@orpc/server 2.0.0-beta.24 → 2.0.0-beta.26

package/dist/plugins/index.mjs

@@ -1,10 +1,9 @@
 import { toArray, value, isCompressibleContentType, isAsyncIteratorObject, stringifyJSON } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standardserver/core';
 import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
-export { C as CSRFGuardHandlerPlugin } from '../shared/server.D_QauotT.mjs';
 import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standardserver/fetch';
 export { R as RequestLimitHandlerPlugin } from '../shared/server.Cd4Z1hpV.mjs';
-import '@orpc/client';
+import { ORPCError } from '@orpc/client';
 
 const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 class BatchHandlerPlugin {
@@ -62,6 +61,12 @@ class BatchHandlerPlugin {
               response: { status: 400, headers: {}, body: "Invalid batch request data parameter" }
             };
           }
+          if (mightBeMessages.some((m) => m.kind === "request" && m.json.method !== "GET")) {
+            return {
+              matched: true,
+              response: { status: 400, headers: {}, body: "GET batch requests only accept GET sub-requests" }
+            };
+          }
           messages = mightBeMessages;
         } else {
           const mightBeMessages = await interceptorOptions.request.resolveBody();
@@ -286,6 +291,48 @@ class CORSHandlerPlugin {
   }
 }
 
+class MethodOverrideHandlerPlugin {
+  name = "~method-override";
+  /**
+   * Should override batch sub-request methods, not the original batch request.
+   */
+  before = ["~batch"];
+  param;
+  methods;
+  constructor(options = {}) {
+    this.param = options.param ?? "method";
+    this.methods = new Set((options.methods ?? ["PUT", "PATCH", "DELETE"]).map((method) => method.toUpperCase()));
+  }
+  init(options) {
+    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+      const { request } = interceptorOptions;
+      if (request.method !== "POST") {
+        return next();
+      }
+      const [pathname, search, hash] = parseStandardUrl(request.url);
+      const params = new URLSearchParams(search);
+      const raw = params.getAll(this.param).at(-1);
+      if (raw === void 0) {
+        return next();
+      }
+      const method = raw.toUpperCase();
+      if (!this.methods.has(method)) {
+        return next();
+      }
+      params.delete(this.param);
+      const url = `${pathname}${params.size ? `?${params}` : ""}${hash ?? ""}`;
+      return next({
+        ...interceptorOptions,
+        request: { ...request, method, url }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+    };
+  }
+}
+
 class RequestCompressionHandlerPlugin {
   name = "~request-compression";
   /**
@@ -633,4 +680,29 @@ class RethrowHandlerPlugin {
   }
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin };
+class SimpleCsrfProtectionHandlerPlugin {
+  name = "~simple-csrf-protection";
+  init(options) {
+    const interceptor = async (interceptorOptions) => {
+      const mode = flattenStandardHeader(
+        interceptorOptions.request.headers["sec-fetch-mode"]
+      )?.toLowerCase();
+      if (mode === void 0) {
+        return interceptorOptions.next();
+      }
+      if (mode === "cors" || mode === "same-origin") {
+        return interceptorOptions.next();
+      }
+      throw new ORPCError("FORBIDDEN", {
+        message: "Request blocked by CSRF protection."
+      });
+    };
+    return {
+      ...options,
+      // appended last so user's interceptors can catch ORPCError
+      interceptors: [...toArray(options.interceptors), interceptor]
+    };
+  }
+}
+
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };

package/dist/shared/{server.BUvC0G_8.d.ts → server.C2n16pp0.d.ts}

@@ -6,6 +6,16 @@ import { A as AnyRouter } from './server.DtfwuV6U.js';
 import { AnyProcedureContract } from '@orpc/contract';
 import { c as StandardHandlerHandleOptions, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure } from './server.DrN1Pj1-.js';
 
