router dispatch - called after global middleware, before the legacy
     // route table. Returning true (or a promise of true) means the request was handled.
@@ -1218,7 +1245,11 @@ export class MoroHttpServer {
             const paramNames = route.paramNames;
             const paramNamesLen = paramNames.length;
             for (let i = 0; i < paramNamesLen; i++) {
-                params[paramNames[i]] = matches[i + 1];
+                const paramName = paramNames[i];
+                const value = matches[i + 1];
+                if (paramName !== undefined && value !== undefined) {
+                    params[paramName] = value;
+                }
             }
             httpReq.params = params;
         }
@@ -1284,18 +1315,23 @@ export class MoroHttpServer {
                 }
             }
             if (!httpRes.headersSent) {
+                // A malformed body is a client error: default to 400 (parity with the
+                // engine/uWS transports), not the generic 500.
+                const isBadRequest = error?.statusCode === 400;
+                const defaultStatus = isBadRequest ? 400 : 500;
+                const defaultError = isBadRequest ? 'Invalid request body' : 'Internal server error';
                 // Ensure response is properly enhanced before using custom methods
                 if (typeof httpRes.status === 'function' && typeof httpRes.json === 'function') {
-                    httpRes.status(500).json({
+                    httpRes.status(defaultStatus).json({
                         success: false,
-                        error: 'Internal server error',
+                        error: defaultError,
                         requestId: httpReq.requestId,
                     });
                 }
                 else {
                     // Defensive fallback - check each method individually
                     if (typeof httpRes.setHeader === 'function') {
-                        httpRes.statusCode = 500;
+                        httpRes.statusCode = defaultStatus;
                         httpRes.setHeader('Content-Type', 'application/json');
                     }
                     else {
@@ -1308,7 +1344,7 @@ export class MoroHttpServer {
                     if (typeof httpRes.end === 'function') {
                         httpRes.end(JSON.stringify({
                             success: false,
-                            error: 'Internal server error',
+                            error: defaultError,
                             requestId: httpReq.requestId,
                         }));
                     }
@@ -1447,12 +1483,12 @@ export class MoroHttpServer {
             error.received = contentLength;
             return Promise.reject(error);
         }
-        // For very large payloads, return a streaming interface instead of buffering
-        if (contentLength > maxSize / 2) {
-            // Stream for payloads > 50MB (uploads) or > 5MB (JSON/form)
-            return this.createStreamingBodyParser(req, contentType, maxSize);
-        }
-        // Standard buffered parsing for smaller payloads
+        // Buffer every body up to maxSize and parse it into its real shape. The
+        // incremental limit check below already bounds memory, and every other
+        // backend (uWS, engine) returns the parsed body here - previously bodies
+        // between maxSize/2 and maxSize resolved to a { type, parser } descriptor
+        // object instead, so handlers/validation on the Node backend silently saw
+        // a bogus shape for the exact same request that parsed normally elsewhere.
         return new Promise((resolve, reject) => {
             const chunks = [];
             let totalLength = 0;
@@ -1474,9 +1510,14 @@ export class MoroHttpServer {
                 try {
                     // Single-chunk fast path (most JSON bodies arrive in one chunk);
                     // otherwise concat with the known total length to avoid a re-scan
-                    const body = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks, totalLength);
+                    const firstChunk = chunks[0];
+                    const body = chunks.length === 1 && firstChunk !== undefined
+                        ? firstChunk
+                        : Buffer.concat(chunks, totalLength);
                     if (contentType.includes('application/json')) {
-                        resolve(JSON.parse(body.toString()));
+                        // Empty JSON body -> null (parity with the engine/uWS servers, and
+                        // avoids JSON.parse('') throwing and 500ing an empty POST).
