@orpc/server 0.0.0-next.350a165 → 0.0.0-next.35fabdb

package/dist/plugins/index.mjs

@@ -1,5 +1,10 @@
-import { value } from '@orpc/shared';
+import { runWithSpan, value, setSpanError, isAsyncIteratorObject, clone } from '@orpc/shared';
+import { flattenHeader } from '@orpc/standard-server';
 import { parseBatchRequest, toBatchResponse } from '@orpc/standard-server/batch';
+import { toFetchHeaders } from '@orpc/standard-server-fetch';
+import { ORPCError } from '@orpc/client';
+export { S as StrictGetMethodPlugin } from '../shared/server.BW-nUGgA.mjs';
+import '@orpc/contract';
 
 class BatchHandlerPlugin {
   maxSize;
@@ -22,61 +27,80 @@ class BatchHandlerPlugin {
   init(options) {
     options.rootInterceptors ??= [];
     options.rootInterceptors.unshift(async (options2) => {
-      if (options2.request.headers["x-orpc-batch"] !== "1") {
+      const xHeader = flattenHeader(options2.request.headers["x-orpc-batch"]);
+      if (xHeader === void 0) {
         return options2.next();
       }
       let isParsing = false;
       try {
-        isParsing = true;
-        const parsed = parseBatchRequest({ ...options2.request, body: await options2.request.body() });
-        isParsing = false;
-        const maxSize = await value(this.maxSize, options2);
-        if (parsed.length > maxSize) {
-          return {
-            matched: true,
-            response: {
-              status: 413,
-              headers: {},
-              body: "Batch request size exceeds the maximum allowed size"
-            }
-          };
-        }
-        const responses = parsed.map(
-          (request, index) => {
-            const mapped = this.mapRequestItem(request, options2);
-            return options2.next({ ...options2, request: { ...mapped, body: () => Promise.resolve(mapped.body) } }).then(({ response: response2, matched }) => {
-              if (matched) {
-                return { ...response2, index };
+        return await runWithSpan({ name: "handle_batch_request" }, async (span) => {
+          const mode = xHeader === "buffered" ? "buffered" : "streaming";
+          isParsing = true;
+          const parsed = parseBatchRequest({ ...options2.request, body: await options2.request.body() });
+          isParsing = false;
+          span?.setAttribute("batch.mode", mode);
+          span?.setAttribute("batch.size", parsed.length);
+          const maxSize = await value(this.maxSize, options2);
+          if (parsed.length > maxSize) {
+            const message = "Batch request size exceeds the maximum allowed size";
+            setSpanError(span, message);
+            return {
+              matched: true,
+              response: {
+                status: 413,
+                headers: {},
+                body: message
               }
-              return { index, status: 404, headers: {}, body: "No procedure matched" };
-            }).catch(() => {
-              return { index, status: 500, headers: {}, body: "Internal server error" };
-            });
+            };
           }
-        );
-        await Promise.race(responses);
-        const status = await value(this.successStatus, responses, options2);
-        const headers = await value(this.headers, responses, options2);
-        const response = toBatchResponse({
-          status,
-          headers,
-          body: async function* () {
-            const promises = [...responses];
-            while (true) {
-              const handling = promises.filter((p) => p !== void 0);
-              if (handling.length === 0) {
-                return;
-              }
-              const result = await Promise.race(handling);
-              promises[result.index] = void 0;
-              yield result;
+          const responses = parsed.map(
+            (request, index) => {
+              const mapped = this.mapRequestItem(request, options2);
+              return options2.next({ ...options2, request: { ...mapped, body: () => Promise.resolve(mapped.body) } }).then(({ response: response2, matched }) => {
+                span?.addEvent(`response.${index}.${matched ? "success" : "not_matched"}`);
+                if (matched) {
+                  if (response2.body instanceof Blob || response2.body instanceof FormData || isAsyncIteratorObject(response2.body)) {
+                    return {
+                      index,
+                      status: 500,
+                      headers: {},
+                      body: "Batch responses do not support file/blob, or event-iterator. Please call this procedure separately outside of the batch request."
+                    };
+                  }
+                  return { ...response2, index };
+                }
+                return { index, status: 404, headers: {}, body: "No procedure matched" };
+              }).catch((err) => {
+                Promise.reject(err);
+                return { index, status: 500, headers: {}, body: "Internal server error" };
+              });
             }
-          }()
+          );
+          await Promise.race(responses);
+          const status = await value(this.successStatus, responses, options2);
+          const headers = await value(this.headers, responses, options2);
+          const response = await toBatchResponse({
+            status,
+            headers,
+            mode,
+            body: (async function* () {
+              const promises = [...responses];
+              while (true) {
+                const handling = promises.filter((p) => p !== void 0);
+                if (handling.length === 0) {
+                  return;
+                }
+                const result = await Promise.race(handling);
+                promises[result.index] = void 0;
+                yield result;
+              }
+            })()
+          });
+          return {
+            matched: true,
+            response
+          };
         });
-        return {
-          matched: true,
-          response
-        };
       } catch (cause) {
         if (isParsing) {
           return {
@@ -112,13 +136,11 @@ class CORSPlugin {
           resHeaders["access-control-max-age"] = this.options.maxAge.toString();
         }
         if (this.options.allowMethods?.length) {
-          resHeaders["access-control-allow-methods"] = this.options.allowMethods.join(",");
+          resHeaders["access-control-allow-methods"] = flattenHeader(this.options.allowMethods);
         }
         const allowHeaders = this.options.allowHeaders ?? interceptorOptions.request.headers["access-control-request-headers"];
-        if (Array.isArray(allowHeaders) && allowHeaders.length) {
-          resHeaders["access-control-allow-headers"] = allowHeaders.join(",");
-        } else if (typeof allowHeaders === "string") {
-          resHeaders["access-control-allow-headers"] = allowHeaders;
+        if (typeof allowHeaders === "string" || allowHeaders?.length) {
+          resHeaders["access-control-allow-headers"] = flattenHeader(allowHeaders);
         }
         return {
           matched: true,
@@ -136,7 +158,7 @@ class CORSPlugin {
       if (!result.matched) {
         return result;
       }
-      const origin = Array.isArray(interceptorOptions.request.headers.origin) ? interceptorOptions.request.headers.origin.join(",") : interceptorOptions.request.headers.origin || "";
+      const origin = flattenHeader(interceptorOptions.request.headers.origin) ?? "";
       const allowedOrigin = await value(this.options.origin, origin, interceptorOptions);
       const allowedOriginArr = Array.isArray(allowedOrigin) ? allowedOrigin : [allowedOrigin];
       if (allowedOriginArr.includes("*")) {
@@ -158,13 +180,29 @@ class CORSPlugin {
         result.response.headers["access-control-allow-credentials"] = "true";
       }
       if (this.options.exposeHeaders?.length) {
-        result.response.headers["access-control-expose-headers"] = this.options.exposeHeaders.join(",");
+        result.response.headers["access-control-expose-headers"] = flattenHeader(this.options.exposeHeaders);
       }
       return result;
     });
   }
 }
 
