@rangojs/router 0.0.0-experimental.2 → 0.0.0-experimental.20

package/src/router/middleware.ts

@@ -9,129 +9,49 @@
  * - Forgiving API: if middleware doesn't return, original response is used
  */
 
-/**
- * Cookie options for setting cookies
- */
-export interface CookieOptions {
-  domain?: string;
-  path?: string;
-  maxAge?: number;
-  expires?: Date;
-  httpOnly?: boolean;
-  secure?: boolean;
-  sameSite?: "strict" | "lax" | "none";
-}
-
-/**
- * Context passed to middleware
- *
- * @template TEnv - Environment type (bindings, variables)
- * @template TParams - URL params type (typed for route middleware, Record<string, string> for global middleware)
- */
-export interface MiddlewareContext<
-  TEnv = any,
-  TParams = Record<string, string>,
-> {
-  /** Original request */
-  request: Request;
-
-  /** Parsed URL */
-  url: URL;
-
-  /** URL pathname */
-  pathname: string;
-
-  /** URL search params */
-  searchParams: URLSearchParams;
-
-  /** Platform bindings (Cloudflare, etc.) */
-  env: TEnv;
-
-  /** URL params extracted from route/middleware pattern */
-  params: TParams;
-
-  /**
-   * Response object - available immediately via stub, real response after `await next()`
-   *
-   * Headers set before `next()` are merged into the final response.
-   * Can be used to modify headers directly like Hono's `c.res`.
-   *
-   * @example
-   * ```typescript
-   * middleware(async (ctx, next) => {
-   *   // Set headers BEFORE next() - will be merged into final response
-   *   ctx.res.headers.set('X-Request-Id', generateId());
-   *
-   *   await next();
-   *
-   *   // Set headers AFTER next() - applied directly
-   *   ctx.res.headers.set('X-Custom', 'value');
-   *   // No return needed!
-   * });
-   * ```
-   */
-  res: Response;
-
-  /** Get a cookie value */
-  cookie(name: string): string | undefined;
-
-  /** Get all cookies as object */
-  cookies(): Record<string, string>;
-
-  /** Set a cookie on the response */
-  setCookie(name: string, value: string, options?: CookieOptions): void;
-
-  /** Delete a cookie */
-  deleteCookie(
-    name: string,
-    options?: Pick<CookieOptions, "domain" | "path">
-  ): void;
-
-  /** Get a context variable (shared with route handlers) */
-  get<K extends string>(key: K): any;
-
-  /** Set a context variable (shared with route handlers) */
-  set<K extends string>(key: K, value: any): void;
-
-  /**
-   * Set a response header - can be called before or after `next()`
-   *
-   * When called before `next()`, headers are queued and merged into the final response.
-   * When called after `next()`, headers are set directly on the response.
-   * Shorthand for `ctx.res.headers.set()`.
-   */
-  header(name: string, value: string): void;
+import { contextGet, contextSet } from "../context-var.js";
+import type {
+  CollectedMiddleware,
+  MiddlewareCollectableEntry,
+  MiddlewareContext,
+  MiddlewareEntry,
+  MiddlewareFn,
+  ResponseHolder,
+} from "./middleware-types.js";
+import { _getRequestContext } from "../server/request-context.js";
+import { isAutoGeneratedRouteName } from "../route-name.js";
+
+// Re-export types and cookie utilities for backward compatibility
+export type {
+  CookieOptions,
+  CollectedMiddleware,
+  MiddlewareCollectableEntry,
+  MiddlewareContext,
+  MiddlewareEntry,
+  MiddlewareFn,
+  ResponseHolder,
+} from "./middleware-types.js";
+export { parseCookies, serializeCookie } from "./middleware-cookies.js";
+
+// W5: Deduplicate by function reference so each distinct middleware warns once,
+// regardless of whether it is named or anonymous.
+let warnedRedirectMiddleware = new WeakSet<Function>();
+
+function warnCtxSetBeforeRedirect(handler: Function): void {
+  if (warnedRedirectMiddleware.has(handler)) return;
+  warnedRedirectMiddleware.add(handler);
+  const label = handler.name || "(anonymous)";
+  console.warn(
+    `[rango] Route middleware "${label}" called ctx.set() then returned a ` +
+      `redirect. Context variables are per-request and won't be available ` +
+      `on the redirect target. Use cookies to persist state across ` +
+      `redirects, or move ctx.set() to the target route's middleware.`,
+  );
 }
 
