@webpieces/http-server 0.3.278 → 0.3.280

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-server",
-  "version": "0.3.278",
+  "version": "0.3.280",
   "description": "WebPieces server with filter chain and dependency injection",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,15 +22,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-context": "0.3.278",
-    "@webpieces/core-util": "0.3.278",
-    "@webpieces/gcp-identity": "0.3.278",
-    "@webpieces/http-filters": "0.3.278",
-    "@webpieces/http-routing": "0.3.278",
+    "@webpieces/core-context": "0.3.280",
+    "@webpieces/core-util": "0.3.280",
+    "@webpieces/gcp-identity": "0.3.280",
+    "@webpieces/http-filters": "0.3.280",
+    "@webpieces/http-routing": "0.3.280",
     "cors": "2.8.5",
+    "express": "5.1.0",
     "inversify": "7.10.4"
   },
   "devDependencies": {
-    "@types/cors": "2.8.19"
+    "@types/cors": "2.8.19",
+    "@types/express": "5.0.5"
   }
 }

package/src/WebpiecesExpress.d.ts

@@ -0,0 +1,44 @@
+import { Express } from 'express';
+import { WebpiecesRouter } from '@webpieces/http-routing';
+/** The value returned by express `app.listen(...)` (a node http.Server). */
+type HttpServer = ReturnType<Express['listen']>;
+/**
+ * WebpiecesExpress - the express adapter (the ONLY place express lifecycle lives).
+ *
+ * Wraps a node-only {@link WebpiecesRouter} and binds its routes + filter chain onto an
+ * express app that the CALLER owns. Webpieces never constructs express and (except for the
+ * opt-in bindAndStartExpress) never calls listen — so a webpieces app can run side-by-side
+ * inside a legacy express server.
+ *
+ * ```typescript
+ * const router = await WebpiecesRouterFactory.create(config, { modules });
+ * router.addRoutes(SaveApi, SaveController);
+ * const server = new WebpiecesExpress(router);
+ *
+ * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware
+ * server.bindExpress(existingApp);
+ *
+ * // non-legacy: add webpieces global middleware + listen for you
+ * await server.bindAndStartExpress(express(), 8080);
+ * ```
+ */
+export declare class WebpiecesExpress {
+    private readonly router;
+    private readonly middleware;
+    constructor(router: WebpiecesRouter);
+    /**
+     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,
+     * express-tier + api-tier filter chain, error->JSON) onto the caller's express app.
+     *
+     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose
+     * other routes must stay untouched. The caller owns app.listen() and any global middleware.
+     */
+    bindExpress(app: Express): void;
+    /**
+     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),
+     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server
+     * where webpieces owns the whole express app. Resolves with the http.Server once listening.
+     */
+    bindAndStartExpress(app: Express, port?: number): Promise<HttpServer>;
+}
+export {};

package/src/WebpiecesExpress.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebpiecesExpress = void 0;
+const WebpiecesMiddleware_1 = require("./WebpiecesMiddleware");
+const WebpiecesRouteCreator_1 = require("./WebpiecesRouteCreator");
+const core_util_1 = require("@webpieces/core-util");
+const log = core_util_1.LogManager.getLogger('WebpiecesExpress');
+/**
+ * WebpiecesExpress - the express adapter (the ONLY place express lifecycle lives).
+ *
+ * Wraps a node-only {@link WebpiecesRouter} and binds its routes + filter chain onto an
+ * express app that the CALLER owns. Webpieces never constructs express and (except for the
+ * opt-in bindAndStartExpress) never calls listen — so a webpieces app can run side-by-side
+ * inside a legacy express server.
+ *
+ * ```typescript
+ * const router = await WebpiecesRouterFactory.create(config, { modules });
+ * router.addRoutes(SaveApi, SaveController);
+ * const server = new WebpiecesExpress(router);
+ *
+ * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware
+ * server.bindExpress(existingApp);
+ *
+ * // non-legacy: add webpieces global middleware + listen for you
+ * await server.bindAndStartExpress(express(), 8080);
+ * ```
+ */
+class WebpiecesExpress {
+    router;
+    middleware = new WebpiecesMiddleware_1.WebpiecesMiddleware();
+    constructor(router) {
+        this.router = router;
+    }
+    /**
+     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,
+     * express-tier + api-tier filter chain, error->JSON) onto the caller's express app.
+     *
+     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose
+     * other routes must stay untouched. The caller owns app.listen() and any global middleware.
+     */
+    bindExpress(app) {
+        const creator = new WebpiecesRouteCreator_1.WebpiecesRouteCreator(app, this.router.getContainer(), this.router.getRouteBuilder(), this.middleware);
+        const count = creator.mountRegisteredRoutes();
+        log.info(`[WebpiecesExpress] Mounted ${count} webpieces route(s) onto express`);
+    }
+    /**
+     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),
+     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server
+     * where webpieces owns the whole express app. Resolves with the http.Server once listening.
+     */
+    async bindAndStartExpress(app, port = 8080) {
+        // Global middleware layers (outermost first) — only for a webpieces-owned app.
+        app.use(this.middleware.globalErrorHandler.bind(this.middleware));
+        app.use(this.middleware.corsForLocalhost());
+        app.use(this.middleware.logNextLayer.bind(this.middleware));
+        this.bindExpress(app);
+        return new Promise((resolve, reject) => {
+            const server = app.listen(port, (error) => {
+                if (error) {
+                    log.error(`[WebpiecesExpress] Failed to start on port ${port}:`, error);
+                    reject(error);
+                    return;
+                }
+                log.info(`[WebpiecesExpress] Listening on http://localhost:${port}`);
+                resolve(server);
+            });
+        });
+    }
+}
+exports.WebpiecesExpress = WebpiecesExpress;
+//# sourceMappingURL=WebpiecesExpress.js.map

package/src/WebpiecesExpress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebpiecesExpress.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesExpress.ts"],"names":[],"mappings":";;;AAEA,+DAA4D;AAC5D,mEAAgE;AAChE,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;AAKrD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,gBAAgB;IAGI;IAFZ,UAAU,GAAG,IAAI,yCAAmB,EAAE,CAAC;IAExD,YAA6B,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAExD;;;;;;OAMG;IACH,WAAW,CAAC,GAAY;QACpB,MAAM,OAAO,GAAG,IAAI,6CAAqB,CACrC,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,EAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAC7B,IAAI,CAAC,UAAU,CAClB,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,8BAA8B,KAAK,kCAAkC,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,OAAe,IAAI;QACvD,+EAA+E;QAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtB,OAAO,IAAI,OAAO,CACd,CAAC,OAAqC,EAAE,MAA4B,EAAE,EAAE;YACpE,MAAM,MAAM,GAAe,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC1D,IAAI,KAAK,EAAE,CAAC;oBACR,GAAG,CAAC,KAAK,CAAC,8CAA8C,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;oBACxE,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACX,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC,CACJ,CAAC;IACN,CAAC;CACJ;AAlDD,4CAkDC","sourcesContent":["import { Express } from 'express';\nimport { WebpiecesRouter } from '@webpieces/http-routing';\nimport { WebpiecesMiddleware } from './WebpiecesMiddleware';\nimport { WebpiecesRouteCreator } from './WebpiecesRouteCreator';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('WebpiecesExpress');\n\n/** The value returned by express `app.listen(...)` (a node http.Server). */\ntype HttpServer = ReturnType<Express['listen']>;\n\n/**\n * WebpiecesExpress - the express adapter (the ONLY place express lifecycle lives).\n *\n * Wraps a node-only {@link WebpiecesRouter} and binds its routes + filter chain onto an\n * express app that the CALLER owns. Webpieces never constructs express and (except for the\n * opt-in bindAndStartExpress) never calls listen — so a webpieces app can run side-by-side\n * inside a legacy express server.\n *\n * ```typescript\n * const router = await WebpiecesRouterFactory.create(config, { modules });\n * router.addRoutes(SaveApi, SaveController);\n * const server = new WebpiecesExpress(router);\n *\n * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware\n * server.bindExpress(existingApp);\n *\n * // non-legacy: add webpieces global middleware + listen for you\n * await server.bindAndStartExpress(express(), 8080);\n * ```\n */\nexport class WebpiecesExpress {\n    private readonly middleware = new WebpiecesMiddleware();\n\n    constructor(private readonly router: WebpiecesRouter) {}\n\n    /**\n     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,\n     * express-tier + api-tier filter chain, error->JSON) onto the caller's express app.\n     *\n     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose\n     * other routes must stay untouched. The caller owns app.listen() and any global middleware.\n     */\n    bindExpress(app: Express): void {\n        const creator = new WebpiecesRouteCreator(\n            app,\n            this.router.getContainer(),\n            this.router.getRouteBuilder(),\n            this.middleware,\n        );\n        const count = creator.mountRegisteredRoutes();\n        log.info(`[WebpiecesExpress] Mounted ${count} webpieces route(s) onto express`);\n    }\n\n    /**\n     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),\n     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server\n     * where webpieces owns the whole express app. Resolves with the http.Server once listening.\n     */\n    async bindAndStartExpress(app: Express, port: number = 8080): Promise<HttpServer> {\n        // Global middleware layers (outermost first) — only for a webpieces-owned app.\n        app.use(this.middleware.globalErrorHandler.bind(this.middleware));\n        app.use(this.middleware.corsForLocalhost());\n        app.use(this.middleware.logNextLayer.bind(this.middleware));\n\n        this.bindExpress(app);\n\n        return new Promise<HttpServer>(\n            (resolve: (server: HttpServer) => void, reject: (err: Error) => void) => {\n                const server: HttpServer = app.listen(port, (error?: Error) => {\n                    if (error) {\n                        log.error(`[WebpiecesExpress] Failed to start on port ${port}:`, error);\n                        reject(error);\n                        return;\n                    }\n                    log.info(`[WebpiecesExpress] Listening on http://localhost:${port}`);\n                    resolve(server);\n                });\n            },\n        );\n    }\n}\n"]}

package/src/WebpiecesMiddleware.d.ts

@@ -2,6 +2,12 @@ import { Request, Response, NextFunction, RequestHandler } from 'express';
 import { MethodMeta } from '@webpieces/http-routing';
 import { RouteMetadata } from '@webpieces/core-util';
 import { Service, WpResponse } from '@webpieces/http-filters';
+/**
+ * Express route handler function type. Lives in http-server (the express adapter),
+ * NOT in the node-only http-routing package, so http-routing stays express-free.
