@nifrajs/core 5.0.0 → 5.2.0

package/src/server/edge.ts

@@ -116,7 +116,8 @@ export function toFetchHandler<Env = unknown>(
       const platform: Platform<Env> = { env, waitUntil: (promise) => ctx.waitUntil(promise) }
       // WebSocket broadcast on Workers: route upgrades to the hub Durable Object (it holds the
       // connections + runs the app's pub/sub, so `app.publish` reaches every client). The hub itself
-      // resolves the route and rejects non-WS paths. See `@nifrajs/workers`' `createWebSocketHub`.
+      // resolves the route, and a request that is no handshake for a WebSocket route gets its HTTP
+      // answer there. See `@nifrajs/workers`' `createWebSocketHub`.
       if (
         webSocketHub !== undefined &&
         request.headers.get("upgrade")?.toLowerCase() === "websocket"

package/src/server/headers.ts

@@ -9,3 +9,42 @@ export function headerObjectOf(headers: Headers): Record<string, string> {
   for (const [name, value] of headers) out[name.toLowerCase()] = value
   return out
 }
+
+const HEADER_NAME = /^[\w!#$%&'*+.^`|~-]+$/
+
+/** The parts of a header schema's JSON Schema that decide how the slot reads the request. */
+interface HeaderJsonSchema {
+  readonly type?: unknown
+  readonly additionalProperties?: unknown
+  readonly patternProperties?: unknown
+  readonly properties?: object
+}
+
+/**
+ * The names a closed header schema declares, or `undefined` when it is open or lists no names.
+ * Every client sends headers no route declares (`host`, `user-agent`, `accept`), so a closed schema
+ * fed the whole record would refuse all real traffic; it is fed the names it declares instead,
+ * which is also how OpenAPI publishes it. A name that is not a valid header token is never sent.
+ */
+export function declaredHeaderNames(schema: object): readonly string[] | undefined {
+  const json: HeaderJsonSchema | null | undefined = Reflect.get(schema, "jsonSchema")
+  return json?.type === "object" &&
+    json.additionalProperties === false &&
+    json.patternProperties === undefined &&
+    json.properties
+    ? Object.keys(json.properties).filter((name) => HEADER_NAME.test(name))
+    : undefined
+}
+
+/** The declared headers present on the request, each under the name as declared. */
+export function declaredHeaders(
+  headers: Headers,
+  names: readonly string[],
+): Record<string, string> {
+  const out: Record<string, string> = Object.create(null)
+  for (const name of names) {
+    const value = headers.get(name)
+    if (value !== null) out[name] = value
+  }
+  return out
+}

package/src/server/http.ts

@@ -30,7 +30,13 @@ export function isSameOriginPath(value: string): boolean {
     const code = value.charCodeAt(i)
     if (code === 0x5c /* \ */ || code <= 0x1f || code === 0x7f) return false
   }
-  return true
+  // `/.//host` and `/a/..//host` (or their `%2e` forms) resolve to the path `//host`, which any
+  // relative reference later built from that path - a client router's redirect - reads as a host.
+  // A path-absolute reference against a valid base always parses, so this cannot throw.
+  return (
+    !(value.includes(".") || value.includes("%")) ||
+    !new URL(value, "http://n.invalid").pathname.startsWith("//")
+  )
 }
 
 /**