@ultimat3/http 30.9.0 → 31.1.0

package/src/server.ts

@@ -19,6 +19,7 @@ import {
   systemClock,
 } from '@ultimat3/core';
 import type { Server } from 'bun';
+import { BUN_MAX_REQUEST_BODY_SIZE, capStreamedBody } from './body-ceiling';
 import { defineHttpConfig, type HttpConfig } from './config';
 import { HttpError, serverNotStarted } from './errors';
 import { disclosesHealthDetail } from './health-disclosure';
@@ -26,9 +27,9 @@ import type { ServerHooks } from './hooks';
 import { socketIdleTimeoutSeconds } from './idle-timeout';
 import type { Middleware } from './middleware';
 import { httpPipeline, type Pipeline } from './pipeline';
-import { type RateLimitStore, rateLimiter } from './rate-limit';
+import { rateLimiter } from './rate-limit';
 import { withRouteBuckets } from './rate-limit-buckets';
-import { adoptRateLimitStore } from './rate-limit-installed';
+import { liveRateLimitStore } from './rate-limit-installed';
 import { jsonResponse } from './response';
 import { describeRoutes, httpRouter, type Route } from './router';
 import { serverWebSockets, type WebSocketOption } from './server-websocket';
@@ -64,13 +65,6 @@ export interface ServerOptions {
   readonly role?: Role;
   readonly hooks?: ServerHooks;
   readonly middleware?: readonly Middleware[];
-  /**
-   * Where the rate limiter keeps its counters. Omitted means `memoryRateLimitStore()`, which is
-   * one process' worth of state — correct for dev and tests, and N × every configured number for
-   * N replicas. An app that runs more than one process declares `rateLimit.scope: 'shared'` and
-   * passes a store that says the same, or `httpServer` refuses here.
-   */
-  readonly rateLimitStore?: RateLimitStore;
   /**
    * A websocket served on THIS socket, beside the pipeline. Omitted, the `web` role opens no
    * websocket at all — which is what it did everywhere, and is why the sync node was only ever
@@ -164,25 +158,9 @@ const BODY_POLL_MS = 5;
 
 const roleFromEnv = (): Role => (Bun.env['ROLE'] ?? 'web') as Role;
 
-export const httpServer = (options: ServerOptions): ServerHandle => {
-  // The store this server is handed is also the one actions and queries spend their declared
-  // `rateLimit:` from — adopted BEFORE the pipeline, whose boot check reads it, and never over a
-  // store the boot already chose (`keepChosen`). Given back on `stop()`, or by ANY refusal from
-  // here to the handle — the pipeline's checks, `configureLifecycle`, `assertMountPathFree` — so a
-  // boot that never produced a server leaves nothing behind it.
-  const releaseStore =
-    options.rateLimitStore === undefined
-      ? () => undefined
-      : adoptRateLimitStore(options.rateLimitStore, { keepChosen: true });
-  try {
-    return buildServer(options, releaseStore);
-  } catch (error) {
-    releaseStore();
-    throw error;
-  }
-};
+export const httpServer = (options: ServerOptions): ServerHandle => buildServer(options);
 
-const buildServer = (options: ServerOptions, releaseStore: () => void): ServerHandle => {
+const buildServer = (options: ServerOptions): ServerHandle => {
   const role = options.role ?? roleFromEnv();
   const table = httpRouter(options.routes);
   // Merged here as well as in `httpPipeline`, and for the store's sake: the limiter below is
@@ -191,18 +169,17 @@ const buildServer = (options: ServerOptions, releaseStore: () => void): ServerHa
   // the pipeline's second pass changes nothing. `handle.config` is the merged one for the same
   // reason: `server.config.rateLimit.buckets` has to be what the limiter runs on.
   const config = withRouteBuckets(options.config ?? defineHttpConfig(), table.routes);
-  // The store feeds the limiter seam `PipelineDeps` already had, rather than becoming a second
-  // one: the bucket maths stays in `rateLimiter`, so every driver agrees on the numbers.
+  // The INSTALLED store — the one actions and queries spend their declared `rateLimit:` from —
+  // read on every request (`liveRateLimitStore`), so a route's bucket and a primitive's count in
+  // one place, and a store installed after this server was built is the one it spends from.
+  // It feeds the limiter seam `PipelineDeps` already had, rather than becoming a second one: the
+  // bucket maths stays in `rateLimiter`, so every driver agrees on the numbers.
   const pipeline = httpPipeline({
     table,
     config,
     ...(options.hooks === undefined ? {} : { hooks: options.hooks }),
     ...(options.middleware === undefined ? {} : { middleware: options.middleware }),
-    ...(options.rateLimitStore === undefined
-      ? {}
-      : {
-          limiter: rateLimiter({ config: config.rateLimit, store: options.rateLimitStore }),
-        }),
+    limiter: rateLimiter({ config: config.rateLimit, store: liveRateLimitStore }),
   });
 