+ * Used by WebpiecesRouteCreator to register handlers Express can call.
+ */
+export type ExpressRouteHandler = (req: Request, res: Response, next: NextFunction) => Promise<void>;
 export declare class ExpressWrapper {
     private service;
     private routeMeta;

package/src/WebpiecesMiddleware.js

@@ -297,7 +297,7 @@ let WebpiecesMiddleware = class WebpiecesMiddleware {
 };
 exports.WebpiecesMiddleware = WebpiecesMiddleware;
 exports.WebpiecesMiddleware = WebpiecesMiddleware = tslib_1.__decorate([
-    (0, http_routing_1.provideSingleton)(),
+    (0, http_routing_1.provideFrameworkSingleton)(),
     (0, inversify_1.injectable)()
 ], WebpiecesMiddleware);
 //# sourceMappingURL=WebpiecesMiddleware.js.map

package/src/WebpiecesMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebpiecesMiddleware.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesMiddleware.ts"],"names":[],"mappings":";;;;AACA,wDAAwB;AACxB,yCAAuC;AACvC,0DAA4F;AAC5F,oDAc8B;AAE9B,oDAA+C;AAC/C,0DAAyD;AACzD,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;AAExD,MAAa,cAAc;IAEX;IACA;IAFZ,YACY,OAAiD,EACjD,SAAwB;QADxB,YAAO,GAAP,OAAO,CAA0C;QACjD,cAAS,GAAT,SAAS,CAAe;IAEpC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QAChE,qDAAqD;QACrD,6DAA6D;QAC7D,MAAM,6BAAc,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAChC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACxE,8HAA8H;QAC9H,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,mBAAmB;YACnB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,4CAA4C;QAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEpD,+EAA+E;QAC/E,IAAI,UAAU,GAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,aAAa;YACb,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,CAAC;QAED,oDAAoD;QACpD,MAAM,UAAU,GAAG,IAAI,yBAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QAE9E,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACX,2DAA2D,IAAI,CAAC,SAAS,CAAC,mBAAmB,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAC/H,CAAC;QACN,CAAC;QAED,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrF,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,GAAY;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAE5C,6EAA6E;QAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAErC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY;QACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrB,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,WAAW,CAAC,GAAa,EAAE,KAAc;QAC5C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;QAE1C,IAAI,KAAK,YAAY,qBAAS,EAAE,CAAC;YAC7B,4CAA4C;YAC5C,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACtC,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACtC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAEhC,8DAA8D;YAC9D,IAAI,KAAK,YAAY,yBAAa,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,aAAa,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAC9C,CAAC;iBAAM,IAAI,KAAK,YAAY,+BAAmB,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBAClC,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,YAAY,6BAAiB,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,YAAY,4BAAgB,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,KAAK,YAAY,2BAAe,EAAE,CAAC;gBAC1C,GAAG,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,aAAa,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YAClD,CAAC;iBAAM,IAAI,KAAK,YAAY,iCAAqB,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,KAAK,YAAY,8BAAkB,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,YAAY,mCAAuB,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,2CAA2C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,KAAK,YAAY,+BAAmB,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,KAAK,YAAY,mCAAuB,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,IAAI,CAAC,uCAAuC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,0DAA0D;YAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACJ,sBAAsB;YACtB,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,KAAK,CAAC,CAAC;YAC3B,aAAa,CAAC,OAAO,GAAG,uBAAuB,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;CACJ;AAxKD,wCAwKC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAE5B;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CACpB,GAAY,EACZ,GAAa,EACb,IAAkB;QAElB,GAAG,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtF,iHAAiH;QACjH,IAAI,CAAC;YACD,6BAA6B;YAC7B,2CAA2C;YAC3C,wDAAwD;YACxD,MAAM,IAAI,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACJ,2DAA2D,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CACtF,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,KAAK,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACnB,yEAAyE;gBACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;;;;;;;mBAOlB,KAAK,CAAC,OAAO;;;SAGvB,CAAC,CAAC;YACC,CAAC;YACD,GAAG,CAAC,IAAI,CACJ,yDAAyD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QAC9D,GAAG,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6CAA6C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB;QACZ,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAEvE,OAAO,IAAA,cAAI,EAAC;YACR,MAAM,EAAE,UAAU,MAAM,EAAE,QAAQ;gBAC9B,6DAA6D;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACrB,OAAO;gBACX,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBACpF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACJ,GAAG,CAAC,IAAI,CAAC,0BAA0B,MAAM,6BAA6B,CAAC,CAAC;oBACxE,QAAQ,CAAC,IAAI,KAAK,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;YACD,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;YAC7D,cAAc,EAAE,GAAG,EAAE,oBAAoB;YACzC,cAAc,EAAE,GAAG,EAAE,4CAA4C;YACjE,MAAM,EAAE,IAAI;SACf,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAChB,OAAiD,EACjD,SAAwB;QAExB,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;CACJ,CAAA;AA/GY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,+BAAgB,GAAE;IAClB,IAAA,sBAAU,GAAE;GACA,mBAAmB,CA+G/B","sourcesContent":["import { Request, Response, NextFunction, RequestHandler } from 'express';\nimport cors from 'cors';\nimport { injectable } from 'inversify';\nimport { provideSingleton, MethodMeta, ExpressRouteHandler } from '@webpieces/http-routing';\nimport {\n    ProtocolError,\n    HttpError,\n    HttpBadRequestError,\n    HttpVendorError,\n    HttpUserError,\n    HttpNotFoundError,\n    HttpTimeoutError,\n    HttpUnauthorizedError,\n    HttpForbiddenError,\n    HttpInternalServerError,\n    HttpBadGatewayError,\n    HttpGatewayTimeoutError,\n    RouteMetadata,\n} from '@webpieces/core-util';\nimport { Service, WpResponse } from '@webpieces/http-filters';\nimport { toError } from '@webpieces/core-util';\nimport { RequestContext } from '@webpieces/core-context';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('WebpiecesMiddleware');\n\nexport class ExpressWrapper {\n    constructor(\n        private service: Service<MethodMeta, WpResponse<unknown>>,\n        private routeMeta: RouteMetadata\n    ) {\n    }\n\n    public async execute(req: Request, res: Response, next: NextFunction) {\n        // MOVED: Wrap entire request in RequestContext.run()\n        // This establishes AsyncLocalStorage context for the request\n        await RequestContext.run(async () => {\n            await this.executeTryCatch(req, res, next);\n        });\n    }\n\n    public async executeTryCatch(req: Request, res: Response, next: NextFunction): Promise<void> {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- ExpressWrapper catches errors to translate to HTTP responses\n        try {\n            await this.executeImpl(req, res, next);\n        } catch (err: unknown) {\n            const error = toError(err);\n            // 5. Handle errors\n            this.handleError(res, error);\n        }\n    }\n\n    public async executeImpl(req: Request, res: Response, next: NextFunction) {\n        // 1. Read HTTP headers from Express request\n        const requestHeaders = this.readExpressHeaders(req);\n\n        // 2. Parse JSON request body manually (SYMMETRIC with client's JSON.stringify)\n        let requestDto: unknown = {};\n        if (['POST', 'PUT', 'PATCH'].includes(req.method)) {\n            // Read raw body as text\n            const bodyText = await this.readRequestBody(req);\n            // Parse JSON\n            requestDto = bodyText ? JSON.parse(bodyText) : {};\n        }\n\n        // 3. Create MethodMeta with headers and request DTO\n        const methodMeta = new MethodMeta(this.routeMeta, requestHeaders, requestDto);\n\n        // 4. Invoke the service (filter chain + controller)\n        const wpResponse = await this.service.invoke(methodMeta);\n        if (!wpResponse.response) {\n            throw new Error(\n                `Route chain(filters & all) is not returning a response. ${this.routeMeta.controllerClassName}.