@orpc/server 0.0.0-next.68378b4 → 0.0.0-next.683f2ee

package/dist/plugins/index.mjs

@@ -1,9 +1,125 @@
-export { C as CompositePlugin } from '../shared/server.Q6ZmnTgO.mjs';
-import { value } from '@orpc/shared';
+import { runWithSpan, value, setSpanError, isAsyncIteratorObject, AsyncIteratorClass, clone } from '@orpc/shared';
+import { flattenHeader } from '@orpc/standard-server';
+import { parseBatchRequest, toBatchResponse } from '@orpc/standard-server/batch';
+import { toFetchHeaders } from '@orpc/standard-server-fetch';
+import { ORPCError } from '@orpc/client';
+export { S as StrictGetMethodPlugin } from '../shared/server.TEVCLCFC.mjs';
+import '@orpc/contract';
+
+class BatchHandlerPlugin {
+  maxSize;
+  mapRequestItem;
+  successStatus;
+  headers;
+  order = 5e6;
+  constructor(options = {}) {
+    this.maxSize = options.maxSize ?? 10;
+    this.mapRequestItem = options.mapRequestItem ?? ((request, { request: batchRequest }) => ({
+      ...request,
+      headers: {
+        ...batchRequest.headers,
+        ...request.headers
+      }
+    }));
+    this.successStatus = options.successStatus ?? 207;
+    this.headers = options.headers ?? {};
+  }
+  init(options) {
+    options.rootInterceptors ??= [];
+    options.rootInterceptors.unshift(async (options2) => {
+      const xHeader = flattenHeader(options2.request.headers["x-orpc-batch"]);
+      if (xHeader === void 0) {
+        return options2.next();
+      }
+      let isParsing = false;
+      try {
+        return await runWithSpan({ name: "handle_batch_request" }, async (span) => {
+          const mode = xHeader === "buffered" ? "buffered" : "streaming";
+          isParsing = true;
+          const parsed = parseBatchRequest({ ...options2.request, body: await options2.request.body() });
+          isParsing = false;
+          span?.setAttribute("batch.mode", mode);
+          span?.setAttribute("batch.size", parsed.length);
+          const maxSize = await value(this.maxSize, options2);
+          if (parsed.length > maxSize) {
+            const message = "Batch request size exceeds the maximum allowed size";
+            setSpanError(span, message);
+            return {
+              matched: true,
+              response: {
+                status: 413,
+                headers: {},
+                body: message
+              }
+            };
+          }
+          const responses = parsed.map(
+            (request, index) => {
+              const mapped = this.mapRequestItem(request, options2);
+              return options2.next({ ...options2, request: { ...mapped, body: () => Promise.resolve(mapped.body) } }).then(({ response: response2, matched }) => {
+                span?.addEvent(`response.${index}.${matched ? "success" : "not_matched"}`);
+                if (matched) {
+                  if (response2.body instanceof Blob || response2.body instanceof FormData || isAsyncIteratorObject(response2.body)) {
+                    return {
+                      index,
+                      status: 500,
+                      headers: {},
+                      body: "Batch responses do not support file/blob, or event-iterator. Please call this procedure separately outside of the batch request."
+                    };
+                  }
+                  return { ...response2, index };
+                }
+                return { index, status: 404, headers: {}, body: "No procedure matched" };
+              }).catch((err) => {
+                Promise.reject(err);
+                return { index, status: 500, headers: {}, body: "Internal server error" };
+              });
+            }
+          );
+          await Promise.race(responses);
+          const status = await value(this.successStatus, responses, options2);
+          const headers = await value(this.headers, responses, options2);
+          const promises = [...responses];
+          const response = await toBatchResponse({
+            status,
+            headers,
+            mode,
+            body: new AsyncIteratorClass(
+              async () => {
+                const handling = promises.filter((p) => p !== void 0);
+                if (handling.length <= 0) {
+                  return { done: true, value: void 0 };
+                }
+                const value2 = await Promise.race(handling);
+                promises[value2.index] = void 0;
+                return { done: false, value: value2 };
+              },
+              async () => {
+              }
+            )
+          });
+          return {
+            matched: true,
+            response
+          };
+        });
+      } catch (cause) {
+        if (isParsing) {
+          return {
+            matched: true,
+            response: { status: 400, headers: {}, body: "Invalid batch request, this could be caused by a malformed request body or a missing header" }
+          };
+        }
+        throw cause;
+      }
+    });
+  }
+}
 
