@orpc/server 0.0.0-next.a5c2886 → 0.0.0-next.a7609ce
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -0
- package/dist/adapters/fetch/index.d.mts +43 -10
- package/dist/adapters/fetch/index.d.ts +43 -10
- package/dist/adapters/fetch/index.mjs +104 -8
- package/dist/adapters/node/index.d.mts +45 -21
- package/dist/adapters/node/index.d.ts +45 -21
- package/dist/adapters/node/index.mjs +82 -23
- package/dist/adapters/standard/index.d.mts +11 -10
- package/dist/adapters/standard/index.d.ts +11 -10
- package/dist/adapters/standard/index.mjs +6 -4
- package/dist/index.d.mts +84 -61
- package/dist/index.d.ts +84 -61
- package/dist/index.mjs +50 -30
- package/dist/plugins/index.d.mts +109 -15
- package/dist/plugins/index.d.ts +109 -15
- package/dist/plugins/index.mjs +156 -7
- package/dist/shared/{server.DmW25ynm.d.ts → server.B1oIHH_j.d.mts} +28 -29
- package/dist/shared/{server.CPteJIPP.d.mts → server.BVHsfJ99.d.mts} +20 -19
- package/dist/shared/{server.CPteJIPP.d.ts → server.BVHsfJ99.d.ts} +20 -19
- package/dist/shared/server.BVwwTHyO.mjs +9 -0
- package/dist/shared/server.BW-nUGgA.mjs +36 -0
- package/dist/shared/server.BuLPHTX1.d.mts +18 -0
- package/dist/shared/{server.CMrS28Go.mjs → server.C37gDhSZ.mjs} +42 -24
- package/dist/shared/{server.CM3tWr3C.d.mts → server.CaWivVk3.d.ts} +28 -29
- package/dist/shared/{server.CSZRzcSW.mjs → server.DFuJLDuo.mjs} +62 -30
- package/dist/shared/server.DMhSfHk1.d.ts +10 -0
- package/dist/shared/server.D_vpYits.d.ts +18 -0
- package/dist/shared/server.Dwnm6cSk.d.mts +10 -0
- package/package.json +8 -22
- package/dist/adapters/hono/index.d.mts +0 -19
- package/dist/adapters/hono/index.d.ts +0 -19
- package/dist/adapters/hono/index.mjs +0 -32
- package/dist/adapters/next/index.d.mts +0 -26
- package/dist/adapters/next/index.d.ts +0 -26
- package/dist/adapters/next/index.mjs +0 -29
- package/dist/shared/server.Cq3B6PoL.mjs +0 -28
- package/dist/shared/server.Q6ZmnTgO.mjs +0 -12
package/dist/plugins/index.d.mts
CHANGED
@@ -1,31 +1,125 @@
|
|
1
|
-
import { a as StandardHandlerInterceptorOptions, H as HandlerPlugin, b as StandardHandlerOptions } from '../shared/server.CM3tWr3C.mjs';
|
2
|
-
export { C as CompositePlugin } from '../shared/server.CM3tWr3C.mjs';
|
3
1
|
import { Value } from '@orpc/shared';
|
4
|
-
import {
|
5
|
-
import '@orpc/
|
6
|
-
import '
|
7
|
-
import '
|
2
|
+
import { StandardRequest, StandardHeaders } from '@orpc/standard-server';
|
3
|
+
import { BatchResponseBodyItem } from '@orpc/standard-server/batch';
|
4
|
+
import { S as StandardHandlerInterceptorOptions, a as StandardHandlerPlugin, b as StandardHandlerOptions } from '../shared/server.B1oIHH_j.mjs';
|
5
|
+
import { C as Context, F as ProcedureClientInterceptorOptions } from '../shared/server.BVHsfJ99.mjs';
|
6
|
+
import { Meta, ORPCError as ORPCError$1 } from '@orpc/contract';
|
7
|
+
import { ORPCError } from '@orpc/client';
|
8
8
|
|
9
|
-
interface
|
10
|
-
|
11
|
-
|
9
|
+
interface BatchHandlerOptions<T extends Context> {
|
10
|
+
/**
|
11
|
+
* The max size of the batch allowed.
