@tryghost/mw-error-handler 1.0.5 → 1.0.7

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2013-2022 Ghost Foundation
+Copyright (c) 2013-2025 Ghost Foundation
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/lib/mw-error-handler.js

@@ -1,11 +1,15 @@
 const _ = require('lodash');
+const path = require('path');
 const semver = require('semver');
 const debug = require('@tryghost/debug')('error-handler');
 const errors = require('@tryghost/errors');
 const {prepareStackForUser} = require('@tryghost/errors').utils;
+const {isReqResUserSpecific, cacheControlValues} = require('@tryghost/http-cache-utils');
 const tpl = require('@tryghost/tpl');
 
 const messages = {
+    genericError: 'An unexpected error occurred, please try again.',
+    invalidValue: 'Invalid value',
     pageNotFound: 'Page not found',
     resourceNotFound: 'Resource not found',
     methodNotAcceptableVersionAhead: {
@@ -18,6 +22,7 @@ const messages = {
         context: 'Provided client accept-version {acceptVersion} is behind current Ghost version {ghostVersion}.',
         help: 'Try upgrading your Ghost API client.'
     },
+    badVersion: 'Requested version is not supported.',
     actions: {
         images: {
             upload: 'upload image'
@@ -51,23 +56,32 @@ const messages = {
     UnknownError: 'Unknown error - {name}, cannot {action}.'
 };
 
+function isDependencyInStack(dependency, err) {
+    const dependencyPath = path.join('node_modules', dependency);
+
+    return err?.stack?.match(dependencyPath);
+}
+
 /**
  * Get an error ready to be shown the the user
  */
-module.exports.prepareError = (err, req, res, next) => {
+module.exports.prepareError = function prepareError(err, req, res, next) {
     debug(err);
 
     if (Array.isArray(err)) {
         err = err[0];
     }
 
+    // If the error is already a GhostError, it has been handled and can be returned as-is
+    // For everything else, we do some custom handling here
     if (!errors.utils.isGhostError(err)) {
-        // We need a special case for 404 errors
-        if (err.statusCode && err.statusCode === 404) {
+        // Catch bookshelf empty errors and other 404s, and turn into a Ghost 404
+        if ((err.statusCode && err.statusCode === 404) || err.message === 'EmptyResponse') {
             err = new errors.NotFoundError({
                 err: err
             });
-        } else if (err.stack.match(/node_modules\/handlebars\//)) {
+        // Catch handlebars / express-hbs errors, and render them as 400, rather than 500 errors as the server isn't broken
+        } else if (isDependencyInStack('handlebars', err) || isDependencyInStack('express-hbs', err)) {
             // Temporary handling of theme errors from handlebars
             // @TODO remove this when #10496 is solved properly
             err = new errors.IncorrectUsageError({
@@ -75,11 +89,33 @@ module.exports.prepareError = (err, req, res, next) => {
                 message: err.message,
                 statusCode: err.statusCode
             });
+        // Catch database errors and turn them into 500 errors, but log some useful data to sentry
+        } else if (isDependencyInStack('mysql2', err)) {
+            // we don't want to return raw database errors to our users
+            err.sqlErrorCode = err.code;
+
+            if (err.code === 'ER_WRONG_VALUE') {
+                err = new errors.ValidationError({
+                    message: tpl(messages.invalidValue),
+                    context: err.message,
+                    err
+                });
+            } else {
+                err = new errors.InternalServerError({
+                    err: err,
+                    message: tpl(messages.genericError),
+                    statusCode: err.statusCode,
+                    code: 'UNEXPECTED_ERROR'
+                });
+            }
+        // For everything else, create a generic 500 error, with context set to the original error message
         } else {
             err = new errors.InternalServerError({
                 err: err,
-                message: err.message,
-                statusCode: err.statusCode
+                message: tpl(messages.genericError),
+                context: err.message,
+                statusCode: err.statusCode,
+                code: 'UNEXPECTED_ERROR'
             });
         }
     }
@@ -90,21 +126,23 @@ module.exports.prepareError = (err, req, res, next) => {
     // alternative for res.status();
     res.statusCode = err.statusCode;
 
-    // never cache errors
-    res.set({
-        'Cache-Control': 'no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0'
-    });
-
     next(err);
 };
 
-module.exports.prepareStack = (err, req, res, next) => { // eslint-disable-line no-unused-vars
+module.exports.prepareStack = function prepareStack(err, req, res, next) { // eslint-disable-line no-unused-vars
     const clonedError = prepareStackForUser(err);
 
     next(clonedError);
 };
 
