@naturalcycles/backend-lib 9.42.4 → 9.44.0

package/dist/express/createDefaultApp.js

@@ -33,6 +33,10 @@ export async function createDefaultApp(cfg) {
     // accepts application/json
     app.use(express.json({
         limit: '1mb',
+        verify(req, _res, buf) {
+            // Store the raw Buffer body
+            req.rawBody = buf;
+        },
         ...cfg.bodyParserJsonOptions,
     }));
     app.use(express.urlencoded({
@@ -44,6 +48,10 @@ export async function createDefaultApp(cfg) {
     app.use(express.raw({
         // inflate: true, // default is `true`
         limit: '1mb',
+        verify(req, _res, buf) {
+            // Store the raw Buffer body
+            req.rawBody = buf;
+        },
         ...cfg.bodyParserRawOptions,
     }));
     app.use(cookieParser());

package/dist/server/server.model.d.ts

@@ -18,6 +18,15 @@ export interface BackendRequest extends Request {
      * Only used for request logging purposes.
      */
     userId?: string;
+    /**
+     * Raw Buffer of the `req.body`, before it's stringified and json-parsed.
+     * Useful for when something mutates `req.body` json (e.g j validation), and you
+     * want access to the original input.
+     *
+     * For `req.rawBody` to exist - you need to use `createDefaultApp`, or use the
+     * `verify` option of the json parser (copy-paste it from `createDefaultApp`).
+     */
+    rawBody?: Buffer;
     /**
      * Set by requestTimeoutMiddleware.
      * Can be used to cancel/override the timeout.

package/dist/validation/ajv/ajvValidateRequest.js

@@ -1,9 +1,8 @@
-import { _deepCopy } from '@naturalcycles/js-lib/object';
 import { AjvSchema, getCoercingAjv, } from '@naturalcycles/nodejs-lib/ajv';
 import { handleValidationError } from '../validateRequest.util.js';
 class AjvValidateRequest {
     body(req, schema, opt = {}) {
-        return this.validate(req, 'body', schema, opt);
+        return this.validate(req, 'body', schema, req.rawBody ? () => JSON.parse(req.rawBody.toString()) : undefined, opt);
     }
     /**
      * Query validation uses type coercion (unlike body validation),
@@ -12,7 +11,11 @@ class AjvValidateRequest {
      * Coercion mutates the input, even if the end result is that the input failed the validation.
      */
     query(req, schema, opt = {}) {
-        return this.validate(req, 'query', schema, { coerceTypes: true, ...opt });
+        const originalQuery = JSON.stringify(req.query);
+        return this.validate(req, 'query', schema, () => JSON.parse(originalQuery), {
+            coerceTypes: true,
+            ...opt,
+        });
     }
     /**
      * Params validation uses type coercion (unlike body validation),
@@ -21,7 +24,11 @@ class AjvValidateRequest {
      * Coercion mutates the input, even if the end result is that the input failed the validation.
      */
     params(req, schema, opt = {}) {
-        return this.validate(req, 'params', schema, { coerceTypes: true, ...opt });
+        const originalParams = JSON.stringify(req.params);
+        return this.validate(req, 'params', schema, () => JSON.parse(originalParams), {
+            coerceTypes: true,
+            ...opt,
+        });
     }
     /**
      * Does NOT mutate `req.headers`,
@@ -32,18 +39,20 @@ class AjvValidateRequest {
      * there may be additional consumers for `req.headers` (e.g middlewares, etc).
      */
     headers(req, schema, opt = {}) {
-        const originalHeaders = _deepCopy(req.headers);
-        const headers = this.validate(req, 'headers', schema, opt);
-        req.headers = originalHeaders;
-        return headers;
+        return this.validate(req, 'headers', schema, undefined, {
+            mutateInput: false,
+            ...opt,
+        });
     }
-    validate(req, reqProperty, schema, opt = {}) {
+    validate(req, reqProperty, schema, getOriginalInput, opt = {}) {
         const input = req[reqProperty] || {};
-        const { coerceTypes } = opt;
+        const { coerceTypes, mutateInput } = opt;
         const ajv = coerceTypes ? getCoercingAjv() : undefined;
         const ajvSchema = AjvSchema.create(schema, { ajv });
         const [error, output] = ajvSchema.getValidationResult(input, {
             inputName: `request.${reqProperty}`,
+            getOriginalInput,
+            mutateInput,
         });
         if (error) {
             handleValidationError(error, input, opt);

package/dist/validation/validateRequest.util.d.ts

@@ -20,4 +20,14 @@ export interface ReqValidationOptions<ERR extends AppError> {
      * typically: request path params and request query params.
      */
     coerceTypes?: boolean;
+    /**
+     * Default value depends on the implementation and the object.
+     * Joi and Zod do not mutate input (even if you pass `mutateInput: true` - that feature is not supported).
+     * AJV by default does mutate the input, but depending on the property:
+     *
+     * body - will be mutated, by req.rawBody will be used (if available) for error message snippet
+     * params, query - will NOT mutate by default (unless you pass `mutateInput: true`)
+     * headers - will NOT mutate by default
+     */
+    mutateInput?: boolean;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.42.4",
+  "version": "9.44.0",
   "peerDependencies": {
     "@sentry/node": "^10"
   },