|
12
|
+
*
|
13
|
+
* @default 10
|
14
|
+
*/
|
15
|
+
maxSize?: Value<number, [StandardHandlerInterceptorOptions<T>]>;
|
16
|
+
/**
|
17
|
+
* Map the request before processing it.
|
18
|
+
*
|
19
|
+
* @default merged back batch request headers into the request
|
20
|
+
*/
|
21
|
+
mapRequestItem?(request: StandardRequest, batchOptions: StandardHandlerInterceptorOptions<T>): StandardRequest;
|
22
|
+
/**
|
23
|
+
* Success batch response status code.
|
24
|
+
*
|
25
|
+
* @default 207
|
26
|
+
*/
|
27
|
+
successStatus?: Value<number, [responses: Promise<BatchResponseBodyItem>[], batchOptions: StandardHandlerInterceptorOptions<T>]>;
|
28
|
+
/**
|
29
|
+
* success batch response headers.
|
30
|
+
*
|
31
|
+
* @default {}
|
32
|
+
*/
|
33
|
+
headers?: Value<StandardHeaders, [responses: Promise<BatchResponseBodyItem>[], batchOptions: StandardHandlerInterceptorOptions<T>]>;
|
34
|
+
}
|
35
|
+
declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
|
36
|
+
private readonly maxSize;
|
37
|
+
private readonly mapRequestItem;
|
38
|
+
private readonly successStatus;
|
39
|
+
private readonly headers;
|
40
|
+
order: number;
|
41
|
+
constructor(options?: BatchHandlerOptions<T>);
|
42
|
+
init(options: StandardHandlerOptions<T>): void;
|
43
|
+
}
|
44
|
+
|
45
|
+
interface CORSOptions<T extends Context> {
|
46
|
+
origin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<T>]>;
|
47
|
+
timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<T>]>;
|
12
48
|
allowMethods?: readonly string[];
|
13
49
|
allowHeaders?: readonly string[];
|
14
50
|
maxAge?: number;
|
15
51
|
credentials?: boolean;
|
16
52
|
exposeHeaders?: readonly string[];
|
17
53
|
}
|
18
|
-
declare class CORSPlugin<
|
54
|
+
declare class CORSPlugin<T extends Context> implements StandardHandlerPlugin<T> {
|
19
55
|
private readonly options;
|
20
|
-
|
21
|
-
|
56
|
+
order: number;
|
57
|
+
constructor(options?: CORSOptions<T>);
|
58
|
+
init(options: StandardHandlerOptions<T>): void;
|
22
59
|
}
|
23
60
|
|
24
61
|
interface ResponseHeadersPluginContext {
|
25
62
|
resHeaders?: Headers;
|
26
63
|
}
|
27
|
-
declare class ResponseHeadersPlugin<
|
28
|
-
init(options: StandardHandlerOptions<
|
64
|
+
declare class ResponseHeadersPlugin<T extends ResponseHeadersPluginContext> implements StandardHandlerPlugin<T> {
|
65
|
+
init(options: StandardHandlerOptions<T>): void;
|
66
|
+
}
|
67
|
+
|
68
|
+
interface SimpleCsrfProtectionHandlerPluginOptions<T extends Context> {
|
69
|
+
/**
|
70
|
+
* The name of the header to check.
|
71
|
+
*
|
72
|
+
* @default 'x-csrf-token'
|
73
|
+
*/
|
74
|
+
headerName?: Value<string, [options: StandardHandlerInterceptorOptions<T>]>;
|
75
|
+
/**
|
76
|
+
* The value of the header to check.
|
77
|
+
*
|
78
|
+
* @default 'orpc'
|
79
|
+
*
|
80
|
+
*/
|
81
|
+
headerValue?: Value<string, [options: StandardHandlerInterceptorOptions<T>]>;
|
82
|
+
/**
|
83
|
+
* Exclude a procedure from the plugin.
|
84
|
+
*
|
85
|
+
* @default false
|
86
|
+
*
|
87
|
+
*/
|
88
|
+
exclude?: Value<boolean, [options: ProcedureClientInterceptorOptions<T, Record<never, never>, Meta>]>;
|
89
|
+
/**
|
90
|
+
* The error thrown when the CSRF token is invalid.