+class RequestHeadersPlugin {
+  init(options) {
+    options.rootInterceptors ??= [];
+    options.rootInterceptors.push((interceptorOptions) => {
+      const reqHeaders = interceptorOptions.context.reqHeaders ?? toFetchHeaders(interceptorOptions.request.headers);
+      return interceptorOptions.next({
+        ...interceptorOptions,
+        context: {
+          ...interceptorOptions.context,
+          reqHeaders
+        }
+      });
+    });
+  }
+}
+
 class ResponseHeadersPlugin {
   init(options) {
     options.rootInterceptors ??= [];
@@ -180,7 +218,7 @@ class ResponseHeadersPlugin {
       if (!result.matched) {
         return result;
       }
-      const responseHeaders = result.response.headers;
+      const responseHeaders = clone(result.response.headers);
       for (const [key, value] of resHeaders) {
         if (Array.isArray(responseHeaders[key])) {
           responseHeaders[key].push(value);
@@ -190,9 +228,58 @@ class ResponseHeadersPlugin {
           responseHeaders[key] = value;
         }
       }
-      return result;
+      return {
+        ...result,
+        response: {
+          ...result.response,
+          headers: responseHeaders
+        }
+      };
+    });
+  }
+}
+
+const SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL = Symbol("SIMPLE_CSRF_PROTECTION_CONTEXT");
+class SimpleCsrfProtectionHandlerPlugin {
+  headerName;
+  headerValue;
+  exclude;
+  error;
+  constructor(options = {}) {
+    this.headerName = options.headerName ?? "x-csrf-token";
+    this.headerValue = options.headerValue ?? "orpc";
+    this.exclude = options.exclude ?? false;
+    this.error = options.error ?? new ORPCError("CSRF_TOKEN_MISMATCH", {
+      status: 403,
+      message: "Invalid CSRF token"
+    });
+  }
+  order = 8e6;
+  init(options) {
+    options.rootInterceptors ??= [];
+    options.clientInterceptors ??= [];
+    options.rootInterceptors.unshift(async (options2) => {
+      const headerName = await value(this.headerName, options2);
+      const headerValue = await value(this.headerValue, options2);
+      return options2.next({
+        ...options2,
+        context: {
+          ...options2.context,
+          [SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]: options2.request.headers[headerName] === headerValue
+        }
+      });
+    });
+    options.clientInterceptors.unshift(async (options2) => {
+      if (typeof options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL] !== "boolean") {
+        throw new TypeError("[SimpleCsrfProtectionHandlerPlugin] CSRF protection context has been corrupted or modified by another plugin or interceptor");
+      }
+      const excluded = await value(this.exclude, options2);
+      if (!excluded && !options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]) {
+        throw this.error;
+      }
+      return options2.next();
     });
   }
 }
 