 class CORSPlugin {
   options;
-  constructor(options) {
+  order = 9e6;
+  constructor(options = {}) {
     const defaults = {
       origin: (origin) => origin,
       allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"]
@@ -22,13 +138,11 @@ class CORSPlugin {
           resHeaders["access-control-max-age"] = this.options.maxAge.toString();
         }
         if (this.options.allowMethods?.length) {
-          resHeaders["access-control-allow-methods"] = this.options.allowMethods.join(",");
+          resHeaders["access-control-allow-methods"] = flattenHeader(this.options.allowMethods);
         }
         const allowHeaders = this.options.allowHeaders ?? interceptorOptions.request.headers["access-control-request-headers"];
-        if (Array.isArray(allowHeaders) && allowHeaders.length) {
-          resHeaders["access-control-allow-headers"] = allowHeaders.join(",");
-        } else if (typeof allowHeaders === "string") {
-          resHeaders["access-control-allow-headers"] = allowHeaders;
+        if (typeof allowHeaders === "string" || allowHeaders?.length) {
+          resHeaders["access-control-allow-headers"] = flattenHeader(allowHeaders);
         }
         return {
           matched: true,
@@ -46,7 +160,7 @@ class CORSPlugin {
       if (!result.matched) {
         return result;
       }
-      const origin = Array.isArray(interceptorOptions.request.headers.origin) ? interceptorOptions.request.headers.origin.join(",") : interceptorOptions.request.headers.origin || "";
+      const origin = flattenHeader(interceptorOptions.request.headers.origin) ?? "";
       const allowedOrigin = await value(this.options.origin, origin, interceptorOptions);
       const allowedOriginArr = Array.isArray(allowedOrigin) ? allowedOrigin : [allowedOrigin];
       if (allowedOriginArr.includes("*")) {
@@ -68,25 +182,46 @@ class CORSPlugin {
         result.response.headers["access-control-allow-credentials"] = "true";
       }
       if (this.options.exposeHeaders?.length) {
-        result.response.headers["access-control-expose-headers"] = this.options.exposeHeaders.join(",");
+        result.response.headers["access-control-expose-headers"] = flattenHeader(this.options.exposeHeaders);
       }
       return result;
     });
   }
 }
 