|
91
|
+
*
|
92
|
+
* @default new ORPCError('CSRF_TOKEN_MISMATCH', {
|
93
|
+
* status: 403,
|
94
|
+
* message: 'Invalid CSRF token',
|
95
|
+
* })
|
96
|
+
*/
|
97
|
+
error?: InstanceType<typeof ORPCError>;
|
98
|
+
}
|
99
|
+
declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
|
100
|
+
private readonly headerName;
|
101
|
+
private readonly headerValue;
|
102
|
+
private readonly exclude;
|
103
|
+
private readonly error;
|
104
|
+
constructor(options?: SimpleCsrfProtectionHandlerPluginOptions<T>);
|
105
|
+
order: number;
|
106
|
+
init(options: StandardHandlerOptions<T>): void;
|
107
|
+
}
|
108
|
+
|
109
|
+
interface StrictGetMethodPluginOptions {
|
110
|
+
/**
|
111
|
+
* The error thrown when a GET request is made to a procedure that doesn't allow GET.
|
112
|
+
*
|
113
|
+
* @default new ORPCError('METHOD_NOT_SUPPORTED')
|
114
|
+
*/
|
115
|
+
error?: InstanceType<typeof ORPCError$1>;
|
116
|
+
}
|
117
|
+
declare class StrictGetMethodPlugin<T extends Context> implements StandardHandlerPlugin<T> {
|
118
|
+
private readonly error;
|
119
|
+
order: number;
|
120
|
+
constructor(options?: StrictGetMethodPluginOptions);
|
121
|
+
init(options: StandardHandlerOptions<T>): void;
|
29
122
|
}
|
30
123
|
|
31
|
-
export {
|
124
|
+
export { BatchHandlerPlugin, CORSPlugin, ResponseHeadersPlugin, SimpleCsrfProtectionHandlerPlugin, StrictGetMethodPlugin };
|
125
|
+
export type { BatchHandlerOptions, CORSOptions, ResponseHeadersPluginContext, SimpleCsrfProtectionHandlerPluginOptions, StrictGetMethodPluginOptions };
|
package/dist/plugins/index.d.ts
CHANGED
@@ -1,31 +1,125 @@
|
|
1
|
-
import { a as StandardHandlerInterceptorOptions, H as HandlerPlugin, b as StandardHandlerOptions } from '../shared/server.DmW25ynm.js';
|
2
|
-
export { C as CompositePlugin } from '../shared/server.DmW25ynm.js';
|
3
1
|
import { Value } from '@orpc/shared';
|
4
|
-
import {
|
5
|
-
import '@orpc/
|
6
|
-
import '
|
7
|
-
import '
|
2
|
+
import { StandardRequest, StandardHeaders } from '@orpc/standard-server';
|
3
|
+
import { BatchResponseBodyItem } from '@orpc/standard-server/batch';
|
4
|
+
import { S as StandardHandlerInterceptorOptions, a as StandardHandlerPlugin, b as StandardHandlerOptions } from '../shared/server.CaWivVk3.js';
|
5
|
+
import { C as Context, F as ProcedureClientInterceptorOptions } from '../shared/server.BVHsfJ99.js';
|
6
|
+
import { Meta, ORPCError as ORPCError$1 } from '@orpc/contract';
|
7
|
+
import { ORPCError } from '@orpc/client';
|
8
8
|
|
9
|
-
interface
|
10
|
-
|
11
|
-
|
9
|
+
interface BatchHandlerOptions<T extends Context> {
|
10
|
+
/**
|
11
|
+
* The max size of the batch allowed.
|
12
|
+
*
|
13
|
+
* @default 10
|
14
|
+
*/
|
15
|
+
maxSize?: Value<number, [StandardHandlerInterceptorOptions<T>]>;
|
16
|
+
/**
|
17
|
+
* Map the request before processing it.
|
18
|
+
*
|
19
|
+
* @default merged back batch request headers into the request
|
20
|
+
*/
|
21
|
+
mapRequestItem?(request: StandardRequest, batchOptions: StandardHandlerInterceptorOptions<T>): StandardRequest;
|
22
|
+
/**
|
23
|
+
* Success batch response status code.
