@orpc/server 1.14.6 → 2.0.0-beta.10

package/dist/plugins/index.mjs

@@ -1,124 +1,173 @@
-import { runWithSpan, value, setSpanError, isAsyncIteratorObject, AsyncIteratorClass, clone } from '@orpc/shared';
-import { flattenHeader } from '@orpc/standard-server';
-import { parseBatchRequest, toBatchResponse } from '@orpc/standard-server/batch';
-import { toFetchHeaders } from '@orpc/standard-server-fetch';
-import { ORPCError } from '@orpc/client';
-export { S as StrictGetMethodPlugin } from '../shared/server.TEVCLCFC.mjs';
-import '@orpc/contract';
+import { toArray, value } from '@orpc/shared';
+import { flattenStandardHeader, parseStandardUrl, mergeStandardHeaders } from '@standardserver/core';
+import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
+export { C as CSRFGuardHandlerPlugin } from '../shared/server.D_QauotT.mjs';
+import { toFetchHeaders, toStandardHeaders } from '@standardserver/fetch';
+import '@orpc/client';
 
 class BatchHandlerPlugin {
+  name = "~batch";
+  /**
+   * Run batch interceptors before OpenTelemetry interceptors
+   * so each subrequest gets its own span instead of sharing one batch-level span.
+   */
+  after = ["~opentelemetry"];
   maxSize;
-  mapRequestItem;
+  mapSubrequest;
   successStatus;
   headers;
-  order = 5e6;
   constructor(options = {}) {
     this.maxSize = options.maxSize ?? 10;
-    this.mapRequestItem = options.mapRequestItem ?? ((request, { request: batchRequest }) => ({
-      ...request,
+    this.mapSubrequest = options.mapSubrequest ?? ((subRequest, { request: batchRequest }) => ({
+      ...subRequest,
       headers: {
         ...batchRequest.headers,
-        ...request.headers
+        ...subRequest.headers,
+        "orpc-batch": void 0
+        // useful in case batch plugin is used multiple times
       }
     }));
     this.successStatus = options.successStatus ?? 207;
     this.headers = options.headers ?? {};
   }
   init(options) {
-    options.rootInterceptors ??= [];
-    options.rootInterceptors.unshift(async (options2) => {
-      const xHeader = flattenHeader(options2.request.headers["x-orpc-batch"]);
-      if (xHeader === void 0) {
-        return options2.next();
+    const routingInterceptor = async (interceptorOptions) => {
+      const batchHeader = flattenStandardHeader(interceptorOptions.request.headers["orpc-batch"]);
+      if (batchHeader === void 0) {
+        return interceptorOptions.next();
       }
-      let isParsing = false;
+      const mode = batchHeader === "buffered" ? "buffered" : "streaming";
+      let messages;
       try {
-        return await runWithSpan({ name: "handle_batch_request" }, async (span) => {
-          const mode = xHeader === "buffered" ? "buffered" : "streaming";
-          isParsing = true;
-          const parsed = parseBatchRequest({ ...options2.request, body: await options2.request.body() });
-          isParsing = false;
-          span?.setAttribute("batch.mode", mode);
-          span?.setAttribute("batch.size", parsed.length);
-          const maxSize = await value(this.maxSize, options2);
-          if (parsed.length > maxSize) {
-            const message = "Batch request size exceeds the maximum allowed size";
-            setSpanError(span, message);
+        if (interceptorOptions.request.method === "GET") {
+          const [, search] = parseStandardUrl(interceptorOptions.request.url);
+          const params = new URLSearchParams(search);
+          const data = params.getAll("data").at(-1);
+          if (!data) {
             return {
               matched: true,
-              response: {
-                status: 413,
-                headers: {},
-                body: message
-              }
+              response: { status: 400, headers: {}, body: "Missing data parameter for batch request" }
             };
           }
-          const responses = parsed.map(
-            (request, index) => {
-              const mapped = this.mapRequestItem(request, options2);
-              return options2.next({ ...options2, request: { ...mapped, body: () => Promise.resolve(mapped.body) } }).then(({ response: response2, matched }) => {
-                span?.addEvent(`response.${index}.${matched ? "success" : "not_matched"}`);
-                if (matched) {
-                  if (response2.body instanceof Blob || response2.body instanceof FormData || isAsyncIteratorObject(response2.body)) {
-                    return {
-                      index,
-                      status: 500,
-                      headers: {},
-                      body: "Batch responses do not support file/blob, or event-iterator. Please call this procedure separately outside of the batch request."