-const jsonErrorRenderer = (err, req, res, next) => { // eslint-disable-line no-unused-vars
+/**
+ * @private the method is exposed for testing purposes only
+ * @param {Object} err
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
+module.exports.jsonErrorRenderer = function jsonErrorRenderer(err, req, res, next) { // eslint-disable-line no-unused-vars
     const userError = prepareUserMessage(err, req);
 
     res.json({
@@ -122,7 +160,32 @@ const jsonErrorRenderer = (err, req, res, next) => { // eslint-disable-line no-u
     });
 };
 
-const prepareUserMessage = (err, req) => {
+/**
+ *
+ * @param {String} [cacheControlHeaderValue] cache-control header value
+ */
+module.exports.prepareErrorCacheControl = function prepareErrorCacheControl(cacheControlHeaderValue) {
+    return function prepareErrorCacheControlInner(err, req, res, next) {
+        let cacheControl = cacheControlHeaderValue;
+        if (!cacheControlHeaderValue) {
+            // never cache errors unless it's a 404
+            cacheControl = cacheControlValues.private;
+
+            // Do not include 'private' cache-control directive for 404 responses
+            if (err.statusCode === 404 && req.method === 'GET' && !isReqResUserSpecific(req, res)) {
+                cacheControl = cacheControlValues.noCacheDynamic;
+            }
+        }
+
+        res.set({
+            'Cache-Control': cacheControl
+        });
+
+        next(err);
+    };
+};
+
+const prepareUserMessage = function prepareUserMessage(err, req) {
     const userError = {
         message: err.message,
         context: err.context
@@ -172,66 +235,78 @@ const prepareUserMessage = (err, req) => {
     return userError;
 };
 
-module.exports.resourceNotFound = (req, res, next) => {
-    if (req && req.headers && req.headers['accept-version']
-        && res.locals && res.locals.safeVersion
-        && semver.compare(semver.coerce(req.headers['accept-version']), semver.coerce(res.locals.safeVersion)) !== 0) {
-        const versionComparison = semver.compare(
-            semver.coerce(req.headers['accept-version']),
-            semver.coerce(res.locals.safeVersion)
-        );
-
-        let notAcceptableError;
-        if (versionComparison === 1) {
-            notAcceptableError = new errors.RequestNotAcceptableError({
-                message: tpl(
-                    messages.methodNotAcceptableVersionAhead.message
-                ),
-                context: tpl(messages.methodNotAcceptableVersionAhead.context, {
-                    acceptVersion: req.headers['accept-version'],
-                    ghostVersion: `v${res.locals.safeVersion}`
-                }),
-                help: tpl(messages.methodNotAcceptableVersionAhead.help),
-                code: 'UPDATE_GHOST'
-            });
-        } else {
-            notAcceptableError = new errors.RequestNotAcceptableError({
-                message: tpl(
-                    messages.methodNotAcceptableVersionBehind.message
-                ),
-                context: tpl(messages.methodNotAcceptableVersionBehind.context, {
-                    acceptVersion: req.headers['accept-version'],
-                    ghostVersion: `v${res.locals.safeVersion}`
-                }),
-                help: tpl(messages.methodNotAcceptableVersionBehind.help),
-                code: 'UPDATE_CLIENT'
-            });
+module.exports.resourceNotFound = function resourceNotFound(req, res, next) {
+    if (req?.headers?.['accept-version'] && res.locals?.safeVersion) {
+        // Protect against invalid `Accept-Version` headers
+        const acceptVersionSemver = semver.coerce(req.headers['accept-version']);
+        if (!acceptVersionSemver) {
+            return next(new errors.BadRequestError({
+                message: tpl(messages.badVersion)
+            }));
         }
 
-        next(notAcceptableError);
-    } else {
-        next(new errors.NotFoundError({message: tpl(messages.resourceNotFound)}));
+        if (semver.compare(acceptVersionSemver, semver.coerce(res.locals.safeVersion)) !== 0) {
+            const versionComparison = semver.compare(
+                acceptVersionSemver,
+                semver.coerce(res.locals.safeVersion)
+            );
+
+            let notAcceptableError;
+            if (versionComparison === 1) {
+                notAcceptableError = new errors.RequestNotAcceptableError({
+                    message: tpl(
+                        messages.methodNotAcceptableVersionAhead.message
+                    ),
+                    context: tpl(messages.methodNotAcceptableVersionAhead.context, {
+                        acceptVersion: req.headers['accept-version'],
+                        ghostVersion: `v${res.locals.safeVersion}`
+                    }),
+                    help: tpl(messages.methodNotAcceptableVersionAhead.help),
+                    code: 'UPDATE_GHOST'
+                });
+            } else {
+                notAcceptableError = new errors.RequestNotAcceptableError({
+                    message: tpl(
+                        messages.methodNotAcceptableVersionBehind.message
+                    ),
+                    context: tpl(messages.methodNotAcceptableVersionBehind.context, {
+                        acceptVersion: req.headers['accept-version'],
+                        ghostVersion: `v${res.locals.safeVersion}`
+                    }),
+                    help: tpl(messages.methodNotAcceptableVersionBehind.help),
+                    code: 'UPDATE_CLIENT'
+                });
+            }
+
+            return next(notAcceptableError);
+        }
     }
+
+    next(new errors.NotFoundError({message: tpl(messages.resourceNotFound)}));
 };
 