|
24
|
+
*
|
25
|
+
* @default 207
|
26
|
+
*/
|
27
|
+
successStatus?: Value<number, [responses: Promise<BatchResponseBodyItem>[], batchOptions: StandardHandlerInterceptorOptions<T>]>;
|
28
|
+
/**
|
29
|
+
* success batch response headers.
|
30
|
+
*
|
31
|
+
* @default {}
|
32
|
+
*/
|
33
|
+
headers?: Value<StandardHeaders, [responses: Promise<BatchResponseBodyItem>[], batchOptions: StandardHandlerInterceptorOptions<T>]>;
|
34
|
+
}
|
35
|
+
declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
|
36
|
+
private readonly maxSize;
|
37
|
+
private readonly mapRequestItem;
|
38
|
+
private readonly successStatus;
|
39
|
+
private readonly headers;
|
40
|
+
order: number;
|
41
|
+
constructor(options?: BatchHandlerOptions<T>);
|
42
|
+
init(options: StandardHandlerOptions<T>): void;
|
43
|
+
}
|
44
|
+
|
45
|
+
interface CORSOptions<T extends Context> {
|
46
|
+
origin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<T>]>;
|
47
|
+
timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<T>]>;
|
12
48
|
allowMethods?: readonly string[];
|
13
49
|
allowHeaders?: readonly string[];
|
14
50
|
maxAge?: number;
|
15
51
|
credentials?: boolean;
|
16
52
|
exposeHeaders?: readonly string[];
|
17
53
|
}
|
18
|
-
declare class CORSPlugin<
|
54
|
+
declare class CORSPlugin<T extends Context> implements StandardHandlerPlugin<T> {
|
19
55
|
private readonly options;
|
20
|
-
|
21
|
-
|
56
|
+
order: number;
|
57
|
+
constructor(options?: CORSOptions<T>);
|
58
|
+
init(options: StandardHandlerOptions<T>): void;
|
22
59
|
}
|
23
60
|
|
24
61
|
interface ResponseHeadersPluginContext {
|
25
62
|
resHeaders?: Headers;
|
26
63
|
}
|
27
|
-
declare class ResponseHeadersPlugin<
|
28
|
-
init(options: StandardHandlerOptions<
|
64
|
+
declare class ResponseHeadersPlugin<T extends ResponseHeadersPluginContext> implements StandardHandlerPlugin<T> {
|
65
|
+
init(options: StandardHandlerOptions<T>): void;
|
66
|
+
}
|
67
|
+
|
68
|
+
interface SimpleCsrfProtectionHandlerPluginOptions<T extends Context> {
|
69
|
+
/**
|
70
|
+
* The name of the header to check.
|
71
|
+
*
|
72
|
+
* @default 'x-csrf-token'
|
73
|
+
*/
|
74
|
+
headerName?: Value<string, [options: StandardHandlerInterceptorOptions<T>]>;
|
75
|
+
/**
|
76
|
+
* The value of the header to check.
|
77
|
+
*
|
78
|
+
* @default 'orpc'
|
79
|
+
*
|
80
|
+
*/
|
81
|
+
headerValue?: Value<string, [options: StandardHandlerInterceptorOptions<T>]>;
|
82
|
+
/**
|
83
|
+
* Exclude a procedure from the plugin.
|
84
|
+
*
|
85
|
+
* @default false
|
86
|
+
*
|
87
|
+
*/
|
88
|
+
exclude?: Value<boolean, [options: ProcedureClientInterceptorOptions<T, Record<never, never>, Meta>]>;
|
89
|
+
/**
|
90
|
+
* The error thrown when the CSRF token is invalid.
