@nestjs/platform-fastify 12.1.2 → 12.2.0

package/adapters/fastify-adapter.js

@@ -2,10 +2,12 @@ import { HttpException, HttpStatus, Logger, StreamableFile, VERSION_NEUTRAL, Ver
 import { fastify, } from 'fastify';
 import Reply from 'fastify/lib/reply.js';
 import fastifySymbols from 'fastify/lib/symbols.js';
+import * as http from 'http';
 import * as net from 'net';
 import { pathToRegexp } from 'path-to-regexp';
+import { Readable } from 'stream';
 import middie from '@fastify/middie';
-import { loadPackage, tryLoadPackage, isNil, isString, isUndefined, } from '@nestjs/common/internal';
+import { loadPackage, tryLoadPackage, isFunction, isNil, isString, isUndefined, } from '@nestjs/common/internal';
 import { AbstractHttpAdapter } from '@nestjs/core';
 import { LegacyRouteConverter } from '@nestjs/core/internal';
 import { getMediaTypeVersion } from './utils/get-media-type-version.util.js';
@@ -37,15 +39,26 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     _pathPrefix;
     openConnections = new Set();
     isClosing = false;
+    isShuttingDown = false;
+    return503OnClosing = false;
     _isParserRegistered;
+    // Fastify's `hasContentTypeParser('application/json')` is always true (built-in
+    // parser), so the types registered through `useBodyParser()` are tracked here.
+    registeredContentTypes = new Set();
     onRequestHook;
     onResponseHook;
+    securityHook;
     isMiddieRegistered;
     multipartMode = 'auto';
     multipartOptions = {};
     isMultipartRequested = false;
     pendingMiddlewares = [];
+    // The encapsulated contexts created since middie was registered (see
+    // `registerMiddie()`)
+    middieContexts = [];
     versioningOptions;
+    // Exceptions thrown by the extractor of custom versioning, by raw request
+    versionExtractorErrors = new WeakMap();
     versionConstraint = {
         name: 'version',
         validate(value) {
@@ -103,7 +116,16 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             }
             // Custom Versioning Handler
             else if (this.versioningOptions?.type === VersioningType.CUSTOM) {
-                return this.versioningOptions.extractor(req);
+                try {
+                    return this.versioningOptions.extractor(req);
+                }
+                catch (err) {
+                    // Fastify routes the request, and so calls the extractor, before
+                    // anything could catch the exception. It is passed to the error
+                    // handler from an `onRequest` hook instead (see the constructor).
+                    this.versionExtractorErrors.set(req, err);
+                    return undefined;
+                }
             }
             return undefined;
         },
@@ -117,11 +139,28 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         const instance = instanceOrOptions && instanceOrOptions.server
             ? instanceOrOptions
             : fastify({
+                // The router answers a malformed URL (400) or an over-long route
+                // parameter (414) before any hook runs, so the security hook (see
+                // `registerSecurityHook()`) runs here, for its headers.
+                frameworkErrors: (error, request, reply) => {
+                    try {
+                        this.securityHook?.(request, reply.raw);
+                    }
+                    catch {
+                        // The request is rejected either way, and a throw here would
+                        // escape the router. `request.params` and `request.query`
+                        // are null, so a CSRF `exclude` predicate may throw.
+                    }
+                    reply.send(error);
+                },
                 ...instanceOrOptions,
                 routerOptions: {
                     ...this.getTopLevelRouterOptions(instanceOrOptions),
                     ...instanceOrOptions?.routerOptions,
                     constraints: {
+                        ...instanceOrOptions?.constraints,
+                        ...instanceOrOptions?.routerOptions
+                            ?.constraints,
                         version: this.versionConstraint,
                     },
                 },
@@ -141,21 +180,102 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         this.instance.addHook('onRequest', (request, reply, done) => {
             if (this.onRequestHook) {
-                this.onRequestHook(request, reply, done);
+                this.runLifecycleHook(this.onRequestHook, request, reply, done);
             }
             else {
                 done();
             }
         });
+        // Fastify's own `return503OnClosing` only applies once `close()` runs,
+        // which is after the shutdown hooks. Added here rather than in
+        // `initHttpServer()` so that it runs before Nest middleware:
+        // `NestFactory.create()` calls `init()`, which registers middie, first.