-module.exports.pageNotFound = (req, res, next) => {
+module.exports.pageNotFound = function pageNotFound(req, res, next) {
     next(new errors.NotFoundError({message: tpl(messages.pageNotFound)}));
 };
 
 module.exports.handleJSONResponse = sentry => [
     // Make sure the error can be served
     module.exports.prepareError,
+    // Add cache-control header
+    module.exports.prepareErrorCacheControl(),
     // Handle the error in Sentry
     sentry.errorHandler,
     // Format the stack for the user
     module.exports.prepareStack,
     // Render the error using JSON format
-    jsonErrorRenderer
+    module.exports.jsonErrorRenderer
 ];
 
 module.exports.handleHTMLResponse = sentry => [
     // Make sure the error can be served
     module.exports.prepareError,
+    // Add cache-control header
+    module.exports.prepareErrorCacheControl(cacheControlValues.private),
     // Handle the error in Sentry
     sentry.errorHandler,
     // Format the stack for the user

package/package.json

@@ -1,35 +1,41 @@
 {
   "name": "@tryghost/mw-error-handler",
-  "version": "1.0.5",
-  "repository": "https://github.com/TryGhost/Utils/tree/main/packages/mw-error-handler",
+  "version": "1.0.7",
   "author": "Ghost Foundation",
   "license": "MIT",
   "main": "index.js",
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "dev": "echo \"Implement me!\"",
-    "test": "NODE_ENV=testing c8 --all --check-coverage --100 --reporter text --reporter cobertura mocha './test/**/*.test.js'",
-    "lint": "eslint . --ext .js --cache",
-    "posttest": "yarn lint"
+    "test:unit": "NODE_ENV=testing c8 --all --check-coverage --100 --reporter text --reporter cobertura -- mocha --reporter dot './test/**/*.test.js'",
+    "test": "yarn test:unit",
+    "lint:code": "eslint *.js lib/ --ext .js --cache",
+    "lint": "yarn lint:code && yarn lint:test",
+    "lint:test": "eslint -c test/.eslintrc.js test/ --ext .js --cache"
   },
   "files": [
     "index.js",
     "lib"
   ],
-  "publishConfig": {
-    "access": "public"
-  },
   "devDependencies": {
-    "c8": "7.12.0",
-    "mocha": "10.0.0",
-    "should": "13.2.3",
-    "sinon": "14.0.0"
+    "c8": "8.0.1",
+    "mocha": "10.8.2",
+    "sinon": "15.2.0"
   },
   "dependencies": {
-    "@tryghost/debug": "^0.1.9",
-    "@tryghost/errors": "1.2.14",
-    "@tryghost/tpl": "^0.1.8",
-    "lodash": "^4.17.21",
-    "semver": "^7.3.6"
+    "@tryghost/debug": "^0.1.35",
+    "@tryghost/errors": "^1.3.8",
+    "@tryghost/http-cache-utils": "^0.1.20",
+    "@tryghost/tpl": "^0.1.35",
+    "lodash": "4.17.21",
+    "semver": "7.7.2"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TryGhost/framework.git",
+    "directory": "packages/mw-error-handler"
   },
-  "gitHead": "2ce0a263975cf6e0f34233caf19404fd8ab5e7a5"
+  "gitHead": "e395f1d79edee4aecc36e572bb402016a8ba9273"
 }

package/README.md

@@ -1,39 +0,0 @@
-# Mw Error Handler
-
-## Install
-
-`npm install @tryghost/mw-error-handler --save`
-
-or
-
-`yarn add @tryghost/mw-error-handler`
-
-
-## Usage
-
-
-## Develop
-
-This is a mono repository, managed with [lerna](https://lernajs.io/).
-
-Follow the instructions for the top-level repo.
-1. `git clone` this repo & `cd` into it as usual
-2. Run `yarn` to install top-level dependencies.
-
-
-## Run
-
-- `yarn dev`
-
-
-## Test
-
-- `yarn lint` run just eslint
-- `yarn test` run lint and tests
-
-
-
-
-# Copyright & License 
-
-Copyright (c) 2013-2022 Ghost Foundation - Released under the [MIT license](LICENSE).