@nxtedition/nxt-undici 7.3.25 → 7.3.27

package/lib/index.js

@@ -1,3 +1,4 @@
+import net from 'node:net'
 import undici from '@nxtedition/undici'
 import { Scheduler } from '@nxtedition/scheduler'
 import { parseHeaders } from './utils.js'
@@ -33,13 +34,19 @@ function defaultLookup(origin, opts, callback) {
   try {
     if (Array.isArray(origin)) {
       origin = origin[Math.floor(Math.random() * origin.length)]
-    } else if (origin != null && typeof origin === 'object') {
+    }
+
+    // Note: not `else if` — an array element may itself be an object that
+    // still needs normalizing to an origin string.
+    if (origin != null && typeof origin === 'object') {
       const protocol = origin.protocol || 'http:'
 
       let host = origin.host
       if (!host && origin.hostname) {
         const port = origin.port || (protocol === 'https:' ? 443 : 80)
-        host = `${origin.hostname}:${port}`
+        // Bracket IPv6 literals, otherwise `::1:80` is not a valid authority.
+        const hostname = net.isIPv6(origin.hostname) ? `[${origin.hostname}]` : origin.hostname
+        host = `${hostname}:${port}`
       }
 
       if (!host) {
@@ -132,7 +139,12 @@ function wrapDispatch(dispatcher) {
         }
 
         if (globalThis.__nxt_undici_global_headers) {
-          Object.assign(headers, globalThis.__nxt_undici_global_headers)
+          // Run global headers through parseHeaders too, so they share the
+          // pipeline invariant (lowercased names, stringified values) instead
+          // of landing verbatim with mixed-case keys or non-string values.
+          // parseHeaders into a fresh object keeps Object.assign's overwrite
+          // semantics (its two-arg form would append instead).
+          Object.assign(headers, parseHeaders(globalThis.__nxt_undici_global_headers))
         }
 
         return dispatch(
@@ -163,7 +175,14 @@ function wrapDispatch(dispatcher) {
             logger: opts.logger ?? null,
             dns: opts.dns ?? true,
             connect: opts.connect,
-            priority: opts.priority ?? headers['nxt-priority'],
+            // A duplicated nxt-priority request header parses to an array; the
+            // scheduler and PRIORITY_TOS_MAP expect a scalar, so take the last
+            // (last-wins). opts.priority, when set, is already scalar.
+            priority:
+              opts.priority ??
+              (Array.isArray(headers['nxt-priority'])
+                ? headers['nxt-priority'][headers['nxt-priority'].length - 1]
+                : headers['nxt-priority']),
             lookup: opts.lookup ?? defaultLookup,
           },
           handler,

package/lib/interceptor/cache.js

@@ -1,8 +1,8 @@
 import undici from '@nxtedition/undici'
-import { DecoratorHandler, parseCacheControl, parseContentRange } from '../utils.js'
+import { DecoratorHandler, getFastNow, parseCacheControl, parseContentRange } from '../utils.js'
 import { SqliteCacheStore } from '../sqlite-cache-store.js'
 
-const DEFAULT_STORE = new SqliteCacheStore({ location: ':memory:' })
+let DEFAULT_STORE = null
 const DEFAULT_MAX_ENTRY_SIZE = 128 * 1024
 const DEFAULT_MAX_ENTRY_TTL = 30 * 24 * 3600
 const NOOP = () => {}
@@ -40,18 +40,36 @@ class CacheHandler extends DecoratorHandler {
       return super.onHeaders(statusCode, headers, resume)
     }
 
-    if (headers.vary === '*' || headers.trailers) {
+    // 'trailer' is the RFC 9110 field name; 'trailers' is kept for backwards
+    // compatibility with servers that misspell it.
+    if (headers.vary === '*' || headers.trailer || headers.trailers) {
       // Not cacheble...
       return super.onHeaders(statusCode, headers, resume)
     }
 