|
91
|
+
*
|
92
|
+
* @default new ORPCError('CSRF_TOKEN_MISMATCH', {
|
93
|
+
* status: 403,
|
94
|
+
* message: 'Invalid CSRF token',
|
95
|
+
* })
|
96
|
+
*/
|
97
|
+
error?: InstanceType<typeof ORPCError>;
|
98
|
+
}
|
99
|
+
declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
|
100
|
+
private readonly headerName;
|
101
|
+
private readonly headerValue;
|
102
|
+
private readonly exclude;
|
103
|
+
private readonly error;
|
104
|
+
constructor(options?: SimpleCsrfProtectionHandlerPluginOptions<T>);
|
105
|
+
order: number;
|
106
|
+
init(options: StandardHandlerOptions<T>): void;
|
107
|
+
}
|
108
|
+
|
109
|
+
interface StrictGetMethodPluginOptions {
|
110
|
+
/**
|
111
|
+
* The error thrown when a GET request is made to a procedure that doesn't allow GET.
|
112
|
+
*
|
113
|
+
* @default new ORPCError('METHOD_NOT_SUPPORTED')
|
114
|
+
*/
|
115
|
+
error?: InstanceType<typeof ORPCError$1>;
|
116
|
+
}
|
117
|
+
declare class StrictGetMethodPlugin<T extends Context> implements StandardHandlerPlugin<T> {
|
118
|
+
private readonly error;
|
119
|
+
order: number;
|
120
|
+
constructor(options?: StrictGetMethodPluginOptions);
|
121
|
+
init(options: StandardHandlerOptions<T>): void;
|
29
122
|
}
|
30
123
|
|
31
|
-
export {
|
124
|
+
export { BatchHandlerPlugin, CORSPlugin, ResponseHeadersPlugin, SimpleCsrfProtectionHandlerPlugin, StrictGetMethodPlugin };
|
125
|
+
export type { BatchHandlerOptions, CORSOptions, ResponseHeadersPluginContext, SimpleCsrfProtectionHandlerPluginOptions, StrictGetMethodPluginOptions };
|
package/dist/plugins/index.mjs
CHANGED
@@ -1,8 +1,109 @@
|
|
1
|
-
|
2
|
-
import {
|
1
|
+
import { value, isAsyncIteratorObject } from '@orpc/shared';
|
2
|
+
import { parseBatchRequest, toBatchResponse } from '@orpc/standard-server/batch';
|
3
|
+
import { ORPCError } from '@orpc/client';
|
4
|
+
export { S as StrictGetMethodPlugin } from '../shared/server.BW-nUGgA.mjs';
|
5
|
+
import '@orpc/contract';
|
6
|
+
|
7
|
+
class BatchHandlerPlugin {
|
8
|
+
maxSize;
|
9
|
+
mapRequestItem;
|
10
|
+
successStatus;
|
11
|
+
headers;
|
12
|
+
order = 5e6;
|
13
|
+
constructor(options = {}) {
|
14
|
+
this.maxSize = options.maxSize ?? 10;
|
15
|
+
this.mapRequestItem = options.mapRequestItem ?? ((request, { request: batchRequest }) => ({
|
16
|
+
...request,
|
17
|
+
headers: {
|
18
|
+
...batchRequest.headers,
|
19
|
+
...request.headers
|
20
|
+
}
|
21
|
+
}));
|
22
|
+
this.successStatus = options.successStatus ?? 207;
|
23
|
+
this.headers = options.headers ?? {};
|
24
|
+
}
|
25
|
+
init(options) {
|
26
|
+
options.rootInterceptors ??= [];
|
27
|
+
options.rootInterceptors.unshift(async (options2) => {
|
28
|
+
if (options2.request.headers["x-orpc-batch"] !== "1") {
|
29
|
+
return options2.next();
|
30
|
+
}
|
31
|
+
let isParsing = false;
|
32
|
+
try {
|
33
|
+
isParsing = true;
|
34
|
+
const parsed = parseBatchRequest({ ...options2.request, body: await options2.request.body() });
|
35
|
+
isParsing = false;
|
36
|
+
const maxSize = await value(this.maxSize, options2);
|
37
|
+
if (parsed.length > maxSize) {
|
38
|
+
return {
|
39
|
+
matched: true,
|
40
|
+
response: {
|
41
|
+
status: 413,
|
42
|
+
headers: {},
|
43
|
+
body: "Batch request size exceeds the maximum allowed size"
|
44
|
+
}
|
45
|
+
};
|
46
|
+
}
|
47
|
+
const responses = parsed.map(
|
48
|
+
(request, index) => {
|
49
|
+
const mapped = this.mapRequestItem(request, options2);
|
50
|
+
return options2.next({ ...options2, request: { ...mapped, body: () => Promise.resolve(mapped.body) } }).then(({ response: response2, matched }) => {
|
51
|
+
if (matched) {
|
52
|
+
if (response2.body instanceof Blob || response2.body instanceof FormData || isAsyncIteratorObject(response2.body)) {
|
53
|
+
return {
|
54
|
+
index,
|
55
|
+
status: 500,
|
56
|
+
headers: {},
|
57
|
+
body: "Batch responses do not support file/blob, or event-iterator. Please call this procedure separately outside of the batch request."