-export { BatchHandlerPlugin, CORSPlugin, ResponseHeadersPlugin };
+export { BatchHandlerPlugin, CORSPlugin, RequestHeadersPlugin, ResponseHeadersPlugin, SimpleCsrfProtectionHandlerPlugin };

package/dist/shared/{server.C37gDhSZ.mjs → server.7jWaIryJ.mjs}

@@ -1,6 +1,7 @@
 import { isContractProcedure, ValidationError, mergePrefix, mergeErrorMap, enhanceRoute } from '@orpc/contract';
-import { fallbackORPCErrorStatus, ORPCError } from '@orpc/client';
-import { value, intercept } from '@orpc/shared';
+import { resolveMaybeOptionalOptions, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, asyncIteratorWithSpan } from '@orpc/shared';
+import { ORPCError, fallbackORPCErrorStatus, mapEventIterator } from '@orpc/client';
+import { HibernationEventIterator } from '@orpc/standard-server';
 
 const LAZY_SYMBOL = Symbol("ORPC_LAZY_SYMBOL");
 function lazy(loader, meta = {}) {
@@ -46,6 +47,9 @@ function addMiddleware(middlewares, addition) {
 }
 
 class Procedure {
+  /**
+   * This property holds the defined options.
+   */
   "~orpc";
   constructor(def) {
     this["~orpc"] = def;
@@ -68,14 +72,15 @@ function createORPCErrorConstructorMap(errors) {
       if (typeof code !== "string") {
         return Reflect.get(target, code);
       }
-      const item = (...[options]) => {
+      const item = (...rest) => {
+        const options = resolveMaybeOptionalOptions(rest);
         const config = errors[code];
         return new ORPCError(code, {
           defined: Boolean(config),
           status: config?.status,
-          message: options?.message ?? config?.message,
-          data: options?.data,
-          cause: options?.cause
+          message: options.message ?? config?.message,
+          data: options.data,
+          cause: options.cause
         });
       };
       return item;
@@ -103,34 +108,59 @@ function middlewareOutputFn(output) {
   return { output, context: {} };
 }
 
