@nestjs/platform-fastify 12.1.3 → 12.2.0

package/adapters/fastify-adapter.d.ts

@@ -67,12 +67,15 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     private readonly registeredContentTypes;
     private onRequestHook?;
     private onResponseHook?;
+    private securityHook?;
     private isMiddieRegistered;
     private multipartMode;
     private multipartOptions;
     private isMultipartRequested;
     private pendingMiddlewares;
+    private readonly middieContexts;
     private versioningOptions?;
+    private readonly versionExtractorErrors;
     private readonly versionConstraint;
     get isParserRegistered(): boolean;
     constructor(instanceOrOptions?: TInstance | FastifyHttp2Options<any> | FastifyHttp2SecureOptions<any> | FastifyHttpsOptions<any> | FastifyHttpOptions<any> | FastifyAdapterBaseOptions<TServer>);
@@ -132,9 +135,9 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     useStaticAssets(options: FastifyStaticOptions): any;
     setViewEngine(options: FastifyViewOptions | string): any;
     isHeadersSent(response: TRawResponse | TReply): boolean;
-    getHeader(response: any, name: string): any;
-    setHeader(response: TReply, name: string, value: string): FastifyReply<RouteGenericInterface, TServer, TRawRequest, TRawResponse, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
-    appendHeader(response: any, name: string, value: string): any;
+    getHeader(response: TRawResponse | TReply, name: string): string | number | string[] | undefined;
+    setHeader(response: TRawResponse | TReply, name: string, value: string): void | http.ServerResponse<http.IncomingMessage> | FastifyReply<RouteGenericInterface, TServer, TRawRequest, TRawResponse, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
+    appendHeader(response: TRawResponse | TReply, name: string, value: string): void | http.ServerResponse<http.IncomingMessage> | FastifyReply<RouteGenericInterface, TServer, TRawRequest, TRawResponse, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
     getRequestHostname(request: TRequest): string;
     getRequestMethod(request: TRequest): string;
     getRequestUrl(request: TRequest): string;
@@ -142,21 +145,27 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     enableCors(options?: FastifyCorsOptions): void;
     /**
      * Runs the request hook of the built-in HTTP security features in an
-     * `onRequest` hook: before middie (Nest middleware), content-type parsing,
-     * guards and handlers, and also for unmatched routes. Headers set by the
-     * hook go to the Node.js response (`reply.raw`): Fastify merges them into
-     * every response it sends, errors and `404`s included, while
+     * `onRequest` hook added by the constructor: before middie (Nest middleware
+     * and `app.use()` middleware, whenever they are registered), content-type
+     * parsing, guards and handlers, and also for unmatched routes. Headers set
+     * by the hook go to the Node.js response (`reply.raw`): Fastify merges them
+     * into every response it sends, errors and `404`s included, while
      * `reply.header()` / `@Header()` values take precedence, and responses
-     * written to `reply.raw` directly (e.g. `@Sse()`) carry them too. A
-     * rejection goes to `done(error)`, i.e. to the Nest exception layer
+     * written to `reply.raw` directly (e.g. `@Sse()`, or middleware) carry them
+     * too. A rejection goes to `done(error)`, i.e. to the Nest exception layer
      * installed with `setErrorHandler()`.
      */
     registerSecurityHook(hook: SecurityRequestHook<TRequest>): void;
     registerParserMiddleware(prefix?: string, rawBody?: boolean): void;
     useBodyParser(type: string | string[] | RegExp, rawBody: boolean, options?: NestFastifyBodyParserOptions, parser?: FastifyBodyParser<Buffer, TServer>): void;
     createMiddlewareFactory(requestMethod: RequestMethod): Promise<(path: string, callback: Function) => any>;
+    private runMiddleware;
     getType(): string;
     isRouteOrderSensitive(): boolean;
+    getRouteMatchingOptions(): {
+        caseSensitive: boolean;
+        ignoreTrailingSlash: boolean;
+    };
     use(...args: any[]): any;
     mapException(error: unknown): unknown;
     private isHttpFastifyError;
@@ -205,6 +214,24 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
      * and leaves any other request target untouched.
      */
     private getPathFromRequestTarget;
+    /**
+     * Whether the request target is in origin-form ("/users") or in the
+     * absolute-form of an "http(s)" URL ("http://host/users"), the only forms
+     * middleware paths can match.
+     *
+     * Node.js accepts other targets too (e.g. "GET *users HTTP/1.1").
+     * "find-my-way" routes those as if their first character were the leading
+     * "/" ("*users" is served by the "/users" route), while no middleware path
+     * matches them, so the route would run without its middleware. They are
+     * answered by the not-found handler instead, as with the ExpressAdapter,
+     * whose router never matches a path that does not start with "/".
+     *
+     * That includes the asterisk-form "OPTIONS *" (RFC 9112, section 3.2.4),
+     * which asks about the server as a whole rather than about a resource:
+     * Nest has no handler for it, and "find-my-way" would serve it with the
+     * "OPTIONS /" route.
+     */
+    private isRoutableRequestTarget;
     private trackOpenConnections;
     private closeOpenConnections;
 }