-                    };
-                  }
-                  return { ...response2, index };
-                }
-                return { index, status: 404, headers: {}, body: "No procedure matched" };
-              }).catch((err) => {
-                Promise.reject(err);
-                return { index, status: 500, headers: {}, body: "Internal server error" };
-              });
-            }
-          );
-          await Promise.race(responses);
-          const status = await value(this.successStatus, responses, options2);
-          const headers = await value(this.headers, responses, options2);
-          const promises = [...responses];
-          const response = await toBatchResponse({
-            status,
-            headers,
-            mode,
-            body: new AsyncIteratorClass(
-              async () => {
-                const handling = promises.filter((p) => p !== void 0);
-                if (handling.length <= 0) {
-                  return { done: true, value: void 0 };
-                }
-                const value2 = await Promise.race(handling);
-                promises[value2.index] = void 0;
-                return { done: false, value: value2 };
-              },
-              async () => {
-              }
-            )
-          });
-          return {
-            matched: true,
-            response
-          };
+          const mightBeMessages = JSON.parse(data);
+          if (!Array.isArray(mightBeMessages) || mightBeMessages.some((m) => !isClientPeerSendMessage(m))) {
+            return {
+              matched: true,
+              response: { status: 400, headers: {}, body: "Invalid batch request data parameter" }
+            };
+          }
+          messages = mightBeMessages;
+        } else {
+          const mightBeMessages = await interceptorOptions.request.resolveBody();
+          if (!Array.isArray(mightBeMessages)) {
+            return {
+              matched: true,
+              response: { status: 400, headers: {}, body: "Invalid batch request body" }
+            };
+          }
+          messages = mightBeMessages;
+        }
+      } catch {
+        return {
+          matched: true,
+          response: { status: 400, headers: {}, body: "Invalid batch request" }
+        };
+      }
+      const maxSize = await value(this.maxSize, interceptorOptions);
+      if (messages.length > maxSize) {
+        return {
+          matched: true,
+          response: { status: 413, headers: {}, body: "Batch request size exceeds the maximum allowed size" }
+        };
+      }
+      const handleIndividualRequest = async (request) => {
+        try {
+          request = this.mapSubrequest(request, interceptorOptions);
+          const { matched, response } = await interceptorOptions.next({ ...interceptorOptions, request });
+          if (!matched) {
+            return { status: 404, headers: {}, body: "No procedure matched" };
+          }
+          return response;
+        } catch (err) {
+          Promise.reject(err);
+          return { status: 500, headers: {}, body: "Internal server error" };
+        }
+      };
+      const status = await value(this.successStatus, interceptorOptions);
+      const headers = await value(this.headers, interceptorOptions);
+      if (mode === "buffered") {
+        const responseMessages = [];
+        const peer2 = new ServerPeer(async (message) => {
+          responseMessages.push(message);
         });
-      } catch (cause) {
-        if (isParsing) {
+        await Promise.all(messages.map((msg) => peer2.message(msg, handleIndividualRequest)));
+        await peer2.close();
+        if (responseMessages.some((msg) => msg.binary !== void 0)) {
+          const chunks = [];
+          for (const message of responseMessages) {
+            const encoded = await encodePeerMessage(message);
+            const bytes = typeof encoded === "string" ? new TextEncoder().encode(encoded) : encoded;
+            const lengthBuffer = new ArrayBuffer(4);
+            new DataView(lengthBuffer).setUint32(0, bytes.byteLength, false);
+            chunks.push(new Uint8Array(lengthBuffer));
+            chunks.push(bytes);
+          }
           return {
             matched: true,
-            response: { status: 400, headers: {}, body: "Invalid batch request, this could be caused by a malformed request body or a missing header" }
+            response: {
+              status,
+              headers,
+              body: new Blob(chunks, { type: "application/octet-stream" })
+            }
           };
         }
-        throw cause;
+        return {
+          matched: true,
+          response: { status, headers, body: responseMessages }
+        };
       }
-    });
+      let streamController;
+      const stream = new ReadableStream({
+        start(controller) {
+          streamController = controller;
+        }
+      });
+      const peer = new ServerPeer(async (message) => {
+        const encoded = await encodePeerMessage(message);
+        const bytes = typeof encoded === "string" ? new TextEncoder().encode(encoded) : encoded;
+        const lengthBuffer = new ArrayBuffer(4);
+        new DataView(lengthBuffer).setUint32(0, bytes.byteLength, false);
+        streamController.enqueue(new Uint8Array(lengthBuffer));
+        streamController.enqueue(bytes);
+      });
+      Promise.all(messages.map((msg) => peer.message(msg, handleIndividualRequest))).then(async () => {
+        streamController.close();
+        await peer.close();
+      }).catch(async (error) => {
+        streamController.error(error);
+        await peer.close(error);
+      });
+      return {
+        matched: true,
+        response: { status, headers, body: stream }
+      };
+    };
+    return {
+      ...options,
+      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+    };
   }
 }
 
-class CORSPlugin {
+class CORSHandlerPlugin {
   options;
-  order = 9e6;
+  name = "~cors";
+  /**
+   * - Do not create spans for CORS preflight requests.