+/**
+ * Methods that can invoke procedures by default. Browsers cannot trigger them
+ * cross-site without a CORS preflight or an HTML form, unlike `GET`, which a plain
+ * `<a>` click or redirect can trigger with `SameSite=Lax` cookies attached. Other
+ * methods (`HEAD`, `OPTIONS`, `QUERY`, ...) have safe semantics that should not
+ * invoke a procedure that can modify data.
+ *
+ * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+ */
+declare const RPC_DEFAULT_ALLOW_METHODS: readonly StandardMethod[];
 interface RPCMatcherOptions {
     /**
      * Filter which procedures are exposed for matching. Return `false` to exclude.
@@ -13,15 +23,27 @@ interface RPCMatcherOptions {
      * @default true
      */
     filter?: Value<boolean, [procedure: AnyProcedureContract | AnyProcedure, path: string[]]>;
+    /**
+     * Restricts which HTTP methods can invoke procedures, either with a list of allowed
+     * methods or decided per request via a function. Requests using a disallowed method
+     * are treated as unmatched. `GET` is excluded by default because it is exposed to
+     * Cross-Site Request Forgery (CSRF) attacks.
+     *
+     * @default RPC_DEFAULT_ALLOW_METHODS (['POST', 'PUT', 'PATCH', 'DELETE'])
+     * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+     */
+    allowMethods?: readonly StandardMethod[] | ((method: StandardMethod, procedure: AnyProcedure, path: string[]) => boolean);
 }
 declare class RPCMatcher {
     private readonly filter;
+    private readonly allowMethodsSet;
+    private readonly allowMethodsFn;
     private readonly rootRouter;
     private readonly tree;
     private readonly pendingLazyRouters;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
-    match(_method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
+    match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
         path: string[];
         procedure: AnyProcedure;
     } | undefined>;
@@ -65,5 +87,5 @@ declare class RPCHandlerCodec<T extends Context> implements StandardHandlerCodec
     encodeError(error: AnyORPCError, _procedure: AnyProcedure, _path: string[], _options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
 }
 
-export { RPCHandlerCodec as a, RPCMatcher as b };
+export { RPCHandlerCodec as a, RPCMatcher as b, RPC_DEFAULT_ALLOW_METHODS as d };
 export type { RPCHandlerCodecOptions as R, RPCMatcherOptions as c };

package/dist/shared/{server.DEGjTAPW.mjs → server.Cbv46U7N.mjs}

@@ -121,13 +121,22 @@ class OtelHandlerPlugin {
   }
 }
 
+const RPC_DEFAULT_ALLOW_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
 class RPCMatcher {
   filter;
+  allowMethodsSet;
+  allowMethodsFn;
   rootRouter;
   tree = /* @__PURE__ */ new Map();
   pendingLazyRouters = /* @__PURE__ */ new Map();
   constructor(router, options = {}) {
     this.filter = options.filter ?? true;
+    const allowMethods = options.allowMethods ?? RPC_DEFAULT_ALLOW_METHODS;
+    if (typeof allowMethods !== "function") {
+      this.allowMethodsSet = new Set(allowMethods);
+    } else {
+      this.allowMethodsFn = allowMethods;
+    }
     this.rootRouter = router;
     this.index(router);
   }
@@ -147,7 +156,10 @@ class RPCMatcher {
       this.pendingLazyRouters.set(pathToHttpPath(result.path), result);
     }
   }
-  async match(_method, pathname, prefix) {
+  async match(method, pathname, prefix) {
+    if (this.allowMethodsSet && !this.allowMethodsSet.has(method)) {
+      return void 0;
+    }
     if (pathname.length > 1 && pathname.endsWith("/")) {
       pathname = pathname.slice(0, -1);
     }
@@ -182,9 +194,13 @@ class RPCMatcher {
     if (entry === void 0) {
       return void 0;
     }
+    const procedure = entry.procedure ?? await this.resolveProcedure(entry);
+    if (this.allowMethodsFn && !this.allowMethodsFn(method, procedure, entry.path)) {
+      return void 0;
+    }
     return {
       path: entry.path,
-      procedure: entry.procedure ?? await this.resolveProcedure(entry)
+      procedure
     };
   }
   resolvePendingLazyRouters(pathname) {
@@ -285,4 +301,4 @@ class RPCHandlerCodec {
   }
 }
 
-export { CompositeStandardHandlerPlugin as C, OtelHandlerPlugin as O, RPCHandlerCodec as R, StandardHandler as S, RPCMatcher as a };
+export { CompositeStandardHandlerPlugin as C, OtelHandlerPlugin as O, RPCHandlerCodec as R, StandardHandler as S, RPCMatcher as a, RPC_DEFAULT_ALLOW_METHODS as b };

package/dist/shared/{server.zySQaS-n.d.mts → server.CkNnZ5F-.d.mts}

@@ -6,6 +6,16 @@ import { A as AnyRouter } from './server.Dm0os-OP.mjs';
 import { AnyProcedureContract } from '@orpc/contract';
 import { c as StandardHandlerHandleOptions, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure } from './server.JbCIPL4P.mjs';
 
