@scriptc/compiler 0.4.3 → 0.4.5

package/dist/frontend/lowering/lower-server.js

@@ -1,4 +1,5 @@
 import { keyedHelperName } from "./stable-names.js";
+import { lowerTlsCertificateCall } from "./builtins/x509.js";
 import { dynUndefinedExpr, nodeThrowExpr, boolLit, numLit, strLit, varRef, } from "../../ir/build.js";
 import * as ts from "../ts7/adapter.js";
 import { ladderFenceExpr } from "./lowerer.js";
@@ -1380,12 +1381,69 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         const { cb } = lowerCallbackArg(lowerer, args[0], "close callbacks", 0, () => false, "use ()", []);
         return { kind: "libCall", fn: "net.serverCloseCb", args: [receiver, cb], type: VOID, loc };
     }
+    if (name === "addContext" || name === "setSecureContext") {
+        // tls.Server's SNI table and default context (scr_tls.c): addContext
+        // takes a SecureContext or createSecureContext's options; the runtime
+        // throws Node's errors and the fence on a non-TLS server.
+        requireStatementPosition(lowerer, call, `server.${name}(...)`);
+        const want = name === "addContext" ? 2 : 1;
+        if (args.length !== want || args.some(ts.isSpreadElement)) {
+            lowerer.noLowering(`${name} with ${args.length} arguments`, call, name === "addContext"
+                ? "the form is addContext(servername, context)"
+                : "the form is setSecureContext(options)");
+        }
+        const receiver = coerceToHandle(lowerer, access.expression, NETSERVER_T);
+        if (name === "setSecureContext") {
+            const options = lowerer.lowerExprExpecting(args[0], DYN);
+            return {
+                kind: "libCall",
+                fn: "tls.serverSetSecureContext",
+                args: [receiver, options],
+                type: VOID,
+                loc,
+            };
+        }
+        const servername = lowerer.lowerExprExpecting(args[0], DYN);
+        const context = lowerer.lowerExpr(args[1]);
+        if (context.type.kind === "secureCtx") {
+            return {
+                kind: "libCall",
+                fn: "tls.serverAddContextCtx",
+                args: [receiver, servername, context],
+                type: VOID,
+                loc,
+            };
+        }
+        return {
+            kind: "libCall",
+            fn: "tls.serverAddContext",
+            args: [receiver, servername, lowerer.coerceInto(args[1], context, DYN)],
+            type: VOID,
+            loc,
+        };
+    }
     if ((name === "on" || name === "once" || name === "addListener") && args.length === 2) {
         requireStatementPosition(lowerer, call, `server.${name}(...)`);
         const once = boolLit(name === "once", loc);
         const evT = lowerer.typeOf(args[0]);
         const event = evT.isStringLiteralType() ? evT.value : null;
         const receiver = coerceToHandle(lowerer, access.expression, NETSERVER_T);
+        if (event === "tlsClientError") {
+            // A failed handshake on a tls or https server: (err, tlsSocket).
+            const listener = args[1];
+            const { cb } = lowerCallbackArgShared(lowerer, listener, "tlsClientError listeners", 2, (p, i) => i === 0 ? p.kind === "object" && p.className === "%Error" : p.kind === "netSocket", "use (err, tlsSocket), (err) or ()", {
+                dynTuple: [ERROR_T, NETSOCKET_T],
+                checkAllParams: true,
+                adapt: (c) => voidizedCallback(lowerer, c, locOf(listener)),
+            });
+            return {
+                kind: "libCall",
+                fn: "tls.serverOnClientError",
+                args: [receiver, cb, once],
+                type: VOID,
+                loc,
+            };
+        }
         if (event === "connection" || event === "secureConnection") {
             // 'secureConnection' rides the same list: a TLS server's
             // 'connection' listeners are DEFERRED to handshake completion
@@ -1744,8 +1802,8 @@ function socketEncodingReachable(lowerer) {
     if (lowerer.socketEncodingReachable !== null)
         return lowerer.socketEncodingReachable;
     let reachable = false;
-    for (const file of lowerer.program.getSourceFiles()) {
-        if (file.isDeclarationFile || !file.text.includes("setEncoding"))
+    for (const file of lowerer.program.getImplementationSourceFiles()) {
+        if (!file.text.includes("setEncoding"))
             continue;
         ts.walkPreorder(file, (node) => {