+        // Answers with the same body as Fastify's own 503, so that clients get
+        // one response shape for the whole shutdown.
+        this.instance.addHook('onRequest', (request, reply, done) => {
+            if (this.return503OnClosing && this.isShuttingDown) {
+                if (request.raw.httpVersionMajor !== 2) {
+                    reply.header('Connection', 'close');
+                }
+                reply.code(503).send({
+                    error: 'Service Unavailable',
+                    message: 'Service Unavailable',
+                    statusCode: 503,
+                });
+            }
+            else {
+                done();
+            }
+        });
+        // The request hook of `app.enableCsrfProtection()` and
+        // `app.useSecurityHeaders()` (see `registerSecurityHook()`). Added here
+        // for the same reason as the hook above: it must run before Nest
+        // middleware, and `NestFactory.create()` registers middie before either
+        // method can be called. After the `503` hook, as on Express.
+        this.instance.addHook('onRequest', (request, reply, done) => {
+            if (this.securityHook) {
+                done(this.securityHook(request, reply.raw));
+            }
+            else {
+                done();
+            }
+        });
+        // Passes requests whose target middleware cannot be matched against to
+        // the not-found handler (see `isRoutableRequestTarget()`). Added here,
+        // like the hooks above, so that it runs before Nest middleware, and
+        // after the security hook, so that the `404` carries its headers, as on
+        // Express. A request the router did not match is already on its way to
+        // the not-found handler.
+        this.instance.addHook('onRequest', (request, reply, done) => {
+            if (request.is404 || this.isRoutableRequestTarget(request.raw.url)) {
+                done();
+            }
+            else {
+                reply.callNotFound();
+            }
+        });
+        // Passes an exception thrown by the extractor of custom versioning while
+        // Fastify routed the request (see `versionConstraint`) to the error
+        // handler, for matched and unmatched routes alike. Added here, like the
+        // hooks above, so that it runs before Nest middleware.
+        this.instance.addHook('onRequest', (request, _reply, done) => {
+            if (!this.versionExtractorErrors.has(request.raw)) {
+                done();
+                return;
+            }
+            const err = this.versionExtractorErrors.get(request.raw);
+            this.versionExtractorErrors.delete(request.raw);
+            done(err || new fastify.errorCodes.FST_ERR_SEND_UNDEFINED_ERR());
+        });
         this.instance.addHook('onResponse', (request, reply, done) => {
             if (this.onResponseHook) {
-                this.onResponseHook(request, reply, done);
+                this.runLifecycleHook(this.onResponseHook, request, reply, done);
             }
             else {
                 done();
             }
         });
     }
+    runLifecycleHook(hook, request, reply, done) {
+        let completed = false;
+        const doneOnce = (err) => {
+            if (completed)
+                return;
+            completed = true;
+            done(err);
+        };
+        try {
+            // Do not return the promise to Fastify: both completion styles share
+            // this guard, including hooks that call done and return a promise.
+            const result = hook.call(this, request, reply, doneOnce);
+            if (result && typeof result.then === 'function') {
+                result.then(() => doneOnce(), err => doneOnce(err || new fastify.errorCodes.FST_ERR_SEND_UNDEFINED_ERR()));
+            }
+        }
+        catch (err) {
+            doneOnce(err);
+        }
+    }
     setOnRequestHook(hook) {
         this.onRequestHook = hook;
     }
@@ -181,6 +301,11 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     listen(listenOptions, ...args) {
         const isFirstArgTypeofFunction = typeof args[0] === 'function';
         const callback = isFirstArgTypeofFunction ? args[0] : args[1];
+        if (typeof listenOptions === 'string' && Number.isNaN(+listenOptions)) {
+            // A string that is not a number is a Unix socket path or a named pipe.
+            // The host does not apply to it.
+            return this.instance.listen({ path: listenOptions }, callback);
+        }
         let options;
         if (typeof listenOptions === 'object' &&
             (listenOptions.host !== undefined ||
@@ -197,8 +322,23 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         if (!isFirstArgTypeofFunction) {
             options.host = args[0];
         }
+        if (options.port !== undefined && !this.isValidPort(options.port)) {
+            // Fastify calls `server.listen()` from its ready callback, where the
+            // RangeError Node throws for a bad port becomes an unhandled rejection
+            // and the callback never runs. Throw right away instead, as the
+            // `http.Server` of the Express adapter does.