package/adapters/fastify-adapter.js

@@ -2,10 +2,12 @@ import { HttpException, HttpStatus, Logger, StreamableFile, VERSION_NEUTRAL, Ver
 import { fastify, } from 'fastify';
 import Reply from 'fastify/lib/reply.js';
 import fastifySymbols from 'fastify/lib/symbols.js';
+import * as http from 'http';
 import * as net from 'net';
 import { pathToRegexp } from 'path-to-regexp';
+import { Readable } from 'stream';
 import middie from '@fastify/middie';
-import { loadPackage, tryLoadPackage, isNil, isString, isUndefined, } from '@nestjs/common/internal';
+import { loadPackage, tryLoadPackage, isFunction, isNil, isString, isUndefined, } from '@nestjs/common/internal';
 import { AbstractHttpAdapter } from '@nestjs/core';
 import { LegacyRouteConverter } from '@nestjs/core/internal';
 import { getMediaTypeVersion } from './utils/get-media-type-version.util.js';
@@ -45,12 +47,18 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     registeredContentTypes = new Set();
     onRequestHook;
     onResponseHook;
+    securityHook;
     isMiddieRegistered;
     multipartMode = 'auto';
     multipartOptions = {};
     isMultipartRequested = false;
     pendingMiddlewares = [];
+    // The encapsulated contexts created since middie was registered (see
+    // `registerMiddie()`)
+    middieContexts = [];
     versioningOptions;
+    // Exceptions thrown by the extractor of custom versioning, by raw request
+    versionExtractorErrors = new WeakMap();
     versionConstraint = {
         name: 'version',
         validate(value) {
@@ -108,7 +116,16 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             }
             // Custom Versioning Handler
             else if (this.versioningOptions?.type === VersioningType.CUSTOM) {
-                return this.versioningOptions.extractor(req);
+                try {
+                    return this.versioningOptions.extractor(req);
+                }
+                catch (err) {
+                    // Fastify routes the request, and so calls the extractor, before
+                    // anything could catch the exception. It is passed to the error
+                    // handler from an `onRequest` hook instead (see the constructor).
+                    this.versionExtractorErrors.set(req, err);
+                    return undefined;
+                }
             }
             return undefined;
         },
@@ -122,6 +139,20 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         const instance = instanceOrOptions && instanceOrOptions.server
             ? instanceOrOptions
             : fastify({
+                // The router answers a malformed URL (400) or an over-long route
+                // parameter (414) before any hook runs, so the security hook (see
+                // `registerSecurityHook()`) runs here, for its headers.
+                frameworkErrors: (error, request, reply) => {
+                    try {
+                        this.securityHook?.(request, reply.raw);
+                    }
+                    catch {
+                        // The request is rejected either way, and a throw here would
+                        // escape the router. `request.params` and `request.query`
+                        // are null, so a CSRF `exclude` predicate may throw.
+                    }
+                    reply.send(error);
+                },
                 ...instanceOrOptions,
                 routerOptions: {
                     ...this.getTopLevelRouterOptions(instanceOrOptions),
@@ -176,6 +207,46 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                 done();
             }
         });
+        // The request hook of `app.enableCsrfProtection()` and
+        // `app.useSecurityHeaders()` (see `registerSecurityHook()`). Added here
+        // for the same reason as the hook above: it must run before Nest
+        // middleware, and `NestFactory.create()` registers middie before either
+        // method can be called. After the `503` hook, as on Express.
+        this.instance.addHook('onRequest', (request, reply, done) => {
+            if (this.securityHook) {
+                done(this.securityHook(request, reply.raw));
+            }
+            else {
+                done();
+            }
+        });
+        // Passes requests whose target middleware cannot be matched against to
+        // the not-found handler (see `isRoutableRequestTarget()`). Added here,
+        // like the hooks above, so that it runs before Nest middleware, and
+        // after the security hook, so that the `404` carries its headers, as on
+        // Express. A request the router did not match is already on its way to
+        // the not-found handler.
+        this.instance.addHook('onRequest', (request, reply, done) => {
+            if (request.is404 || this.isRoutableRequestTarget(request.raw.url)) {
+                done();
+            }
+            else {
+                reply.callNotFound();
+            }
+        });
+        // Passes an exception thrown by the extractor of custom versioning while
+        // Fastify routed the request (see `versionConstraint`) to the error
+        // handler, for matched and unmatched routes alike. Added here, like the
+        // hooks above, so that it runs before Nest middleware.
+        this.instance.addHook('onRequest', (request, _reply, done) => {
+            if (!this.versionExtractorErrors.has(request.raw)) {
+                done();
+                return;
+            }
+            const err = this.versionExtractorErrors.get(request.raw);
+            this.versionExtractorErrors.delete(request.raw);
+            done(err || new fastify.errorCodes.FST_ERR_SEND_UNDEFINED_ERR());
+        });
         this.instance.addHook('onResponse', (request, reply, done) => {
             if (this.onResponseHook) {
                 this.runLifecycleHook(this.onResponseHook, request, reply, done);
@@ -317,6 +388,11 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         return this.injectRouteOptions('UNLOCK', ...args);
     }
     all(...args) {
+        // Routes registered by Nest ("path, handler") get the route options
+        // (e.g. the version), with the same methods as "fastify.all()".
+        if (args.length === 2 && isFunction(args[1])) {
+            return this.injectRouteOptions(this.instance.supportedMethods, ...args);
+        }
         const handlerRef = args[args.length - 1];
         args[args.length - 1] = this.requireNonEmptyParams(args[0], handlerRef);
         return this.instance.all(...args);
@@ -345,6 +421,12 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             fastifyReply.status(statusCode);
         }
         if (body instanceof StreamableFile) {
+            const stream = body.getStream();
+            // Once the reply was sent (e.g. by `handlerTimeout`), send() drops the
+            // stream without consuming or destroying it.
+            if (fastifyReply.sent && isFunction(stream?.destroy)) {
+                stream.destroy();
+            }
             const streamHeaders = body.getHeaders();
             if (fastifyReply.getHeader('Content-Type') === undefined &&
                 streamHeaders.type !== undefined) {
@@ -358,7 +440,29 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                 streamHeaders.length !== undefined) {
                 fastifyReply.header('Content-Length', streamHeaders.length);
             }
-            body = body.getStream();