+   * - Run CORS interceptors before batch interceptors so headers are applied to
+   *  the actual response rather than sub-responses.
+   */
+  after = ["~opentelemetry", "~batch"];
   constructor(options = {}) {
     const defaults = {
       origin: (origin) => origin,
@@ -130,19 +179,48 @@ class CORSPlugin {
     };
   }
   init(options) {
-    options.rootInterceptors ??= [];
-    options.rootInterceptors.unshift(async (interceptorOptions) => {
+    const corsHeadersInterceptor = async (interceptorOptions) => {
+      const result = await interceptorOptions.next();
+      if (!result.matched) {
+        return result;
+      }
+      const resHeaders = { ...result.response.headers };
+      const origin = flattenStandardHeader(interceptorOptions.request.headers.origin) ?? "";
+      const allowedOrigins = toArray(await value(this.options.origin, origin, interceptorOptions));
+      if (allowedOrigins.includes("*")) {
+        resHeaders["access-control-allow-origin"] = "*";
+      } else {
+        if (allowedOrigins.includes(origin)) {
+          resHeaders["access-control-allow-origin"] = origin;
+        }
+        resHeaders.vary = interceptorOptions.request.headers.vary ?? "origin";
+      }
+      const allowedTimingOrigins = toArray(await value(this.options.timingOrigin, origin, interceptorOptions));
+      if (allowedTimingOrigins.includes("*")) {
+        resHeaders["timing-allow-origin"] = "*";
+      } else if (allowedTimingOrigins.includes(origin)) {
+        resHeaders["timing-allow-origin"] = origin;
+      }
+      if (this.options.credentials) {
+        resHeaders["access-control-allow-credentials"] = "true";
+      }
+      if (this.options.exposeHeaders?.length) {
+        resHeaders["access-control-expose-headers"] = flattenStandardHeader(this.options.exposeHeaders);
+      }
+      return { ...result, response: { ...result.response, headers: resHeaders } };
+    };
+    const preflightInterceptor = async (interceptorOptions) => {
       if (interceptorOptions.request.method === "OPTIONS") {
         const resHeaders = {};
         if (this.options.maxAge !== void 0) {
           resHeaders["access-control-max-age"] = this.options.maxAge.toString();
         }
         if (this.options.allowMethods?.length) {
-          resHeaders["access-control-allow-methods"] = flattenHeader(this.options.allowMethods);
+          resHeaders["access-control-allow-methods"] = flattenStandardHeader(this.options.allowMethods);
         }
         const allowHeaders = this.options.allowHeaders ?? interceptorOptions.request.headers["access-control-request-headers"];
         if (typeof allowHeaders === "string" || allowHeaders?.length) {
-          resHeaders["access-control-allow-headers"] = flattenHeader(allowHeaders);
+          resHeaders["access-control-allow-headers"] = flattenStandardHeader(allowHeaders);
         }
         return {
           matched: true,
@@ -154,103 +232,85 @@ class CORSPlugin {
         };
       }
       return interceptorOptions.next();
-    });