+            const error = new RangeError(`Options.port should be >= 0 and < 65536. Received ${String(options.port)}.`);
+            throw Object.assign(error, { code: 'ERR_SOCKET_BAD_PORT' });
+        }
         return this.instance.listen(options, callback);
     }
+    isValidPort(port) {
+        const value = typeof port === 'string' && port.trim() !== '' ? Number(port) : port;
+        return (typeof value === 'number' &&
+            Number.isInteger(value) &&
+            value >= 0 &&
+            value <= 65535);
+    }
     get(...args) {
         return this.injectRouteOptions('GET', ...args);
     }
@@ -247,6 +387,16 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     unlock(...args) {
         return this.injectRouteOptions('UNLOCK', ...args);
     }
+    all(...args) {
+        // Routes registered by Nest ("path, handler") get the route options
+        // (e.g. the version), with the same methods as "fastify.all()".
+        if (args.length === 2 && isFunction(args[1])) {
+            return this.injectRouteOptions(this.instance.supportedMethods, ...args);
+        }
+        const handlerRef = args[args.length - 1];
+        args[args.length - 1] = this.requireNonEmptyParams(args[0], handlerRef);
+        return this.instance.all(...args);
+    }
     applyVersionFilter(handler, version, versioningOptions) {
         if (!this.versioningOptions) {
             this.versioningOptions = versioningOptions;
@@ -271,6 +421,12 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             fastifyReply.status(statusCode);
         }
         if (body instanceof StreamableFile) {
+            const stream = body.getStream();
+            // Once the reply was sent (e.g. by `handlerTimeout`), send() drops the
+            // stream without consuming or destroying it.
+            if (fastifyReply.sent && isFunction(stream?.destroy)) {
+                stream.destroy();
+            }
             const streamHeaders = body.getHeaders();
             if (fastifyReply.getHeader('Content-Type') === undefined &&
                 streamHeaders.type !== undefined) {
@@ -284,7 +440,29 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                 streamHeaders.length !== undefined) {
                 fastifyReply.header('Content-Length', streamHeaders.length);
             }
-            body = body.getStream();
+            body = stream;
+            // Fastify's HEAD route handler resumes a stream payload, and a route
+            // declared for HEAD (or a raw response) pipes it into a response that
+            // discards it, so the whole source would be read for nothing. Fastify
+            // gets an empty stream instead, as an empty body would reset
+            // Content-Length to 0.
+            if (fastifyReply.raw?.req?.method === 'HEAD' &&
+                isFunction(stream?.destroy)) {
+                stream.destroy();
+                body = Readable.from([]);
+            }
+        }
+        // Fastify passes an Error payload to the error handler instead of
+        // sending it, and the reply around a raw response (e.g. the one
+        // middleware gets) has none. An Error body sent with an error status,
+        // as for `new UnauthorizedException(err)`, gets the standard body of the
+        // status instead, without the properties of the Error.
+        if (body instanceof Error &&
+            fastifyReply.statusCode >= HttpStatus.BAD_REQUEST) {
+            body = {
+                statusCode: fastifyReply.statusCode,
+                message: http.STATUS_CODES[fastifyReply.statusCode] ?? 'Error',
+            };
         }
         const responseContentType = fastifyReply.getHeader('Content-Type');
         if (typeof responseContentType === 'string' &&
@@ -303,7 +481,12 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         return response.code(statusCode);
     }
     end(response, message) {
-        response.raw.end(message);
+        if (this.isNativeResponse(response)) {
+            response.end(message);
+            return;
+        }
+        const reply = response;
+        reply.raw.end(message);
     }
     render(response, view, options) {
         return response && response.view(view, options);
@@ -379,7 +562,11 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     inject(opts) {
         return this.instance.inject(opts);
     }
+    beforeClose() {
+        this.isShuttingDown = true;
+    }
     async close() {
+        this.isShuttingDown = true;
         this.isClosing = true;
         try {
             this.closeOpenConnections();
@@ -395,6 +582,7 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     }
     initHttpServer(options = {}) {
         this.httpServer = this.instance.server;
+        this.return503OnClosing = !!options?.return503OnClosing;
         if (options?.forceCloseConnections) {
             this.trackOpenConnections();
         }
@@ -415,26 +603,52 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         return this.register(loadPackage('@fastify/view', 'FastifyAdapter.setViewEngine()', () => import('@fastify/view')), options);
     }
     isHeadersSent(response) {
-        return response.sent;
+        if (this.isNativeResponse(response)) {
+            return response.headersSent;
+        }
+        const reply = response;
+        // `reply.sent` only covers hijacked or ended replies, not headers
+        // already flushed through `reply.raw`.