+            body = stream;
+            // Fastify's HEAD route handler resumes a stream payload, and a route
+            // declared for HEAD (or a raw response) pipes it into a response that
+            // discards it, so the whole source would be read for nothing. Fastify
+            // gets an empty stream instead, as an empty body would reset
+            // Content-Length to 0.
+            if (fastifyReply.raw?.req?.method === 'HEAD' &&
+                isFunction(stream?.destroy)) {
+                stream.destroy();
+                body = Readable.from([]);
+            }
+        }
+        // Fastify passes an Error payload to the error handler instead of
+        // sending it, and the reply around a raw response (e.g. the one
+        // middleware gets) has none. An Error body sent with an error status,
+        // as for `new UnauthorizedException(err)`, gets the standard body of the
+        // status instead, without the properties of the Error.
+        if (body instanceof Error &&
+            fastifyReply.statusCode >= HttpStatus.BAD_REQUEST) {
+            body = {
+                statusCode: fastifyReply.statusCode,
+                message: http.STATUS_CODES[fastifyReply.statusCode] ?? 'Error',
+            };
         }
         const responseContentType = fastifyReply.getHeader('Content-Type');
         if (typeof responseContentType === 'string' &&
@@ -511,20 +615,40 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         return response.getHeader(name);
     }
     setHeader(response, name, value) {
-        return response.header(name, value);
+        if (this.isNativeResponse(response)) {
+            return response.setHeader(name, value);
+        }
+        const reply = response;
+        return reply.header(name, value);
     }
     appendHeader(response, name, value) {
-        const current = response.getHeader(name);
-        if (current === undefined) {
-            return response.header(name, value);
+        if (this.isNativeResponse(response)) {
+            const current = response.getHeader(name);
+            return response.setHeader(name, current === undefined ? value : [current, value].flat().map(String));
         }
-        // Fastify Reply.header() already concatenates set-cookie.
-        // Re-passing the accumulated list would duplicate previous cookies.
+        const reply = response;
+        // A set-cookie value can live on the reply or only on the raw response
+        // (e.g., set by a middleware). Reply.getHeader() reads both, and the
+        // merged list is written to both: reply.send() sends the reply headers,
+        // while a hijacked reply or a handler that ends reply.raw sends the raw
+        // ones.
         if (String(name).toLowerCase() === 'set-cookie') {
-            return response.header(name, value);
+            const current = reply.getHeader(name);
+            const values = current === undefined ? [value] : [current, value].flat().map(String);
+            reply.removeHeader(name);
+            reply.header(name, values);
+            if (!reply.raw.headersSent) {
+                // A copy, so a later reply.header() call does not change the raw header
+                reply.raw.setHeader(name, [...values]);
+            }
+            return reply;
+        }
+        const current = reply.getHeader(name);
+        if (current === undefined) {
+            return reply.header(name, value);
         }
         const values = Array.isArray(current) ? current : [current];
-        return response.header(name, values.concat(value));
+        return reply.header(name, values.concat(value));
     }
     getRequestHostname(request) {
         return request.hostname;
@@ -540,19 +664,18 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     }
     /**
      * Runs the request hook of the built-in HTTP security features in an
-     * `onRequest` hook: before middie (Nest middleware), content-type parsing,
-     * guards and handlers, and also for unmatched routes. Headers set by the
-     * hook go to the Node.js response (`reply.raw`): Fastify merges them into
-     * every response it sends, errors and `404`s included, while
+     * `onRequest` hook added by the constructor: before middie (Nest middleware
+     * and `app.use()` middleware, whenever they are registered), content-type
+     * parsing, guards and handlers, and also for unmatched routes. Headers set
+     * by the hook go to the Node.js response (`reply.raw`): Fastify merges them
+     * into every response it sends, errors and `404`s included, while
      * `reply.header()` / `@Header()` values take precedence, and responses
-     * written to `reply.raw` directly (e.g. `@Sse()`) carry them too. A
-     * rejection goes to `done(error)`, i.e. to the Nest exception layer
+     * written to `reply.raw` directly (e.g. `@Sse()`, or middleware) carry them
+     * too. A rejection goes to `done(error)`, i.e. to the Nest exception layer
      * installed with `setErrorHandler()`.
      */
     registerSecurityHook(hook) {
-        this.instance.addHook('onRequest', (request, reply, done) => {
-            done(hook(request, reply.raw));
-        });
+        this.securityHook = hook;
     }
     registerParserMiddleware(prefix, rawBody) {
         if (this._isParserRegistered) {
@@ -616,9 +739,13 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                 re = hasEndOfStringCharacter
                     ? new RegExp(re.source + '$', re.flags)
                     : re;
-                // The following type assertion is valid as we use import('@fastify/middie') rather than require('@fastify/middie')
-                // ref https://github.com/fastify/middie/pull/55
-                this.instance.use(normalizedPath, (req, res, next) => {
+                // A case-insensitive router lower-cases the decoded path, where some
+                // characters only fold to ASCII ("%E2%84%AA", KELVIN SIGN, is routed
+                // as "k"). The RegExp of @fastify/middie does not fold them, so on
+                // such a router the middleware is registered for every path and the
+                // path is only matched below.
+                const { caseSensitive } = this.getRouteMatchingOptions();
+                const createMiddleware = (stripsPath) => (req, res, next) => {
                     const queryParamsIndex = req.originalUrl.indexOf('?');
                     let pathname = queryParamsIndex >= 0
                         ? req.originalUrl.slice(0, queryParamsIndex)
@@ -631,9 +758,28 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                         if (!re.exec(pathToCheck)) {
                             return next();
                         }
+                        if (stripsPath) {
+                            // Strips the path from "req.url", as @fastify/middie does
+                            // when it matches the path itself
+                            const suffixIndex = req.originalUrl.search(/[?#]/);
+                            req.url =
+                                suffixIndex >= 0
+                                    ? `/${req.originalUrl.slice(suffixIndex)}`
+                                    : '/';
+                        }
                     }
-                    return callback(req, res, next);
-                });
+                    this.runMiddleware(callback, req, res, next);
+                };