${this.routeMeta.methodName}`\n            );\n        }\n\n        // 5. Serialize response DTO to JSON (SYMMETRIC with client's response.json())\n        const responseJson = JSON.stringify(wpResponse.response);\n        res.status(200).setHeader('Content-Type', 'application/json').send(responseJson);\n    }\n\n    /**\n     * Read HTTP headers from Express request.\n     * Returns Map of header name (lowercase) -> array of values.\n     *\n     * HTTP spec allows multiple values for same header name.\n     */\n    private readExpressHeaders(req: Request): Map<string, string[]> {\n        const headers = new Map<string, string[]>();\n\n        // Express stores headers in req.headers as Record<string, string | string[]>\n        for (const [name, value] of Object.entries(req.headers)) {\n            const lowerName = name.toLowerCase();\n\n            if (typeof value === 'string') {\n                headers.set(lowerName, [value]);\n            } else if (Array.isArray(value)) {\n                headers.set(lowerName, value);\n            }\n        }\n\n        return headers;\n    }\n\n    /**\n     * Read raw request body as text.\n     * Used to manually parse JSON (instead of express.json() middleware).\n     */\n    private async readRequestBody(req: Request): Promise<string> {\n        return new Promise((resolve, reject) => {\n            let body = '';\n            req.on('data', (chunk) => {\n                body += chunk.toString();\n            });\n            req.on('end', () => {\n                resolve(body);\n            });\n            req.on('error', (err) => {\n                reject(err);\n            });\n        });\n    }\n\n    /**\n     * Handle errors - translate to JSON ProtocolError (SYMMETRIC with ClientErrorTranslator).\n     * PUBLIC so wrapExpress can call it for symmetric error handling.\n     * Maps HttpError subclasses to appropriate HTTP status codes and ProtocolError response.\n     *\n     * Maps all HttpError types (must match ClientErrorTranslator.translateError()):\n     * - HttpUserError → 266 (with errorCode)\n     * - HttpBadRequestError → 400 (with field, guiAlertMessage)\n     * - HttpUnauthorizedError → 401\n     * - HttpForbiddenError → 403\n     * - HttpNotFoundError → 404\n     * - HttpTimeoutError → 408\n     * - HttpInternalServerError → 500\n     * - HttpBadGatewayError → 502\n     * - HttpGatewayTimeoutError → 504\n     * - HttpVendorError → 598 (with waitSeconds)\n     */\n    public handleError(res: Response, error: unknown): void {\n        if (res.headersSent) {\n            return;\n        }\n\n        const protocolError = new ProtocolError();\n\n        if (error instanceof HttpError) {\n            // Set common fields for all HttpError types\n            protocolError.message = error.message;\n            protocolError.subType = error.subType;\n            protocolError.name = error.name;\n\n            // Set type-specific fields (MUST match ClientErrorTranslator)\n            if (error instanceof HttpUserError) {\n                log.info(`[ExpressWrapper] User Error: ${error.message}`);\n                protocolError.errorCode = error.errorCode;\n            } else if (error instanceof HttpBadRequestError) {\n                log.info(`[ExpressWrapper] Bad Request: ${error.message}`);\n                protocolError.field = error.field;\n                protocolError.guiAlertMessage = error.guiMessage;\n            } else if (error instanceof HttpNotFoundError) {\n                log.info(`[ExpressWrapper] Not Found: ${error.message}`);\n            } else if (error instanceof HttpTimeoutError) {\n                log.error(`[ExpressWrapper] Timeout Error: ${error.message}`);\n            } else if (error instanceof HttpVendorError) {\n                log.error(`[ExpressWrapper] Vendor Error: ${error.message}`);\n                protocolError.waitSeconds = error.waitSeconds;\n            } else if (error instanceof HttpUnauthorizedError) {\n                log.info(`[ExpressWrapper] Unauthorized: ${error.message}`);\n            } else if (error instanceof HttpForbiddenError) {\n                log.info(`[ExpressWrapper] Forbidden: ${error.message}`);\n            } else if (error instanceof HttpInternalServerError) {\n                log.error(`[ExpressWrapper] Internal Server Error: ${error.message}`);\n            } else if (error instanceof HttpBadGatewayError) {\n                log.error(`[ExpressWrapper] Bad Gateway: ${error.message}`);\n            } else if (error instanceof HttpGatewayTimeoutError) {\n                log.error(`[ExpressWrapper] Gateway Timeout: ${error.message}`);\n            } else {\n                log.info(`[ExpressWrapper] Generic HttpError: ${error.message}`);\n            }\n\n            // Serialize ProtocolError to JSON (SYMMETRIC with client)\n            const responseJson = JSON.stringify(protocolError);\n            res.status(error.code).setHeader('Content-Type', 'application/json').send(responseJson);\n        } else {\n            // Unknown error - 500\n            const err = toError(error);\n            protocolError.message = 'Internal Server Error';\n            log.error('[ExpressWrapper] Unexpected error:', err);\n            const responseJson = JSON.stringify(protocolError);\n            res.status(500).setHeader('Content-Type', 'application/json').send(responseJson);\n        }\n    }\n}\n\n/**\n * WebpiecesMiddleware - Express middleware for WebPieces server.\n *\n * This class contains all Express middleware used by WebpiecesServer:\n * 1. globalErrorHandler - Outermost error handler, returns HTML 500 page\n * 2. logNextLayer - Request/response logging\n * 3. jsonTranslator - JSON Content-Type validation and error translation\n *\n * The middleware is injected into WebpiecesServerImpl and registered with Express\n * in the start() method.\n *\n * IMPORTANT: jsonTranslator does NOT dispatch routes - route dispatch happens via\n * Express's registered route handlers (created by RouteBuilder.createHandler()).\n * jsonTranslator only validates Content-Type and translates errors to JSON.\n *\n * NEW: ExpressWrapper simplified - no longer handles JSON or headers\n * - JSON parsing/serialization moved to JsonFilter\n * - Header transfer moved to ContextFilter (injects PlatformHeadersExtension directly)\n * - ExpressWrapper just creates RouterReqResp and invokes filter chain\n *\n * Extension vs Plugin pattern:\n * - Extensions (DI-level): Contribute capabilities to framework (headers, converters, etc.)\n * - Plugins (App-level): Provide complete features with modules + routes (Hibernate, Jackson, etc.)\n */\n@provideSingleton()\n@injectable()\nexport class WebpiecesMiddleware {\n\n    /**\n     * Global error handler middleware - catches ALL unhandled errors.\n     * Returns HTML 500 error page for any errors that escape the filter chain.\n     *\n     * This is the outermost safety net - JsonTranslator catches JSON API errors,\n     * this catches everything else.