@morojs/moro 1.8.15 → 1.8.17

package/dist/core/http/moro-engine-server.d.ts

@@ -190,6 +190,14 @@ export declare class MoroEngineServer {
     /** @internal */ _getBody: (reqId: number) => ArrayBuffer | null;
     /** @internal */ _getRemoteAddress: (reqId: number) => string | undefined;
     /** @internal */ _getMethod: (reqId: number) => string | undefined;
+    /** @internal */ _wsSend: (wsId: number, data: any, isBinary: boolean) => boolean;
+    /** @internal */ _wsClose: (wsId: number, code?: number, reason?: string) => void;
+    /** @internal */ _upgradeToWebSocket: (reqId: number) => number;
+    private _setWsAutoUpgrade?;
+    private _wsGetHeaders?;
+    private _wsGetQuery?;
+    private _wsGetRemoteAddress?;
+    private _wsAutoOn;
     /** @internal */ _prepareResponse?: (serverId: number, status: number, headers: string[] | null) => number;
     /** @internal */ _respondPrepared?: (reqId: number, tplId: number, body: any) => void;
     /** @internal */ _respondPreparedEmpty?: (reqId: number, tplId: number) => void;
@@ -305,6 +313,17 @@ export declare class MoroEngineServer {
         onMessage(wsId: number, data: any, isBinary: boolean): void;
         onClose(wsId: number, code: number): void;
     }): void;
+    /**
+     * The handshake of a WebSocket the engine upgraded itself: the peer's
+     * address, the request headers as the engine's flat list and the raw query
+     * string. undefined without the capability, or once the socket is gone
+     * (the engine keeps it for the socket's lifetime, through onWsClose).
+     */
+    wsHandshake(wsId: number): {
+        ip: string;
+        flat: string[] | undefined;
+        query: string;
+    } | undefined;
     /** Send a frame on a WebSocket. Returns false on backpressure. */
     wsSend(wsId: number, data: string | ArrayBuffer | Buffer, isBinary: boolean): boolean;
     /** Close a WebSocket (RFC 6455 close frame). */
@@ -328,6 +347,7 @@ export declare class MoroEngineServer {
     private dispatchDirectRoute;
     setNativeRouteProvider(_provider: () => Array<any>, _onError?: (...args: any[]) => any): void;
     private onRequest;
+    private dispatchRouter;
     private _armMicrotaskDrain;
     private onAborted;
     private onWritable;

package/dist/core/http/moro-engine-server.js

@@ -756,7 +756,7 @@ export class EngineResponse extends LazyEventEmitter {
         if (shouldInline(bytes, s)) {
             let compressed;
             try {
-                compressed = compressBufferSync(body, encoding, s.level);
+                compressed = compressBufferSync(body, encoding, s.level, s);
             }
             catch {
                 compressed = undefined;
@@ -773,7 +773,7 @@ export class EngineResponse extends LazyEventEmitter {
         }
         // Async path: compress, then respond (guarding against an abort that
         // raced the await - the reqId would be invalid).
-        void compressBuffer(body, encoding, s.level)
+        void compressBuffer(body, encoding, s.level, s)
             .then(compressed => {
             if (this._ended || this._server._isAborted(this._reqId))
                 return;
@@ -1480,6 +1480,22 @@ export class MoroEngineServer {
     /** @internal */ _getBody;
     /** @internal */ _getRemoteAddress;
     /** @internal */ _getMethod;
+    // The WebSocket natives, hoisted for the same reason: wsSend runs once per
+    // frame, and through the loader's Proxy every call paid the `get` trap.
+    /** @internal */ _wsSend;
+    /** @internal */ _wsClose;
+    /** @internal */ _upgradeToWebSocket;
+    // Engine-side upgrades (engine >= 1.1.15, capabilities.wsAutoUpgrade): a
+    // valid handshake is answered inside the engine and onWsOpen fires without
+    // the request ever reaching onRequest - no header materialisation, no
+    // native round trips, no request/response objects per upgrade. The
+    // handshake is read from the socket on first access (wsHandshake). Assigned
+    // only when the flag AND every function are present, like the templates.