+                // The following type assertion is valid as we use import('@fastify/middie') rather than require('@fastify/middie')
+                // ref https://github.com/fastify/middie/pull/55
+                this.instance.use(caseSensitive ? normalizedPath : '/', createMiddleware(!caseSensitive));
+                // The contexts created since middie was registered have a copy of the
+                // middleware of their parent without this one (see `registerMiddie()`).
+                // It is registered there without its path, which middie would prefix
+                // with the one of the context.
+                for (const context of this.middieContexts) {
+                    context.use(createMiddleware(true));
+                }
             }
             catch (e) {
                 if (e instanceof TypeError) {
@@ -643,12 +789,53 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             }
         };
     }
+    runMiddleware(middleware, req, res, next) {
+        let completed = false;
+        const nextOnce = (err) => {
+            if (completed)
+                return;
+            completed = true;
+            next(err);
+        };
+        try {
+            // middie discards the return value, so the promise is observed here:
+            // the proxies of `RouterProxy` reject when the exception layer throws.
+            // Its resolution is not passed to `next`, as a middleware that answers
+            // the request does not call it.
+            const result = middleware(req, res, nextOnce);
+            if (result && typeof result.then === 'function') {
+                result.then(undefined, (err) => {
+                    if (completed) {
+                        this.logger.error(err);
+                        return;
+                    }
+                    nextOnce(err || new fastify.errorCodes.FST_ERR_SEND_UNDEFINED_ERR());
+                });
+            }
+        }
+        catch (err) {
+            nextOnce(err);
+        }
+    }
     getType() {
         return 'fastify';
     }
     isRouteOrderSensitive() {
         return false;
     }
+    // The return type is spelled out (rather than "RouteMatchingOptions") so
+    // that the declarations still compile against an older "@nestjs/common"
+    getRouteMatchingOptions() {
+        const initialConfig = this.instance.initialConfig;
+        // Absent when a Fastify instance created without it is passed in
+        const routerOptions = (initialConfig.routerOptions ??
+            {});
+        return {
+            caseSensitive: !(routerOptions.caseSensitive === false ||
+                initialConfig.caseSensitive === false),
+            ignoreTrailingSlash: !!(routerOptions.ignoreTrailingSlash || initialConfig.ignoreTrailingSlash),
+        };
+    }
     use(...args) {
         // Fastify requires @fastify/middie plugin to be registered before middleware can be used.
         // If middie is not registered yet, we queue the middleware and register it later during init.
@@ -732,6 +919,15 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     async registerMiddie() {
         this.isMiddieRegistered = true;
         await this.register(middie);
+        // middie gives each encapsulated context created from now on a copy of
+        // the middleware of its parent, as it is at that time. As
+        // `NestFactory.create()` registers middie before `main.ts` runs, a
+        // plugin registered there with an awaited `register()` gets a context
+        // without the Nest middleware `app.init()` registers later, so
+        // `createMiddlewareFactory()` adds it to the contexts tracked here.
+        this.instance.addHook('onRegister', instance => {
+            this.middieContexts.push(instance);
+        });
     }
     getRequestOriginalUrl(rawRequest) {
         return rawRequest.originalUrl || rawRequest.url;
@@ -751,7 +947,8 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             url: args[0],
             handler: this.requireNonEmptyParams(args[0], handlerRef),
         };
-        if (!this.instance.supportedMethods.includes(routerMethodKey)) {
+        if (isString(routerMethodKey) &&
+            !this.instance.supportedMethods.includes(routerMethodKey)) {
             this.instance.addHttpMethod(routerMethodKey, { hasBody: true });
         }
         if (isVersioned || hasConstraints || hasConfig || hasSchema) {
@@ -837,7 +1034,8 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     }
     sanitizeUrl(url) {
         const initialConfig = this.instance.initialConfig;
-        const routerOptions = initialConfig.routerOptions;
+        const routerOptions = (initialConfig.routerOptions ??
+            {});
         // Absolute-form request targets ("GET http://host/path HTTP/1.1") must be
         // resolved to their path before any other normalization, as the Fastify
         // router does, so that middleware and routes always match the same path.
@@ -846,16 +1044,15 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             initialConfig.ignoreDuplicateSlashes) {
             url = this.removeDuplicateSlashes(url);
         }
-        if (routerOptions.ignoreTrailingSlash ||
-            initialConfig.ignoreTrailingSlash) {
+        const { caseSensitive, ignoreTrailingSlash } = this.getRouteMatchingOptions();
+        if (ignoreTrailingSlash) {
             url = this.trimLastSlash(url);
         }
-        if (routerOptions.caseSensitive === false ||
-            initialConfig.caseSensitive === false) {
-            url = url.toLowerCase();
-        }
-        return safeDecodeURI(url, routerOptions.useSemicolonDelimiter ||
-            initialConfig.useSemicolonDelimiter).path;
+        const { path } = safeDecodeURI(url, routerOptions.useSemicolonDelimiter ||
+            initialConfig.useSemicolonDelimiter);
+        // Lower-cased once decoded, as the router does: "%E2%84%AA" (KELVIN
+        // SIGN) only lower-cases to "k" then
+        return caseSensitive ? path : path.toLowerCase();
     }
     removeDuplicateSlashes(path) {
         const REMOVE_DUPLICATE_SLASHES_REGEXP = /\/\/+/g;
@@ -894,6 +1091,26 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         return pathStart === -1 ? '/' : url.slice(pathStart);
     }
+    /**
+     * Whether the request target is in origin-form ("/users") or in the
+     * absolute-form of an "http(s)" URL ("http://host/users"), the only forms
+     * middleware paths can match.
+     *
+     * Node.js accepts other targets too (e.g. "GET *users HTTP/1.1").
+     * "find-my-way" routes those as if their first character were the leading
+     * "/" ("*users" is served by the "/users" route), while no middleware path
+     * matches them, so the route would run without its middleware. They are
+     * answered by the not-found handler instead, as with the ExpressAdapter,
+     * whose router never matches a path that does not start with "/".
+     *
+     * That includes the asterisk-form "OPTIONS *" (RFC 9112, section 3.2.4),
+     * which asks about the server as a whole rather than about a resource:
+     * Nest has no handler for it, and "find-my-way" would serve it with the
+     * "OPTIONS /" route.
+     */
+    isRoutableRequestTarget(url) {
+        return !!url && this.getPathFromRequestTarget(url).charCodeAt(0) === 47;
+    }
     trackOpenConnections() {
         const track = (socket) => {
             if (this.isClosing) {

