@orpc/server 2.0.0-beta.3 → 2.0.0-beta.31

package/dist/plugins/index.mjs

@@ -1,10 +1,11 @@
-import { toArray, value } from '@orpc/shared';
-import { flattenStandardHeader, parseStandardUrl, mergeStandardHeaders } from '@standardserver/core';
+import { toArray, value, isNoTransformCacheControl, parseAcceptEncodingQualities, isCompressibleContentType, varyByAcceptEncoding, isAsyncIteratorObject, stringifyJSON, anyAbortSignal, override, wrapAsyncIterator, wrapReadableStream, AbortError } from '@orpc/shared';
+import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standardserver/core';
 import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
-export { C as CSRFGuardHandlerPlugin } from '../shared/server.D_QauotT.mjs';
-import { toFetchHeaders, toStandardHeaders } from '@standardserver/fetch';
+import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standardserver/fetch';
+export { R as RequestLimitHandlerPlugin } from '../shared/server.Cd4Z1hpV.mjs';
 import '@orpc/client';
 
+const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 class BatchHandlerPlugin {
   name = "~batch";
   /**
@@ -16,19 +17,28 @@ class BatchHandlerPlugin {
   mapSubrequest;
   successStatus;
   headers;
+  keepAliveEnabled;
+  keepAliveInterval;
   constructor(options = {}) {
     this.maxSize = options.maxSize ?? 10;
     this.mapSubrequest = options.mapSubrequest ?? ((subRequest, { request: batchRequest }) => ({
       ...subRequest,
       headers: {
-        ...batchRequest.headers,
         ...subRequest.headers,
+        /**
+         * The batch request headers win over the subrequest ones. They are the only ones the
+         * transport actually saw, so headers the browser injects on its own, such as `cookie`
+         * or `origin`, cannot be overridden by a subrequest, which is just request payload.
+         */
+        ...batchRequest.headers,
         "orpc-batch": void 0
         // useful in case batch plugin is used multiple times
       }
     }));
     this.successStatus = options.successStatus ?? 207;
     this.headers = options.headers ?? {};
+    this.keepAliveEnabled = options.keepAlive?.enabled ?? true;
+    this.keepAliveInterval = options.keepAlive?.interval ?? 15e3;
   }
   init(options) {
     const routingInterceptor = async (interceptorOptions) => {
@@ -59,7 +69,7 @@ class BatchHandlerPlugin {
           messages = mightBeMessages;
         } else {
           const mightBeMessages = await interceptorOptions.request.resolveBody();
-          if (!Array.isArray(mightBeMessages)) {
+          if (!Array.isArray(mightBeMessages) || mightBeMessages.some((m) => !isClientPeerSendMessage(m))) {
             return {
               matched: true,
               response: { status: 400, headers: {}, body: "Invalid batch request body" }
@@ -73,6 +83,13 @@ class BatchHandlerPlugin {
           response: { status: 400, headers: {}, body: "Invalid batch request" }
         };
       }
+      const outerMethod = interceptorOptions.request.method;
+      if ((outerMethod === "GET" || outerMethod === "QUERY") && messages.some((message) => message.kind === "request" && message.json.method !== outerMethod)) {
+        return {
+          matched: true,
+          response: { status: 400, headers: {}, body: `${outerMethod} batch requests only accept ${outerMethod} sub-requests` }
+        };
+      }
       const maxSize = await value(this.maxSize, interceptorOptions);
       if (messages.length > maxSize) {
         return {
@@ -117,7 +134,7 @@ class BatchHandlerPlugin {
             response: {
               status,
               headers,
-              body: new Blob(chunks, { type: "application/octet-stream" })
+              body: new Blob(chunks, { type: BATCH_CONTENT_TYPE })
             }
           };
         }
@@ -127,9 +144,35 @@ class BatchHandlerPlugin {
         };
       }
       let streamController;
+      let keepAliveTimer;
+      const clearKeepAlive = () => {
+        if (keepAliveTimer !== void 0) {
+          clearInterval(keepAliveTimer);
+          keepAliveTimer = void 0;
+        }
+      };
+      const scheduleKeepAlive = () => {
+        if (!this.keepAliveEnabled) {
+          return;
+        }
+        clearKeepAlive();
+        keepAliveTimer = setInterval(() => {
+          try {
+            const lengthBuffer = new ArrayBuffer(4);
+            new DataView(lengthBuffer).setUint32(0, 0, false);
+            streamController.enqueue(new Uint8Array(lengthBuffer));
+          } catch {
+            clearKeepAlive();