-/**
- * Middleware function signature
- *
- * @template TEnv - Environment type
- * @template TParams - URL params type (typed for route middleware)
- */
-export type MiddlewareFn<TEnv = any, TParams = Record<string, string>> = (
-  ctx: MiddlewareContext<TEnv, TParams>,
-  next: () => Promise<Response>
-) => Response | Promise<Response> | void | Promise<void>;
-
-/**
- * Stored middleware entry with pattern matching info
- */
-export interface MiddlewareEntry<TEnv = any> {
-  /** Original pattern string */
-  pattern: string | null;
-
-  /** Compiled regex for matching */
-  regex: RegExp | null;
-
-  /** Param names extracted from pattern */
-  paramNames: string[];
-
-  /** The middleware function */
-  handler: MiddlewareFn<TEnv>;
-
-  /** Mount prefix this middleware is scoped to (null = global) */
-  mountPrefix: string | null;
+/** Reset W5 deduplication state (for tests only). */
+export function _resetW5Warnings(): void {
+  warnedRedirectMiddleware = new WeakSet();
 }
 
 /**
@@ -191,7 +111,7 @@ function escapeRegex(str: string): string {
 export function extractParams(
   pathname: string,
   regex: RegExp,
-  paramNames: string[]
+  paramNames: string[],
 ): Record<string, string> {
   const match = pathname.match(regex);
   if (!match) return {};
@@ -203,149 +123,110 @@ export function extractParams(
   return params;
 }
 
-/**
- * Parse cookies from Cookie header
- */
-export function parseCookies(
-  cookieHeader: string | null
-): Record<string, string> {
-  if (!cookieHeader) return {};
-
-  const cookies: Record<string, string> = {};
-  const pairs = cookieHeader.split(";");
-
-  for (const pair of pairs) {
-    const [name, ...rest] = pair.trim().split("=");
-    if (name) {
-      cookies[name] = decodeURIComponent(rest.join("="));
-    }
-  }
-
-  return cookies;
-}
-
-/**
- * Serialize a cookie for Set-Cookie header
- */
-export function serializeCookie(
-  name: string,
-  value: string,
-  options: CookieOptions = {}
-): string {
-  let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
-
-  if (options.domain) cookie += `; Domain=${options.domain}`;
-  if (options.path) cookie += `; Path=${options.path}`;
-  if (options.maxAge !== undefined) cookie += `; Max-Age=${options.maxAge}`;
-  if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
-  if (options.httpOnly) cookie += "; HttpOnly";
-  if (options.secure) cookie += "; Secure";
-  if (options.sameSite) cookie += `; SameSite=${options.sameSite}`;
-
-  return cookie;
-}
-
-/**
- * Mutable response holder - allows ctx.res to be updated after next() is called
- */
-export interface ResponseHolder {
-  response: Response | null;
-}
-
 /**
  * Create middleware context
+ *
+ * Note: The implementation uses runtime values while the interface provides
+ * compile-time type safety. The env/get/set types are resolved at call sites
+ * via conditional types based on TEnv from createRouter<TBindings>().
  */
 export function createMiddlewareContext<TEnv>(
   request: Request,
   env: TEnv,
   params: Record<string, string>,
-  variables: Record<string, any>,
-  responseHolder: ResponseHolder
+  variables: Record<string, unknown>,
+  responseHolder: ResponseHolder,
+  reverse?: (
+    name: string,
+    params?: Record<string, string>,
+    search?: Record<string, unknown>,
+  ) => string,
 ): MiddlewareContext<TEnv> {
   const url = new URL(request.url);
-  const cookieHeader = request.headers.get("Cookie");
-  let parsedCookies: Record<string, string> | null = null;
 