+        return reply.sent || reply.raw.headersSent;
     }
     getHeader(response, name) {
         return response.getHeader(name);
     }
     setHeader(response, name, value) {
-        return response.header(name, value);
+        if (this.isNativeResponse(response)) {
+            return response.setHeader(name, value);
+        }
+        const reply = response;
+        return reply.header(name, value);
     }
     appendHeader(response, name, value) {
-        const current = response.getHeader(name);
-        if (current === undefined) {
-            return response.header(name, value);
+        if (this.isNativeResponse(response)) {
+            const current = response.getHeader(name);
+            return response.setHeader(name, current === undefined ? value : [current, value].flat().map(String));
         }
-        // Fastify Reply.header() already concatenates set-cookie.
-        // Re-passing the accumulated list would duplicate previous cookies.
+        const reply = response;
+        // A set-cookie value can live on the reply or only on the raw response
+        // (e.g., set by a middleware). Reply.getHeader() reads both, and the
+        // merged list is written to both: reply.send() sends the reply headers,
+        // while a hijacked reply or a handler that ends reply.raw sends the raw
+        // ones.
         if (String(name).toLowerCase() === 'set-cookie') {
-            return response.header(name, value);
+            const current = reply.getHeader(name);
+            const values = current === undefined ? [value] : [current, value].flat().map(String);
+            reply.removeHeader(name);
+            reply.header(name, values);
+            if (!reply.raw.headersSent) {
+                // A copy, so a later reply.header() call does not change the raw header
+                reply.raw.setHeader(name, [...values]);
+            }
+            return reply;
+        }
+        const current = reply.getHeader(name);
+        if (current === undefined) {
+            return reply.header(name, value);
         }
         const values = Array.isArray(current) ? current : [current];
-        return response.header(name, values.concat(value));
+        return reply.header(name, values.concat(value));
     }
     getRequestHostname(request) {
         return request.hostname;
@@ -450,19 +664,18 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     }
     /**
      * Runs the request hook of the built-in HTTP security features in an
-     * `onRequest` hook: before middie (Nest middleware), content-type parsing,
-     * guards and handlers, and also for unmatched routes. Headers set by the
-     * hook go to the Node.js response (`reply.raw`): Fastify merges them into
-     * every response it sends, errors and `404`s included, while
+     * `onRequest` hook added by the constructor: before middie (Nest middleware
+     * and `app.use()` middleware, whenever they are registered), content-type
+     * parsing, guards and handlers, and also for unmatched routes. Headers set
+     * by the hook go to the Node.js response (`reply.raw`): Fastify merges them
+     * into every response it sends, errors and `404`s included, while
      * `reply.header()` / `@Header()` values take precedence, and responses
-     * written to `reply.raw` directly (e.g. `@Sse()`) carry them too. A
-     * rejection goes to `done(error)`, i.e. to the Nest exception layer
+     * written to `reply.raw` directly (e.g. `@Sse()`, or middleware) carry them
+     * too. A rejection goes to `done(error)`, i.e. to the Nest exception layer
      * installed with `setErrorHandler()`.
      */
     registerSecurityHook(hook) {
-        this.instance.addHook('onRequest', (request, reply, done) => {
-            done(hook(request, reply.raw));
-        });
+        this.securityHook = hook;
     }
     registerParserMiddleware(prefix, rawBody) {
         if (this._isParserRegistered) {
@@ -478,23 +691,29 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             : undefined;
     }
     useBodyParser(type, rawBody, options, parser) {
+        if (Array.isArray(type)) {
+            // One by one, so that each content type gets its own default parser.