+          }
+        }, this.keepAliveInterval);
+      };
       const stream = new ReadableStream({
         start(controller) {
           streamController = controller;
+          scheduleKeepAlive();
+        },
+        cancel() {
+          clearKeepAlive();
         }
       });
       const peer = new ServerPeer(async (message) => {
@@ -139,17 +182,24 @@ class BatchHandlerPlugin {
         new DataView(lengthBuffer).setUint32(0, bytes.byteLength, false);
         streamController.enqueue(new Uint8Array(lengthBuffer));
         streamController.enqueue(bytes);
+        scheduleKeepAlive();
       });
       Promise.all(messages.map((msg) => peer.message(msg, handleIndividualRequest))).then(async () => {
+        clearKeepAlive();
         streamController.close();
         await peer.close();
       }).catch(async (error) => {
+        clearKeepAlive();
         streamController.error(error);
         await peer.close(error);
       });
       return {
         matched: true,
-        response: { status, headers, body: stream }
+        response: {
+          status,
+          headers: { ...headers, "content-type": BATCH_CONTENT_TYPE },
+          body: stream
+        }
       };
     };
     return {
@@ -170,8 +220,8 @@ class CORSHandlerPlugin {
   after = ["~opentelemetry", "~batch"];
   constructor(options = {}) {
     const defaults = {
-      origin: (origin) => origin,
-      allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"]
+      origin: "*",
+      allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"]
     };
     this.options = {
       ...defaults,
@@ -185,20 +235,23 @@ class CORSHandlerPlugin {
         return result;
       }
       const resHeaders = { ...result.response.headers };
-      const origin = flattenStandardHeader(interceptorOptions.request.headers.origin) ?? "";
+      const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
       const allowedOrigins = toArray(await value(this.options.origin, origin, interceptorOptions));
       if (allowedOrigins.includes("*")) {
         resHeaders["access-control-allow-origin"] = "*";
       } else {
-        if (allowedOrigins.includes(origin)) {
+        if (origin !== void 0 && allowedOrigins.includes(origin)) {
           resHeaders["access-control-allow-origin"] = origin;
         }
-        resHeaders.vary = interceptorOptions.request.headers.vary ?? "origin";
+        const existingVary = flattenStandardHeader(resHeaders.vary);
+        if (!existingVary?.split(",").some((v) => v.trim().toLowerCase() === "origin")) {
+          resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
+        }
       }
       const allowedTimingOrigins = toArray(await value(this.options.timingOrigin, origin, interceptorOptions));
       if (allowedTimingOrigins.includes("*")) {
         resHeaders["timing-allow-origin"] = "*";
-      } else if (allowedTimingOrigins.includes(origin)) {
+      } else if (origin !== void 0 && allowedTimingOrigins.includes(origin)) {
         resHeaders["timing-allow-origin"] = origin;
       }
       if (this.options.credentials) {
@@ -244,6 +297,147 @@ class CORSHandlerPlugin {
   }
 }
 
+class GetMethodCsrfProtectionHandlerPlugin {
+  name = "~get-method-csrf-protection";
+  /** Judge the real request, before batch splits it into client-authored sub-requests. */
+  after = ["~batch"];
+  init(options) {
+    const routingInterceptor = (interceptorOptions) => {
+      if (this.isAllowed(interceptorOptions)) {
+        return interceptorOptions.next();
+      }
+      return Promise.resolve({
+        matched: true,
+        response: { status: 403, headers: {}, body: "Request blocked by CSRF protection." }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+    };
+  }
+  isAllowed({ request }) {
+    if (request.method !== "GET") {
+      return true;
+    }
+    const site = flattenStandardHeader(request.headers["sec-fetch-site"])?.toLowerCase();
+    if (site === void 0 || site === "same-origin" || site === "same-site") {
+      return true;
+    }
+    const mode = flattenStandardHeader(request.headers["sec-fetch-mode"])?.toLowerCase();
+    const dest = flattenStandardHeader(request.headers["sec-fetch-dest"])?.toLowerCase();
+    if (mode === void 0 || dest === void 0) {
+      return false;
+    }
+    return mode !== "navigate" || dest !== "document";
+  }
+}
+
+class MethodOverrideHandlerPlugin {
+  name = "~method-override";
+  /**
+   * Should override batch sub-request methods, not the original batch request.