+  // Track the initial response to detect pre/post-next() phase.
+  // Before next(): responseHolder.response === initialResponse (the stub).
+  // After next(): responseHolder.response is the real downstream response.
+  const initialResponse = responseHolder.response;
+  const isPreNext = () => responseHolder.response === initialResponse;
+
+  // Delegation strategy for RequestContext (reqCtx):
+  // - res getter: before next() returns shared reqCtx stub; after next() returns
+  //   the real downstream response.
+  // - header(): before next() delegates to reqCtx; after next() writes to the
+  //   real downstream response.
+  // Cookie operations are handled by the standalone cookies() function which
+  // delegates to the shared RequestContext internally.
+  // The runtime implementation - types are enforced at call sites via MiddlewareContext<TEnv>
   return {
     request,
     url,
     pathname: url.pathname,
     searchParams: url.searchParams,
-    env,
+    env: env as MiddlewareContext<TEnv>["env"],
     params,
+    // Getter: re-derives from request context on each access so that global
+    // middleware sees the matched route name after await next().
+    get routeName(): MiddlewareContext<TEnv>["routeName"] {
+      const reqCtx = _getRequestContext();
+      const raw = reqCtx?._routeName;
+      return (
+        raw && !isAutoGeneratedRouteName(raw) ? raw : undefined
+      ) as MiddlewareContext<TEnv>["routeName"];
+    },
 
-    // res getter - returns the stub or real response (always available)
     get res(): Response {
+      // Before next(): return shared RequestContext stub so headers
+      // set via ctx.header() are visible on ctx.res.
+      if (isPreNext()) {
+        const reqCtx = _getRequestContext();
+        if (reqCtx) return reqCtx.res;
+      }
       if (!responseHolder.response) {
         throw new Error(
-          "ctx.res is not available - responseHolder was not initialized"
+          "ctx.res is not available - responseHolder was not initialized",
         );
       }
       return responseHolder.response;
     },
-
-    // res setter - allows middleware to replace the response
-    set res(response: Response) {
-      responseHolder.response = response;
+    set res(_: Response) {
+      throw new Error(
+        "ctx.res is read-only. Use ctx.header() to set response headers, or cookies() for cookie mutations.",
+      );
     },
 
-    cookie(name: string): string | undefined {
-      if (!parsedCookies) {
-        parsedCookies = parseCookies(cookieHeader);
-      }
-      return parsedCookies[name];
-    },
+    get: ((keyOrVar: any) =>
+      contextGet(variables, keyOrVar)) as MiddlewareContext<TEnv>["get"],
 
-    cookies(): Record<string, string> {
-      if (!parsedCookies) {
-        parsedCookies = parseCookies(cookieHeader);
-      }
-      return { ...parsedCookies };
-    },
+    set: ((keyOrVar: any, value: unknown) => {
+      contextSet(variables, keyOrVar, value);
+    }) as MiddlewareContext<TEnv>["set"],
 
-    setCookie(name: string, value: string, options?: CookieOptions): void {
-      if (!responseHolder.response) {
-        throw new Error(
-          "ctx.setCookie() is not available - responseHolder was not initialized"
-        );
+    header(name: string, value: string): void {
+      // Before next(): delegate to shared RequestContext stub
+      if (isPreNext()) {
+        const reqCtx = _getRequestContext();
+        if (reqCtx) {
+          reqCtx.header(name, value);
+          return;
+        }
       }
-      responseHolder.response.headers.append(
-        "Set-Cookie",
-        serializeCookie(name, value, options)
-      );
-    },
-
-    deleteCookie(
-      name: string,
-      options?: Pick<CookieOptions, "domain" | "path">
-    ): void {
+      // After next() or standalone: write to current response
       if (!responseHolder.response) {
         throw new Error(
-          "ctx.deleteCookie() is not available - responseHolder was not initialized"
+          "ctx.header() is not available - responseHolder was not initialized",
         );
       }
-      responseHolder.response.headers.append(
-        "Set-Cookie",
-        serializeCookie(name, "", { ...options, maxAge: 0 })
-      );
-    },
-
-    get<K extends string>(key: K): any {
-      return variables[key];
-    },
-
-    set<K extends string>(key: K, value: any): void {
-      variables[key] = value;
+      responseHolder.response.headers.set(name, value);
     },
 