package/adapters/utils/get-media-type-version.util.d.ts

@@ -6,6 +6,10 @@
  * media range of a list (`text/html, application/json;v=2`); the first match
  * wins. Returns `undefined` when no parameter starts with the key.
  *
+ * Quoted parameter values are unescaped, and separators inside them are ignored.
+ * An unterminated quoted string runs to the end of the header value, so a
+ * version that follows its opening quote is not read.
+ *
  * Duplicated in each platform package so that a platform package never
  * depends on a newer `@nestjs/core` than the one installed.
  */

package/adapters/utils/get-media-type-version.util.js

@@ -1,3 +1,29 @@
+/**
+ * Splits a header value at separators outside quoted strings in linear time.
+ * Backslash-escaped characters inside quoted strings are treated as literals.
+ */
+const splitOutsideQuotes = (value, separator) => {
+    const parts = [];
+    let start = 0;
+    let isQuoted = false;
+    const len = value.length;
+    for (let index = 0; index < len; index++) {
+        const character = value[index];
+        if (isQuoted && character === '\\') {
+            // A quoted-pair consumes the next character, including an escaped quote.
+            index++;
+        }
+        else if (character === '"') {
+            isQuoted = !isQuoted;
+        }
+        else if (character === separator && !isQuoted) {
+            parts.push(value.slice(start, index));
+            start = index + 1;
+        }
+    }
+    parts.push(value.slice(start));
+    return parts;
+};
 /**
  * Returns the version carried by an `Accept` header for media type versioning,
  * e.g. `2` for `application/json;v=2` with the `v=` key.
@@ -6,19 +32,27 @@
  * media range of a list (`text/html, application/json;v=2`); the first match
  * wins. Returns `undefined` when no parameter starts with the key.
  *
+ * Quoted parameter values are unescaped, and separators inside them are ignored.
+ * An unterminated quoted string runs to the end of the header value, so a
+ * version that follows its opening quote is not read.
+ *
  * Duplicated in each platform package so that a platform package never
  * depends on a newer `@nestjs/core` than the one installed.
  */
 export function getMediaTypeVersion(acceptHeader, key) {
     const mediaRanges = []
         .concat(acceptHeader ?? [])
-        .flatMap(value => value.split(','));
+        .flatMap(value => splitOutsideQuotes(value, ','));
     for (const mediaRange of mediaRanges) {
-        const [, ...parameters] = mediaRange.split(';');
+        const [, ...parameters] = splitOutsideQuotes(mediaRange, ';');
         for (const parameter of parameters) {
             const trimmedParameter = parameter.trim();
             if (trimmedParameter.startsWith(key)) {
-                return trimmedParameter.slice(key.length);
+                const version = trimmedParameter.slice(key.length);
+                if (version.startsWith('"') && version.endsWith('"')) {
+                    return version.slice(1, -1).replace(/\\([\s\S])/g, '$1');
+                }
+                return version;
             }
         }
     }

package/multipart/interfaces/multipart-options.interface.d.ts

@@ -12,11 +12,11 @@ export interface MultipartStorageEngine {
 /**
  * Same keys as platform-express's `MulterLimits`.
  *
- * Limits that are not set fall back to the options `@fastify/multipart` was
- * registered with, and then to its own defaults. Unlike multer (which
- * defaults `fileSize` and `parts` to `Infinity`), `@fastify/multipart` caps
- * `fileSize` at the Fastify instance's `bodyLimit` (1 MiB unless configured)
- * and `parts` at 1000.
+ * Limits that are not set, or set to `null` or `undefined`, fall back to the
+ * options `@fastify/multipart` was registered with, and then to its own
+ * defaults. Unlike multer (which defaults `fileSize` and `parts` to
+ * `Infinity`), `@fastify/multipart` caps `fileSize` at the Fastify
+ * instance's `bodyLimit` (1 MiB unless configured) and `parts` at 1000.
  *
  * @publicApi
  */
@@ -40,15 +40,17 @@ export interface MultipartLimits {
     /** For multipart forms, the max number of header key => value pairs to parse (Default: 2000) */
     headerPairs?: number;
     /**
-     * Max nesting depth of field names; `a[b][c]` has 2 levels (Default:
-     * Infinity). Like `fieldNameSize`, it does not fall back to the options
+     * Max nesting depth of field names; `a[b][c]` has 2 levels (Default: 32,
+     * where multer's own default is Infinity). Set it to `Infinity` to lift
+     * the limit. Like `fieldNameSize`, it does not fall back to the options
      * `@fastify/multipart` was registered with.
      */
     fieldNestingDepth?: number;
     /**
      * Max numeric array index accepted in field names; `a[3]` uses index 3
-     * (Default: Infinity). Like `fieldNameSize`, it does not fall back to the
-     * options `@fastify/multipart` was registered with.
+     * (Default: 1000, where multer's own default is Infinity). Set it to
+     * `Infinity` to lift the limit. Like `fieldNameSize`, it does not fall back
+     * to the options `@fastify/multipart` was registered with.
      */
     fieldArrayIndexLimit?: number;
 }