+            for (const contentType of type) {
+                this.useBodyParser(contentType, rawBody, options, parser);
+            }
+            return;
+        }
         const parserOptions = {
             ...(options || {}),
             parseAs: 'buffer',
         };
+        const bodyParser = parser ?? this.getDefaultBodyParser(type);
         this.getInstance().addContentTypeParser(type, parserOptions, (req, body, done) => {
             if (rawBody === true && Buffer.isBuffer(body)) {
                 req.rawBody = body;
             }
-            if (parser) {
-                parser(req, body, done);
+            if (bodyParser) {
+                bodyParser(req, body, done);
                 return;
             }
             done(null, body);
         });
-        // To avoid the Nest application init to override our custom
-        // body parser, we mark the parsers as registered.
-        this._isParserRegistered = true;
+        this.registeredContentTypes.add(this.normalizeContentType(type));
     }
     async createMiddlewareFactory(requestMethod) {
         if (!this.isMiddieRegistered) {
@@ -520,9 +739,13 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                 re = hasEndOfStringCharacter
                     ? new RegExp(re.source + '$', re.flags)
                     : re;
-                // The following type assertion is valid as we use import('@fastify/middie') rather than require('@fastify/middie')
-                // ref https://github.com/fastify/middie/pull/55
-                this.instance.use(normalizedPath, (req, res, next) => {
+                // A case-insensitive router lower-cases the decoded path, where some
+                // characters only fold to ASCII ("%E2%84%AA", KELVIN SIGN, is routed
+                // as "k"). The RegExp of @fastify/middie does not fold them, so on
+                // such a router the middleware is registered for every path and the
+                // path is only matched below.
+                const { caseSensitive } = this.getRouteMatchingOptions();
+                const createMiddleware = (stripsPath) => (req, res, next) => {
                     const queryParamsIndex = req.originalUrl.indexOf('?');
                     let pathname = queryParamsIndex >= 0
                         ? req.originalUrl.slice(0, queryParamsIndex)
@@ -535,9 +758,28 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                         if (!re.exec(pathToCheck)) {
                             return next();
                         }
+                        if (stripsPath) {
+                            // Strips the path from "req.url", as @fastify/middie does
+                            // when it matches the path itself
+                            const suffixIndex = req.originalUrl.search(/[?#]/);
+                            req.url =
+                                suffixIndex >= 0
+                                    ? `/${req.originalUrl.slice(suffixIndex)}`
+                                    : '/';
+                        }
                     }
-                    return callback(req, res, next);
-                });
+                    this.runMiddleware(callback, req, res, next);
+                };
+                // The following type assertion is valid as we use import('@fastify/middie') rather than require('@fastify/middie')
+                // ref https://github.com/fastify/middie/pull/55
+                this.instance.use(caseSensitive ? normalizedPath : '/', createMiddleware(!caseSensitive));
+                // The contexts created since middie was registered have a copy of the
+                // middleware of their parent without this one (see `registerMiddie()`).
+                // It is registered there without its path, which middie would prefix
+                // with the one of the context.
+                for (const context of this.middieContexts) {
+                    context.use(createMiddleware(true));
+                }
             }
             catch (e) {
                 if (e instanceof TypeError) {
@@ -547,12 +789,53 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             }
         };
     }
+    runMiddleware(middleware, req, res, next) {
+        let completed = false;
+        const nextOnce = (err) => {
+            if (completed)
+                return;
+            completed = true;
+            next(err);
+        };
+        try {
+            // middie discards the return value, so the promise is observed here:
+            // the proxies of `RouterProxy` reject when the exception layer throws.
+            // Its resolution is not passed to `next`, as a middleware that answers
+            // the request does not call it.
+            const result = middleware(req, res, nextOnce);
+            if (result && typeof result.then === 'function') {
+                result.then(undefined, (err) => {
+                    if (completed) {
+                        this.logger.error(err);
+                        return;
+                    }
+                    nextOnce(err || new fastify.errorCodes.FST_ERR_SEND_UNDEFINED_ERR());
+                });
+            }
+        }
+        catch (err) {
+            nextOnce(err);
+        }
+    }
     getType() {
         return 'fastify';
     }
     isRouteOrderSensitive() {
         return false;
     }
+    // The return type is spelled out (rather than "RouteMatchingOptions") so
+    // that the declarations still compile against an older "@nestjs/common"
+    getRouteMatchingOptions() {
+        const initialConfig = this.instance.initialConfig;
+        // Absent when a Fastify instance created without it is passed in
+        const routerOptions = (initialConfig.routerOptions ??