-    header(name: string, value: string): void {
-      if (!responseHolder.response) {
+    reverse:
+      reverse ??
+      ((name: string) => {
         throw new Error(
-          "ctx.header() is not available - responseHolder was not initialized"
+          `ctx.reverse() is not available - route map was not provided to middleware context`,
         );
-      }
-      responseHolder.response.headers.set(name, value);
-    },
+      }),
   };
 }
 
@@ -355,7 +236,7 @@ export function createMiddlewareContext<TEnv>(
  */
 export function matchMiddleware<TEnv>(
   pathname: string,
-  entries: MiddlewareEntry<TEnv>[]
+  entries: MiddlewareEntry<TEnv>[],
 ): Array<{ entry: MiddlewareEntry<TEnv>; params: Record<string, string> }> {
   const matches: Array<{
     entry: MiddlewareEntry<TEnv>;
@@ -398,7 +279,12 @@ export async function executeMiddleware<TEnv>(
   request: Request,
   env: TEnv,
   variables: Record<string, any>,
-  finalHandler: () => Promise<Response>
+  finalHandler: () => Promise<Response>,
+  reverse?: (
+    name: string,
+    params?: Record<string, string>,
+    search?: Record<string, unknown>,
+  ) => string,
 ): Promise<Response> {
   let index = 0;
 
@@ -412,8 +298,8 @@ export async function executeMiddleware<TEnv>(
       // End of chain - call actual RSC handler
       const response = await finalHandler();
 
-      // Merge headers set on stub into the real response
-      // Use append for Set-Cookie to preserve multiple cookies
+      // Merge headers set on stub into the real response.
+      // Use append for Set-Cookie to preserve multiple cookies.
       const mergedHeaders = new Headers(response.headers);
       stubResponse.headers.forEach((value, name) => {
         if (name.toLowerCase() === "set-cookie") {
@@ -422,6 +308,19 @@ export async function executeMiddleware<TEnv>(
           mergedHeaders.set(name, value);
         }
       });
+      // Also merge shared RequestContext stub (cookies written via cookies().set()).
+      // Set-Cookie duplication is prevented by createResponseWithMergedHeaders
+      // draining Set-Cookie from ctx.res after merging (helpers.ts).
+      const reqCtx = _getRequestContext();
+      if (reqCtx) {
+        reqCtx.res.headers.forEach((value, name) => {
+          if (name.toLowerCase() === "set-cookie") {
+            mergedHeaders.append(name, value);
+          } else if (!mergedHeaders.has(name)) {
+            mergedHeaders.set(name, value);
+          }
+        });
+      }
 
       // Clone response with merged headers (mutable for post-next() modifications)
       responseHolder.response = new Response(response.body, {
@@ -439,23 +338,77 @@ export async function executeMiddleware<TEnv>(
       env,
       params,
       variables,
-      responseHolder
+      responseHolder,
+      reverse,
     );
 
-    // Track if next() was called and capture its Promise
-    // This handles the case where middleware calls next() synchronously without await
+    // Track if next() was called and capture its Promise.
+    // Guard against double-calling: a second call would re-enter the
+    // downstream chain and overwrite responseHolder.response.
     let nextPromise: Promise<Response> | null = null;
     const wrappedNext = (): Promise<Response> => {
+      if (nextPromise) {
+        throw new Error(
+          `[@rangojs/router] Middleware called next() more than once.`,
+        );
+      }
       nextPromise = next();
       return nextPromise;
     };
 
+    // W5: track whether ctx.set() is called during this middleware
+    let ctxSetCalled = false;
+    if (process.env.NODE_ENV !== "production") {
+      const originalSet = ctx.set;
+      ctx.set = ((...args: any[]) => {
+        ctxSetCalled = true;
+        return (originalSet as Function).apply(ctx, args);
+      }) as typeof ctx.set;
+    }
+
     const result = await entry.handler(ctx, wrappedNext);
 