+    _setWsAutoUpgrade;
+    _wsGetHeaders;
+    _wsGetQuery;
+    _wsGetRemoteAddress;
+    _wsAutoOn = false;
     // Prepared response templates (engine >= 1.1.6): assigned only when the
     // engine advertises capabilities.responseTemplates AND the functions exist,
     // so a flag/binary mismatch can never put `undefined` into a hot call site.
@@ -1614,6 +1630,9 @@ export class MoroEngineServer {
         this._getBody = surface.getBody;
         this._getRemoteAddress = surface.getRemoteAddress;
         this._getMethod = surface.getMethod;
+        this._wsSend = surface.wsSend;
+        this._wsClose = surface.wsClose;
+        this._upgradeToWebSocket = surface.upgradeToWebSocket;
         if (this._capabilities?.responseTemplates === true &&
             typeof surface.prepareResponse === 'function' &&
             typeof surface.respondPrepared === 'function' &&
@@ -1633,6 +1652,16 @@ export class MoroEngineServer {
             this._setParamRoute = surface.setParamRoute;
             this._paramOn = true;
         }
+        if (this._capabilities?.wsAutoUpgrade === true &&
+            typeof surface.setWsAutoUpgrade === 'function' &&
+            typeof surface.wsGetHeaders === 'function' &&
+            typeof surface.wsGetQuery === 'function' &&
+            typeof surface.wsGetRemoteAddress === 'function') {
+            this._setWsAutoUpgrade = surface.setWsAutoUpgrade;
+            this._wsGetHeaders = surface.wsGetHeaders;
+            this._wsGetQuery = surface.wsGetQuery;
+            this._wsGetRemoteAddress = surface.wsGetRemoteAddress;
+        }
         if (this._capabilities?.batchDispatch === true &&
             typeof surface.getBatchBuffers === 'function' &&
             typeof surface.getPath === 'function') {
@@ -1932,14 +1961,35 @@ export class MoroEngineServer {
     /** Register the engine WebSocket bridge; upgrade requests then route natively. */
     enableWebSocket(bridge) {
         this._wsBridge = bridge;
+        // With the capability the engine answers valid handshakes itself; the
+        // onRequest branch below stays for an invalid one (surfaced as a plain
+        // request, answered 400 by the router) and for older engines.
+        if (this._setWsAutoUpgrade) {
+            this._setWsAutoUpgrade(this.serverId, true);
+            this._wsAutoOn = true;
+        }
+    }
+    /**
+     * The handshake of a WebSocket the engine upgraded itself: the peer's
+     * address, the request headers as the engine's flat list and the raw query
+     * string. undefined without the capability, or once the socket is gone
+     * (the engine keeps it for the socket's lifetime, through onWsClose).
+     */
+    wsHandshake(wsId) {
+        if (!this._wsGetHeaders || !this._wsGetQuery || !this._wsGetRemoteAddress)
+            return undefined;
+        const flat = this._wsGetHeaders(wsId);
+        if (flat === undefined)
+            return undefined;
+        return { ip: this._wsGetRemoteAddress(wsId) || '', flat, query: this._wsGetQuery(wsId) || '' };
     }
     /** Send a frame on a WebSocket. Returns false on backpressure. */
     wsSend(wsId, data, isBinary) {
-        return this._engine.wsSend(wsId, data, isBinary) !== false;
+        return this._wsSend(wsId, data, isBinary) !== false;
     }
     /** Close a WebSocket (RFC 6455 close frame). */
     wsClose(wsId, code, reason) {
-        this._engine.wsClose(wsId, code, reason);
+        this._wsClose(wsId, code, reason);
     }
     // Direct router dispatch - called after global middleware without the
     // per-middleware promise machinery (mirrors MoroHttpServer.setRouterHandler)
@@ -2093,29 +2143,18 @@ export class MoroEngineServer {
             const upgrade = this._getHeader(reqId, 'upgrade');
             if (upgrade && upgrade.toLowerCase() === 'websocket') {
                 // Snapshot handshake data now - the upgrade invalidates the reqId,
-                // after which these fetchers return empty values.