\n     */\n    async globalErrorHandler(\n        req: Request,\n        res: Response,\n        next: NextFunction,\n    ): Promise<void> {\n        log.info(`🔴 [Layer 1: GlobalErrorHandler] Request START: ${req.method} ${req.path}`);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- Global error handler IS the top-level catch-all\n        try {\n            // await next() catches BOTH:\n            // 1. Synchronous throws from next() itself\n            // 2. Rejected promises from downstream async middleware\n            await next();\n            log.info(\n                `🔴 [Layer 1: GlobalErrorHandler] Request END (success): ${req.method} ${req.path}`,\n            );\n        } catch (err: unknown) {\n            const error = toError(err);\n            log.error('🔴 [Layer 1: GlobalErrorHandler] Caught unhandled error:', error);\n            if (!res.headersSent) {\n                // Return HTML error page (not JSON - JsonTranslator handles JSON errors)\n                res.status(500).send(`\n          <!DOCTYPE html>\n          <html>\n          <head><title>Server Error</title></head>\n          <body>\n            <h1>You hit a server error</h1>\n            <p>An unexpected error occurred while processing your request.</p>\n            <pre>${error.message}</pre>\n          </body>\n          </html>\n        `);\n            }\n            log.info(\n                `🔴 [Layer 1: GlobalErrorHandler] Request END (error): ${req.method} ${req.path}`,\n            );\n        }\n    }\n\n    /**\n     * Logging middleware - logs request/response flow.\n     * Demonstrates middleware execution order.\n     * IMPORTANT: Must be async and await next() to properly chain with async middleware.\n     */\n    async logNextLayer(req: Request, res: Response, next: NextFunction): Promise<void> {\n        log.info(`🟡 [Layer 2: LogNextLayer] Before next() - ${req.method} ${req.path}`);\n        await next();\n        log.info(`🟡 [Layer 2: LogNextLayer] After next() - ${req.method} ${req.path}`);\n    }\n\n    /**\n     * CORS middleware for localhost development.\n     * Only enables CORS when request origin is localhost:*.\n     *\n     * Wide open for all headers/methods in dev mode.\n     * Non-localhost origins are blocked.\n     *\n     * @returns Express middleware handler for CORS\n     */\n    corsForLocalhost(): RequestHandler {\n        log.info('[WebpiecesMiddleware] CORS enabled for localhost:* origins');\n\n        return cors({\n            origin: function (origin, callback) {\n                // Allow requests with no origin (same-origin, Postman, curl)\n                if (!origin) {\n                    callback(null, true);\n                    return;\n                }\n\n                // Only allow localhost origins\n                if (origin.startsWith('http://localhost:') || origin.startsWith('https://localhost:')) {\n                    callback(null, true);\n                } else {\n                    log.info(`[CORS] Blocked origin: ${origin} (only localhost:* allowed)`);\n                    callback(new Error(`CORS not allowed for origin: ${origin}`));\n                }\n            },\n            credentials: true,\n            methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],\n            allowedHeaders: '*', // Wide open for dev\n            exposedHeaders: '*', // Expose all response headers to browser JS\n            maxAge: 3600,\n        });\n    }\n\n    /**\n     * Create an ExpressWrapper for a route.\n     * The wrapper handles the full request/response cycle (symmetric design).\n     *\n     * NEW: Simplified - no longer passes headers (ContextFilter handles it now)\n     *\n     * @param service - The service wrapping the filter chain and controller\n     * @param routeMeta - Route metadata for MethodMeta and DTO type\n     * @returns ExpressWrapper instance\n     */\n    createExpressWrapper(\n        service: Service<MethodMeta, WpResponse<unknown>>,\n        routeMeta: RouteMetadata,\n    ): ExpressWrapper {\n        return new ExpressWrapper(service, routeMeta);\n    }\n}\n"]}
+{"version":3,"file":"WebpiecesMiddleware.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesMiddleware.ts"],"names":[],"mappings":";;;;AACA,wDAAwB;AACxB,yCAAuC;AACvC,0DAAgF;AAChF,oDAc8B;AAE9B,oDAA+C;AAC/C,0DAAyD;AACzD,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;AAaxD,MAAa,cAAc;IAEX;IACA;IAFZ,YACY,OAAiD,EACjD,SAAwB;QADxB,YAAO,GAAP,OAAO,CAA0C;QACjD,cAAS,GAAT,SAAS,CAAe;IAEpC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QAChE,qDAAqD;QACrD,6DAA6D;QAC7D,MAAM,6BAAc,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAChC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACxE,8HAA8H;QAC9H,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,mBAAmB;YACnB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,4CAA4C;QAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEpD,+EAA+E;QAC/E,IAAI,UAAU,GAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,aAAa;YACb,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,CAAC;QAED,oDAAoD;QACpD,MAAM,UAAU,GAAG,IAAI,yBAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QAE9E,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACX,2DAA2D,IAAI,CAAC,SAAS,CAAC,mBAAmB,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAC/H,CAAC;QACN,CAAC;QAED,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrF,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,GAAY;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAE5C,6EAA6E;QAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAErC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY;QACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrB,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,WAAW,CAAC,GAAa,EAAE,KAAc;QAC5C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;QAE1C,IAAI,KAAK,YAAY,qBAAS,EAAE,CAAC;YAC7B,4CAA4C;YAC5C,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACtC,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACtC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAEhC,8DAA8D;YAC9D,IAAI,KAAK,YAAY,yBAAa,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,aAAa,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAC9C,CAAC;iBAAM,IAAI,KAAK,YAAY,+BAAmB,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBAClC,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,YAAY,6BAAiB,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,YAAY,4BAAgB,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,KAAK,YAAY,2BAAe,EAAE,CAAC;gBAC1C,GAAG,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,aAAa,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YAClD,CAAC;iBAAM,IAAI,KAAK,YAAY,iCAAqB,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,KAAK,YAAY,8BAAkB,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,YAAY,mCAAuB,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,2CAA2C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,KAAK,YAAY,+BAAmB,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,KAAK,YAAY,mCAAuB,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,IAAI,CAAC,uCAAuC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,0DAA0D;YAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACJ,sBAAsB;YACtB,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,KAAK,CAAC,CAAC;YAC3B,aAAa,CAAC,OAAO,GAAG,uBAAuB,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;CACJ;AAxKD,wCAwKC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAE5B;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CACpB,GAAY,EACZ,GAAa,EACb,IAAkB;QAElB,GAAG,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtF,iHAAiH;QACjH,IAAI,CAAC;YACD,6BAA6B;YAC7B,2CAA2C;YAC3C,wDAAwD;YACxD,MAAM,IAAI,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACJ,2DAA2D,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CACtF,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,KAAK,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACnB,yEAAyE;gBACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;;;;;;;mBAOlB,KAAK,CAAC,OAAO;;;SAGvB,CAAC,CAAC;YACC,CAAC;YACD,GAAG,CAAC,IAAI,CACJ,yDAAyD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QAC9D,GAAG,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6CAA6C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB;QACZ,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAEvE,OAAO,IAAA,cAAI,EAAC;YACR,MAAM,EAAE,UAAU,MAAM,EAAE,QAAQ;gBAC9B,6DAA6D;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACrB,OAAO;gBACX,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBACpF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACJ,GAAG,CAAC,IAAI,CAAC,0BAA0B,MAAM,6BAA6B,CAAC,CAAC;oBACxE,QAAQ,CAAC,IAAI,KAAK,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;YACD,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;YAC7D,cAAc,EAAE,GAAG,EAAE,oBAAoB;YACzC,cAAc,EAAE,GAAG,EAAE,4CAA4C;YACjE,MAAM,EAAE,IAAI;SACf,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAChB,OAAiD,EACjD,SAAwB;QAExB,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;CACJ,CAAA;AA/GY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;GACA,mBAAmB,CA+G/B","sourcesContent":["import { Request, Response, NextFunction, RequestHandler } from 'express';\nimport cors from 'cors';\nimport { injectable } from 'inversify';\nimport { provideFrameworkSingleton, MethodMeta } from '@webpieces/http-routing';\nimport {\n    ProtocolError,\n    HttpError,\n    HttpBadRequestError,\n    HttpVendorError,\n    HttpUserError,\n    HttpNotFoundError,\n    HttpTimeoutError,\n    HttpUnauthorizedError,\n    HttpForbiddenError,\n    HttpInternalServerError,\n    HttpBadGatewayError,\n    HttpGatewayTimeoutError,\n    RouteMetadata,\n} from '@webpieces/core-util';\nimport { Service, WpResponse } from '@webpieces/http-filters';\nimport { toError } from '@webpieces/core-util';\nimport { RequestContext } from '@webpieces/core-context';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('WebpiecesMiddleware');\n\n/**\n * Express route handler function type. Lives in http-server (the express adapter),\n * NOT in the node-only http-routing package, so http-routing stays express-free.\n * Used by WebpiecesRouteCreator to register handlers Express can call.\n */\nexport type ExpressRouteHandler = (\n    req: Request,\n    res: Response,\n    next: NextFunction,\n) => Promise<void>;\n\nexport class ExpressWrapper {\n    constructor(\n        private service: Service<MethodMeta, WpResponse<unknown>>,\n        private routeMeta: RouteMetadata\n    ) {\n    }\n\n    public async execute(req: Request, res: Response, next: NextFunction) {\n        // MOVED: Wrap entire request in RequestContext.run()\n        // This establishes AsyncLocalStorage context for the request\n        await RequestContext.run(async () => {\n            await this.executeTryCatch(req, res, next);\n        });\n    }\n\n    public async executeTryCatch(req: Request, res: Response, next: NextFunction): Promise<void> {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- ExpressWrapper catches errors to translate to HTTP responses\n        try {\n            await this.executeImpl(req, res, next);\n        } catch (err: unknown) {\n            const error = toError(err);\n            // 5. Handle errors\n            this.handleError(res, error);\n        }\n    }\n\n    public async executeImpl(req: Request, res: Response, next: NextFunction) {\n        // 1. Read HTTP headers from Express request\n        const requestHeaders = this.readExpressHeaders(req);\n\n        // 2. Parse JSON request body manually (SYMMETRIC with client's JSON.stringify)\n        let requestDto: unknown = {};\n        if (['POST', 'PUT', 'PATCH'].includes(req.method)) {\n            // Read raw body as text\n            const bodyText = await this.readRequestBody(req);\n            // Parse JSON\n            requestDto = bodyText ? JSON.parse(bodyText) : {};\n        }\n\n        // 3. Create MethodMeta with headers and request DTO\n        const methodMeta = new MethodMeta(this.routeMeta, requestHeaders, requestDto);\n\n        // 4. Invoke the service (filter chain + controller)\n        const wpResponse = await this.service.invoke(methodMeta);\n        if (!wpResponse.response) {\n            throw new Error(\n                `Route chain(filters & all) is not returning a response. ${this.routeMeta.controllerClassName}.${this.routeMeta.methodName}`\n            );\n        }\n\n        // 5. Serialize response DTO to JSON (SYMMETRIC with client's response.json())\n        const responseJson = JSON.stringify(wpResponse.response);\n        res.status(200).setHeader('Content-Type', 'application/json').send(responseJson);\n    }\n\n    /**\n     * Read HTTP headers from Express request.\n     * Returns Map of header name (lowercase) -> array of values.\n     *\n     * HTTP spec allows multiple values for same header name.\n     */\n    private readExpressHeaders(req: Request): Map<string, string[]> {\n        const headers = new Map<string, string[]>();\n\n        // Express stores headers in req.headers as Record<string, string | string[]>\n        for (const [name, value] of Object.entries(req.headers)) {\n            const lowerName = name.toLowerCase();\n\n            if (typeof value === 'string') {\n                headers.set(lowerName, [value]);\n            } else if (Array.isArray(value)) {\n                headers.set(lowerName, value);\n            }\n        }\n\n        return headers;\n    }\n\n    /**\n     * Read raw request body as text.\n     * Used to manually parse JSON (instead of express.json() middleware).\n     */\n    private async readRequestBody(req: Request): Promise<string> {\n        return new Promise((resolve, reject) => {\n            let body = '';\n            req.on('data', (chunk) => {\n                body += chunk.toString();\n            });\n            req.on('end', () => {\n                resolve(body);\n            });\n            req.on('error', (err) => {\n                reject(err);\n            });\n        });\n    }\n\n    /**\n     * Handle errors - translate to JSON ProtocolError (SYMMETRIC with ClientErrorTranslator).\n     * PUBLIC so wrapExpress can call it for symmetric error handling.\n     * Maps HttpError subclasses to appropriate HTTP status codes and ProtocolError response.\n     *\n     * Maps all HttpError types (must match ClientErrorTranslator.translateError()):\n     * - HttpUserError → 266 (with errorCode)\n     * - HttpBadRequestError → 400 (with field, guiAlertMessage)\n     * - HttpUnauthorizedError → 401\n     * - HttpForbiddenError → 403\n     * - HttpNotFoundError → 404\n     * - HttpTimeoutError → 408\n     * - HttpInternalServerError → 500\n     * - HttpBadGatewayError → 502\n     * - HttpGatewayTimeoutError → 504\n     * - HttpVendorError → 598 (with waitSeconds)\n     */\n    public handleError(res: Response, error: unknown): void {\n        if (res.headersSent) {\n            return;\n        }\n\n        const protocolError = new ProtocolError();\n\n        if (error instanceof HttpError) {\n            // Set common fields for all HttpError types\n            protocolError.message = error.message;\n            protocolError.subType = error.subType;\n            protocolError.name = error.name;\n\n            // Set type-specific fields (MUST match ClientErrorTranslator)\n            if (error instanceof HttpUserError) {\n                log.info(`[ExpressWrapper] User Error: ${error.message}`);\n                protocolError.errorCode = error.errorCode;\n            } else if (error instanceof HttpBadRequestError) {\n                log.info(`[ExpressWrapper] Bad Request: ${error.message}`);\n                protocolError.field = error.field;\n                protocolError.guiAlertMessage = error.guiMessage;\n            } else if (error instanceof HttpNotFoundError) {\n                log.info(`[ExpressWrapper] Not Found: ${error.message}`);\n            } else if (error instanceof HttpTimeoutError) {\n                log.error(`[ExpressWrapper] Timeout Error: ${error.message}`);\n            } else if (error instanceof HttpVendorError) {\n                log.error(`[ExpressWrapper] Vendor Error: ${error.message}`);\n                protocolError.waitSeconds = error.waitSeconds;\n            } else if (error instanceof HttpUnauthorizedError) {\n                log.info(`[ExpressWrapper] Unauthorized: ${error.message}`);\n            } else if (error instanceof HttpForbiddenError) {\n                