-    // Explicit return takes precedence
+    // Explicit return takes precedence (middleware short-circuit).
+    // Merge stub headers (from ctx.header before this point) and
+    // RequestContext stub headers (from ctx.setCookie) into the
+    // returned Response so they are not lost.
     if (result instanceof Response) {
-      responseHolder.response = result;
-      return result;
+      // W5: warn if ctx.set() was called but middleware returned a redirect
+      if (
+        process.env.NODE_ENV !== "production" &&
+        ctxSetCalled &&
+        result.status >= 300 &&
+        result.status < 400
+      ) {
+        warnCtxSetBeforeRedirect(entry.handler);
+      }
+
+      const mergedHeaders = new Headers(result.headers);
+      stubResponse.headers.forEach((value, name) => {
+        if (name.toLowerCase() === "set-cookie") {
+          mergedHeaders.append(name, value);
+        } else if (!mergedHeaders.has(name)) {
+          mergedHeaders.set(name, value);
+        }
+      });
+      // Also merge shared RequestContext stub (cookies written via setCookie)
+      const reqCtx = _getRequestContext();
+      if (reqCtx) {
+        reqCtx.res.headers.forEach((value, name) => {
+          if (name.toLowerCase() === "set-cookie") {
+            mergedHeaders.append(name, value);
+          } else if (!mergedHeaders.has(name)) {
+            mergedHeaders.set(name, value);
+          }
+        });
+      }
+      const merged = new Response(result.body, {
+        status: result.status,
+        statusText: result.statusText,
+        headers: mergedHeaders,
+      });
+      responseHolder.response = merged;
+      return merged;
     }
 
     // Warn about unexpected return values (non-Response, non-undefined)
@@ -464,13 +417,26 @@ export async function executeMiddleware<TEnv>(
       const fnName = entry.handler.name || "(anonymous)";
       console.warn(
         `[Middleware] "${fnName}" returned ${typeof result} instead of Response or undefined. ` +
-          `This return value will be ignored. Did you mean to return a Response?`
+          `This return value will be ignored. Did you mean to return a Response?`,
       );
     }
 
     // If middleware called next(), await it and return the response
     if (nextPromise) {
       await nextPromise;
+
+      // W5: warn if ctx.set() was called but the downstream response is a redirect.
+      // The ctx.set() values will be lost because the redirect navigates away.
+      if (
+        process.env.NODE_ENV !== "production" &&
+        ctxSetCalled &&
+        responseHolder.response &&
+        responseHolder.response.status >= 300 &&
+        responseHolder.response.status < 400
+      ) {
+        warnCtxSetBeforeRedirect(entry.handler);
+      }
+
       return responseHolder.response!;
     }
 
@@ -481,7 +447,7 @@ export async function executeMiddleware<TEnv>(
       `Middleware must call next() or return a Response. ` +
         `Function: ${fnName}, Pattern: ${entry.pattern ?? "(all)"}
         Source: ${import.meta.env.DEV ? entry.handler.toString().slice(0, 200) : "(source hidden in production)"}`,
-      { cause: { url: request.url, fn: entry.handler } }
+      { cause: { url: request.url, fn: entry.handler } },
     );
   };
 
@@ -496,63 +462,6 @@ export async function executeMiddleware<TEnv>(
   return finalResponse;
 }
 