+class RequestHeadersPlugin {
+  init(options) {
+    options.rootInterceptors ??= [];
+    options.rootInterceptors.push((interceptorOptions) => {
+      const reqHeaders = interceptorOptions.context.reqHeaders ?? toFetchHeaders(interceptorOptions.request.headers);
+      return interceptorOptions.next({
+        ...interceptorOptions,
+        context: {
+          ...interceptorOptions.context,
+          reqHeaders
+        }
+      });
+    });
+  }
+}
+
 class ResponseHeadersPlugin {
   init(options) {
     options.rootInterceptors ??= [];
     options.rootInterceptors.push(async (interceptorOptions) => {
-      const headers = new Headers();
-      interceptorOptions.context.resHeaders = headers;
-      const result = await interceptorOptions.next();
+      const resHeaders = interceptorOptions.context.resHeaders ?? new Headers();
+      const result = await interceptorOptions.next({
+        ...interceptorOptions,
+        context: {
+          ...interceptorOptions.context,
+          resHeaders
+        }
+      });
       if (!result.matched) {
         return result;
       }
-      const responseHeaders = result.response.headers;
-      for (const [key, value] of headers) {
+      const responseHeaders = clone(result.response.headers);
+      for (const [key, value] of resHeaders) {
         if (Array.isArray(responseHeaders[key])) {
           responseHeaders[key].push(value);
         } else if (responseHeaders[key] !== void 0) {
@@ -95,9 +230,99 @@ class ResponseHeadersPlugin {
           responseHeaders[key] = value;
         }
       }
+      return {
+        ...result,
+        response: {
+          ...result.response,
+          headers: responseHeaders
+        }
+      };
+    });
+  }
+}
+
+class experimental_RethrowHandlerPlugin {
+  filter;
+  CONTEXT_SYMBOL = Symbol("ORPC_RETHROW_HANDLER_PLUGIN_CONTEXT");
+  constructor(options) {
+    this.filter = options.filter;
+  }
+  init(options) {
+    options.rootInterceptors ??= [];
+    options.interceptors ??= [];
+    options.rootInterceptors.push(async (options2) => {
+      const pluginContext = {};
+      const result = await options2.next({
+        ...options2,
+        context: {
+          ...options2.context,
+          [this.CONTEXT_SYMBOL]: pluginContext
+        }
+      });
+      if (pluginContext.error) {
+        throw pluginContext.error.value;
+      }
       return result;
     });
+    options.interceptors.unshift(async (options2) => {
+      const pluginContext = options2.context[this.CONTEXT_SYMBOL];
+      if (!pluginContext) {
+        throw new TypeError("[RethrowHandlerPlugin] Rethrow handler context has been corrupted or modified by another plugin or interceptor");
+      }
+      try {
+        return await options2.next();
+      } catch (error) {
+        if (value(this.filter, error, options2)) {
+          pluginContext.error = { value: error };
+          return { matched: false, response: void 0 };
+        }
+        throw error;
+      }
+    });
+  }
+}
+
+const SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL = Symbol("SIMPLE_CSRF_PROTECTION_CONTEXT");
+class SimpleCsrfProtectionHandlerPlugin {
+  headerName;
+  headerValue;
+  exclude;
+  error;
+  constructor(options = {}) {
+    this.headerName = options.headerName ?? "x-csrf-token";
+    this.headerValue = options.headerValue ?? "orpc";
+    this.exclude = options.exclude ?? false;
+    this.error = options.error ?? new ORPCError("CSRF_TOKEN_MISMATCH", {
+      status: 403,
+      message: "Invalid CSRF token"
+    });
+  }
+  order = 8e6;
+  init(options) {
+    options.rootInterceptors ??= [];
+    options.clientInterceptors ??= [];
+    options.rootInterceptors.unshift(async (options2) => {
+      const headerName = await value(this.headerName, options2);
+      const headerValue = await value(this.headerValue, options2);
+      return options2.next({
+        ...options2,
+        context: {
+          ...options2.context,
+          [SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]: options2.request.headers[headerName] === headerValue
+        }
+      });
+    });
+    options.clientInterceptors.unshift(async (options2) => {
+      if (typeof options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL] !== "boolean") {
+        throw new TypeError("[SimpleCsrfProtectionHandlerPlugin] CSRF protection context has been corrupted or modified by another plugin or interceptor");
+      }
+      const excluded = await value(this.exclude, options2);
+      if (!excluded && !options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]) {
+        throw this.error;
+      }
+      return options2.next();
+    });
   }
 }
 
-export { CORSPlugin, ResponseHeadersPlugin };
+export { BatchHandlerPlugin, CORSPlugin, RequestHeadersPlugin, ResponseHeadersPlugin, SimpleCsrfProtectionHandlerPlugin, experimental_RethrowHandlerPlugin };

