@server/next 0.35.0 → 0.35.1

package/index.d.ts

@@ -230,7 +230,9 @@ type ParamsToObject<Params extends string> = {
 };
 type PathToParams<Path extends string> = ParamsToObject<ExtractPathParams<Path>>;
 type BunEnv = Record<string, string> & {
-    upgrade?: (req: Request) => boolean;
+    upgrade?: (req: Request, options?: {
+        data?: any;
+    }) => boolean;
 };
 type Context<Params extends Record<string, string | undefined> = Record<string, string>, O extends ServerConfig = object> = {
     method: Method;
@@ -407,9 +409,9 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
-        post: (path: string, body?: string | number | boolean | ArrayBuffer | {
+        post: (path: string, body?: string | number | boolean | ArrayBuffer | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams | {
             [key: string]: SerializableValue;
-        } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
+        } | SerializableValue[], options?: {
             cache?: RequestCache;
             credentials?: RequestCredentials;
             headers?: HeadersInit;
@@ -424,9 +426,9 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
-        put: (path: string, body?: string | number | boolean | ArrayBuffer | {
+        put: (path: string, body?: string | number | boolean | ArrayBuffer | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams | {
             [key: string]: SerializableValue;
-        } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
+        } | SerializableValue[], options?: {
             cache?: RequestCache;
             credentials?: RequestCredentials;
             headers?: HeadersInit;
@@ -441,9 +443,9 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
-        patch: (path: string, body?: string | number | boolean | ArrayBuffer | {
+        patch: (path: string, body?: string | number | boolean | ArrayBuffer | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams | {
             [key: string]: SerializableValue;
-        } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
+        } | SerializableValue[], options?: {
             cache?: RequestCache;
             credentials?: RequestCredentials;
             headers?: HeadersInit;

package/index.js

@@ -1736,9 +1736,10 @@ function etag(bytes) {
 function createWebsocket(sockets, handlers) {
   const run = (event, socket, body) => {
     const routes = handlers.socket?.filter((r2) => r2.path === event) ?? [];
+    const user = socket.user ?? socket.data?.user;
     for (const route of routes) {
       for (const fn of route.fns) {
-        fn({ socket, sockets, body });
+        fn({ socket, sockets, body, user });
       }
     }
   };
@@ -2632,6 +2633,13 @@ function timer(ctx) {
   ctx.time = createTime();
 }
 
+// src/auth/socketUser.ts
+async function socketUser(app, headers2, cookies2) {
+  if (!app.settings.auth) return void 0;
+  const ctx = { options: app.settings, headers: headers2, cookies: cookies2 };
+  return getUser(ctx);
+}
+
 // src/helpers/wsNode.ts
 var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 var CONTINUATION = 0;
@@ -2666,6 +2674,9 @@ var NodeWebSocket = class {
   fragmentOpcode;
   closed;
   readyState;
+  // The auth user resolved from the upgrade request (see attachWebsocket), or
+  // undefined for an anonymous connection. Read by socket handlers as `ctx.user`.
+  user;
   constructor(socket, handlers) {
     this.socket = socket;
     this.handlers = handlers;
@@ -2764,13 +2775,24 @@ var NodeWebSocket = class {
 };
 async function attachWebsocket(server2, app) {
   const { createHash } = await import("crypto");
-  server2.on("upgrade", (req, socket, head) => {
+  server2.on("upgrade", async (req, socket, head) => {
     const key = req.headers["sec-websocket-key"];
     const upgrade = String(req.headers.upgrade || "").toLowerCase();
     if (upgrade !== "websocket" || !key || !app.handlers.socket.length) {
       socket.destroy();
       return;
     }
+    const cookies2 = parseCookies(req.headers.cookie);
+    let user;
+    try {
+      user = await socketUser(app, req.headers, cookies2);
+    } catch {
+      socket.write(
+        "HTTP/1.1 401 Unauthorized\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
+      );
+      socket.destroy();
+      return;
+    }
     const accept = createHash("sha1").update(key + GUID).digest("base64");
     socket.write(
       `HTTP/1.1 101 Switching Protocols\r
@@ -2786,6 +2808,7 @@ Sec-WebSocket-Accept: ${accept}\r
       onMessage: (body) => app.websocket.message(ws, body),
       onClose: () => app.websocket.close(ws)
     });
+    ws.user = user;
     app.websocket.open(ws);
     if (head?.length) ws.receive(head);
     socket.on("data", (chunk) => ws.receive(chunk));
@@ -2902,7 +2925,20 @@ async function createWinter(req, app, server2) {
 
 // src/context/handlers.ts
 var Winter = async (app, request, env2) => {
-  if (env2?.upgrade(request)) return;
+  if (env2?.upgrade) {
+    const wantsWs = String(request.headers.get("upgrade") || "").toLowerCase() === "websocket";
+    if (wantsWs) {
+      const headers2 = parseHeaders_default(request.headers);
+      const cookies2 = parseCookies(headers2.cookie);
+      let user;
+      try {
+        user = await socketUser(app, headers2, cookies2);
+      } catch {
+        return new Response("Unauthorized", { status: 401 });
+      }
+      if (env2.upgrade(request, { data: { user } })) return;
+    }
+  }
   Object.assign(globalThis.env, env2);
   const ctx = await createWinter(request, app, env2);
   const res = await handleRequest(app, ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",