@naturalcycles/backend-lib 9.77.0 → 9.77.1

package/dist/server/genericErrorMiddleware.js

@@ -53,7 +53,8 @@ export function respondWithError(req, res, err) {
     const httpError = _errorLikeToErrorObject(originalError);
     if (!includeErrorStack)
         delete httpError.stack;
-    httpError.data.backendResponseStatusCode ||= 500; // default to 500
+    // http-errors (express itself, its body parsers) carry the status they should be answered with
+    httpError.data.backendResponseStatusCode ||= getHttpErrorStatusCode(originalError) || 500; // default to 500
     _objectAssign(httpError.data, {
         errorId,
         headersSent: headersSent || undefined,
@@ -63,3 +64,18 @@ export function respondWithError(req, res, err) {
         error: httpError,
     });
 }
+/**
+ * Errors created by the `http-errors` package (express itself, body-parser, raw-body, send)
+ * carry the HTTP status they are meant to be answered with: `status` and `statusCode` (always equal),
+ * plus `expose` (whether the message is safe to show to the client).
+ * All three together are the marker: other libraries also put a `statusCode` on their errors
+ * (e.g a gateway's response status), which says nothing about how we should respond.
+ */
+function getHttpErrorStatusCode(err) {
+    const { status, statusCode, expose } = err;
+    if (typeof expose !== 'boolean' || typeof statusCode !== 'number' || status !== statusCode)
+        return;
+    if (!Number.isInteger(statusCode) || statusCode < 400 || statusCode > 599)
+        return;
+    return statusCode;
+}

package/dist/server/request.util.js

@@ -43,6 +43,6 @@ function buildRequestEndpoint(req, stripPrefix, sanitize) {
 // the exact bytes are not worth preserving here, `req.url` still has them.
 const UNSAFE_PATH_CHAR = /[^\w\-./:@%!$*+,;=~]/gu;
 function sanitizePath(path) {
-    return path.replace(UNSAFE_PATH_CHAR, '_');
+    return path.replaceAll(UNSAFE_PATH_CHAR, '_');
 }
 const identity = (path) => path;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.77.0",
+  "version": "9.77.1",
   "dependencies": {
     "@naturalcycles/db-lib": "^10",
     "@naturalcycles/js-lib": "^15",

package/src/server/genericErrorMiddleware.ts

@@ -1,5 +1,6 @@
 import type { BackendErrorResponseObject, ErrorObject } from '@naturalcycles/js-lib/error'
 import { _anyToError, _errorLikeToErrorObject } from '@naturalcycles/js-lib/error'
+import type { HttpStatusCode } from '@naturalcycles/js-lib/http'
 import { _objectAssign } from '@naturalcycles/js-lib/types'
 import type { BackendErrorRequestHandler, BackendRequest, BackendResponse } from './server.model.js'
 
@@ -89,7 +90,8 @@ export function respondWithError(req: BackendRequest, res: BackendResponse, err:
   const httpError = _errorLikeToErrorObject(originalError)
   if (!includeErrorStack) delete httpError.stack
 
-  httpError.data.backendResponseStatusCode ||= 500 // default to 500
+  // http-errors (express itself, its body parsers) carry the status they should be answered with
+  httpError.data.backendResponseStatusCode ||= getHttpErrorStatusCode(originalError) || 500 // default to 500
   _objectAssign(httpError.data, {
     errorId,
     headersSent: headersSent || undefined,
@@ -101,3 +103,23 @@ export function respondWithError(req: BackendRequest, res: BackendResponse, err:
     error: httpError,
   } satisfies BackendErrorResponseObject)
 }
+
+interface HttpErrorLike {
+  status: number
+  statusCode: number
+  expose: boolean
+}
+
+/**
+ * Errors created by the `http-errors` package (express itself, body-parser, raw-body, send)
+ * carry the HTTP status they are meant to be answered with: `status` and `statusCode` (always equal),
+ * plus `expose` (whether the message is safe to show to the client).
+ * All three together are the marker: other libraries also put a `statusCode` on their errors
+ * (e.g a gateway's response status), which says nothing about how we should respond.
+ */
+function getHttpErrorStatusCode(err: Error): HttpStatusCode | undefined {
+  const { status, statusCode, expose } = err as Partial<HttpErrorLike>
+  if (typeof expose !== 'boolean' || typeof statusCode !== 'number' || status !== statusCode) return
+  if (!Number.isInteger(statusCode) || statusCode < 400 || statusCode > 599) return
+  return statusCode
+}

package/src/server/request.util.ts

@@ -55,7 +55,7 @@ function buildRequestEndpoint(
 const UNSAFE_PATH_CHAR = /[^\w\-./:@%!$*+,;=~]/gu
 
 function sanitizePath(path: string): string {
-  return path.replace(UNSAFE_PATH_CHAR, '_')
+  return path.replaceAll(UNSAFE_PATH_CHAR, '_')
 }
 
 const identity = (path: string): string => path