package/dist/shared/server.7cEtMB30.d.ts

@@ -0,0 +1,74 @@
+import { HTTPPath, ORPCError } from '@orpc/client';
+import { Meta } from '@orpc/contract';
+import { Interceptor } from '@orpc/shared';
+import { StandardResponse, StandardLazyRequest } from '@orpc/standard-server';
+import { C as Context, R as Router, b as AnyRouter, A as AnyProcedure, d as ProcedureClientInterceptorOptions } from './server.qKsRrdxW.js';
+
+interface StandardHandlerPlugin<T extends Context> {
+    order?: number;
+    init?(options: StandardHandlerOptions<T>, router: Router<any, T>): void;
+}
+declare class CompositeStandardHandlerPlugin<T extends Context, TPlugin extends StandardHandlerPlugin<T>> implements StandardHandlerPlugin<T> {
+    protected readonly plugins: TPlugin[];
+    constructor(plugins?: readonly TPlugin[]);
+    init(options: StandardHandlerOptions<T>, router: Router<any, T>): void;
+}
+
+type StandardParams = Record<string, string>;
+type StandardMatchResult = {
+    path: readonly string[];
+    procedure: AnyProcedure;
+    params?: StandardParams;
+} | undefined;
+interface StandardMatcher {
+    init(router: AnyRouter): void;
+    match(method: string, pathname: HTTPPath): Promise<StandardMatchResult>;
+}
+interface StandardCodec {
+    encode(output: unknown, procedure: AnyProcedure): StandardResponse;
+    encodeError(error: ORPCError<any, any>): StandardResponse;
+    decode(request: StandardLazyRequest, params: StandardParams | undefined, procedure: AnyProcedure): Promise<unknown>;
+}
+
+interface StandardHandleOptions<T extends Context> {
+    prefix?: HTTPPath;
+    context: T;
+}
+type StandardHandleResult = {
+    matched: true;
+    response: StandardResponse;
+} | {
+    matched: false;
+    response: undefined;
+};
+interface StandardHandlerInterceptorOptions<T extends Context> extends StandardHandleOptions<T> {
+    request: StandardLazyRequest;
+}
+interface StandardHandlerOptions<TContext extends Context> {
+    plugins?: StandardHandlerPlugin<TContext>[];
+    /**
+     * Interceptors at the request level, helpful when you want catch errors
+     */
+    interceptors?: Interceptor<StandardHandlerInterceptorOptions<TContext>, Promise<StandardHandleResult>>[];
+    /**
+     * Interceptors at the root level, helpful when you want override the request/response
+     */
+    rootInterceptors?: Interceptor<StandardHandlerInterceptorOptions<TContext>, Promise<StandardHandleResult>>[];
+    /**
+     *
+     * Interceptors for procedure client.
+     */
+    clientInterceptors?: Interceptor<ProcedureClientInterceptorOptions<TContext, Record<never, never>, Meta>, Promise<unknown>>[];
+}
+declare class StandardHandler<T extends Context> {
+    private readonly matcher;
+    private readonly codec;
+    private readonly interceptors;
+    private readonly clientInterceptors;
+    private readonly rootInterceptors;
+    constructor(router: Router<any, T>, matcher: StandardMatcher, codec: StandardCodec, options: NoInfer<StandardHandlerOptions<T>>);
+    handle(request: StandardLazyRequest, options: StandardHandleOptions<T>): Promise<StandardHandleResult>;
+}
+
+export { CompositeStandardHandlerPlugin as C, StandardHandler as f };
+export type { StandardCodec as S, StandardParams as a, StandardHandleOptions as b, StandardHandleResult as c, StandardHandlerInterceptorOptions as d, StandardHandlerOptions as e, StandardHandlerPlugin as g, StandardMatchResult as h, StandardMatcher as i };

package/dist/shared/server.B8gYOD5g.d.mts

@@ -0,0 +1,12 @@
+import { C as Context } from './server.qKsRrdxW.mjs';
+import { b as StandardHandleOptions } from './server.BqadksTP.mjs';
+
+type FriendlyStandardHandleOptions<T extends Context> = Omit<StandardHandleOptions<T>, 'context'> & (Record<never, never> extends T ? {
+    context?: T;
+} : {
+    context: T;
+});
+declare function resolveFriendlyStandardHandleOptions<T extends Context>(options: FriendlyStandardHandleOptions<T>): StandardHandleOptions<T>;
+
+export { resolveFriendlyStandardHandleOptions as r };
+export type { FriendlyStandardHandleOptions as F };