log.info(`[ExpressWrapper] Forbidden: ${error.message}`);\n            } else if (error instanceof HttpInternalServerError) {\n                log.error(`[ExpressWrapper] Internal Server Error: ${error.message}`);\n            } else if (error instanceof HttpBadGatewayError) {\n                log.error(`[ExpressWrapper] Bad Gateway: ${error.message}`);\n            } else if (error instanceof HttpGatewayTimeoutError) {\n                log.error(`[ExpressWrapper] Gateway Timeout: ${error.message}`);\n            } else {\n                log.info(`[ExpressWrapper] Generic HttpError: ${error.message}`);\n            }\n\n            // Serialize ProtocolError to JSON (SYMMETRIC with client)\n            const responseJson = JSON.stringify(protocolError);\n            res.status(error.code).setHeader('Content-Type', 'application/json').send(responseJson);\n        } else {\n            // Unknown error - 500\n            const err = toError(error);\n            protocolError.message = 'Internal Server Error';\n            log.error('[ExpressWrapper] Unexpected error:', err);\n            const responseJson = JSON.stringify(protocolError);\n            res.status(500).setHeader('Content-Type', 'application/json').send(responseJson);\n        }\n    }\n}\n\n/**\n * WebpiecesMiddleware - Express middleware for WebPieces server.\n *\n * This class contains all Express middleware used by WebpiecesServer:\n * 1. globalErrorHandler - Outermost error handler, returns HTML 500 page\n * 2. logNextLayer - Request/response logging\n * 3. jsonTranslator - JSON Content-Type validation and error translation\n *\n * The middleware is injected into WebpiecesServerImpl and registered with Express\n * in the start() method.\n *\n * IMPORTANT: jsonTranslator does NOT dispatch routes - route dispatch happens via\n * Express's registered route handlers (created by RouteBuilder.createHandler()).\n * jsonTranslator only validates Content-Type and translates errors to JSON.\n *\n * NEW: ExpressWrapper simplified - no longer handles JSON or headers\n * - JSON parsing/serialization moved to JsonFilter\n * - Header transfer moved to ContextFilter (injects PlatformHeadersExtension directly)\n * - ExpressWrapper just creates RouterReqResp and invokes filter chain\n *\n * Extension vs Plugin pattern:\n * - Extensions (DI-level): Contribute capabilities to framework (headers, converters, etc.)\n * - Plugins (App-level): Provide complete features with modules + routes (Hibernate, Jackson, etc.)\n */\n@provideFrameworkSingleton()\n@injectable()\nexport class WebpiecesMiddleware {\n\n    /**\n     * Global error handler middleware - catches ALL unhandled errors.\n     * Returns HTML 500 error page for any errors that escape the filter chain.\n     *\n     * This is the outermost safety net - JsonTranslator catches JSON API errors,\n     * this catches everything else.\n     */\n    async globalErrorHandler(\n        req: Request,\n        res: Response,\n        next: NextFunction,\n    ): Promise<void> {\n        log.info(`🔴 [Layer 1: GlobalErrorHandler] Request START: ${req.method} ${req.path}`);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- Global error handler IS the top-level catch-all\n        try {\n            // await next() catches BOTH:\n            // 1. Synchronous throws from next() itself\n            // 2. Rejected promises from downstream async middleware\n            await next();\n            log.info(\n                `🔴 [Layer 1: GlobalErrorHandler] Request END (success): ${req.method} ${req.path}`,\n            );\n        } catch (err: unknown) {\n            const error = toError(err);\n            log.error('🔴 [Layer 1: GlobalErrorHandler] Caught unhandled error:', error);\n            if (!res.headersSent) {\n                // Return HTML error page (not JSON - JsonTranslator handles JSON errors)\n                res.status(500).send(`\n          <!DOCTYPE html>\n          <html>\n          <head><title>Server Error</title></head>\n          <body>\n            <h1>You hit a server error</h1>\n            <p>An unexpected error occurred while processing your request.</p>\n            <pre>${error.message}</pre>\n          </body>\n          </html>\n        `);\n            }\n            log.info(\n                `🔴 [Layer 1: GlobalErrorHandler] Request END (error): ${req.method} ${req.path}`,\n            );\n        }\n    }\n\n    /**\n     * Logging middleware - logs request/response flow.\n     * Demonstrates middleware execution order.\n     * IMPORTANT: Must be async and await next() to properly chain with async middleware.\n     */\n    async logNextLayer(req: Request, res: Response, next: NextFunction): Promise<void> {\n        log.info(`🟡 [Layer 2: LogNextLayer] Before next() - ${req.method} ${req.path}`);\n        await next();\n        log.info(`🟡 [Layer 2: LogNextLayer] After next() - ${req.method} ${req.path}`);\n    }\n\n    /**\n     * CORS middleware for localhost development.\n     * Only enables CORS when request origin is localhost:*.\n     *\n     * Wide open for all headers/methods in dev mode.\n     * Non-localhost origins are blocked.\n     *\n     * @returns Express middleware handler for CORS\n     */\n    corsForLocalhost(): RequestHandler {\n        log.info('[WebpiecesMiddleware] CORS enabled for localhost:* origins');\n\n        return cors({\n            origin: function (origin, callback) {\n                // Allow requests with no origin (same-origin, Postman, curl)\n                if (!origin) {\n                    callback(null, true);\n                    return;\n                }\n\n                // Only allow localhost origins\n                if (origin.startsWith('http://localhost:') || origin.startsWith('https://localhost:')) {\n                    callback(null, true);\n                } else {\n                    log.info(`[CORS] Blocked origin: ${origin} (only localhost:* allowed)`);\n                    callback(new Error(`CORS not allowed for origin: ${origin}`));\n                }\n            },\n            credentials: true,\n            methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],\n            allowedHeaders: '*', // Wide open for dev\n            exposedHeaders: '*', // Expose all response headers to browser JS\n            maxAge: 3600,\n        });\n    }\n\n    /**\n     * Create an ExpressWrapper for a route.\n     * The wrapper handles the full request/response cycle (symmetric design).\n     *\n     * NEW: Simplified - no longer passes headers (ContextFilter handles it now)\n     *\n     * @param service - The service wrapping the filter chain and controller\n     * @param routeMeta - Route metadata for MethodMeta and DTO type\n     * @returns ExpressWrapper instance\n     */\n    createExpressWrapper(\n        service: Service<MethodMeta, WpResponse<unknown>>,\n        routeMeta: RouteMetadata,\n    ): ExpressWrapper {\n        return new ExpressWrapper(service, routeMeta);\n    }\n}\n"]}

package/src/WebpiecesRouteCreator.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.WebpiecesRouteCreator = void 0;
 const http_routing_1 = require("@webpieces/http-routing");
 const WebpiecesMiddleware_1 = require("./WebpiecesMiddleware");
-const InProcessApiClientFactory_1 = require("./InProcessApiClientFactory");
 const core_util_1 = require("@webpieces/core-util");
 /**
  * WebpiecesRouteCreator - Embeddable adapter that mounts the webpieces
@@ -62,7 +61,7 @@ class WebpiecesRouteCreator {
         this.routeBuilder = routeBuilder ?? new http_routing_1.RouteBuilderImpl();
         this.routeBuilder.setContainer(container);
         this.middleware = middleware ?? new WebpiecesMiddleware_1.WebpiecesMiddleware();
-        this.clientFactory = new InProcessApiClientFactory_1.InProcessApiClientFactory(this.routeBuilder);
+        this.clientFactory = new http_routing_1.InProcessApiClientFactory(this.routeBuilder);
     }
     /**
      * Register filters that wrap every matching route (glob pattern vs controller filepath).