+    if (headers['set-cookie']) {
+      // Shared cache: replaying Set-Cookie to other clients leaks sessions.
+      return super.onHeaders(statusCode, headers, resume)
+    }
+
     let contentRange
     if (headers['content-range']) {
       contentRange = parseContentRange(headers['content-range'])
-      if (contentRange === null) {
+      if (
+        contentRange == null ||
+        (contentRange.end != null &&
+          (contentRange.end <= contentRange.start ||
+            (contentRange.size != null && contentRange.end > contentRange.size)))
+      ) {
         // We don't support caching responses with invalid content-range...
         return super.onHeaders(statusCode, headers, resume)
       }
+      if (this.#key.method === 'HEAD') {
+        // A HEAD response delivers no body, so we never receive the byte
+        // window Content-Range describes — storing it would fail the store's
+        // body-length validation.
+        return super.onHeaders(statusCode, headers, resume)
+      }
     }
 
     let contentLength
@@ -104,10 +122,16 @@ class CacheHandler extends DecoratorHandler {
       }
 
       for (const key of headers.vary.split(',').map((key) => key.trim().toLowerCase())) {
-        const val = this.#key.headers[key]
-        if (val != null) {
-          vary[key] = this.#key.headers[key]
+        if (key === '*') {
+          // RFC 9111 §4.1: a Vary field containing '*' never matches.
+          return super.onHeaders(statusCode, headers, resume)
         }
+        // Record every selecting header, using a null sentinel when it was
+        // absent from the request. RFC 9111 §4.1: absent-vs-present is a
+        // mismatch, so an empty vary object must NOT act as a wildcard that
+        // matches requests which later supply the header. headerValueEquals
+        // treats null/absent as equal only to another null/absent.
+        vary[key] = this.#key.headers[key] ?? null
       }
     }
 
@@ -118,8 +142,22 @@ class CacheHandler extends DecoratorHandler {
       return super.onHeaders(statusCode, headers, resume)
     }
 
+    // RFC 9111 §4.2.3: a response relayed by an upstream/shared cache may
+    // already be partway through its freshness lifetime. Subtract the
+    // advertised Age so we don't over-extend the TTL and serve stale content.
+    const age = Number(headers.age)
+    const lifetime = Math.min(ttl, this.#maxEntryTTL) - (Number.isFinite(age) && age > 0 ? age : 0)
+    if (lifetime <= 0) {
+      // Already stale on arrival — not worth caching.
+      return super.onHeaders(statusCode, headers, resume)
+    }
+
     const start = contentRange ? contentRange.start : 0
-    const end = contentRange ? contentRange.end : contentLength
+    // HEAD never delivers a body, so a Content-Length must not drive the
+    // stored byte window (end). Storing end = contentLength with an empty body
+    // would fail the store's body-length validation and emit error-level log
+    // spam on every cacheable HEAD response.
+    const end = contentRange ? contentRange.end : this.#key.method === 'HEAD' ? 0 : contentLength
 
     if (end == null || end - start <= this.#maxEntrySize) {
       const cachedAt = Date.now()
@@ -127,7 +165,7 @@ class CacheHandler extends DecoratorHandler {
         body: [],
         start,
         end,
-        deleteAt: cachedAt + Math.min(ttl, this.#maxEntryTTL) * 1e3,
+        deleteAt: cachedAt + lifetime * 1e3,
         statusCode,
         statusMessage: '',
         headers,
@@ -202,23 +240,46 @@ export default () => (dispatch) => (opts, handler) => {
   }
 
   if (
-    cacheControlDirectives['max-age'] ||
-    cacheControlDirectives['max-stale'] ||
-    cacheControlDirectives['min-fresh'] ||
+    // != null: 'max-age=0' parses to 0 (falsy) but still demands revalidation.
+    cacheControlDirectives['max-age'] != null ||
     cacheControlDirectives['no-cache'] ||
-    cacheControlDirectives['stale-if-error']
+    cacheControlDirectives['stale-if-error'] != null ||
+    // cache-control-parser does not recognise 'max-stale'/'min-fresh', so
+    // check the raw string like we do for 'only-if-cached'.
+    (typeof rawCacheControl === 'string' &&
+      (rawCacheControl.includes('max-stale') || rawCacheControl.includes('min-fresh')))
   ) {
     // TODO (fix): Support all cache control directives...
     return dispatch(opts, handler)
   }
 