package/multipart/multipart/multipart-interceptor.factory.js

@@ -1,10 +1,12 @@
 import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, StreamableFile, } from '@nestjs/common';
 import { HttpAdapterHost } from '@nestjs/core';
+import { isRejectedByPipes } from '@nestjs/core/internal';
 import { catchError, concatMap, from, throwError } from 'rxjs';
+import { finished } from 'stream';
 import { MULTIPART_MODULE_OPTIONS } from '../files.constants.js';
 import { MISSING_PLUGIN_MESSAGE, PLUGIN_NOT_REGISTERED_AT_STARTUP_MESSAGE, WRONG_ADAPTER_MESSAGE, } from './multipart.constants.js';
-import { drainRequest, processMultipart, processStream, resolveStorage, validateLimits, } from './multipart.parser.js';
+import { drainRequest, processMultipart, processStream, removeFiles, resolveStorage, validateLimits, } from './multipart.parser.js';
 import { mergeMultipartOptions } from './multipart.utils.js';
 const verifiedInstances = new WeakSet();
 /**
@@ -78,9 +80,23 @@ export function createMultipartInterceptor(spec, localOptions) {
             this.storage = resolveStorage(this.options);
         }
         async intercept(context, next) {
-            const req = context.switchToHttp().getRequest();
-            await processMultipart(req, spec, this.options, this.storage);
-            return next.handle();
+            const ctx = context.switchToHttp();
+            const req = ctx.getRequest();
+            const stored = await processMultipart(req, spec, this.options, this.storage);
+            return next.handle().pipe(
+            // When the route's pipes reject the request (e.g. `ParseFilePipe`),
+            // the route handler never sees the files, and nothing else would
+            // remove them. They are removed once the response has been sent, as
+            // an exception filter may still use (or remove) them.
+            catchError(err => {
+                if (isRejectedByPipes(req)) {
+                    const reply = ctx.getResponse();
+                    finished(reply.raw, () => {
+                        removeFiles(this.storage, req, stored).catch(() => undefined);
+                    });
+                }
+                return throwError(() => err);
+            }));
         }
     };
     MixinInterceptor = __decorate([

package/multipart/multipart/multipart.constants.d.ts

@@ -18,6 +18,19 @@ export declare const multerExceptions: {
     readonly INVALID_FIELD_NAME: "Invalid field name";
 };
 export type MultipartErrorCode = keyof typeof multerExceptions;
+/**
+ * Defaults of the field name limits that multer leaves at `Infinity`, which
+ * let a single small request build an arbitrarily deep `req.body`
+ * (`fieldNestingDepth`) or arrays of arbitrary length (`fieldArrayIndexLimit`).
+ * `32` is the nesting depth `body-parser` allows in the urlencoded bodies the
+ * ExpressAdapter parses; `1000` is the number of parameters it parses, and
+ * the number of parts `@fastify/multipart` accepts. Kept identical to
+ * platform-express's `DEFAULT_FIELD_NAME_LIMITS`.
+ */
+export declare const DEFAULT_FIELD_NAME_LIMITS: {
+    readonly fieldNestingDepth: 32;
+    readonly fieldArrayIndexLimit: 1000;
+};
 /**
  * The messages platform-express reports for busboy 1.x parser errors
  * (prefixed with "Multipart: "), which is what multer bundles.

package/multipart/multipart/multipart.constants.js

@@ -20,6 +20,19 @@ export const multerExceptions = {
     // field names that would pollute a prototype, which multer accepts.
     INVALID_FIELD_NAME: 'Invalid field name',
 };
+/**
+ * Defaults of the field name limits that multer leaves at `Infinity`, which
+ * let a single small request build an arbitrarily deep `req.body`
+ * (`fieldNestingDepth`) or arrays of arbitrary length (`fieldArrayIndexLimit`).
+ * `32` is the nesting depth `body-parser` allows in the urlencoded bodies the
+ * ExpressAdapter parses; `1000` is the number of parameters it parses, and
+ * the number of parts `@fastify/multipart` accepts. Kept identical to
+ * platform-express's `DEFAULT_FIELD_NAME_LIMITS`.
+ */
+export const DEFAULT_FIELD_NAME_LIMITS = {
+    fieldNestingDepth: 32,
+    fieldArrayIndexLimit: 1000,
+};
 /**
  * The messages platform-express reports for busboy 1.x parser errors
  * (prefixed with "Multipart: "), which is what multer bundles.

package/multipart/multipart/multipart.parser.d.ts

@@ -1,6 +1,6 @@
 import type { FastifyRequest } from 'fastify';
 import type { IncomingMessage } from 'http';
-import type { MultipartField, MultipartLimits, MultipartOptions, MultipartStorageEngine } from '../interfaces/index.js';
+import type { MultipartField, MultipartLimits, MultipartOptions, MultipartStorageEngine, UploadedMultipartFile } from '../interfaces/index.js';
 /**
  * Where accepted files end up, named after multer's `FileAppender` strategies.
  */
@@ -12,6 +12,7 @@ export interface UploadSpec {
 }
 /** Same resolution order as multer: `storage`, then `dest`, then memory. */
 export declare function resolveStorage(options: MultipartOptions): MultipartStorageEngine;
+export declare function removeFiles(storage: MultipartStorageEngine, req: FastifyRequest, files: UploadedMultipartFile[]): Promise<void[]>;
 /**
  * Stops parsing and discards the rest of the body, so that an error response
  * does not race a client that is still uploading (multer does the same
@@ -26,10 +27,11 @@ export declare function drainRequest(raw: IncomingMessage): Promise<void>;
 export declare function validateLimits(limits: MultipartLimits | undefined): void;
 /**
  * Parses the multipart body with multer's semantics and populates
- * `req.body` and `req.file` / `req.files`. Requests that are not multipart
- * are passed through untouched, as multer does.
+ * `req.body` and `req.file` / `req.files`, and returns the stored files.
+ * Requests that are not multipart are passed through untouched, as multer
+ * does.
  */
-export declare function processMultipart(request: FastifyRequest, spec: UploadSpec, options: MultipartOptions, storage: MultipartStorageEngine): Promise<void>;
+export declare function processMultipart(request: FastifyRequest, spec: UploadSpec, options: MultipartOptions, storage: MultipartStorageEngine): Promise<UploadedMultipartFile[]>;
 /**
  * Parses up to and including the first file in `fieldName`, then stops and
  * hands that file's stream to the route handler (`req.file.stream`). Text