             if (reachable)
@@ -1781,8 +1839,8 @@ function unixListenReachable(lowerer) {
     if (lowerer.unixListenReachable !== null)
         return lowerer.unixListenReachable;
     let reachable = false;
-    for (const file of lowerer.program.getSourceFiles()) {
-        if (file.isDeclarationFile || !file.text.includes("listen"))
+    for (const file of lowerer.program.getImplementationSourceFiles()) {
+        if (!file.text.includes("listen"))
             continue;
         ts.walkPreorder(file, (node) => {
             if (reachable)
@@ -1868,7 +1926,10 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
         };
     }
     if (name === "write" || name === "end") {
-        requireStatementPosition(lowerer, call, `socket.${name}(...)`);
+        // write() answers Node's backpressure boolean; end() stays a statement
+        if (name === "end")
+            requireStatementPosition(lowerer, call, `socket.${name}(...)`);
+        const resultT = name === "write" ? BOOL : VOID;
         // write(chunk, encoding) — the two-argument encoding form: 'buffer'
         // beside a string chunk is Writable's encoding check (a synchronous
         // ERR_UNKNOWN_ENCODING TypeError, "Unknown encoding: buffer" — the
@@ -1891,7 +1952,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                     const socket = coerceToHandle(lowerer, access.expression, NETSOCKET_T);
                     const chunk = lowerer.lowerExpr(args[0]);
                     const fn = chunk.type.kind === "string" ? "net.sockWrite" : "net.sockWriteBytes";
-                    return { kind: "libCall", fn, args: [socket, chunk], type: VOID, loc };
+                    return { kind: "libCall", fn, args: [socket, chunk], type: BOOL, loc };
                 }
             }
         }
@@ -1943,7 +2004,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                 if (fn === null) {
                     lowerer.noLowering(`${name} of '${lowerer.fmt(data.type)}' data`, dataNode, NARROW_DATA_HINT);
                 }
-                main = { kind: "libCall", fn, args: [receiver(), data], type: VOID, loc };
+                main = { kind: "libCall", fn, args: [receiver(), data], type: resultT, loc };
             }
             const cb = lowerer.lowerExpr(last);
             let register;
@@ -1965,8 +2026,21 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                     loc,
                 };
             }
-            stmts.push({ kind: "exprStmt", expr: main, loc });
-            return { kind: "seqExpr", stmts, result: register, type: VOID, loc };
+            if (resultT.kind === "void") {
+                stmts.push({ kind: "exprStmt", expr: main, loc });
+                return { kind: "seqExpr", stmts, result: register, type: VOID, loc };
+            }
+            // write(data, cb): the data is written, the callback registered, and
+            // the write's answer is the value
+            const okLocal = lowerer.declareHiddenLocal("%sockWriteOk", BOOL);
+            stmts.push({ kind: "varDecl", localId: okLocal.id, init: main, loc }, { kind: "exprStmt", expr: register, loc });
+            return {
+                kind: "seqExpr",
+                stmts,
+                result: { kind: "varRef", localId: okLocal.id, type: BOOL, loc },
+                type: BOOL,
+                loc,
+            };
         }
         const maxArgs = name === "write" ? 1 : 1;
         const minArgs = name === "write" ? 1 : 0;
@@ -1982,17 +2056,17 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
         const data = lowerer.lowerExpr(args[0]);
         if (data.type.kind === "string") {
             const fn = name === "write" ? "net.sockWrite" : "net.sockEndStr";
-            return { kind: "libCall", fn, args: [receiver, data], type: VOID, loc };
+            return { kind: "libCall", fn, args: [receiver, data], type: resultT, loc };
         }
         if (data.type.kind === "bytes" && data.type.elem === "u8") {
             const fn = name === "write" ? "net.sockWriteBytes" : "net.sockEndBytes";
-            return { kind: "libCall", fn, args: [receiver, data], type: VOID, loc };
+            return { kind: "libCall", fn, args: [receiver, data], type: resultT, loc };
         }
         if (data.type.kind === "dyn") {
             // An untyped JS payload (a helper's parameter): the runtime
             // dispatches STR/BYTES and throws Node's chunk TypeError otherwise.