-  const store = opts.cache.store ?? DEFAULT_STORE
+  const store =
+    opts.cache.store ?? (DEFAULT_STORE ??= new SqliteCacheStore({ location: ':memory:' }))
 
   // TODO (fix): enable range requests
 
+  // Build the key the same way for lookups and stores: makeCacheKey
+  // stringifies the origin (e.g. URL objects), so using raw opts on the get
+  // path while the set path normalizes would make the cache permanently miss.
+  const key = undici.util.cache.makeCacheKey(opts)
+
+  // makeCacheKey preserves request header names verbatim. Vary selector names
+  // are lowercased (in onHeaders and matchesValue), so lowercase the key's
+  // header names once here — the same key feeds both the get and set paths, so
+  // this keeps Vary matching symmetric even when a caller supplies non-lowercase
+  // header names (the standalone interceptors.cache() composition; the wrapped
+  // pipeline already normalizes). A fresh object avoids mutating opts.headers.
+  if (key.headers && typeof key.headers === 'object') {
+    const lower = {}
+    for (const name in key.headers) {
+      lower[name.toLowerCase()] = key.headers[name]
+    }
+    key.headers = lower
+  }
+
   let entry
   try {
-    entry = store.get(opts)
+    entry = store.get(key)
   } catch (err) {
     if (err.message === 'database is locked') {
       // Database is busy. We don't bother trying again...
@@ -235,16 +296,34 @@ export default () => (dispatch) => (opts, handler) => {
   }
 
   // RFC 9110 Section 13: Evaluate conditional request headers against cached entry.
+  // typeof guards: duplicated conditional headers arrive as arrays — treat
+  // them as non-matching and bypass to origin rather than crashing.
   if (entry && opts.headers?.['if-none-match']) {
-    if (entry.etag && weakMatch(opts.headers['if-none-match'], entry.etag)) {
-      return serveFromCache({ statusCode: 304, headers: entry.headers }, opts, handler)
+    if (
+      typeof opts.headers['if-none-match'] === 'string' &&
+      entry.etag &&
+      weakMatch(opts.headers['if-none-match'], entry.etag)
+    ) {
+      return serveFromCache(
+        { statusCode: 304, headers: entry.headers, cachedAt: entry.cachedAt },
+        opts,
+        handler,
+      )
     }
     // Etag didn't match — bypass to origin.
     entry = undefined
   } else if (entry && opts.headers?.['if-modified-since']) {
     const lastModified = entry.headers?.['last-modified']
-    if (lastModified && new Date(lastModified) <= new Date(opts.headers['if-modified-since'])) {
-      return serveFromCache({ statusCode: 304, headers: entry.headers }, opts, handler)
+    if (
+      typeof opts.headers['if-modified-since'] === 'string' &&
+      lastModified &&
+      new Date(lastModified) <= new Date(opts.headers['if-modified-since'])
+    ) {
+      return serveFromCache(
+        { statusCode: 304, headers: entry.headers, cachedAt: entry.cachedAt },
+        opts,
+        handler,
+      )
     }
     // No last-modified or modified since — bypass to origin.
     entry = undefined
@@ -264,7 +343,7 @@ export default () => (dispatch) => (opts, handler) => {
       opts,
       cacheControlDirectives['no-store']
         ? handler
-        : new CacheHandler(undici.util.cache.makeCacheKey(opts), {
+        : new CacheHandler(key, {
             maxEntrySize: opts.cache.maxEntrySize,
             maxEntryTTL: opts.cache.maxEntryTTL,
             store,
@@ -278,11 +357,30 @@ export default () => (dispatch) => (opts, handler) => {
 }
 