+            {});
+        return {
+            caseSensitive: !(routerOptions.caseSensitive === false ||
+                initialConfig.caseSensitive === false),
+            ignoreTrailingSlash: !!(routerOptions.ignoreTrailingSlash || initialConfig.ignoreTrailingSlash),
+        };
+    }
     use(...args) {
         // Fastify requires @fastify/middie plugin to be registered before middleware can be used.
         // If middie is not registered yet, we queue the middleware and register it later during init.
@@ -582,25 +865,69 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     }
     registerJsonContentParser(rawBody) {
         const contentType = 'application/json';
+        if (this.hasCustomBodyParser(contentType)) {
+            return;
+        }
         const withRawBody = !!rawBody;
         const { bodyLimit } = this.getInstance().initialConfig;
-        this.useBodyParser(contentType, withRawBody, { bodyLimit }, (req, body, done) => {
-            const { onProtoPoisoning, onConstructorPoisoning } = this.instance.initialConfig;
-            const defaultJsonParser = this.instance.getDefaultJsonParser(onProtoPoisoning || 'error', onConstructorPoisoning || 'error');
-            defaultJsonParser(req, body, done);
-        });
+        this.useBodyParser(contentType, withRawBody, { bodyLimit });
     }
     registerUrlencodedContentParser(rawBody) {
         const contentType = 'application/x-www-form-urlencoded';
+        if (this.hasCustomBodyParser(contentType)) {
+            return;
+        }
         const withRawBody = !!rawBody;
         const { bodyLimit } = this.getInstance().initialConfig;
-        this.useBodyParser(contentType, withRawBody, { bodyLimit }, (_req, body, done) => {
-            done(null, querystringParse(body.toString()));
-        });
+        this.useBodyParser(contentType, withRawBody, { bodyLimit });
+    }
+    // A parser registered through `useBodyParser()` takes precedence over the
+    // default one, including a RegExp or catch-all ('*') parser matching the type.
+    hasCustomBodyParser(contentType) {
+        for (const type of this.registeredContentTypes) {
+            if (type === '*' || type === contentType) {
+                return true;
+            }
+            if (isString(type)) {
+                continue;
+            }
+            type.lastIndex = 0;
+            if (type.test(contentType)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    // Fastify stores string content types trimmed and lower-cased.
+    normalizeContentType(type) {
+        return isString(type) ? type.trim().toLowerCase() : type;
+    }
+    getDefaultBodyParser(type) {
+        switch (this.normalizeContentType(type)) {
+            case 'application/json':
+                return (req, body, done) => {
+                    const { onProtoPoisoning, onConstructorPoisoning } = this.instance.initialConfig;
+                    const defaultJsonParser = this.instance.getDefaultJsonParser(onProtoPoisoning || 'error', onConstructorPoisoning || 'error');
+                    defaultJsonParser(req, body, done);
+                };
+            case 'application/x-www-form-urlencoded':
+                return (_req, body, done) => {
+                    done(null, querystringParse(body.toString()));
+                };
+        }
     }
     async registerMiddie() {
         this.isMiddieRegistered = true;
         await this.register(middie);
+        // middie gives each encapsulated context created from now on a copy of
+        // the middleware of its parent, as it is at that time. As
+        // `NestFactory.create()` registers middie before `main.ts` runs, a
+        // plugin registered there with an awaited `register()` gets a context
+        // without the Nest middleware `app.init()` registers later, so
+        // `createMiddlewareFactory()` adds it to the contexts tracked here.
+        this.instance.addHook('onRegister', instance => {
+            this.middieContexts.push(instance);
+        });
     }
     getRequestOriginalUrl(rawRequest) {
         return rawRequest.originalUrl || rawRequest.url;
@@ -618,9 +945,10 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         const routeToInject = {
             method: routerMethodKey,
             url: args[0],
-            handler: handlerRef,
+            handler: this.requireNonEmptyParams(args[0], handlerRef),
         };
-        if (!this.instance.supportedMethods.includes(routerMethodKey)) {
+        if (isString(routerMethodKey) &&
+            !this.instance.supportedMethods.includes(routerMethodKey)) {
             this.instance.addHttpMethod(routerMethodKey, { hasBody: true });
         }
         if (isVersioned || hasConstraints || hasConfig || hasSchema) {
@@ -649,6 +977,35 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         return this.instance.route(routeToInject);
     }
+    /**
+     * "find-my-way" matches an empty path segment for a route parameter
+     * ("/users//profile" -> { id: "" }), while "path-to-regexp", which
+     * middleware paths (and the ExpressAdapter's routes) are matched with,
+     * needs at least one character per parameter. Requests with an empty route
+     * parameter are passed to the not-found handler instead, as with the
+     * ExpressAdapter, so that middleware and routes always match the same
+     * requests. Only the wildcard ("*") may be empty.