+                        resolve(totalLength === 0 ? null : JSON.parse(body.toString()));
                     }
                     else if (contentType.includes('application/x-www-form-urlencoded')) {
                         resolve(this.parseUrlEncoded(body.toString()));
@@ -1489,132 +1530,12 @@ export class MoroHttpServer {
                     }
                 }
                 catch (error) {
-                    reject(error);
-                }
-            });
-            req.on('error', reject);
-        });
-    }
-    /**
-     * Create a streaming body parser for large payloads
-     * Returns a streaming interface instead of buffering
-     */
-    createStreamingBodyParser(req, contentType, maxSize) {
-        let totalLength = 0;
-        const chunks = [];
-        return new Promise((resolve, reject) => {
-            const streamParser = {
-                // Streaming JSON parser for large JSON payloads
-                json: () => this.streamJsonParse(req, maxSize),
-                // Streaming form data parser
-                form: () => this.streamFormParse(req, maxSize),
-                // Raw stream access
-                stream: () => ({
-                    onData: (callback) => {
-                        req.on('data', (chunk) => {
-                            totalLength += chunk.length;
-                            if (totalLength > maxSize) {
-                                reject(new Error('Request body too large'));
-                                return;
-                            }
-                            callback(chunk);
-                        });
-                    },
-                    onEnd: (callback) => {
-                        req.on('end', callback);
-                    },
-                    onError: (callback) => {
-                        req.on('error', callback);
-                    },
-                }),
-                // Traditional buffered parsing (fallback)
-                buffer: async () => {
-                    return new Promise((resolveBuffer, rejectBuffer) => {
-                        req.on('data', (chunk) => {
-                            totalLength += chunk.length;
-                            if (totalLength > maxSize) {
-                                rejectBuffer(new Error('Request body too large'));
-                                return;
-                            }
-                            chunks.push(chunk);
-                        });
-                        req.on('end', () => {
-                            try {
-                                const body = Buffer.concat(chunks);
-                                if (contentType.includes('application/json')) {
-                                    resolveBuffer(JSON.parse(body.toString()));
-                                }
-                                else {
-                                    resolveBuffer(body.toString());
-                                }
-                            }
-                            catch (error) {
-                                rejectBuffer(error);
-                            }
-                        });
-                        req.on('error', rejectBuffer);
-                    });
-                },
-            };
-            // Auto-detect and return appropriate parser
-            if (contentType.includes('application/json')) {
-                resolve({ type: 'json', parser: streamParser.json });
-            }
-            else if (contentType.includes('application/x-www-form-urlencoded')) {
-                resolve({ type: 'form', parser: streamParser.form });
-            }
-            else {
-                resolve({ type: 'stream', parser: streamParser.stream });
-            }
-        });
-    }
-    /**
-     * Streaming JSON parser for large payloads
-     */
-    async streamJsonParse(req, maxSize) {
-        return new Promise((resolve, reject) => {
-            let jsonString = '';
-            let totalLength = 0;
-            req.on('data', (chunk) => {
-                totalLength += chunk.length;
-                if (totalLength > maxSize) {
-                    reject(new Error('Request body too large'));
-                    return;
-                }
-                jsonString += chunk.toString();
-            });
-            req.on('end', () => {
-                try {
-                    // For very large JSON, consider streaming JSON parsing in the future
-                    resolve(JSON.parse(jsonString));
-                }
-                catch (error) {
-                    reject(error);
-                }
-            });
-            req.on('error', reject);
-        });
-    }
-    /**
-     * Streaming form data parser
-     */
-    async streamFormParse(req, maxSize) {
-        return new Promise((resolve, reject) => {
-            let formData = '';
-            let totalLength = 0;
-            req.on('data', (chunk) => {
-                totalLength += chunk.length;
-                if (totalLength > maxSize) {
-                    reject(new Error('Request body too large'));
-                    return;
-                }
-                formData += chunk.toString();
-            });
-            req.on('end', () => {
-                try {
-                    resolve(this.parseUrlEncoded(formData));
-                }
-                catch (error) {
+                    // A malformed body is a client error (400), not a server error (500).
+                    // Tag it so the request-error path answers 400, matching the engine
+                    // and uWS transports.