|
58
|
+
};
|
59
|
+
}
|
60
|
+
return { ...response2, index };
|
61
|
+
}
|
62
|
+
return { index, status: 404, headers: {}, body: "No procedure matched" };
|
63
|
+
}).catch(() => {
|
64
|
+
return { index, status: 500, headers: {}, body: "Internal server error" };
|
65
|
+
});
|
66
|
+
}
|
67
|
+
);
|
68
|
+
await Promise.race(responses);
|
69
|
+
const status = await value(this.successStatus, responses, options2);
|
70
|
+
const headers = await value(this.headers, responses, options2);
|
71
|
+
const response = toBatchResponse({
|
72
|
+
status,
|
73
|
+
headers,
|
74
|
+
body: async function* () {
|
75
|
+
const promises = [...responses];
|
76
|
+
while (true) {
|
77
|
+
const handling = promises.filter((p) => p !== void 0);
|
78
|
+
if (handling.length === 0) {
|
79
|
+
return;
|
80
|
+
}
|
81
|
+
const result = await Promise.race(handling);
|
82
|
+
promises[result.index] = void 0;
|
83
|
+
yield result;
|
84
|
+
}
|
85
|
+
}()
|
86
|
+
});
|
87
|
+
return {
|
88
|
+
matched: true,
|
89
|
+
response
|
90
|
+
};
|
91
|
+
} catch (cause) {
|
92
|
+
if (isParsing) {
|
93
|
+
return {
|
94
|
+
matched: true,
|
95
|
+
response: { status: 400, headers: {}, body: "Invalid batch request, this could be caused by a malformed request body or a missing header" }
|
96
|
+
};
|
97
|
+
}
|
98
|
+
throw cause;
|
99
|
+
}
|
100
|
+
});
|
101
|
+
}
|
102
|
+
}
|
3
103
|
|
4
104
|
class CORSPlugin {
|
5
105
|
options;
|
106
|
+
order = 9e6;
|
6
107
|
constructor(options = {}) {
|
7
108
|
const defaults = {
|
8
109
|
origin: (origin) => origin,
|
@@ -79,14 +180,19 @@ class ResponseHeadersPlugin {
|
|
79
180
|
init(options) {
|
80
181
|
options.rootInterceptors ??= [];
|
81
182
|
options.rootInterceptors.push(async (interceptorOptions) => {
|
82
|
-
const
|
83
|
-
|
84
|
-
|
183
|
+
const resHeaders = interceptorOptions.context.resHeaders ?? new Headers();
|
184
|
+
const result = await interceptorOptions.next({
|
185
|
+
...interceptorOptions,
|
186
|
+
context: {
|
187
|
+
...interceptorOptions.context,
|
188
|
+
resHeaders
|
189
|
+
}
|
190
|
+
});
|
85
191
|
if (!result.matched) {
|
86
192
|
return result;
|
87
193
|
}
|
88
194
|
const responseHeaders = result.response.headers;
|
89
|
-
for (const [key, value] of
|
195
|
+
for (const [key, value] of resHeaders) {
|
90
196
|
if (Array.isArray(responseHeaders[key])) {
|
91
197
|
responseHeaders[key].push(value);
|
92
198
|
} else if (responseHeaders[key] !== void 0) {
|
@@ -100,4 +206,47 @@ class ResponseHeadersPlugin {
|
|
100
206
|
}
|
101
207
|
}
|
102
208
|
|
103
|
-
|
209
|
+
const SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL = Symbol("SIMPLE_CSRF_PROTECTION_CONTEXT");
|
210
|
+
class SimpleCsrfProtectionHandlerPlugin {
|
211
|
+
headerName;
|
212
|
+
headerValue;
|
213
|
+
exclude;
|
214
|
+
error;
|
215
|
+
constructor(options = {}) {
|
216
|
+
this.headerName = options.headerName ?? "x-csrf-token";
|
217
|
+
this.headerValue = options.headerValue ?? "orpc";
|
218
|
+
this.exclude = options.exclude ?? false;
|
219
|
+