+   */
+  before = ["~batch"];
+  param;
+  methods;
+  constructor(options = {}) {
+    this.param = options.param ?? "method";
+    this.methods = new Set((options.methods ?? ["PUT", "PATCH", "DELETE"]).map((method) => method.toUpperCase()));
+  }
+  init(options) {
+    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+      const { request } = interceptorOptions;
+      if (request.method !== "POST") {
+        return next();
+      }
+      const [pathname, search, hash] = parseStandardUrl(request.url);
+      const params = new URLSearchParams(search);
+      const raw = params.getAll(this.param).at(-1);
+      if (raw === void 0) {
+        return next();
+      }
+      const method = raw.toUpperCase();
+      if (!this.methods.has(method)) {
+        return next();
+      }
+      params.delete(this.param);
+      const url = `${pathname}${params.size ? `?${params}` : ""}${hash ?? ""}`;
+      return next({
+        ...interceptorOptions,
+        request: { ...request, method, url }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+    };
+  }
+}
+
+class RequestCompressionHandlerPlugin {
+  name = "~request-compression";
+  /**
+   * Should decompress the original batch request body instead of sub-requests.
+   */
+  after = ["~batch"];
+  init(options) {
+    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+      const encodings = parseContentEncodings(
+        flattenStandardHeader(interceptorOptions.request.headers["content-encoding"])
+      );
+      if (encodings.length === 0 || !encodings.every(isSupportedEncoding)) {
+        return next();
+      }
+      const decompressedHeaders = {
+        ...interceptorOptions.request.headers,
+        "content-length": void 0,
+        "content-encoding": void 0
+      };
+      return next({
+        ...interceptorOptions,
+        request: {
+          ...interceptorOptions.request,
+          headers: decompressedHeaders,
+          async resolveBody(hint) {
+            const stream = await interceptorOptions.request.resolveBody("octet-stream");
+            if (!(stream instanceof ReadableStream)) {
+              return stream;
+            }
+            let decompressedStream = stream;
+            for (let i = encodings.length - 1; i >= 0; i--) {
+              decompressedStream = decompressedStream.pipeThrough(
+                new DecompressionStream(encodings[i])
+              );
+            }
+            const response = new Response(decompressedStream, {
+              headers: toFetchHeaders(decompressedHeaders)
+            });
+            return toStandardBody(response, { hint });
+          }
+        }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [
+        routingInterceptor,
+        ...toArray(options.routingInterceptors)
+      ]
+    };
+  }
+}
+const SUPPORTED_ENCODINGS = ["gzip", "deflate", "deflate-raw"];
+function isSupportedEncoding(encoding) {
+  return SUPPORTED_ENCODINGS.includes(encoding);
+}
+function parseContentEncodings(header) {
+  if (header === void 0) {
+    return [];
+  }
+  return header.split(",").map((part) => part.trim().toLowerCase());
+}
+
 class RequestHeadersHandlerPlugin {
   name = "~request-headers";
   init(options) {
@@ -266,6 +460,175 @@ class RequestHeadersHandlerPlugin {
   }
 }
 
+const AVG_BYTES_PER_CHAR = 1.2;
+class ResponseCompressionHandlerPlugin {
+  name = "~response-compression";
+  /**
+   * Compression should be done after batching, to compress the final response.
+   * Compression should also be done after response headers are set, to access final headers like Content-Type and Cache-Control.