package/src/WebpiecesRouteCreator.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebpiecesRouteCreator.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesRouteCreator.ts"],"names":[],"mappings":";;;AAEA,0DAOiC;AACjC,+DAA4D;AAC5D,2EAAwE;AACxE,oDAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;AAE1D,MAAa,qBAAqB;IAelB;IAdJ,YAAY,CAAmB;IAC/B,UAAU,CAAsB;IAChC,aAAa,CAA4B;IAEjD,gFAAgF;IACxE,SAAS,GAAG,KAAK,CAAC;IAE1B;;;;;OAKG;IACH,YACY,GAAY,EACpB,SAAoB,EACpB,YAA+B,EAC/B,UAAgC;QAHxB,QAAG,GAAH,GAAG,CAAS;QAKpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,+BAAgB,EAAE,CAAC;QAC3D,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,IAAI,yCAAmB,EAAE,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,qDAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,GAAG,IAAwB;QACnC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACX,+IAA+I,CAClJ,CAAC;QACN,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CACH,YAA6B,EAC7B,eAAuC;QAEvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAEtB,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,gCAAiB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAErE,2CAA2C;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QAC1D,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAE7C,KAAK,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAC7C,KAAK,MAAM,aAAa,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,yFAAyF;IACzF,eAAe,CAAI,YAAgD;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,eAAe;QACX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,aAAmC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QAErD,oEAAoE;QACpE,gFAAgF;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEzE,IAAI,CAAC,eAAe,CAChB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,IAAI,EACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAChC,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,UAAkB,EAAE,IAAY,EAAE,cAAmC;QACzF,QAAQ,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,KAAK,KAAK;gBACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,MAAM;YACV,KAAK,MAAM;gBACP,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACpC,MAAM;YACV,KAAK,KAAK;gBACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,MAAM;YACV,KAAK,QAAQ;gBACT,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACtC,MAAM;YACV,KAAK,OAAO;gBACR,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACrC,MAAM;YACV;gBACI,GAAG,CAAC,IAAI,CAAC,gDAAgD,UAAU,EAAE,CAAC,CAAC;QAC/E,CAAC;IACL,CAAC;CACJ;AAxID,sDAwIC","sourcesContent":["import { Express } from 'express';\nimport { Container } from 'inversify';\nimport {\n    ApiRoutingFactory,\n    ClassType,\n    ExpressRouteHandler,\n    FilterDefinition,\n    RouteBuilderImpl,\n    RouteHandlerWithMeta,\n} from '@webpieces/http-routing';\nimport { WebpiecesMiddleware } from './WebpiecesMiddleware';\nimport { InProcessApiClientFactory } from './InProcessApiClientFactory';\nimport { LogManager } from '@webpieces/core-util';\n\n/**\n * WebpiecesRouteCreator - Embeddable adapter that mounts the webpieces\n * api -> filters -> controller pipeline onto ANY existing Express app.\n *\n * Legacy Express apps can adopt webpieces incrementally: existing routes and\n * middleware keep working untouched; each wired webpieces route is fully\n * self-contained (own body parsing, own RequestContext, own error->JSON mapping).\n * This class never calls app.use() - it only registers per-route handlers.\n *\n * Usage:\n * ```typescript\n * const app = express();                       // your existing legacy app\n * const container = new Container();\n * await container.load(buildProviderModule()); // picks up @provideSingleton classes\n * await container.load(WebpiecesModule);       // required if you use ContextFilter\n *\n * const creator = new WebpiecesRouteCreator(app, container);\n * creator.wireFilters(\n *     new FilterDefinition(2000, ContextFilter, '*'),\n *     new FilterDefinition(1900, AuthFilter, 'src/controllers/admin/**'),\n * );\n * creator.wireApi(SaveApi, SaveController);    // controller resolved from container\n * creator.wireApi(PublicApi, PublicController);\n * app.listen(8080);\n * ```\n *\n * Notes:\n * - ALL wireFilters() calls must come BEFORE the first wireApi() call. Filter\n *   chains are composed per-route at wireApi time, so late filters would be\n *   silently ignored - we throw instead.\n * - Scoped filter glob patterns match the controller filepath from the\n *   @SourceFile decorator, falling back to the pattern `**\\/{ClassName}.ts`.\n * - Want webpieces' localhost CORS? Opt in yourself:\n *   `app.use(new WebpiecesMiddleware().corsForLocalhost())`.\n *\n * This same class is used internally by WebpiecesServerImpl.start(), so the\n * full server and the embeddable adapter share one code path.\n */\nconst log = LogManager.getLogger('WebpiecesRouteCreator');\n\nexport class WebpiecesRouteCreator {\n    private routeBuilder: RouteBuilderImpl;\n    private middleware: WebpiecesMiddleware;\n    private clientFactory: InProcessApiClientFactory;\n\n    /** Locks wireFilters() once the first wireApi() has composed a filter chain. */\n    private apisWired = false;\n\n    /**\n     * @param app - The Express app to mount routes on (yours - never taken over)\n     * @param container - Inversify container used to resolve controllers and filters\n     * @param routeBuilder - Internal: WebpiecesServerImpl passes its DI singleton; standalone users omit\n     * @param middleware - Internal: WebpiecesServerImpl passes its DI singleton; standalone users omit\n     */\n    constructor(\n        private app: Express,\n        container: Container,\n        routeBuilder?: RouteBuilderImpl,\n        middleware?: WebpiecesMiddleware,\n    ) {\n        this.routeBuilder = routeBuilder ?? new RouteBuilderImpl();\n        this.routeBuilder.setContainer(container);\n        this.middleware = middleware ?? new WebpiecesMiddleware();\n        this.clientFactory = new InProcessApiClientFactory(this.routeBuilder);\n    }\n\n    /**\n     * Register filters that wrap every matching route (glob pattern vs controller filepath).\n     * Must be called before the first wireApi() - filter chains are composed per-route.\n     */\n    wireFilters(...defs: FilterDefinition[]): void {\n        if (this.apisWired) {\n            throw new Error(\n                'wireFilters() must be called before wireApi() - filter chains are composed per-route at wireApi time, so filters added later would never run.',\n            );\n        }\n        for (const def of defs) {\n            this.routeBuilder.addFilter(def);\n        }\n    }\n\n    /**\n     * Wire an API prototype class (with @ApiPath/@Endpoint decorators) to its\n     * controller, mounting one Express route per endpoint with the full filter\n     * chain. The controller is resolved from the Inversify container.\n     */\n    wireApi<TApi, TController extends TApi>(\n        apiPrototype: ClassType<TApi>,\n        controllerClass: ClassType<TController>,\n    ): void {\n        this.apisWired = true;\n\n        // Reuses all existing validation: @ApiPath present, controller extends\n        // api prototype, every endpoint implemented + has @Authentication.\n        const factory = new ApiRoutingFactory(apiPrototype, controllerClass);\n\n        // Mount only the routes added by THIS call\n        const routesBefore = this.routeBuilder.getRoutes().length;\n        factory.configure(this.routeBuilder);\n        const routes = this.routeBuilder.getRoutes();\n\n        for (let i = routesBefore; i < routes.length; i++) {\n            this.mountRoute(routes[i]);\n        }\n    }\n\n    /**\n     * Mount every route currently registered on the RouteBuilder.\n     * Used by WebpiecesServerImpl.start() where routes were registered up front\n     * from WebAppMeta.getRoutes().\n     *\n     * @returns Number of routes mounted\n     */\n    mountRegisteredRoutes(): number {\n        const routes = this.routeBuilder.getRoutes();\n        for (const routeWithMeta of routes) {\n            this.mountRoute(routeWithMeta);\n        }\n        return routes.length;\n    }\n\n    /**\n     * Create an in-process API client (full filter chain + controller, no HTTP).\n     * Same testing story as WebpiecesServer.createApiClient().\n     */\n    // webpieces-disable no-any-unknown -- abstract constructor signature requires any[] args\n    createApiClient<T>(apiPrototype: abstract new (...args: any[]) => T): T {\n        return this.clientFactory.createApiClient(apiPrototype);\n    }\n\n    /**\n     * Escape hatch for advanced wiring (e.g. addRoute with a hand-built RouteDefinition).\n     */\n    getRouteBuilder(): RouteBuilderImpl {\n        return this.routeBuilder;\n    }\n\n    /**\n     * Compose the filter chain for one route and register it on the Express app.\n     */\n    private mountRoute(routeWithMeta: RouteHandlerWithMeta): void {\n        const service = this.routeBuilder.createRouteHandler(routeWithMeta);\n        const routeMeta = routeWithMeta.definition.routeMeta;\n\n        // ExpressWrapper handles the full request/response cycle per route:\n        // RequestContext.run, header read, manual JSON body parse, error->ProtocolError\n        const wrapper = this.middleware.createExpressWrapper(service, routeMeta);\n\n        this.registerHandler(\n            routeMeta.httpMethod,\n            routeMeta.path,\n            wrapper.execute.bind(wrapper),\n        );\n    }\n\n    private registerHandler(httpMethod: string, path: string, expressHandler: ExpressRouteHandler): void {\n        switch (httpMethod.toLowerCase()) {\n            case 'get':\n                this.app.get(path, expressHandler);\n                break;\n            case 'post':\n                this.app.post(path, expressHandler);\n                break;\n            case 'put':\n                this.app.put(path, expressHandler);\n                break;\n            case 'delete':\n                this.app.delete(path, expressHandler);\n                break;\n            case 'patch':\n                this.app.patch(path, expressHandler);\n                break;\n            default:\n                log.warn(`[WebpiecesRouteCreator] Unknown HTTP method: ${httpMethod}`);\n        }\n    }\n}\n"]}