+                    if (error instanceof Error && error.statusCode === undefined) {
+                        error.statusCode = 400;
+                    }
                     reject(error);
                 }
             });
@@ -1622,76 +1543,9 @@ export class MoroHttpServer {
         });
     }
     parseMultipart(buffer, contentType) {
-        const boundary = contentType.split('boundary=')[1];
-        if (!boundary) {
-            throw new Error('Invalid multipart boundary');
-        }
-        // Work with Buffer directly - don't convert to string (corrupts binary data)
-        const boundaryBuffer = Buffer.from(`--${boundary}`);
-        const parts = this.splitBuffer(buffer, boundaryBuffer);
-        const fields = {};
-        const files = {};
-        // Skip first (empty) and last (closing boundary) parts
-        const partsLen = parts.length - 1;
-        for (let i = 1; i < partsLen; i++) {
-            const part = parts[i];
-            // Find the double CRLF that separates headers from content
-            const headerEndPos = this.findBufferSequence(part, Buffer.from('\r\n\r\n'));
-            if (headerEndPos === -1)
-                continue;
-            // Headers are always text - safe to convert to string
-            const headers = part.slice(0, headerEndPos).toString('utf8');
-            // Content stays as Buffer to preserve binary data
-            const content = part.slice(headerEndPos + 4); // Skip the \r\n\r\n
-            const nameMatch = headers.match(/name="([^"]+)"/);
-            const filenameMatch = headers.match(/filename="([^"]+)"/);
-            const contentTypeMatch = headers.match(/Content-Type: ([^\r\n]+)/);
-            if (nameMatch) {
-                const name = nameMatch[1];
-                if (filenameMatch) {
-                    // This is a file - keep as Buffer to preserve binary data
-                    const filename = filenameMatch[1];
-                    const mimeType = contentTypeMatch ? contentTypeMatch[1] : 'application/octet-stream';
-                    // Remove trailing \r\n (2 bytes) from the end
-                    const fileData = content.slice(0, content.length - 2);
-                    files[name] = {
-                        filename,
-                        mimetype: mimeType,
-                        data: fileData, // Already a Buffer - preserves binary integrity
-                        size: fileData.length,
-                    };
-                }
-                else {
-                    // This is a regular field - convert to string
-                    const fieldContent = content.slice(0, content.length - 2); // Remove trailing \r\n
-                    fields[name] = fieldContent.toString('utf8');
-                }
-            }
-        }
-        return { fields, files };
-    }
-    /**
-     * Split a Buffer by a delimiter Buffer
-     * Used for multipart boundary splitting without corrupting binary data
-     */
-    splitBuffer(buffer, delimiter) {
-        const parts = [];
-        let start = 0;
-        let pos = 0;
-        while ((pos = buffer.indexOf(delimiter, start)) !== -1) {
-            parts.push(buffer.slice(start, pos));
-            start = pos + delimiter.length;
-        }
-        // Add the remaining part
-        parts.push(buffer.slice(start));
-        return parts;
-    }
-    /**
-     * Find the position of a sequence within a Buffer
-     * Returns -1 if not found
-     */
-    findBufferSequence(buffer, sequence) {
-        return buffer.indexOf(sequence);
+        // Shared implementation - the native engine server parses uploads with
+        // the exact same code so both transports agree on body/files shape
+        return parseMultipartBuffer(buffer, contentType, this.multipartLimits);
     }
     parseUrlEncoded(body) {
         const params = new URLSearchParams(body);
@@ -1755,6 +1609,8 @@ export class MoroHttpServer {
             // Only test routes with matching method and segment count
             for (let i = 0; i < candidateLen; i++) {
                 const candidateRoute = candidateRoutes[i];
+                if (candidateRoute === undefined)
+                    continue;
                 if (candidateRoute.method === method && candidateRoute.pattern.test(normalizedPath)) {
                     route = candidateRoute;
                     break;
@@ -1864,7 +1720,11 @@ export class MoroHttpServer {
             callback = host;
             host = undefined;
         }
-        if (host) {
+        const backlog = this.listenBacklog;
+        if (host && backlog) {
+            this.server.listen(port, host, backlog, callback);
+        }
+        else if (host) {
             this.server.listen(port, host, callback);
         }
         else {