this.error = options.error ?? new ORPCError("CSRF_TOKEN_MISMATCH", {
|
220
|
+
status: 403,
|
221
|
+
message: "Invalid CSRF token"
|
222
|
+
});
|
223
|
+
}
|
224
|
+
order = 8e6;
|
225
|
+
init(options) {
|
226
|
+
options.rootInterceptors ??= [];
|
227
|
+
options.clientInterceptors ??= [];
|
228
|
+
options.rootInterceptors.unshift(async (options2) => {
|
229
|
+
const headerName = await value(this.headerName, options2);
|
230
|
+
const headerValue = await value(this.headerValue, options2);
|
231
|
+
return options2.next({
|
232
|
+
...options2,
|
233
|
+
context: {
|
234
|
+
...options2.context,
|
235
|
+
[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]: options2.request.headers[headerName] === headerValue
|
236
|
+
}
|
237
|
+
});
|
238
|
+
});
|
239
|
+
options.clientInterceptors.unshift(async (options2) => {
|
240
|
+
if (typeof options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL] !== "boolean") {
|
241
|
+
throw new TypeError("[SimpleCsrfProtectionHandlerPlugin] CSRF protection context has been corrupted or modified by another plugin or interceptor");
|
242
|
+
}
|
243
|
+
const excluded = await value(this.exclude, options2);
|
244
|
+
if (!excluded && !options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]) {
|
245
|
+
throw this.error;
|
246
|
+
}
|
247
|
+
return options2.next();
|
248
|
+
});
|
249
|
+
}
|
250
|
+
}
|
251
|
+
|
252
|
+
export { BatchHandlerPlugin, CORSPlugin, ResponseHeadersPlugin, SimpleCsrfProtectionHandlerPlugin };
|
@@ -1,8 +1,18 @@
|
|
1
|
-
import { HTTPPath,
|
2
|
-
import {
|
1
|
+
import { HTTPPath, ORPCError } from '@orpc/client';
|
2
|
+
import { Meta, InferSchemaOutput, AnySchema, ErrorFromErrorMap } from '@orpc/contract';
|
3
|
+
import { Interceptor, ThrowableError } from '@orpc/shared';
|
3
4
|
import { StandardResponse, StandardLazyRequest } from '@orpc/standard-server';
|
4
|
-
import {
|
5
|
-
|
5
|
+
import { C as Context, f as AnyRouter, h as AnyProcedure, F as ProcedureClientInterceptorOptions, R as Router } from './server.BVHsfJ99.mjs';
|
6
|
+
|
7
|
+
interface StandardHandlerPlugin<TContext extends Context> {
|
8
|
+
order?: number;
|
9
|
+
init?(options: StandardHandlerOptions<TContext>): void;
|
10
|
+
}
|
11
|
+
declare class CompositeStandardHandlerPlugin<T extends Context, TPlugin extends StandardHandlerPlugin<T>> implements StandardHandlerPlugin<T> {
|
12
|
+
protected readonly plugins: TPlugin[];
|
13
|
+
constructor(plugins?: readonly TPlugin[]);
|
14
|
+
init(options: StandardHandlerOptions<T>): void;
|
15
|
+
}
|
6
16
|
|
7
17
|
type StandardParams = Record<string, string>;
|
8
18
|
type StandardMatchResult = {
|
@@ -20,13 +30,10 @@ interface StandardCodec {
|
|
20
30
|
decode(request: StandardLazyRequest, params: StandardParams | undefined, procedure: AnyProcedure): Promise<unknown>;
|
21
31
|
}
|
22
32
|
|
23
|
-
|
33
|
+
interface StandardHandleOptions<T extends Context> {
|
24
34
|
prefix?: HTTPPath;
|
25
|
-
} & (Record<never, never> extends T ? {
|
26
|
-
context?: T;
|
27
|
-
} : {
|
28
35
|
context: T;
|
29
|
-
}
|
36
|
+