-/**
- * Execute middleware for server actions
- *
- * Server actions can't return Response directly, but headers/cookies set
- * on ctx.res (from getRequestContext().res) will be merged into the final response.
- *
- * - Runs middleware for auth checks, variable setting, headers, cookies
- * - Throws if middleware returns Response (can't short-circuit server action)
- */
-export async function executeServerActionMiddleware<TEnv>(
-  middlewares: MiddlewareFn<TEnv>[],
-  request: Request,
-  env: TEnv,
-  params: Record<string, string>,
-  variables: Record<string, any>,
-  stubResponse: Response
-): Promise<void> {
-  if (middlewares.length === 0) {
-    return;
-  }
-
-  let index = 0;
-  const responseHolder: ResponseHolder = { response: stubResponse };
-
-  const next = async (): Promise<Response> => {
-    if (index >= middlewares.length) {
-      return stubResponse;
-    }
-
-    const middleware = middlewares[index++];
-    const ctx = createMiddlewareContext(
-      request,
-      env,
-      params,
-      variables,
-      responseHolder
-    );
-
-    const result = await middleware(ctx, next);
-
-    // If middleware returned a Response, throw an error
-    // Server actions can't short-circuit with a Response
-    if (result instanceof Response) {
-      throw new Error(
-        `Loader middleware returned a Response (status: ${result.status}). ` +
-          `Server actions cannot return Response. ` +
-          `Use GET-based loader fetching for redirects, or throw an error instead.`
-      );
-    }
-
-    return stubResponse;
-  };
-
-  await next();
-  // Headers/cookies set on stubResponse will be merged by the caller
-}
-
 /**
  * Execute middleware for intercepts (simplified execution)
  *
@@ -574,7 +483,12 @@ export async function executeInterceptMiddleware<TEnv>(
   env: TEnv,
   params: Record<string, string>,
   variables: Record<string, any>,
-  stubResponse: Response
+  stubResponse: Response,
+  reverse?: (
+    name: string,
+    params?: Record<string, string>,
+    search?: Record<string, unknown>,
+  ) => string,
 ): Promise<Response | null> {
   if (middlewares.length === 0) {
     return null;
@@ -597,22 +511,28 @@ export async function executeInterceptMiddleware<TEnv>(
       env,
       params,
       variables,
-      responseHolder
+      responseHolder,
+      reverse,
     );
 
-    const result = await middleware(ctx, next);
+    let nextCalled = false;
+    const guardedNext = (): Promise<Response> => {
+      if (nextCalled) {
+        throw new Error(
+          `[@rangojs/router] Intercept middleware called next() more than once.`,
+        );
+      }
+      nextCalled = true;
+      return next();
+    };
+
+    const result = await middleware(ctx, guardedNext);
 
     if (result instanceof Response) {
       earlyResponse = result;
       return result;
     }
 
-    // Check if middleware replaced ctx.res with a different response
-    if (responseHolder.response && responseHolder.response !== stubResponse) {
-      earlyResponse = responseHolder.response;
-      return earlyResponse;
-    }
-
     return stubResponse;
   };
 
@@ -630,12 +550,14 @@ export async function executeInterceptMiddleware<TEnv>(
     });
 
     if (hasStubHeaders) {
-      // Clone and merge headers from stub into early response
+      // Clone and merge headers from stub into early response.
+      // Only fill in missing headers — the returned Response's explicit
+      // headers take precedence, matching executeMiddleware behavior.
       const mergedHeaders = new Headers(response.headers);
       stubResponse.headers.forEach((value, name) => {
         if (name.toLowerCase() === "set-cookie") {
           mergedHeaders.append(name, value);
-        } else {
+        } else if (!mergedHeaders.has(name)) {
           mergedHeaders.set(name, value);
         }
       });
@@ -665,7 +587,12 @@ export async function executeLoaderMiddleware<TEnv>(
   env: TEnv,
   params: Record<string, string>,
   variables: Record<string, any>,
-  finalHandler: () => Promise<Response>
+  finalHandler: () => Promise<Response>,
+  reverse?: (
+    name: string,
+    params?: Record<string, string>,
+    search?: Record<string, unknown>,
+  ) => string,
 ): Promise<Response> {
   if (middlewares.length === 0) {
     return finalHandler();
@@ -688,27 +615,11 @@ export async function executeLoaderMiddleware<TEnv>(
     request,
     env,
     variables,
-    finalHandler
+    finalHandler,
+    reverse,
   );
 }
 
-/**
- * Entry type for middleware collection
- * Matches the shape of EntryData used in router.ts
- */
-export interface MiddlewareCollectableEntry {
-  middleware?: MiddlewareFn<any, any>[];
-  layout?: MiddlewareCollectableEntry[];
-}
-
-/**
- * Collected route middleware with params
- */
-export interface CollectedMiddleware {
-  handler: MiddlewareFn<any, any>;
-  params: Record<string, string>;
-}
-
 /**
  * Collect route-level middleware from an entry tree
  *
@@ -721,7 +632,7 @@ export interface CollectedMiddleware {
  */
 export function collectRouteMiddleware(
   entries: Iterable<MiddlewareCollectableEntry>,
-  params: Record<string, string>
+  params: Record<string, string>,
 ): CollectedMiddleware[] {
   const result: CollectedMiddleware[] = [];