-    options.rootInterceptors.unshift(async (interceptorOptions) => {
-      const result = await interceptorOptions.next();
-      if (!result.matched) {
-        return result;
-      }
-      const origin = flattenHeader(interceptorOptions.request.headers.origin) ?? "";
-      const allowedOrigin = await value(this.options.origin, origin, interceptorOptions);
-      const allowedOriginArr = Array.isArray(allowedOrigin) ? allowedOrigin : [allowedOrigin];
-      if (allowedOriginArr.includes("*")) {
-        result.response.headers["access-control-allow-origin"] = "*";
-      } else {
-        if (allowedOriginArr.includes(origin)) {
-          result.response.headers["access-control-allow-origin"] = origin;
-        }
-        result.response.headers.vary = interceptorOptions.request.headers.vary ?? "origin";
-      }
-      const allowedTimingOrigin = await value(this.options.timingOrigin, origin, interceptorOptions);
-      const allowedTimingOriginArr = Array.isArray(allowedTimingOrigin) ? allowedTimingOrigin : [allowedTimingOrigin];
-      if (allowedTimingOriginArr.includes("*")) {
-        result.response.headers["timing-allow-origin"] = "*";
-      } else if (allowedTimingOriginArr.includes(origin)) {
-        result.response.headers["timing-allow-origin"] = origin;
-      }
-      if (this.options.credentials) {
-        result.response.headers["access-control-allow-credentials"] = "true";
-      }
-      if (this.options.exposeHeaders?.length) {
-        result.response.headers["access-control-expose-headers"] = flattenHeader(this.options.exposeHeaders);
-      }
-      return result;
-    });
+    };
+    return {
+      ...options,
+      routingInterceptors: [
+        corsHeadersInterceptor,
+        preflightInterceptor,
+        ...toArray(options.routingInterceptors)
+      ]
+    };
   }
 }
 
-class RequestHeadersPlugin {
+class RequestHeadersHandlerPlugin {
+  name = "~request-headers";
   init(options) {
-    options.rootInterceptors ??= [];
-    options.rootInterceptors.push((interceptorOptions) => {
-      const reqHeaders = interceptorOptions.context.reqHeaders ?? toFetchHeaders(interceptorOptions.request.headers);
-      return interceptorOptions.next({
-        ...interceptorOptions,
-        context: {
-          ...interceptorOptions.context,
-          reqHeaders
-        }
-      });
-    });
+    return {
+      ...options,
+      interceptors: [
+        (interceptorOptions) => {
+          const reqHeaders = interceptorOptions.context.reqHeaders ?? toFetchHeaders(interceptorOptions.request.headers);
+          return interceptorOptions.next({
+            ...interceptorOptions,
+            context: {
+              ...interceptorOptions.context,
+              reqHeaders
+            }
+          });
+        },
+        ...toArray(options.interceptors)
+      ]
+    };
   }
 }
 
-class ResponseHeadersPlugin {
+class ResponseHeadersHandlerPlugin {
+  name = "~response-headers";
+  /**
+   * Interceptors should run after batch interceptors so headers are applied to each sub-response.