+   */
+  after = ["~batch", "~response-headers"];
+  encodings;
+  threshold;
+  constructor(options = {}) {
+    this.encodings = options.encodings ?? ["gzip", "deflate"];
+    this.threshold = options.threshold ?? 1024;
+  }
+  init(options) {
+    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+      const result = await next();
+      if (!result.matched) {
+        return result;
+      }
+      const response = result.response;
+      const contentEncoding = flattenStandardHeader(response.headers["content-encoding"])?.trim()?.toLowerCase();
+      if (contentEncoding !== void 0) {
+        return result;
+      }
+      if (response.status === 206 || response.headers["content-range"] !== void 0) {
+        return result;
+      }
+      if (isNoTransformCacheControl(flattenStandardHeader(response.headers["cache-control"]))) {
+        return result;
+      }
+      const acceptEncodings = parseAcceptEncodingQualities(
+        flattenStandardHeader(interceptorOptions.request.headers["accept-encoding"])
+      );
+      const encoding = this.encodings.find((enc) => (acceptEncodings.get(enc) ?? 0) > 0);
+      if (encoding === void 0) {
+        return result;
+      }
+      const body = response.body;
+      const headers = response.headers;
+      if (body instanceof ReadableStream) {
+        const contentLength = Number(flattenStandardHeader(headers["content-length"]));
+        if ((!Number.isFinite(contentLength) || contentLength >= this.threshold) && isCompressibleContentType(flattenStandardHeader(headers["content-type"]))) {
+          return {
+            ...result,
+            response: {
+              ...response,
+              body: body.pipeThrough(new CompressionStream(encoding)),
+              headers: {
+                ...headers,
+                "standard-server": "octet-stream",
+                "content-length": [],
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(flattenStandardHeader(headers.vary))
+              }
+            }
+          };
+        }
+      } else if (body instanceof Blob) {
+        if ((!Number.isFinite(body.size) || body.size >= this.threshold) && isCompressibleContentType(body.type)) {
+          const contentDisposition = headers["content-disposition"] ?? generateContentDisposition(
+            body instanceof File ? body.name : "blob"
+          );
+          return {
+            ...result,
+            response: {
+              ...response,
+              body: body.stream().pipeThrough(new CompressionStream(encoding)),
+              headers: {
+                ...headers,
+                "standard-server": "file",
+                "content-type": body.type,
+                "content-length": [],
+                "content-disposition": contentDisposition,
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(flattenStandardHeader(headers.vary))
+              }
+            }
+          };
+        }
+      } else if (body instanceof FormData) {
+        const PART_OVERHEAD = 64;
+        let contentLength = 0;
+        for (const [key, value] of body) {
+          contentLength += PART_OVERHEAD + key.length;
+          if (value instanceof Blob) {
+            if (!Number.isFinite(value.size)) {
+              if (!isCompressibleContentType(value.type)) {
+                contentLength = -Infinity;
+                break;
+              }
+              contentLength = Infinity;
+            } else {
+              contentLength += isCompressibleContentType(value.type) ? value.size : -value.size;
+            }
+          } else {
+            contentLength += value.length * AVG_BYTES_PER_CHAR;
+          }
+        }
+        if (contentLength >= this.threshold) {
+          const res = new Response(body);
+          const compressedStream = res.body.pipeThrough(new CompressionStream(encoding));
+          return {
+            ...result,
+            response: {
+              ...response,
+              body: compressedStream,
+              headers: {
+                ...headers,
+                "standard-server": [],
+                "content-type": res.headers.get("content-type"),
+                "content-length": [],
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(flattenStandardHeader(headers.vary))
+              }
+            }
+          };
+        }
+      } else if (body instanceof URLSearchParams) {
+        const string = body.toString();
+        if (string.length * AVG_BYTES_PER_CHAR >= this.threshold) {
+          return {
+            ...result,
+            response: {
+              ...response,
+              body: new Blob([string]).stream().pipeThrough(new CompressionStream(encoding)),
+              headers: {
+                ...headers,
+                "standard-server": [],
+                "content-type": "application/x-www-form-urlencoded",
+                "content-length": [],
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(flattenStandardHeader(headers.vary))
+              }
+            }
+          };
+        }
+      } else if (body !== void 0 && !isAsyncIteratorObject(body)) {
+        const string = stringifyJSON(body);
+        if (string.length * AVG_BYTES_PER_CHAR >= this.threshold) {
+          return {
+            ...result,
+            response: {
+              ...response,
+              body: new Blob([string]).stream().pipeThrough(new CompressionStream(encoding)),
+              headers: {
+                ...headers,
+                "standard-server": [],
+                "content-type": "application/json",