             const fn = name === "write" ? "net.sockWriteDyn" : "net.sockEndDyn";
-            return { kind: "libCall", fn, args: [receiver, data], type: VOID, loc };
+            return { kind: "libCall", fn, args: [receiver, data], type: resultT, loc };
         }
         lowerer.noLowering(`${name} of '${lowerer.fmt(data.type)}' data`, args[0] ?? call, NARROW_DATA_HINT);
     }
@@ -2098,6 +2172,11 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
             ? value
             : lowerer.coerceInto(call, value, declared);
     }
+    {
+        const certificate = lowerTlsCertificateCall(lowerer, call, name, () => coerceToHandle(lowerer, access.expression, NETSOCKET_T));
+        if (certificate)
+            return certificate;
+    }
     if (name === "isSessionReused" && args.length === 0) {
         // TLSSocket.isSessionReused(): the client never offers a cached
         // session (no session resumption, a documented TLS divergence), so
@@ -2273,6 +2352,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
             event === "connect" ||
             event === "ready" ||
             event === "timeout" ||
+            event === "drain" ||
             event === "readable") {
             const { cb } = lowerCallbackArg(lowerer, args[1], `${event} listeners`, 0, () => false, "use ()", []);
             const fn = event === "end"
@@ -2281,11 +2361,13 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                     ? "net.sockOnClose"
                     : event === "timeout"
                         ? "net.sockOnTimeout"
-                        : event === "readable"
-                            ? "net.sockOnReadable"
-                            : event === "ready"
-                                ? "net.sockOnReady"
-                                : "net.sockOnConnect";
+                        : event === "drain"
+                            ? "net.sockOnDrain"
+                            : event === "readable"
+                                ? "net.sockOnReadable"
+                                : event === "ready"
+                                    ? "net.sockOnReady"
+                                    : "net.sockOnConnect";
             return { kind: "libCall", fn, args: [receiver, cb, once], type: VOID, loc };
         }
         if (event === "lookup") {
@@ -3028,6 +3110,16 @@ export function lowerServerProperty(lowerer, expr) {
         const receiver = coerceToHandle(lowerer, expr.expression, NETSOCKET_T);
         return { kind: "libCall", fn: "net.sockBytesWritten", args: [receiver], type: F64, loc };
     }
+    if (recvKind === "netSocket" &&
+        lowerer.isStdlibMember(expr) &&
+        (expr.name.text === "writableLength" || expr.name.text === "writableNeedDrain")) {
+        // The write buffer's unsent bytes, and whether a write answered false
+        // and 'drain' has not fired yet.
+        const receiver = coerceToHandle(lowerer, expr.expression, NETSOCKET_T);
+        return expr.name.text === "writableLength"
+            ? { kind: "libCall", fn: "net.sockWritableLength", args: [receiver], type: F64, loc }
+            : { kind: "libCall", fn: "net.sockWritableNeedDrain", args: [receiver], type: BOOL, loc };
+    }
     if (recvKind === "netSocket" && lowerer.isStdlibMember(expr) && expr.name.text === "readable") {
         // true until the read half is done (peer FIN / destroy).
         const receiver = coerceToHandle(lowerer, expr.expression, NETSOCKET_T);
@@ -3904,20 +3996,14 @@ function lowerTlsServerOptions(lowerer, node, what, allowSni = false) {
         }
         if (k !== "cert" && k !== "key") {
             const init = ts.isPropertyAssignment(prop) ? prop.initializer : null;
-            if ((k === "ca" || k === "rejectUnauthorized") &&
-                (init === null || sideEffectFreeOptionValue(init))) {
-                // Both are inert without requestCert (which fences): the server's
-                // `ca` verifies CLIENT certificates and rejectUnauthorized only
-                // gates that verification — Node-observably droppable, matching
+            if (k === "rejectUnauthorized" && (init === null || sideEffectFreeOptionValue(init))) {
+                // Without requestCert (a literal with requestCert or ca rides the
+                // runtime walk) rejectUnauthorized gates nothing — droppable, like
                 // the runtime walk's split (effectful values keep the fence).
                 continue;
             }
-            if (k === "requestCert" && (init === null || init.kind === ts.SyntaxKind.FalseKeyword)) {
-                continue; // Node's false default, spelled out
-            }
             fenceOrDropOptionKey(lowerer, prop, k, what, TLS_SERVER_DOCUMENTED_OPTIONS, "cert and key (PEM strings or Buffers) are the supported options", {
                 SNICallback: "SNICallback lowers on tls.createServer and http2.createSecureServer({ allowHTTP1: true, ... }) — serve one cert/key pair here",
-                requestCert: "client-certificate handshakes are not modeled (SEMANTICS.md divergence 55) — requestCert: false is the lowered value",
             });
             continue; // an undocumented key, dropped like Node drops it