package/multipart/multipart/multipart.parser.js

@@ -2,7 +2,7 @@ import { BadRequestException, PayloadTooLargeException } from '@nestjs/common';
 import { diskStorage } from '../storage/disk.storage.js';
 import { memoryStorage } from '../storage/memory.storage.js';
 import { appendField } from './append-field.util.js';
-import { busboyExceptions, MISSING_PLUGIN_MESSAGE, multerExceptions, } from './multipart.constants.js';
+import { busboyExceptions, DEFAULT_FIELD_NAME_LIMITS, MISSING_PLUGIN_MESSAGE, multerExceptions, } from './multipart.constants.js';
 import { MultipartError } from './multipart.error.js';
 import { transformException } from './multipart.utils.js';
 /** Same resolution order as multer: `storage`, then `dest`, then memory. */
@@ -22,15 +22,18 @@ function assertPluginRegistered(req) {
 }
 /**
  * Per-route options handed to `req.parts()`; `@fastify/multipart` deep-merges
- * them over the options the plugin was registered with. `@fastify/busboy`
- * treats `fileSize` and `parts` as "max allowed" (it fires once a limit is
+ * them over the options the plugin was registered with. Limits set to `null`
+ * or `undefined` are left out, as the merge would copy them over the
+ * plugin's limits (and its `fileSize` and `parts` defaults), which
+ * `@fastify/busboy` then reads as no limit. `@fastify/busboy` treats
+ * `fileSize` and `parts` as "max allowed" (it fires once a limit is
  * exceeded), so unlike multer there is no `+1` adjustment. Truncation is
  * detected here (`file.truncated`), so the plugin's own throw is disabled.
  */
 function toBusboyConfig(limits, options) {
     const config = { throwFileSizeLimit: false };
     if (limits) {
-        config.limits = { ...limits };
+        config.limits = Object.fromEntries(Object.entries(limits).filter(([, value]) => value != null));
     }
     if (options.preservePath !== undefined) {
         config.preservePath = options.preservePath;
@@ -86,9 +89,12 @@ const ABORTED = Symbol('aborted');
  * the engine (e.g. by a `pipeline()` to a file that cannot be written), which
  * reports that error itself.
  *
- * Whatever the engine stores after an abort is removed once it calls back,
- * as multer does: what it stored when it succeeds, and the file at `path`
- * (which engines set before writing, by multer's convention) when it fails.
+ * Whatever the engine stores after an abort is removed, as multer does. The
+ * file at `path` (which engines set before writing, by multer's convention)
+ * is removed right away, as an engine waiting on `pipeline()` never calls
+ * back for a stream destroyed after its last chunk; removing it clears
+ * `path`. What the engine stored is removed once it calls back: what it
+ * returned when it succeeds, and the file at `path` when it fails.
  */
 function storeFile(storage, req, file) {
     return new Promise((resolve, reject) => {
@@ -101,6 +107,10 @@ function storeFile(storage, req, file) {
             if (!stream.readableEnded && !stream.errored) {
                 aborted = true;
                 resolve(ABORTED);
+                const partial = file;
+                if (partial.path) {
+                    removeFiles(storage, req, [partial]).catch(() => undefined);
+                }
             }
         };
         stream.once('close', onClose);
@@ -116,7 +126,7 @@ function storeFile(storage, req, file) {
         });
     });
 }
-function removeFiles(storage, req, files) {
+export function removeFiles(storage, req, files) {
     return Promise.all(files.map(file => new Promise(resolve => storage._removeFile(req, file, () => resolve()))));
 }
 /**
@@ -216,14 +226,17 @@ function exceedsArrayIndexLimit(name, limit) {
 /**
  * `fieldNestingDepth` and `fieldArrayIndexLimit` are multer's own limits
  * (busboy knows neither), so they are checked here, against the decoded name.
+ * Unlike multer, they default to `DEFAULT_FIELD_NAME_LIMITS`.
  */
 function checkFieldNameShape(name, limits) {
-    if (typeof limits?.fieldNestingDepth === 'number' &&
-        name.split('[').length - 1 > limits.fieldNestingDepth) {
+    const nestingDepth = limits?.fieldNestingDepth ?? DEFAULT_FIELD_NAME_LIMITS.fieldNestingDepth;
+    if (name.split('[').length - 1 > nestingDepth) {
         throw new MultipartError('LIMIT_FIELD_NESTING', name);
     }
-    if (typeof limits?.fieldArrayIndexLimit === 'number' &&
-        exceedsArrayIndexLimit(name, limits.fieldArrayIndexLimit)) {
+    const arrayIndexLimit = limits?.fieldArrayIndexLimit ??
+        DEFAULT_FIELD_NAME_LIMITS.fieldArrayIndexLimit;
+    if (arrayIndexLimit !== Infinity &&
+        exceedsArrayIndexLimit(name, arrayIndexLimit)) {
         throw new MultipartError('LIMIT_FIELD_ARRAY_INDEX', name);
     }
 }
@@ -260,15 +273,16 @@ function readFilePart(part, limits) {
 }
 /**
  * Parses the multipart body with multer's semantics and populates
- * `req.body` and `req.file` / `req.files`. Requests that are not multipart
- * are passed through untouched, as multer does.
+ * `req.body` and `req.file` / `req.files`, and returns the stored files.
+ * Requests that are not multipart are passed through untouched, as multer
+ * does.
  */
 export async function processMultipart(request, spec, options, storage) {
     const req = request;
     assertPluginRegistered(req);
     resetFiles(req);
     if (!req.isMultipart()) {
-        return;
+        return [];
     }
     const filesLeft = new Map();
     if (spec.fields !== 'ANY') {
@@ -339,6 +353,7 @@ export async function processMultipart(request, spec, options, storage) {
             break;
         }
     }
+    return stored;
 }
 /**
  * Parses up to and including the first file in `fieldName`, then stops and