}
|
30
37
|
type StandardHandleResult = {
|
31
38
|
matched: true;
|
32
39
|
response: StandardResponse;
|
@@ -34,42 +41,34 @@ type StandardHandleResult = {
|
|
34
41
|
matched: false;
|
35
42
|
response: undefined;
|
36
43
|
};
|
37
|
-
|
38
|
-
context: T;
|
44
|
+
interface StandardHandlerInterceptorOptions<T extends Context> extends StandardHandleOptions<T> {
|
39
45
|
request: StandardLazyRequest;
|
40
|
-
}
|
46
|
+
}
|
41
47
|
interface StandardHandlerOptions<TContext extends Context> {
|
42
|
-
plugins?:
|
48
|
+
plugins?: StandardHandlerPlugin<TContext>[];
|
43
49
|
/**
|
44
50
|
* Interceptors at the request level, helpful when you want catch errors
|
45
51
|
*/
|
46
|
-
interceptors?: Interceptor<StandardHandlerInterceptorOptions<TContext>, StandardHandleResult,
|
52
|
+
interceptors?: Interceptor<StandardHandlerInterceptorOptions<TContext>, StandardHandleResult, ThrowableError>[];
|
47
53
|
/**
|
48
54
|
* Interceptors at the root level, helpful when you want override the request/response
|
49
55
|
*/
|
50
|
-
rootInterceptors?: Interceptor<StandardHandlerInterceptorOptions<TContext>, StandardHandleResult,
|
56
|
+
rootInterceptors?: Interceptor<StandardHandlerInterceptorOptions<TContext>, StandardHandleResult, ThrowableError>[];
|
51
57
|
/**
|
52
58
|
*
|
53
59
|
* Interceptors for procedure client.
|
54
60
|
*/
|
55
|
-
clientInterceptors?: Interceptor<ProcedureClientInterceptorOptions<TContext,
|
61
|
+
clientInterceptors?: Interceptor<ProcedureClientInterceptorOptions<TContext, Record<never, never>, Meta>, InferSchemaOutput<AnySchema>, ErrorFromErrorMap<Record<never, never>>>[];
|
56
62
|
}
|
57
63
|
declare class StandardHandler<T extends Context> {
|
58
64
|
private readonly matcher;
|
59
65
|
private readonly codec;
|
60
|
-
private readonly
|
61
|
-
private readonly
|
66
|
+
private readonly interceptors;
|
67
|
+
private readonly clientInterceptors;
|
68
|
+
private readonly rootInterceptors;
|
62
69
|
constructor(router: Router<any, T>, matcher: StandardMatcher, codec: StandardCodec, options: NoInfer<StandardHandlerOptions<T>>);
|
63
|
-
handle(request: StandardLazyRequest,
|
64
|
-
}
|
65
|
-
|
66
|
-
interface HandlerPlugin<TContext extends Context> {
|
67
|
-
init?(options: StandardHandlerOptions<TContext>): void;
|
68
|
-
}
|
69
|
-
declare class CompositePlugin<TContext extends Context> implements HandlerPlugin<TContext> {
|
70
|
-
private readonly plugins;
|
71
|
-
constructor(plugins?: HandlerPlugin<TContext>[]);
|
72
|
-
init(options: StandardHandlerOptions<TContext>): void;
|
70
|
+
handle(request: StandardLazyRequest, options: StandardHandleOptions<T>): Promise<StandardHandleResult>;
|
73
71
|
}
|
74
72
|
|
75
|
-
export {
|
73
|
+
export { CompositeStandardHandlerPlugin as C, StandardHandler as i };
|
74
|
+
export type { StandardHandlerInterceptorOptions as S, StandardHandlerPlugin as a, StandardHandlerOptions as b, StandardCodec as c, StandardParams as d, StandardMatcher as e, StandardMatchResult as f, StandardHandleOptions as g, StandardHandleResult as h };
|