-function createProcedureClient(lazyableProcedure, ...[options]) {
+function createProcedureClient(lazyableProcedure, ...rest) {
+  const options = resolveMaybeOptionalOptions(rest);
   return async (...[input, callerOptions]) => {
-    const path = options?.path ?? [];
+    const path = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
-    const context = await value(options?.context ?? {}, clientContext);
+    const context = await value(options.context ?? {}, clientContext);
     const errors = createORPCErrorConstructorMap(procedure["~orpc"].errorMap);
+    const validateError = async (e) => {
+      if (e instanceof ORPCError) {
+        return await validateORPCError(procedure["~orpc"].errorMap, e);
+      }
+      return e;
+    };
     try {
-      return await intercept(
-        options?.interceptors ?? [],
-        {
-          context,
-          input,
-          // input only optional when it undefinable so we can safely cast it
-          errors,
-          path,
-          procedure,
-          signal: callerOptions?.signal,
-          lastEventId: callerOptions?.lastEventId
-        },
-        (interceptorOptions) => executeProcedureInternal(interceptorOptions.procedure, interceptorOptions)
+      const output = await runWithSpan(
+        { name: "call_procedure", signal: callerOptions?.signal },
+        (span) => {
+          span?.setAttribute("procedure.path", [...path]);
+          return intercept(
+            toArray(options.interceptors),
+            {
+              context,
+              input,
+              // input only optional when it undefinable so we can safely cast it
+              errors,
+              path,
+              procedure,
+              signal: callerOptions?.signal,
+              lastEventId: callerOptions?.lastEventId
+            },
+            (interceptorOptions) => executeProcedureInternal(interceptorOptions.procedure, interceptorOptions)
+          );
+        }
       );
-    } catch (e) {
-      if (!(e instanceof ORPCError)) {
-        throw e;
+      if (isAsyncIteratorObject(output)) {
+        if (output instanceof HibernationEventIterator) {
+          return output;
+        }
+        return mapEventIterator(
+          asyncIteratorWithSpan(
+            { name: "consume_event_iterator_output", signal: callerOptions?.signal },
+            output
+          ),
+          {
+            value: (v) => v,
+            error: (e) => validateError(e)
+          }
+        );
       }
-      const validated = await validateORPCError(procedure["~orpc"].errorMap, e);
-      throw validated;
+      return output;
+    } catch (e) {
+      throw await validateError(e);
     }
   };
 }
@@ -139,31 +169,41 @@ async function validateInput(procedure, input) {
   if (!schema) {
     return input;
   }
-  const result = await schema["~standard"].validate(input);
-  if (result.issues) {
-    throw new ORPCError("BAD_REQUEST", {
-      message: "Input validation failed",
-      data: {
-        issues: result.issues
-      },
-      cause: new ValidationError({ message: "Input validation failed", issues: result.issues })
-    });
-  }
-  return result.value;
+  return runWithSpan(
+    { name: "validate_input" },
+    async () => {
+      const result = await schema["~standard"].validate(input);
+      if (result.issues) {
+        throw new ORPCError("BAD_REQUEST", {
+          message: "Input validation failed",
+          data: {
+            issues: result.issues
+          },
+          cause: new ValidationError({ message: "Input validation failed", issues: result.issues })
+        });
+      }
+      return result.value;
+    }
+  );
 }
 async function validateOutput(procedure, output) {
   const schema = procedure["~orpc"].outputSchema;
   if (!schema) {
     return output;
   }
-  const result = await schema["~standard"].validate(output);
-  if (result.issues) {
-    throw new ORPCError("INTERNAL_SERVER_ERROR", {
-      message: "Output validation failed",
-      cause: new ValidationError({ message: "Output validation failed", issues: result.issues })
-    });
-  }
-  return result.value;
+  return runWithSpan(
+    { name: "validate_output" },
+    async () => {
+      const result = await schema["~standard"].validate(output);
+      if (result.issues) {
+        throw new ORPCError("INTERNAL_SERVER_ERROR", {
+          message: "Output validation failed",
+          cause: new ValidationError({ message: "Output validation failed", issues: result.issues })
+        });
+      }
+      return result.value;
+    }
+  );
 }
 async function executeProcedureInternal(procedure, options) {
   const middlewares = procedure["~orpc"].middlewares;
@@ -175,17 +215,28 @@ async function executeProcedureInternal(procedure, options) {
       currentInput = await validateInput(procedure, currentInput);
     }
     const mid = middlewares[index];
-    const output = mid ? (await mid({
-      ...options,
-      context,
-      next: async (...[nextOptions]) => {
-        const nextContext = nextOptions?.context ?? {};
-        return {
-          output: await next(index + 1, mergeCurrentContext(context, nextContext), currentInput),
-          context: nextContext
-        };
+    const output = mid ? await runWithSpan(
+      { name: `middleware.${mid.name}`, signal: options.signal },
+      async (span) => {
+        span?.setAttribute("middleware.index", index);
+        span?.setAttribute("middleware.name", mid.name);
+        const result = await mid({
+          ...options,
+          context,
+          next: async (...[nextOptions]) => {
+            const nextContext = nextOptions?.context ?? {};
+            return {
+              output: await next(index + 1, mergeCurrentContext(context, nextContext), currentInput),
+              context: nextContext
+            };
+          }
+        }, currentInput, middlewareOutputFn);
+        return result.output;
       }
-    }, currentInput, middlewareOutputFn)).output : await procedure["~orpc"].handler({ ...options, context, input: currentInput });
+    ) : await runWithSpan(
+      { name: "handler", signal: options.signal },
+      () => procedure["~orpc"].handler({ ...options, context, input: currentInput })
+    );
     if (index === outputValidationIndex) {
       return await validateOutput(procedure, output);
     }
@@ -358,7 +409,8 @@ function createContractedProcedure(procedure, contract) {
   });
 }
 function call(procedure, input, ...rest) {
-  return createProcedureClient(procedure, ...rest)(input);
+  const options = resolveMaybeOptionalOptions(rest);
+  return createProcedureClient(procedure, options)(input, options);
 }
 