package/multipart/multipart/multipart.utils.js

@@ -13,6 +13,11 @@ export function mergeMultipartOptions(options = {}, localOptions = {}) {
     if (isPlainObject(options.limits) && isPlainObject(localOptions.limits)) {
         merged.limits = { ...options.limits, ...localOptions.limits };
     }
+    // `dest` and `storage` both say where files go, and `resolveStorage()`
+    // prefers `storage`, so a global storage engine would shadow a local `dest`.
+    if (localOptions.dest && !localOptions.storage) {
+        delete merged.storage;
+    }
     return merged;
 }
 /**

package/multipart/storage/disk.storage.js

@@ -3,10 +3,24 @@ import { createWriteStream, mkdirSync } from 'fs';
 import { unlink } from 'fs/promises';
 import { tmpdir } from 'os';
 import { join } from 'path';
-import { pipeline } from 'stream/promises';
+import { finished, pipeline } from 'stream/promises';
 function resolveName(resolver, req, file) {
     return new Promise((resolve, reject) => resolver(req, file, (err, value) => (err ? reject(err) : resolve(value))));
 }
+const STREAM_DESTROYED_MESSAGE = 'File stream was destroyed';
+/**
+ * Rejects once `stream` is destroyed before its end without an error, as
+ * `@fastify/multipart` does when the form is cut off. `pipeline()` never
+ * settles then if the last chunk had already been pushed: it waits for an
+ * 'end' that is never emitted, with the file still open.
+ */
+function rejectWhenCutOff(stream) {
+    return new Promise((_resolve, reject) => stream.once('close', () => {
+        if (!stream.readableEnded && !stream.errored) {
+            reject(new Error(STREAM_DESTROYED_MESSAGE));
+        }
+    }));
+}
 /**
  * Writes each file to disk, with multer's `diskStorage` defaults and file
  * shape (`destination`, `filename`, `path`, `size`).
@@ -30,14 +44,25 @@ export function diskStorage(options = {}) {
     const store = async (req, file) => {
         const destination = await resolveName(resolveDestination, req, file);
         const filename = await resolveName(resolveFilename, req, file);
+        // As in multer, no file is created for a stream destroyed in the meantime.
+        if (file.stream.destroyed) {
+            throw new Error(STREAM_DESTROYED_MESSAGE);
+        }
         const path = join(destination, filename);
         // As in multer, `path` is known to the file before it is written.
         file.path = path;
         const out = createWriteStream(path);
         try {
-            await pipeline(file.stream, out);
+            await Promise.race([
+                pipeline(file.stream, out),
+                rejectWhenCutOff(file.stream),
+            ]);
         }
         catch (err) {
+            // Removed once closed: a file still being opened would be created
+            // after the unlink.
+            out.destroy();
+            await finished(out).catch(() => undefined);
             await unlink(path).catch(() => undefined);
             throw err;
         }

package/multipart/storage/memory.storage.js

@@ -8,12 +8,20 @@ export function memoryStorage() {
     return {
         _handleFile(_req, file, callback) {
             const chunks = [];
-            file.stream.on('data', (chunk) => chunks.push(chunk));
-            file.stream.once('error', callback);
-            file.stream.once('end', () => {
+            const onData = (chunk) => chunks.push(chunk);
+            const onError = (err) => {
+                stopListening();
+                callback(err);
+            };
+            const onEnd = () => {
+                stopListening();
                 const buffer = Buffer.concat(chunks);
                 callback(null, { buffer, size: buffer.length });
-            });
+            };
+            // `@fastify/multipart` keeps every part's stream until the request
+            // ends, and with it these listeners and the chunks they hold.
+            const stopListening = () => file.stream.off('data', onData).off('error', onError).off('end', onEnd);
+            file.stream.on('data', onData).once('error', onError).once('end', onEnd);
         },
         _removeFile(_req, file, callback) {
             delete file.buffer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-fastify",
-  "version": "12.1.3",
+  "version": "12.2.0",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-fastify)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -8,6 +8,7 @@
   "main": "./index.js",
   "exports": {
     ".": "./index.js",
+    "./package.json": "./package.json",
     "./multipart": "./multipart/index.js",
     "./*.js": "./*.js",
     "./*": "./*.js"
@@ -30,9 +31,9 @@
     "@fastify/formbody": "9.0.1",
     "@fastify/middie": "9.3.5",
     "fast-querystring": "1.1.2",
-    "fastify": "5.12.5",
-    "find-my-way": "9.9.0",
-    "light-my-request": "6.6.0",
+    "fastify": "5.12.7",
+    "find-my-way": "9.10.0",
+    "light-my-request": "6.8.0",
     "path-to-regexp": "8.4.2",
     "tslib": "2.8.1"
   },
@@ -54,5 +55,5 @@
       "optional": true
     }
   },
-  "gitHead": "4514623279f6087808e3c8f08fbf9f37d3c17482"
+  "gitHead": "af37111368de7fd2dfab0bdec2f530c7845510c2"
 }