         }
@@ -3997,12 +4083,18 @@ function tlsLiteralNeedsRuntimeWalk(node, includeHttpTimeoutOptions = false, run
             runtimeKeys.has(p.name.text) ||
             (jsSource && TLS_VALIDATED_OPTIONS.has(p.name.text))));
 }
+/** The client-certificate options (requestCert, and ca, which also
+ * completes the server's own chain): the runtime walk implements them for
+ * tls.createServer and https.createServer, and the literal cert/key
+ * lowering does not. */
+const TLS_CLIENT_AUTH_OPTIONS = new Set(["requestCert", "ca"]);
 /** tls.createServer options the runtime walk implements and the literal
  * cert/key lowering does not. */
 const TLS_SERVER_RUNTIME_OPTIONS = new Set([
     "ALPNProtocols",
     "minVersion",
     "maxVersion",
+    ...TLS_CLIENT_AUTH_OPTIONS,
 ]);
 function lowerTlsServerOptionsOrDyn(lowerer, node, what, includeHttpTimeoutOptions = false, runtimeKeys = new Set(), allowSni = false) {
     if (ts.isObjectLiteralExpression(node)) {
@@ -4012,7 +4104,7 @@ function lowerTlsServerOptionsOrDyn(lowerer, node, what, includeHttpTimeoutOptio
             (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name)) &&
             p.name.text === "SNICallback");
         if (allowSni && sniOption !== undefined) {
-            lowerer.noLowering(`${what} with SNICallback and options the runtime walk reads`, sniOption, "SNICallback lowers with cert and key; ALPNProtocols, minVersion, maxVersion and the validated options are not combined with it yet");
+            lowerer.noLowering(`${what} with SNICallback and options the runtime walk reads`, sniOption, "SNICallback lowers with cert and key; ALPNProtocols, minVersion, maxVersion, requestCert, ca and the validated options are not combined with it yet");
         }
     }
     const v = lowerer.lowerExpr(node);
@@ -4033,13 +4125,13 @@ function lowerTlsServerOptionsOrDyn(lowerer, node, what, includeHttpTimeoutOptio
  * connect(options[, cb]) and connect(port[, host][, options][, cb]) with
  * a RUNTIME options record (the checked-dynamic JS lane's shape — a dyn
  * value, or a record that converts): the runtime walk implements
- * port/host/socket/rejectUnauthorized/ca/servername/ALPNProtocols/minVersion/maxVersion/timeout and throws the catchable
+ * port/host/socket/rejectUnauthorized/ca/cert/key/servername/ALPNProtocols/minVersion/maxVersion/timeout and throws the catchable
  * fence for other documented members (the divergence-66 stance). The
  * callback (and 'secureConnect'/'connect' listeners) fires
  * post-handshake — Node's secureConnect timing. */
 function lowerTlsConnectCall(lowerer, expr, loc) {
     const args = expr.arguments.nodes;
-    const FORMS_HINT = "the supported forms are connect(options[, cb]) and connect(port[, host][, options][, cb]) — options implement port/host/socket/rejectUnauthorized/ca/servername/ALPNProtocols/minVersion/maxVersion/timeout";
+    const FORMS_HINT = "the supported forms are connect(options[, cb]) and connect(port[, host][, options][, cb]) — options implement port/host/socket/rejectUnauthorized/ca/cert/key/servername/ALPNProtocols/minVersion/maxVersion/timeout";
     if (args.length < 1 || args.length > 4 || args.some(ts.isSpreadElement)) {
         lowerer.noLowering(`tls.connect with ${args.length} arguments`, expr, FORMS_HINT);
     }
@@ -4228,7 +4320,7 @@ function lowerTlsModuleCall(lowerer, expr, bi, loc) {
         if (args.length !== 1) {
             lowerer.noLowering(`createSecureContext with ${args.length} arguments`, expr, "the supported form is createSecureContext({ cert, key })");
         }
-        const opts = lowerTlsServerOptionsOrDyn(lowerer, args[0], "tls.createSecureContext");
+        const opts = lowerTlsServerOptionsOrDyn(lowerer, args[0], "tls.createSecureContext", false, TLS_CLIENT_AUTH_OPTIONS);
         if (opts.dyn !== undefined) {
             return {
                 kind: "libCall",
@@ -4422,7 +4514,7 @@ function lowerHttpsModuleCall(lowerer, expr, bi, loc) {
         if (args.length < 1 || args.length > 2) {
             lowerer.noLowering(`createServer with ${args.length} arguments`, expr, "the supported form is createServer({ cert, key }, (req, res) => ...)");
         }
-        const opts = lowerTlsServerOptionsOrDyn(lowerer, args[0], "https.createServer", true);
+        const opts = lowerTlsServerOptionsOrDyn(lowerer, args[0], "https.createServer", true, TLS_CLIENT_AUTH_OPTIONS);
         if (args.length === 1) {
             // The handler-less form: 'request' listeners arrive later via
             // server.on("request", ...) — the createSecureServer emission's
@@ -4949,7 +5041,9 @@ function runtimeRequestOptions(lowerer, optsNode, secureish) {
             }
             return ((ts.isPropertyAssignment(prop) || ts.isShorthandPropertyAssignment(prop)) &&
                 (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) &&
-                prop.name.text === "socketPath");
+                (prop.name.text === "socketPath" ||
+                    // a client certificate: the runtime request walk reads cert and key
+                    (secureish && (prop.name.text === "cert" || prop.name.text === "key"))));
         });
         if (!needsRuntime)
             return null;