 export { LAZY_SYMBOL as L, Procedure as P, createContractedProcedure as a, addMiddleware as b, createProcedureClient as c, isLazy as d, enhanceRouter as e, createAssertedLazyProcedure as f, getRouter as g, createORPCErrorConstructorMap as h, isProcedure as i, getLazyMeta as j, middlewareOutputFn as k, lazy as l, mergeCurrentContext as m, isStartWithMiddlewares as n, mergeMiddlewares as o, call as p, getHiddenRouterContract as q, createAccessibleLazyRouter as r, setHiddenRouterContract as s, traverseContractProcedures as t, unlazy as u, validateORPCError as v, resolveContractProcedures as w, unlazyRouter as x };

package/dist/shared/server.B7b2w3_i.d.ts

@@ -0,0 +1,12 @@
+import { C as Context } from './server.CYNGeoCm.js';
+import { b as StandardHandleOptions } from './server.Bmh5xd4n.js';
+
+type FriendlyStandardHandleOptions<T extends Context> = Omit<StandardHandleOptions<T>, 'context'> & (Record<never, never> extends T ? {
+    context?: T;
+} : {
+    context: T;
+});
+declare function resolveFriendlyStandardHandleOptions<T extends Context>(options: FriendlyStandardHandleOptions<T>): StandardHandleOptions<T>;
+
+export { resolveFriendlyStandardHandleOptions as r };
+export type { FriendlyStandardHandleOptions as F };

package/dist/shared/server.BEFBl-Cb.d.mts

@@ -0,0 +1,12 @@
+import { C as Context } from './server.CYNGeoCm.mjs';
+import { b as StandardHandleOptions } from './server.gqRxT-yN.mjs';
+
+type FriendlyStandardHandleOptions<T extends Context> = Omit<StandardHandleOptions<T>, 'context'> & (Record<never, never> extends T ? {
+    context?: T;
+} : {
+    context: T;
+});
+declare function resolveFriendlyStandardHandleOptions<T extends Context>(options: FriendlyStandardHandleOptions<T>): StandardHandleOptions<T>;
+
+export { resolveFriendlyStandardHandleOptions as r };
+export type { FriendlyStandardHandleOptions as F };