+   */
+  before = ["~batch"];
   init(options) {
-    options.rootInterceptors ??= [];
-    options.rootInterceptors.push(async (interceptorOptions) => {
-      const resHeaders = interceptorOptions.context.resHeaders ?? new Headers();
-      const result = await interceptorOptions.next({
-        ...interceptorOptions,
-        context: {
-          ...interceptorOptions.context,
-          resHeaders
-        }
-      });
-      if (!result.matched) {
-        return result;
-      }
-      const responseHeaders = clone(result.response.headers);
-      for (const [key, value] of resHeaders) {
-        if (Array.isArray(responseHeaders[key])) {
-          responseHeaders[key].push(value);
-        } else if (responseHeaders[key] !== void 0) {
-          responseHeaders[key] = [responseHeaders[key], value];
-        } else {
-          responseHeaders[key] = value;
-        }
-      }
-      return {
-        ...result,
-        response: {
-          ...result.response,
-          headers: responseHeaders
-        }
-      };
-    });
+    return {
+      ...options,
+      routingInterceptors: [
+        async (interceptorOptions) => {
+          const resHeaders = new Headers(interceptorOptions.context.resHeaders);
+          const result = await interceptorOptions.next({
+            ...interceptorOptions,
+            context: {
+              ...interceptorOptions.context,
+              resHeaders
+            }
+          });
+          if (!result.response) {
+            return result;
+          }
+          return {
+            ...result,
+            response: {
+              ...result.response,
+              headers: mergeStandardHeaders(result.response.headers, toStandardHeaders(resHeaders))
+            }
+          };
+        },
+        ...toArray(options.routingInterceptors)
+      ]
+    };
   }
 }
 
-class experimental_RethrowHandlerPlugin {
+class RethrowHandlerPlugin {
+  name = "~rethrow";
   filter;
   CONTEXT_SYMBOL = Symbol("ORPC_RETHROW_HANDLER_PLUGIN_CONTEXT");
   constructor(options) {
     this.filter = options.filter;
   }
   init(options) {
-    options.rootInterceptors ??= [];
-    options.interceptors ??= [];
-    options.rootInterceptors.push(async (options2) => {
+    const routingInterceptor = async (options2) => {
       const pluginContext = {};
       const result = await options2.next({
         ...options2,
@@ -263,8 +323,8 @@ class experimental_RethrowHandlerPlugin {
         throw pluginContext.error.value;
       }
       return result;
-    });
-    options.interceptors.unshift(async (options2) => {
+    };
+    const interceptor = async (options2) => {
       const pluginContext = options2.context[this.CONTEXT_SYMBOL];
       if (!pluginContext) {
         throw new TypeError("[RethrowHandlerPlugin] Rethrow handler context has been corrupted or modified by another plugin or interceptor");
@@ -272,57 +332,26 @@ class experimental_RethrowHandlerPlugin {
       try {
         return await options2.next();
       } catch (error) {
-        if (value(this.filter, error, options2)) {
+        if (this.filter(error, options2)) {
           pluginContext.error = { value: error };
-          return { matched: false, response: void 0 };
         }
         throw error;
       }
-    });
-  }
-}
-
-const SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL = Symbol("SIMPLE_CSRF_PROTECTION_CONTEXT");
-class SimpleCsrfProtectionHandlerPlugin {
-  headerName;
-  headerValue;
-  exclude;
-  error;
-  constructor(options = {}) {
-    this.headerName = options.headerName ?? "x-csrf-token";
-    this.headerValue = options.headerValue ?? "orpc";
-    this.exclude = options.exclude ?? false;
-    this.error = options.error ?? new ORPCError("CSRF_TOKEN_MISMATCH", {
-      status: 403,
-      message: "Invalid CSRF token"
-    });
-  }
-  order = 8e6;
-  init(options) {
-    options.rootInterceptors ??= [];
-    options.clientInterceptors ??= [];
-    options.rootInterceptors.unshift(async (options2) => {
-      const headerName = await value(this.headerName, options2);
-      const headerValue = await value(this.headerValue, options2);
-      return options2.next({
-        ...options2,
-        context: {
-          ...options2.context,
-          [SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]: options2.request.headers[headerName] === headerValue
-        }
-      });
-    });
-    options.clientInterceptors.unshift(async (options2) => {
-      if (typeof options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL] !== "boolean") {
-        throw new TypeError("[SimpleCsrfProtectionHandlerPlugin] CSRF protection context has been corrupted or modified by another plugin or interceptor");
-      }
-      const excluded = await value(this.exclude, options2);
-      if (!excluded && !options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]) {
-        throw this.error;
-      }
-      return options2.next();
-    });
+    };
+    return {
+      ...options,
+      routingInterceptors: [
+        ...toArray(options.routingInterceptors),
+        routingInterceptor
+        // rethrow as early as possible and keep it close to `interceptor` to avoid a corrupted or modified context
+      ],
+      interceptors: [
+        interceptor,
+        // catch as many errors as possible
+        ...toArray(options.interceptors)
+      ]
+    };
   }
 }
 
-export { BatchHandlerPlugin, CORSPlugin, RequestHeadersPlugin, ResponseHeadersPlugin, SimpleCsrfProtectionHandlerPlugin, experimental_RethrowHandlerPlugin };
+export { BatchHandlerPlugin, CORSHandlerPlugin, RequestHeadersHandlerPlugin, ResponseHeadersHandlerPlugin, RethrowHandlerPlugin };