 function serveFromCache(entry, opts, handler) {
-  const { statusCode, headers, trailers, body } = entry
+  const { statusCode, trailers, body } = entry
+
+  let headers = entry.headers
+  if (entry.cachedAt != null) {
+    // RFC 9111 §5.1: every response served from cache must carry an Age header
+    // reflecting time spent in this cache plus any age it arrived with —
+    // otherwise downstream caches treat it as fresh-from-origin.
+    // getFastNow has 1s resolution — Age is whole seconds, so that's enough.
+    const residentAge = Math.max(0, Math.floor((getFastNow() - entry.cachedAt) / 1000))
+    const originAge = Number(headers?.age)
+    const age = Number.isFinite(originAge) && originAge > 0 ? originAge + residentAge : residentAge
+    headers = { ...headers, age: `${age}` }
+  }
 
+  // serveFromCache drives the raw user handler directly (no DecoratorHandler),
+  // so it must enforce the contract itself: onError is terminal and mutually
+  // exclusive with onComplete. The `completed` guard makes a late abort() a
+  // no-op, and onComplete runs outside the try so a throw from the user's
+  // terminal callback propagates instead of being converted into a second
+  // (post-complete) onError.
   let aborted = false
+  let completed = false
   const abort = (reason) => {
-    if (!aborted) {
+    if (!aborted && !completed) {
       aborted = true
       handler.onError(reason)
     }
@@ -308,11 +406,13 @@ function serveFromCache(entry, opts, handler) {
         return
       }
     }
-
-    handler.onComplete(trailers ?? {})
   } catch (err) {
     abort(err)
+    return
   }
+
+  completed = true
+  handler.onComplete(trailers ?? {})
 }
 
 /**

package/lib/interceptor/dns.js

@@ -30,10 +30,29 @@ class Handler extends DecoratorHandler {
   }
 }
 
+const SWEEP_INTERVAL = 30e3
+
 export default () => (dispatch) => {
   const cache = new Map()
   const promises = new Map()
 
+  // The `cache` Map is otherwise only ever written, never trimmed, so a process
+  // touching many distinct hostnames over its lifetime would leak entries that
+  // can never be selected again. Sweep dead entries (all records expired and
+  // none in flight) at most once per SWEEP_INTERVAL to bound the O(n) cost.
+  let lastSweep = 0
+  function sweep(now) {
+    if (now - lastSweep < SWEEP_INTERVAL) {
+      return
+    }
+    lastSweep = now
+    for (const [hostname, records] of cache) {
+      if (records.every((x) => x.expires < now && x.pending === 0)) {
+        cache.delete(hostname)
+      }
+    }
+  }
+
   function resolve(hostname, { ttl }) {
     let promise = promises.get(hostname)
     if (!promise) {
@@ -84,6 +103,8 @@ export default () => (dispatch) => {
 
       const now = getFastNow()
 
+      sweep(now)
+
       let records = cache.get(hostname)
 
       if (records == null || records.every((x) => x.expires < now)) {
@@ -144,18 +165,33 @@ export default () => (dispatch) => {
       record.counter++
       record.pending++
 
-      return dispatch(
-        { ...opts, origin: url.origin, headers: { ...opts.headers, host } },
-        new Handler(handler, (err, statusCode) => {
-          record.pending--
+      // Guarded so it runs exactly once: on the normal Handler callback, or
+      // if dispatch throws synchronously (otherwise record.pending would leak
+      // and skew load balancing toward the wrongly-busy record).
+      let settled = false
+      const onSettle = (err, statusCode) => {
+        if (settled) {
+          return
+        }
+        settled = true
+        record.pending--
 