+                "content-length": [],
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(flattenStandardHeader(headers.vary))
+              }
+            }
+          };
+        }
+      }
+      return result;
+    };
+    return {
+      ...options,
+      routingInterceptors: [
+        routingInterceptor,
+        ...toArray(options.routingInterceptors)
+      ]
+    };
+  }
+}
+
 class ResponseHeadersHandlerPlugin {
   name = "~response-headers";
   /**
@@ -302,4 +665,105 @@ class ResponseHeadersHandlerPlugin {
   }
 }
 
-export { BatchHandlerPlugin, CORSHandlerPlugin, RequestHeadersHandlerPlugin, ResponseHeadersHandlerPlugin };
+class RethrowHandlerPlugin {
+  name = "~rethrow";
+  filter;
+  CONTEXT_SYMBOL = Symbol("ORPC_RETHROW_HANDLER_PLUGIN_CONTEXT");
+  constructor(options) {
+    this.filter = options.filter;
+  }
+  init(options) {
+    const routingInterceptor = async (options2) => {
+      const pluginContext = {};
+      const result = await options2.next({
+        ...options2,
+        context: {
+          ...options2.context,
+          [this.CONTEXT_SYMBOL]: pluginContext
+        }
+      });
+      if (pluginContext.error) {
+        throw pluginContext.error.value;
+      }
+      return result;
+    };
+    const interceptor = async (options2) => {
+      const pluginContext = options2.context[this.CONTEXT_SYMBOL];
+      if (!pluginContext) {
+        throw new TypeError("[RethrowHandlerPlugin] Rethrow handler context has been corrupted or modified by another plugin or interceptor");
+      }
+      try {
+        return await options2.next();
+      } catch (error) {
+        if (this.filter(error, options2)) {
+          pluginContext.error = { value: error };
+        }
+        throw error;
+      }
+    };
+    return {
+      ...options,
+      routingInterceptors: [
+        ...toArray(options.routingInterceptors),
+        routingInterceptor
+        // rethrow as early as possible and keep it close to `interceptor` to avoid a corrupted or modified context
+      ],
+      interceptors: [
+        interceptor,
+        // catch as many errors as possible
+        ...toArray(options.interceptors)
+      ]
+    };
+  }
+}
+
+class TimeoutHandlerPlugin {
+  timeout;
+  streamingTimeout;
+  name = "~timeout";
+  constructor(options) {
+    this.timeout = options.timeout;
+    this.streamingTimeout = options.streamingTimeout;
+  }
+  init(options) {
+    const interceptor = async (interceptorOptions) => {
+      const timeoutMs = value(this.timeout, interceptorOptions);
+      const streamingTimeoutMs = value(this.streamingTimeout, interceptorOptions);
+      const hasTimeout = timeoutMs !== null && timeoutMs !== void 0;
+      const hasStreamingTimeout = streamingTimeoutMs !== null && streamingTimeoutMs !== void 0;
+      if (!hasTimeout && !hasStreamingTimeout) {
+        return interceptorOptions.next();
+      }
+      const controller = new AbortController();
+      const abortWithTimeout = (ms) => {
+        controller.abort(new AbortError(`Request timed out after ${ms}ms`));
+      };
+      const timeoutId = hasTimeout ? setTimeout(abortWithTimeout, timeoutMs, timeoutMs) : void 0;
+      const signal = anyAbortSignal([interceptorOptions.request.signal, controller.signal]);
+      try {
+        const response = await interceptorOptions.next({
+          ...interceptorOptions,
+          request: { ...interceptorOptions.request, signal }
+        });
+        if (hasStreamingTimeout) {
+          const body = response.body;
+          const isIterator = isAsyncIteratorObject(body);
+          if (isIterator || body instanceof ReadableStream) {
+            const streamingTimeoutId = setTimeout(abortWithTimeout, streamingTimeoutMs, streamingTimeoutMs);
+            const onFinish = () => clearTimeout(streamingTimeoutId);
+            return {
+              ...response,
+              body: isIterator ? override(body, wrapAsyncIterator(body, { onFinish })) : override(body, wrapReadableStream(body, { onFinish }))
+            };
+          }
+        }
+        return response;
+      } finally {
+        clearTimeout(timeoutId);
+      }
+    };
+    return { ...options, interceptors: [interceptor, ...toArray(options.interceptors)] };
+  }
+}
+
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };

package/dist/shared/server.BhHrioCw.d.ts

@@ -0,0 +1,34 @@
+import { C as Context } from './server.CwrYlF72.js';
+import { S as StandardHandlerPlugin, a as StandardHandlerOptions } from './server.DrN1Pj1-.js';
+
+interface RequestLimitHandlerPluginOptions {
+    /**
+     * The maximum allowed request body size in bytes.
+     */
+    maxBodySize: number;
+}
+/**
+ * Rejects requests whose body exceeds `maxBodySize`.
+ *
+ * When used with the request compression plugin, the limit applies to the
+ * decompressed payload rather than the compressed wire size.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-limit | Request Limit Plugin}
+ */
+declare class RequestLimitHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Should limit the original batch request body instead of sub-requests.
+     */
+    after: string[];
+    /**
+     * Should limit the final body size instead of the compressed one.
+     */
+    before: string[];
+    private readonly maxBodySize;
+    constructor(options: RequestLimitHandlerPluginOptions);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+export { RequestLimitHandlerPlugin as R };
+export type { RequestLimitHandlerPluginOptions as a };