+                // after which these fetchers return empty values. The headers stay
+                // the engine's flat [name, value, ...] list: the adapter builds the
+                // object (joining duplicates like EngineRequest.headers) the first
+                // time a handler reads socket.headers, so an upgrade whose handlers
+                // never look pays for no object at all.
                 const ip = this._getRemoteAddress(reqId) || '';
-                const headers = {};
                 const flat = this._getHeaders(reqId);
-                if (flat) {
-                    // Join duplicates exactly like the EngineRequest.headers getter -
-                    // last-wins would let a client send two X-Forwarded-For lines and
-                    // hide the earlier one from IP-based WS auth / rate-limiting.
-                    for (let i = 0; i + 1 < flat.length; i += 2) {
-                        const key = flat[i];
-                        const val = flat[i + 1];
-                        if (key === undefined || val === undefined)
-                            continue;
-                        const existing = headers[key];
-                        headers[key] =
-                            existing === undefined ? val : existing + (key === 'cookie' ? '; ' : ', ') + val;
-                    }
-                }
                 // Capture the query string too (invalidated by the upgrade like the
                 // rest), so handlers can read handshake query params (e.g. orgId).
                 const query = this._getQuery(reqId) || '';
-                this._pendingWsInfo = { ip, headers, query };
-                const wsId = this._engine.upgradeToWebSocket(reqId);
+                this._pendingWsInfo = { ip, flat, query };
+                const wsId = this._upgradeToWebSocket(reqId);
                 this._pendingWsInfo = undefined;
                 if (wsId !== -1)
                     return; // WS took over this connection
@@ -2141,40 +2180,58 @@ export class MoroEngineServer {
         }
         this.requestCounter++;
         // SYNC FAST PATH (parity with MoroHttpServer's handleRequest split): with
-        // no body to parse, no request/response hooks and no global middleware,
-        // the router dispatch runs synchronously in this frame - the async
-        // handleRequest below would allocate a promise + async context per
-        // request only to reach zero awaits. Only the framework's own frame is
-        // de-asynced: an async route handler still returns its promise through
-        // the router and is driven to completion here.
+        // no request/response hooks, the body parse, the global middleware chain
+        // and the router dispatch all run synchronously in this frame whenever
+        // they can - the async handleRequest below would allocate a promise and
+        // an async context per request only to reach zero awaits. The engine
+        // buffered the body before onRequest fired, so parsing it is synchronous;
+        // a middleware chain whose members call next() synchronously costs no
+        // promise either (executeMiddleware returns undefined then), and only a
+        // chain that genuinely goes async hands the rest of the request to a
+        // continuation. Only the framework's own frame is de-asynced: an async
+        // route handler still returns its promise through the router and is
+        // driven to completion here.
         const hookManager = this.hookManager;
         const hooksActive = hookManager &&
             (hookManager.hasHooks === undefined ||
                 hookManager.hasHooks('request') ||
                 hookManager.hasHooks('response'));
-        const needsBody = method.charCodeAt(0) === 80 && // 'P' char code
-            (method === 'POST' || method === 'PUT' || method === 'PATCH');
-        if (!needsBody && !hooksActive && this.globalMiddleware.length === 0 && this.routerHandler) {
-            let handled = true;
-            try {
-                handled = this.routerHandler(httpReq, httpRes);
+        if (!hooksActive && this.routerHandler) {
+            let proceed = true;
+            if (method.charCodeAt(0) === 80 && // 'P' char code
+                (method === 'POST' || method === 'PUT' || method === 'PATCH')) {
+                try {
+                    this.parseBody(httpReq);
+                }
+                catch (error) {
+                    proceed = false;
+                    void this.handleDispatchError(error, httpReq, httpRes);
+                }
             }
-            catch (error) {
-                // Error path owns the response from here (handled stays true)
-                void this.handleDispatchError(error, httpReq, httpRes);
-            }
-            if (handled !== true) {
-                if (handled && typeof handled.then === 'function') {
-                    handled.then(ok => {
-                        if (!ok)
-                            void this.finishUnrouted(httpReq, httpRes);
+            if (proceed && this.globalMiddleware.length > 0) {
+                let chain;
+                try {
+                    chain = this.executeMiddleware(this.globalMiddleware, httpReq, httpRes);
+                }
+                catch (error) {
+                    proceed = false;
+                    chain = undefined;
+                    void this.handleDispatchError(error, httpReq, httpRes);
+                }
+                if (chain) {
+                    // The chain went async: route once it settles, unless it answered.