+     */
+    requireNonEmptyParams(url, handler) {
+        if (isString(url) && !url.includes(':')) {
+            return handler;
+        }
+        const routeHandler = function (request, reply) {
+            const params = request.params;
+            for (const name in params) {
+                if (params[name] === '' && name !== '*') {
+                    reply.callNotFound();
+                    return;
+                }
+            }
+            return handler.call(this, request, reply);
+        };
+        Object.defineProperty(routeHandler, 'name', {
+            configurable: true,
+            value: handler.name,
+        });
+        return routeHandler;
+    }
     /**
      * Fastify still accepts the router options ("ignoreTrailingSlash",
      * "caseSensitive", ...) at the top level, but "initialConfig.routerOptions"
@@ -677,7 +1034,8 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     }
     sanitizeUrl(url) {
         const initialConfig = this.instance.initialConfig;
-        const routerOptions = initialConfig.routerOptions;
+        const routerOptions = (initialConfig.routerOptions ??
+            {});
         // Absolute-form request targets ("GET http://host/path HTTP/1.1") must be
         // resolved to their path before any other normalization, as the Fastify
         // router does, so that middleware and routes always match the same path.
@@ -686,16 +1044,15 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             initialConfig.ignoreDuplicateSlashes) {
             url = this.removeDuplicateSlashes(url);
         }
-        if (routerOptions.ignoreTrailingSlash ||
-            initialConfig.ignoreTrailingSlash) {
+        const { caseSensitive, ignoreTrailingSlash } = this.getRouteMatchingOptions();
+        if (ignoreTrailingSlash) {
             url = this.trimLastSlash(url);
         }
-        if (routerOptions.caseSensitive === false ||
-            initialConfig.caseSensitive === false) {
-            url = url.toLowerCase();
-        }
-        return safeDecodeURI(url, routerOptions.useSemicolonDelimiter ||
-            initialConfig.useSemicolonDelimiter).path;
+        const { path } = safeDecodeURI(url, routerOptions.useSemicolonDelimiter ||
+            initialConfig.useSemicolonDelimiter);
+        // Lower-cased once decoded, as the router does: "%E2%84%AA" (KELVIN
+        // SIGN) only lower-cases to "k" then
+        return caseSensitive ? path : path.toLowerCase();
     }
     removeDuplicateSlashes(path) {
         const REMOVE_DUPLICATE_SLASHES_REGEXP = /\/\/+/g;
@@ -734,6 +1091,26 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         return pathStart === -1 ? '/' : url.slice(pathStart);
     }
+    /**
+     * Whether the request target is in origin-form ("/users") or in the
+     * absolute-form of an "http(s)" URL ("http://host/users"), the only forms
+     * middleware paths can match.
+     *
+     * Node.js accepts other targets too (e.g. "GET *users HTTP/1.1").
+     * "find-my-way" routes those as if their first character were the leading
+     * "/" ("*users" is served by the "/users" route), while no middleware path
+     * matches them, so the route would run without its middleware. They are
+     * answered by the not-found handler instead, as with the ExpressAdapter,
+     * whose router never matches a path that does not start with "/".
+     *
+     * That includes the asterisk-form "OPTIONS *" (RFC 9112, section 3.2.4),
+     * which asks about the server as a whole rather than about a resource:
+     * Nest has no handler for it, and "find-my-way" would serve it with the
+     * "OPTIONS /" route.
+     */
+    isRoutableRequestTarget(url) {
+        return !!url && this.getPathFromRequestTarget(url).charCodeAt(0) === 47;
+    }
     trackOpenConnections() {
         const track = (socket) => {
             if (this.isClosing) {