@telorun/http-server 0.15.0 → 0.15.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @telorun/http-server
 
+## 0.15.2
+
+### Patch Changes
+
+- a33b8cc: Log mid-stream failures server-side. When a `mode: stream` route's stream throws
+  after the response headers are flushed, the failure can't reach Fastify's error
+  handler or a `catches:` entry, so it was previously silent for the operator (it
+  was only emitted as an `Http.Api.streamFailed` event, which nothing logs unless a
+  debug consumer is attached). The stream-error hook now also logs on the server's
+  request logger (the one `Http.Server.logger` configures) at `error` level with
+  the error, route, status, and MIME. Client-facing behaviour is unchanged.
+  - @telorun/http-dispatch@0.4.1
+
+## 0.15.1
+
+### Patch Changes
+
+- 06c675b: Fix CORS preflight returning 404. `Http.Server` forwarded every `cors` option to `@fastify/cors`, including the ones the manifest left unset — spreading `preflight: undefined` (and friends) clobbered the plugin's own default `preflight: true`, so its `OPTIONS *` handler `callNotFound()`'d and the preflight came back 404. Browsers reject that ("Response to preflight request … does not have HTTP ok status") and block every cross-origin `POST`. Now only the fields actually set on `cors` are passed through, so unset options keep the plugin's defaults and preflight replies 204.
+
 ## 0.15.0
 
 ### Minor Changes

package/dist/http-api-controller.js

@@ -165,15 +165,28 @@ export class HttpServerApi {
                     return dispatchCatches(route.catches, { code: err.code, message: err.message, data: err.data }, requestContext, acceptHeader, this.ctx.moduleContext, this.ctx.validateSchema.bind(this.ctx), sink);
                 }
                 await span.settle("ok");
-                return dispatchReturns(route.returns, result, requestContext, acceptHeader, this.ctx.moduleContext, this.ctx.validateSchema.bind(this.ctx), sink, (err, errCtx) => this.ctx.emitEvent("Http.Api.streamFailed", {
-                    path: route.request.path,
-                    method: route.request.method,
-                    status: errCtx.status,
-                    mime: errCtx.mime,
-                    error: err instanceof Error
-                        ? { message: err.message, stack: err.stack, code: err.code }
-                        : { message: String(err) },
-                }));
+                return dispatchReturns(route.returns, result, requestContext, acceptHeader, this.ctx.moduleContext, this.ctx.validateSchema.bind(this.ctx), sink, (err, errCtx) => {
+                    // Headers are already flushed, so this failure can't reach Fastify's
+                    // error handler (which logs pre-stream throws) — log it here, on the
+                    // same request logger `logger:` configures, so a mid-stream failure
+                    // isn't silent server-side. The event below stays for debug tooling.
+                    reply.log.error({
+                        err,
+                        path: route.request.path,
+                        method: route.request.method,
+                        status: errCtx.status,
+                        mime: errCtx.mime,
+                    }, "Http.Api stream failed after response headers were flushed");
+                    return this.ctx.emitEvent("Http.Api.streamFailed", {
+                        path: route.request.path,
+                        method: route.request.method,
+                        status: errCtx.status,
+                        mime: errCtx.mime,
+                        error: err instanceof Error
+                            ? { message: err.message, stack: err.stack, code: err.code }
+                            : { message: String(err) },
+                    });
+                });
             },
         });
     }