-          if (err != null && err.name !== 'AbortError') {
-            record.expires = 0
-          } else if (statusCode != null && statusCode >= 500) {
-            record.errored++
-          }
-        }),
-      )
+        if (err != null && err.name !== 'AbortError') {
+          record.expires = 0
+        } else if (statusCode != null && statusCode >= 500) {
+          record.errored++
+        }
+      }
+
+      try {
+        return dispatch(
+          { ...opts, origin: url.origin, headers: { ...opts.headers, host } },
+          new Handler(handler, onSettle),
+        )
+      } catch (err) {
+        onSettle(err)
+        throw err
+      }
     } catch (err) {
       handler.onError(err)
     }

package/lib/interceptor/lookup.js

@@ -1,3 +1,5 @@
+import { DecoratorHandler } from '../utils.js'
+
 export default () => (dispatch) => async (opts, handler) => {
   const lookup = opts.lookup
 
@@ -5,6 +7,12 @@ export default () => (dispatch) => async (opts, handler) => {
     return dispatch(opts, handler)
   }
 
+  // Wrap so the catch below can't deliver a second onError: if a downstream
+  // layer already reported a terminal callback and then let an error escape
+  // dispatch synchronously, DecoratorHandler's #errored/#completed guards
+  // absorb the duplicate instead of violating the once-only onError contract.
+  const wrapped = new DecoratorHandler(handler)
+
   try {
     const origin = await new Promise((resolve, reject) => {
       const thenable = lookup(opts.origin, { signal: opts.signal ?? undefined }, (err, val) => {
@@ -24,8 +32,8 @@ export default () => (dispatch) => async (opts, handler) => {
       throw new Error('invalid origin: ' + origin)
     }
 
-    return dispatch({ ...opts, origin }, handler)
+    return dispatch({ ...opts, origin }, wrapped)
   } catch (err) {
-    handler.onError(err)
+    wrapped.onError(err)
   }
 }

package/lib/interceptor/priority.js

@@ -3,10 +3,12 @@ import { DecoratorHandler } from '../utils.js'
 
 class Handler extends DecoratorHandler {
   #scheduler
+  #onIdle
 
-  constructor(handler, scheduler) {
+  constructor(handler, scheduler, onIdle) {
     super(handler)
     this.#scheduler = scheduler
+    this.#onIdle = onIdle
   }
 
   onConnect(abort) {
@@ -29,6 +31,7 @@ class Handler extends DecoratorHandler {
       const scheduler = this.#scheduler
       this.#scheduler = null
       scheduler.release()
+      this.#onIdle?.()
     }
   }
 }
@@ -41,13 +44,29 @@ export default () => (dispatch) => {
       return dispatch(opts, handler)
     }
 
-    let scheduler = schedulers.get(opts.origin)
+    // Key on the logical origin, not opts.origin: an outer dns interceptor
+    // rewrites opts.origin to a rotating resolved IP, which would scatter one
+    // logical host across many schedulers and silently defeat the per-origin
+    // concurrency limit. dns preserves the logical host in the `host` header.
+    const key = (typeof opts.headers?.host === 'string' && opts.headers.host) || opts.origin
+
+    let scheduler = schedulers.get(key)
     if (!scheduler) {
       scheduler = new Scheduler({ concurrency: 1 })
-      schedulers.set(opts.origin, scheduler)
+      schedulers.set(key, scheduler)
+    }
+
+    // Evict a scheduler once it has fully drained, so a client touching many
+    // distinct origins doesn't accumulate them forever. The `=== scheduler`
+    // guard avoids deleting a freshly-created replacement; release() drains
+    // pending synchronously, so running===0 && pending===0 here means idle.
+    const onIdle = () => {
+      if (schedulers.get(key) === scheduler && scheduler.running === 0 && scheduler.pending === 0) {
+        schedulers.delete(key)
+      }
     }
 
-    const priorityHandler = new Handler(handler, scheduler)
+    const priorityHandler = new Handler(handler, scheduler, onIdle)
     scheduler.acquire(
       (priorityHandler) => {
         try {