+                    proceed = false;
+                    chain.then(() => {
+                        if (!httpRes.headersSent)
+                            this.dispatchRouter(httpReq, httpRes);
                     }, error => void this.handleDispatchError(error, httpReq, httpRes));
                 }
-                else {
-                    // Sync miss from the router - direct-route fallback, then 404
-                    void this.finishUnrouted(httpReq, httpRes);
+                else if (httpRes.headersSent) {
+                    proceed = false; // a middleware answered the request itself
                 }
             }
+            if (proceed)
+                this.dispatchRouter(httpReq, httpRes);
         }
         else {
             void this.handleRequest(httpReq, httpRes);
@@ -2192,6 +2249,36 @@ export class MoroEngineServer {
             this._armMicrotaskDrain();
         }
     }
+    // The router dispatch of the sync fast path, and of a global middleware
+    // chain's async continuation: the unified router, then the direct route
+    // table and the 404 behind it, with the same error shaping as handleRequest.
+    dispatchRouter(httpReq, httpRes) {
+        const routerHandler = this.routerHandler;
+        if (!routerHandler) {
+            void this.finishUnrouted(httpReq, httpRes);
+            return;
+        }
+        let handled = true;
+        try {
+            handled = routerHandler(httpReq, httpRes);
+        }
+        catch (error) {
+            // Error path owns the response from here (handled stays true)
+            void this.handleDispatchError(error, httpReq, httpRes);
+        }
+        if (handled !== true) {
+            if (handled && typeof handled.then === 'function') {
+                handled.then(ok => {
+                    if (!ok)
+                        void this.finishUnrouted(httpReq, httpRes);
+                }, error => void this.handleDispatchError(error, httpReq, httpRes));
+            }
+            else {
+                // Sync miss from the router - direct-route fallback, then 404
+                void this.finishUnrouted(httpReq, httpRes);
+            }
+        }
+    }
     // The engine invokes onRequest with a plain V8 call from its own uv
     // callback, outside a Node callback scope, so microtasks queued during
     // dispatch - an await on an already-settled promise, a .then chain, the
@@ -2357,7 +2444,11 @@ export class MoroEngineServer {
         const raw = this._getBody(httpReq._reqId);
         if (!raw || raw.byteLength === 0)
             return;
-        const contentType = httpReq.headers['content-type'] || '';
+        // One header through one crossing: materialising the header object here
+        // would cost every request with a body a string per header line.
+        const contentType = (httpReq._headers !== undefined
+            ? httpReq._headers['content-type']
+            : this._getHeader(httpReq._reqId, 'content-type')) || '';
         const isMultipart = contentType.includes('multipart/form-data');
         const maxSize = isMultipart ? this.maxUploadSize : this.maxBodySize;
         // The engine natively enforces the larger of the two limits; the tighter
@@ -2554,6 +2645,8 @@ export class MoroEngineServer {
                 this.serverId = this.registerWithEngine();
                 this._resetTemplates();
                 this._reapplyStaticRoutes();
+                if (this._wsAutoOn && this._setWsAutoUpgrade)
+                    this._setWsAutoUpgrade(this.serverId, true);
                 this.closed = false;
             }
             // Synchronous bind; throws on bind errors, returns the actual port