@pikku/core 0.12.30 → 0.12.32

package/src/types/state.types.ts

@@ -171,6 +171,11 @@ export interface PikkuPackageState {
     } | null
     /** Cached singleton services for this package */
     singletonServices: CoreSingletonServices | null
+    /** The pikkuBetterAuth factory, self-registered when auth.ts is evaluated.
+     *  pikkuServices reads it to build and inject the `auth` singleton. */
+    authFactory:
+      | ((services: CoreSingletonServices) => unknown | Promise<unknown>)
+      | null
     /** Credential metadata for this addon package */
     credentialsMeta: Record<
       string,

package/src/wirings/http/http-runner.test.ts

@@ -272,6 +272,19 @@ describe('http-runner helpers', () => {
     )
   })
 
+  test('addHTTPMiddleware composes repeated registrations for the same pattern', () => {
+    const first: CorePikkuMiddleware = async (_s, _w, next) => next()
+    const second: CorePikkuMiddleware = async (_s, _w, next) => next()
+
+    addHTTPMiddleware('*', [first])
+    addHTTPMiddleware('*', [second])
+
+    assert.deepEqual(pikkuState(null, 'middleware', 'httpGroup')['*'], [
+      first,
+      second,
+    ])
+  })
+
   test('createHTTPWire combines request and response when present', () => {
     const req = new TestRequest('/x', 'get')
     const res = new TestResponse()

package/src/wirings/http/http-runner.ts

@@ -96,7 +96,10 @@ export const addHTTPMiddleware = <PikkuMiddleware extends CorePikkuMiddleware>(
   packageName: string | null = null
 ): CorePikkuMiddlewareGroup => {
   const httpGroups = pikkuState(packageName, 'middleware', 'httpGroup')
-  httpGroups[pattern] = middleware
+  const existing = httpGroups[pattern] as CorePikkuMiddleware[] | undefined
+  httpGroups[pattern] = existing
+    ? [...existing, ...(middleware as CorePikkuMiddleware[])]
+    : middleware
   return middleware
 }
 

package/src/wirings/http/pikku-fetch-http-request.ts

@@ -16,7 +16,7 @@ export class PikkuFetchHTTPRequest<
   #url: URL
   #rawBodyText: string | undefined
   #rawBodyBuffer: ArrayBuffer | undefined
-  #bodyRead = false
+  #rawBufferPromise: Promise<ArrayBuffer> | undefined
 
   constructor(private request: Request) {
     this.#url = new URL(request.url)
@@ -44,36 +44,53 @@ export class PikkuFetchHTTPRequest<
    * @returns A promise that resolves to the raw request body.
    */
   public async arrayBuffer(): Promise<ArrayBuffer> {
+    return this.#readRawBuffer()
+  }
+
+  /**
+   * Reads the underlying single-use request body exactly once and memoises both
+   * the in-flight promise and the result. `json()`, `arrayBuffer()`, `body()`
+   * and `toWebRequest()` all funnel through here, so a request whose body is
+   * consumed in more than one place can no longer race on the underlying stream
+   * and fail with "Body has already been used".
+   *
+   * If a second consumer asks for the body while the first read is still in
+   * flight, that is the concurrent double-read that used to crash — now safe,
+   * but warned about so the redundant consumer is found and removed at the
+   * source rather than silently leaning on this cache.
+   */
+  async #readRawBuffer(): Promise<ArrayBuffer> {
     if (this.#rawBodyBuffer !== undefined) {
       return this.#rawBodyBuffer
     }
-    if (this.#bodyRead) {
-      if (this.#rawBodyText !== undefined) {
-        const buf = new TextEncoder().encode(this.#rawBodyText)
-          .buffer as ArrayBuffer
-        this.#rawBodyBuffer = buf
-        return buf
-      }
-      return new ArrayBuffer(0)
+    if (this.#rawBodyText !== undefined) {
+      const buf = new TextEncoder().encode(this.#rawBodyText)
+        .buffer as ArrayBuffer
+      this.#rawBodyBuffer = buf
+      return buf
+    }
+    if (this.#rawBufferPromise !== undefined) {
+      console.warn(
+        `[pikku] request body for ${this.method().toUpperCase()} ${this.path()} ` +
+          `was requested again before the first read resolved — the read is now ` +
+          `shared, but a duplicate body consumer (e.g. middleware calling ` +
+          `toWebRequest just for headers) should be removed.`
+      )
+      return this.#rawBufferPromise
     }
-    const buf = await this.request.arrayBuffer()
-    this.#rawBodyBuffer = buf
-    this.#bodyRead = true
-    return buf
+    this.#rawBufferPromise = this.request.arrayBuffer().then((buf) => {
+      this.#rawBodyBuffer = buf
+      return buf
+    })
+    return this.#rawBufferPromise
   }
 
   async #readRawText(): Promise<string> {
     if (this.#rawBodyText !== undefined) {
       return this.#rawBodyText
     }
-    if (this.#rawBodyBuffer !== undefined) {
-      const text = new TextDecoder().decode(this.#rawBodyBuffer)
-      this.#rawBodyText = text
-      return text
-    }
-    const text = await this.request.text()
+    const text = new TextDecoder().decode(await this.#readRawBuffer())
     this.#rawBodyText = text
-    this.#bodyRead = true
     return text
   }
 

package/src/wirings/http/web-request.test.ts

@@ -274,8 +274,8 @@ describe('applyWebResponse', () => {
     const { res, state } = createMockResponse()
     const webRes = new Response('{"csrfToken":"abc"}', { status: 200 })
     const cookies = [
-      'authjs.csrf-token=abc; Path=/; HttpOnly',
-      'authjs.callback-url=http%3A%2F%2Flocalhost; Path=/; HttpOnly',
+      'better-auth.session_token=abc; Path=/; HttpOnly',
+      'better-auth.callback-url=http%3A%2F%2Flocalhost; Path=/; HttpOnly',
     ]
     ;(webRes.headers as any).getSetCookie = () => cookies
 

package/src/wirings/http/web-request.ts

@@ -30,8 +30,13 @@ export function toWebRequest(req: PikkuHTTPRequest, baseUrl?: string): Request {
   return new Request(url, {
     method,
     headers,
+    // `pull` (lazy) rather than `start` (eager): the body is only read from the
+    // underlying request when this stream is actually consumed. A consumer that
+    // builds a web Request just to read its headers (e.g. a session middleware
+    // calling getSession({ headers })) never touches the body, so it does zero
+    // body I/O and cannot race the route handler's read of the same request.
     body: new ReadableStream({
-      async start(controller) {
+      async pull(controller) {
         try {
           const buffer = await req.arrayBuffer()
           if (buffer.byteLength > 0) {