package/src/express/createDefaultApp.ts

@@ -10,7 +10,11 @@ import { logMiddleware } from '../server/logMiddleware.js'
 import { methodOverrideMiddleware } from '../server/methodOverrideMiddleware.js'
 import { notFoundMiddleware } from '../server/notFoundMiddleware.js'
 import { requestTimeoutMiddleware } from '../server/requestTimeoutMiddleware.js'
-import type { BackendApplication, BackendRequestHandler } from '../server/server.model.js'
+import type {
+  BackendApplication,
+  BackendRequest,
+  BackendRequestHandler,
+} from '../server/server.model.js'
 import { simpleRequestLoggerMiddleware } from '../server/simpleRequestLoggerMiddleware.js'
 
 const isTest = process.env['APP_ENV'] === 'test'
@@ -53,6 +57,10 @@ export async function createDefaultApp(cfg: DefaultAppCfg): Promise<BackendAppli
   app.use(
     express.json({
       limit: '1mb',
+      verify(req: BackendRequest, _res, buf) {
+        // Store the raw Buffer body
+        req.rawBody = buf
+      },
       ...cfg.bodyParserJsonOptions,
     }),
   )
@@ -70,6 +78,10 @@ export async function createDefaultApp(cfg: DefaultAppCfg): Promise<BackendAppli
     express.raw({
       // inflate: true, // default is `true`
       limit: '1mb',
+      verify(req: BackendRequest, _res, buf) {
+        // Store the raw Buffer body
+        req.rawBody = buf
+      },
       ...cfg.bodyParserRawOptions,
     }),
   )

package/src/server/server.model.ts

@@ -20,6 +20,15 @@ export interface BackendRequest extends Request {
    * Only used for request logging purposes.
    */
   userId?: string
+  /**
+   * Raw Buffer of the `req.body`, before it's stringified and json-parsed.
+   * Useful for when something mutates `req.body` json (e.g j validation), and you
+   * want access to the original input.
+   *
+   * For `req.rawBody` to exist - you need to use `createDefaultApp`, or use the
+   * `verify` option of the json parser (copy-paste it from `createDefaultApp`).
+   */
+  rawBody?: Buffer
 
   /**
    * Set by requestTimeoutMiddleware.

package/src/validation/ajv/ajvValidateRequest.ts

@@ -1,4 +1,3 @@
-import { _deepCopy } from '@naturalcycles/js-lib/object'
 import {
   AjvSchema,
   type AjvValidationError,
@@ -14,7 +13,13 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'body', schema, opt)
+    return this.validate(
+      req,
+      'body',
+      schema,
+      req.rawBody ? () => JSON.parse(req.rawBody!.toString()) : undefined,
+      opt,
+    )
   }
 
   /**
@@ -28,7 +33,11 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'query', schema, { coerceTypes: true, ...opt })
+    const originalQuery = JSON.stringify(req.query)
+    return this.validate(req, 'query', schema, () => JSON.parse(originalQuery), {
+      coerceTypes: true,
+      ...opt,
+    })
   }
 
   /**
@@ -42,7 +51,11 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    return this.validate(req, 'params', schema, { coerceTypes: true, ...opt })
+    const originalParams = JSON.stringify(req.params)
+    return this.validate(req, 'params', schema, () => JSON.parse(originalParams), {
+      coerceTypes: true,
+      ...opt,
+    })
   }
 
   /**
@@ -58,26 +71,29 @@ class AjvValidateRequest {
     schema: SchemaHandledByAjv<IN, OUT>,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
-    const originalHeaders = _deepCopy(req.headers)
-    const headers = this.validate(req, 'headers', schema, opt)
-    req.headers = originalHeaders
-    return headers
+    return this.validate(req, 'headers', schema, undefined, {
+      mutateInput: false,
+      ...opt,
+    })
   }
 
   private validate<IN, OUT>(
     req: BackendRequest,
     reqProperty: 'body' | 'params' | 'query' | 'headers',
     schema: SchemaHandledByAjv<IN, OUT>,
+    getOriginalInput?: () => IN,
     opt: ReqValidationOptions<AjvValidationError> = {},
   ): OUT {
     const input: IN = req[reqProperty] || {}
 
-    const { coerceTypes } = opt
+    const { coerceTypes, mutateInput } = opt
     const ajv = coerceTypes ? getCoercingAjv() : undefined
     const ajvSchema = AjvSchema.create(schema, { ajv })
 
     const [error, output] = ajvSchema.getValidationResult(input, {
       inputName: `request.${reqProperty}`,
+      getOriginalInput,
+      mutateInput,
     })
 
     if (error) {

package/src/validation/validateRequest.util.ts

@@ -69,4 +69,15 @@ export interface ReqValidationOptions<ERR extends AppError> {
    * typically: request path params and request query params.
    */
   coerceTypes?: boolean
+
+  /**
+   * Default value depends on the implementation and the object.
+   * Joi and Zod do not mutate input (even if you pass `mutateInput: true` - that feature is not supported).
+   * AJV by default does mutate the input, but depending on the property:
+   *
+   * body - will be mutated, by req.rawBody will be used (if available) for error message snippet
+   * params, query - will NOT mutate by default (unless you pass `mutateInput: true`)
+   * headers - will NOT mutate by default
+   */
+  mutateInput?: boolean
 }