   // No deadline is set here. `drain.deadlineMs` is the one budget, applied per role by
@@ -254,9 +231,11 @@ const buildServer = (options: ServerOptions, releaseStore: () => void): ServerHa
     // in-flight work it does not know about.
     const done = beginWork();
     try {
-      return await pipeline.handle(request, {
+      // The address off the socket's own Request, before the body is wrapped: `requestIP` keys on it.
+      const ip = socket?.requestIP(request)?.address ?? null;
+      return await pipeline.handle(capStreamedBody(request, config.maxRequestBodyBytes), {
         role,
-        ip: socket?.requestIP(request)?.address ?? null,
+        ip,
       });
     } finally {
       done();
@@ -338,6 +317,10 @@ const buildServer = (options: ServerOptions, releaseStore: () => void): ServerHa
         development: config.dev,
         // Unset, Bun cuts a silent socket at 10 s whatever `requestTimeoutMs` promised.
         idleTimeout: socketIdleTimeoutSeconds(config.requestTimeoutMs),
+        // Off: Bun's own cap answered an empty, uncoded 413 before this process saw the request,
+        // and its 128 MiB default refused every larger signed upload. `maxRequestBodyBytes` is
+        // the ceiling, enforced coded in `admit` and on the stream (`body-ceiling.ts`).
+        maxRequestBodySize: BUN_MAX_REQUEST_BODY_SIZE,
         routes: {
           ...nativeRoutes(),
           // Health endpoints answer outside the pipeline on purpose: a draining or
@@ -432,7 +415,6 @@ const buildServer = (options: ServerOptions, releaseStore: () => void): ServerHa
       // core's `shutdownHookCount()` exists to make visible. The shape `worker.ts`'s teardown
       // holds: the unregisters are the closure's, not the drain's.
       const releaseHooks = (): void => {
-        releaseStore();
         unregister?.();
         unregisterBodies?.();
         unregisterClose?.();

package/src/stages.ts

@@ -14,6 +14,7 @@ import {
   reportError,
 } from '@ultimat3/core';
 import { signInRedirect } from './auth-redirect';
+import { assertDeclaredBody } from './body-ceiling';
 import { finalizeCacheHeaders } from './cache-stage';
 import { compressResponse } from './compress';
 import { type HttpConfig, stripBasePath } from './config';
@@ -143,7 +144,7 @@ export const stageRunners = (input: StageRunnersInput): Record<StageName, StageR
       return undefined;
     },
 
-    admit: (_request, ctx) => {
+    admit: (request, ctx) => {
       // Before the trace, the route match, auth, the body — everything. A refusal that costs as
       // much as a served request is not load shedding, and this is the stage that makes
       // "reject 40% fast, serve 60% at p99" expressible at all.
@@ -156,6 +157,8 @@ export const stageRunners = (input: StageRunnersInput): Record<StageName, StageR
         throw draining();
       }
       if (isDraining()) ctx.headers.set('connection', 'close');
+      // A declared body over the transport ceiling is refused before anything reads it.
+      assertDeclaredBody(request.raw, ctx.url.pathname, config.maxRequestBodyBytes);
       const ceiling = config.maxInflight;
       // `beginWork()` in `server.ts` counted THIS request before the pipeline was entered, so the
       // ceiling is compared against a number that already includes it.
@@ -350,7 +353,7 @@ export const stageRunners = (input: StageRunnersInput): Record<StageName, StageR
       // The other half of this is `@ultimat3/schema`'s, and it is the load-bearing one: an issue
       // message must stop echoing the rejected value at all. This change makes the value
       // redactable; it does not make it absent.
-      ctx.logger[errorLogLevel(facts.status)](facts.code, {
+      ctx.logger[errorLogLevel(facts.status, error)](facts.code, {
         cause: facts.cause,
         status: facts.status,
       });