+/**
+ * Methods that can invoke procedures by default. Browsers cannot trigger them
+ * cross-site without a CORS preflight or an HTML form, unlike `GET`, which a plain
+ * `<a>` click or redirect can trigger with `SameSite=Lax` cookies attached. Other
+ * methods (`HEAD`, `OPTIONS`, `QUERY`, ...) have safe semantics that should not
+ * invoke a procedure that can modify data.
+ *
+ * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+ */
+declare const RPC_DEFAULT_ALLOW_METHODS: readonly StandardMethod[];
 interface RPCMatcherOptions {
     /**
      * Filter which procedures are exposed for matching. Return `false` to exclude.
@@ -13,15 +23,27 @@ interface RPCMatcherOptions {
      * @default true
      */
     filter?: Value<boolean, [procedure: AnyProcedureContract | AnyProcedure, path: string[]]>;
+    /**
+     * Restricts which HTTP methods can invoke procedures, either with a list of allowed
+     * methods or decided per request via a function. Requests using a disallowed method
+     * are treated as unmatched. `GET` is excluded by default because it is exposed to
+     * Cross-Site Request Forgery (CSRF) attacks.
+     *
+     * @default RPC_DEFAULT_ALLOW_METHODS (['POST', 'PUT', 'PATCH', 'DELETE'])
+     * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+     */
+    allowMethods?: readonly StandardMethod[] | ((method: StandardMethod, procedure: AnyProcedure, path: string[]) => boolean);
 }
 declare class RPCMatcher {
     private readonly filter;
+    private readonly allowMethodsSet;
+    private readonly allowMethodsFn;
     private readonly rootRouter;
     private readonly tree;
     private readonly pendingLazyRouters;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
-    match(_method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
+    match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
         path: string[];
         procedure: AnyProcedure;
     } | undefined>;
@@ -65,5 +87,5 @@ declare class RPCHandlerCodec<T extends Context> implements StandardHandlerCodec
     encodeError(error: AnyORPCError, _procedure: AnyProcedure, _path: string[], _options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
 }
 
-export { RPCHandlerCodec as a, RPCMatcher as b };
+export { RPCHandlerCodec as a, RPCMatcher as b, RPC_DEFAULT_ALLOW_METHODS as d };
 export type { RPCHandlerCodecOptions as R, RPCMatcherOptions as c };

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@orpc/server",
   "type": "module",
-  "version": "2.0.0-beta.24",
+  "version": "2.0.0-beta.26",
   "license": "MIT",
+  "funding": "https://github.com/sponsors/dinwwwh",
   "homepage": "https://orpc.dev",
   "repository": {
     "type": "git",
@@ -106,9 +107,9 @@
     "@standardserver/node": "^0.7.1",
     "@standardserver/peer": "^0.7.1",
     "cookie": "^2.0.1",
-    "@orpc/client": "2.0.0-beta.24",
-    "@orpc/contract": "2.0.0-beta.24",
-    "@orpc/shared": "2.0.0-beta.24"
+    "@orpc/client": "2.0.0-beta.26",
+    "@orpc/contract": "2.0.0-beta.26",
+    "@orpc/shared": "2.0.0-beta.26"
   },
   "devDependencies": {
     "crossws": "^0.4.6",

package/dist/shared/server.D_QauotT.mjs

@@ -1,30 +0,0 @@
-import { ORPCError } from '@orpc/client';
-import { toArray } from '@orpc/shared';
-import { flattenStandardHeader } from '@standardserver/core';
-
-class CSRFGuardHandlerPlugin {
-  name = "~csrf-guard";
-  init(options) {
-    const interceptor = async (interceptorOptions) => {
-      const mode = flattenStandardHeader(
-        interceptorOptions.request.headers["sec-fetch-mode"]
-      )?.toLowerCase();
-      if (mode === void 0) {
-        return interceptorOptions.next();
-      }
-      if (mode === "cors" || mode === "same-origin") {
-        return interceptorOptions.next();
-      }
-      throw new ORPCError("FORBIDDEN", {
-        message: "Request blocked by CSRF protection."
-      });
-    };
-    return {
-      ...options,
-      // appended last so user's interceptors can catch ORPCError
-      interceptors: [...toArray(options.interceptors), interceptor]
-    };
-  }
-}
-
-export { CSRFGuardHandlerPlugin as C };