package/dist/http-server-controller.js

@@ -73,20 +73,31 @@ class HttpServer {
             }
         }
         if (this.resource.cors) {
-            await this.app.register(cors, {
-                origin: this.resource.cors.origin,
-                methods: this.resource.cors.methods,
-                allowedHeaders: this.resource.cors.allowedHeaders,
-                exposedHeaders: this.resource.cors.exposedHeaders,
-                credentials: this.resource.cors.credentials,
-                maxAge: this.resource.cors.maxAge,
-                cacheControl: this.resource.cors.cacheControl,
-                preflightContinue: this.resource.cors.preflightContinue,
-                optionsSuccessStatus: this.resource.cors.optionsSuccessStatus,
-                preflight: this.resource.cors.preflight,
-                strictPreflight: this.resource.cors.strictPreflight,
-                hideOptionsRoute: this.resource.cors.hideOptionsRoute,
-            });
+            // Only forward the fields the manifest actually set. Spreading `undefined`
+            // for an unset option overrides @fastify/cors's own defaults with
+            // `undefined` — notably `preflight: undefined` disables the preflight 204
+            // reply (its `OPTIONS *` handler then `callNotFound()`s → 404), which a
+            // browser reports as "preflight … does not have HTTP ok status".
+            const cfg = this.resource.cors;
+            const corsOptions = {};
+            for (const key of [
+                "origin",
+                "methods",
+                "allowedHeaders",
+                "exposedHeaders",
+                "credentials",
+                "maxAge",
+                "cacheControl",
+                "preflightContinue",
+                "optionsSuccessStatus",
+                "preflight",
+                "strictPreflight",
+                "hideOptionsRoute",
+            ]) {
+                if (cfg[key] !== undefined)
+                    corsOptions[key] = cfg[key];
+            }
+            await this.app.register(cors, corsOptions);
         }
         // Register custom error handler for validation errors
         this.app.setErrorHandler((error, request, reply) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/http-server",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Telo HTTP Server module - HTTP server and API resource kinds for Telo manifests.",
   "keywords": [
     "telo",
@@ -55,7 +55,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.38.0"
+    "@telorun/sdk": "0.44.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/http-api-controller.ts

@@ -222,8 +222,22 @@ export class HttpServerApi implements ResourceInstance {
           this.ctx.moduleContext,
           this.ctx.validateSchema.bind(this.ctx),
           sink,
-          (err, errCtx) =>
-            this.ctx.emitEvent("Http.Api.streamFailed", {
+          (err, errCtx) => {
+            // Headers are already flushed, so this failure can't reach Fastify's
+            // error handler (which logs pre-stream throws) — log it here, on the
+            // same request logger `logger:` configures, so a mid-stream failure
+            // isn't silent server-side. The event below stays for debug tooling.
+            reply.log.error(
+              {
+                err,
+                path: route.request.path,
+                method: route.request.method,
+                status: errCtx.status,
+                mime: errCtx.mime,
+              },
+              "Http.Api stream failed after response headers were flushed",
+            );
+            return this.ctx.emitEvent("Http.Api.streamFailed", {
               path: route.request.path,
               method: route.request.method,
               status: errCtx.status,
@@ -232,7 +246,8 @@ export class HttpServerApi implements ResourceInstance {
                 err instanceof Error
                   ? { message: err.message, stack: err.stack, code: (err as { code?: string }).code }
                   : { message: String(err) },
-            }),
+            });
+          },
         );
       },
     });

package/src/http-server-controller.ts

@@ -155,20 +155,30 @@ class HttpServer implements ResourceInstance {
     }
 
     if (this.resource.cors) {
-      await this.app.register(cors, {
-        origin: this.resource.cors.origin,
-        methods: this.resource.cors.methods,
-        allowedHeaders: this.resource.cors.allowedHeaders,
-        exposedHeaders: this.resource.cors.exposedHeaders,
-        credentials: this.resource.cors.credentials,
-        maxAge: this.resource.cors.maxAge,
-        cacheControl: this.resource.cors.cacheControl,
-        preflightContinue: this.resource.cors.preflightContinue,
-        optionsSuccessStatus: this.resource.cors.optionsSuccessStatus,
-        preflight: this.resource.cors.preflight,
-        strictPreflight: this.resource.cors.strictPreflight,
-        hideOptionsRoute: this.resource.cors.hideOptionsRoute,
-      });
+      // Only forward the fields the manifest actually set. Spreading `undefined`
+      // for an unset option overrides @fastify/cors's own defaults with
+      // `undefined` — notably `preflight: undefined` disables the preflight 204
+      // reply (its `OPTIONS *` handler then `callNotFound()`s → 404), which a
+      // browser reports as "preflight … does not have HTTP ok status".
+      const cfg = this.resource.cors;
+      const corsOptions: Record<string, unknown> = {};
+      for (const key of [
+        "origin",
+        "methods",
+        "allowedHeaders",
+        "exposedHeaders",
+        "credentials",
+        "maxAge",
+        "cacheControl",
+        "preflightContinue",
+        "optionsSuccessStatus",
+        "preflight",
+        "strictPreflight",
+        "hideOptionsRoute",
+      ] as const) {
+        if (cfg[key] !== undefined) corsOptions[key] = cfg[key];
+      }
+      await this.app.register(cors, corsOptions);
     }
 
     // Register custom error handler for validation errors