+{"version":3,"file":"WebpiecesRouteCreator.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesRouteCreator.ts"],"names":[],"mappings":";;;AAEA,0DAOiC;AACjC,+DAAiF;AACjF,oDAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;AAE1D,MAAa,qBAAqB;IAelB;IAdJ,YAAY,CAAmB;IAC/B,UAAU,CAAsB;IAChC,aAAa,CAA4B;IAEjD,gFAAgF;IACxE,SAAS,GAAG,KAAK,CAAC;IAE1B;;;;;OAKG;IACH,YACY,GAAY,EACpB,SAAoB,EACpB,YAA+B,EAC/B,UAAgC;QAHxB,QAAG,GAAH,GAAG,CAAS;QAKpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,+BAAgB,EAAE,CAAC;QAC3D,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,IAAI,yCAAmB,EAAE,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,wCAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,GAAG,IAAwB;QACnC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACX,+IAA+I,CAClJ,CAAC;QACN,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CACH,YAA6B,EAC7B,eAAuC;QAEvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAEtB,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,gCAAiB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAErE,2CAA2C;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QAC1D,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAE7C,KAAK,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAC7C,KAAK,MAAM,aAAa,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,yFAAyF;IACzF,eAAe,CAAI,YAAgD;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,eAAe;QACX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,aAAmC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QAErD,oEAAoE;QACpE,gFAAgF;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEzE,IAAI,CAAC,eAAe,CAChB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,IAAI,EACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAChC,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,UAAkB,EAAE,IAAY,EAAE,cAAmC;QACzF,QAAQ,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,KAAK,KAAK;gBACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,MAAM;YACV,KAAK,MAAM;gBACP,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACpC,MAAM;YACV,KAAK,KAAK;gBACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,MAAM;YACV,KAAK,QAAQ;gBACT,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACtC,MAAM;YACV,KAAK,OAAO;gBACR,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACrC,MAAM;YACV;gBACI,GAAG,CAAC,IAAI,CAAC,gDAAgD,UAAU,EAAE,CAAC,CAAC;QAC/E,CAAC;IACL,CAAC;CACJ;AAxID,sDAwIC","sourcesContent":["import { Express } from 'express';\nimport { Container } from 'inversify';\nimport {\n    ApiRoutingFactory,\n    ClassType,\n    FilterDefinition,\n    RouteBuilderImpl,\n    RouteHandlerWithMeta,\n    InProcessApiClientFactory,\n} from '@webpieces/http-routing';\nimport { WebpiecesMiddleware, ExpressRouteHandler } from './WebpiecesMiddleware';\nimport { LogManager } from '@webpieces/core-util';\n\n/**\n * WebpiecesRouteCreator - Embeddable adapter that mounts the webpieces\n * api -> filters -> controller pipeline onto ANY existing Express app.\n *\n * Legacy Express apps can adopt webpieces incrementally: existing routes and\n * middleware keep working untouched; each wired webpieces route is fully\n * self-contained (own body parsing, own RequestContext, own error->JSON mapping).\n * This class never calls app.use() - it only registers per-route handlers.\n *\n * Usage:\n * ```typescript\n * const app = express();                       // your existing legacy app\n * const container = new Container();\n * await container.load(buildProviderModule()); // picks up @provideSingleton classes\n * await container.load(WebpiecesModule);       // required if you use ContextFilter\n *\n * const creator = new WebpiecesRouteCreator(app, container);\n * creator.wireFilters(\n *     new FilterDefinition(2000, ContextFilter, '*'),\n *     new FilterDefinition(1900, AuthFilter, 'src/controllers/admin/**'),\n * );\n * creator.wireApi(SaveApi, SaveController);    // controller resolved from container\n * creator.wireApi(PublicApi, PublicController);\n * app.listen(8080);\n * ```\n *\n * Notes:\n * - ALL wireFilters() calls must come BEFORE the first wireApi() call. Filter\n *   chains are composed per-route at wireApi time, so late filters would be\n *   silently ignored - we throw instead.\n * - Scoped filter glob patterns match the controller filepath from the\n *   @SourceFile decorator, falling back to the pattern `**\\/{ClassName}.ts`.\n * - Want webpieces' localhost CORS? Opt in yourself:\n *   `app.use(new WebpiecesMiddleware().corsForLocalhost())`.\n *\n * This same class is used internally by WebpiecesServerImpl.start(), so the\n * full server and the embeddable adapter share one code path.\n */\nconst log = LogManager.getLogger('WebpiecesRouteCreator');\n\nexport class WebpiecesRouteCreator {\n    private routeBuilder: RouteBuilderImpl;\n    private middleware: WebpiecesMiddleware;\n    private clientFactory: InProcessApiClientFactory;\n\n    /** Locks wireFilters() once the first wireApi() has composed a filter chain. */\n    private apisWired = false;\n\n    /**\n     * @param app - The Express app to mount routes on (yours - never taken over)\n     * @param container - Inversify container used to resolve controllers and filters\n     * @param routeBuilder - Internal: WebpiecesServerImpl passes its DI singleton; standalone users omit\n     * @param middleware - Internal: WebpiecesServerImpl passes its DI singleton; standalone users omit\n     */\n    constructor(\n        private app: Express,\n        container: Container,\n        routeBuilder?: RouteBuilderImpl,\n        middleware?: WebpiecesMiddleware,\n    ) {\n        this.routeBuilder = routeBuilder ?? new RouteBuilderImpl();\n        this.routeBuilder.setContainer(container);\n        this.middleware = middleware ?? new WebpiecesMiddleware();\n        this.clientFactory = new InProcessApiClientFactory(this.routeBuilder);\n    }\n\n    /**\n     * Register filters that wrap every matching route (glob pattern vs controller filepath).\n     * Must be called before the first wireApi() - filter chains are composed per-route.\n     */\n    wireFilters(...defs: FilterDefinition[]): void {\n        if (this.apisWired) {\n            throw new Error(\n                'wireFilters() must be called before wireApi() - filter chains are composed per-route at wireApi time, so filters added later would never run.',\n            );\n        }\n        for (const def of defs) {\n            this.routeBuilder.addFilter(def);\n        }\n    }\n\n    /**\n     * Wire an API prototype class (with @ApiPath/@Endpoint decorators) to its\n     * controller, mounting one Express route per endpoint with the full filter\n     * chain. The controller is resolved from the Inversify container.\n     */\n    wireApi<TApi, TController extends TApi>(\n        apiPrototype: ClassType<TApi>,\n        controllerClass: ClassType<TController>,\n    ): void {\n        this.apisWired = true;\n\n        // Reuses all existing validation: @ApiPath present, controller extends\n        // api prototype, every endpoint implemented + has @Authentication.\n        const factory = new ApiRoutingFactory(apiPrototype, controllerClass);\n\n        // Mount only the routes added by THIS call\n        const routesBefore = this.routeBuilder.getRoutes().length;\n        factory.configure(this.routeBuilder);\n        const routes = this.routeBuilder.getRoutes();\n\n        for (let i = routesBefore; i < routes.length; i++) {\n            this.mountRoute(routes[i]);\n        }\n    }\n\n    /**\n     * Mount every route currently registered on the RouteBuilder.\n     * Used by WebpiecesServerImpl.start() where routes were registered up front\n     * from WebAppMeta.getRoutes().\n     *\n     * @returns Number of routes mounted\n     */\n    mountRegisteredRoutes(): number {\n        const routes = this.routeBuilder.getRoutes();\n        for (const routeWithMeta of routes) {\n            this.mountRoute(routeWithMeta);\n        }\n        return routes.length;\n    }\n\n    /**\n     * Create an in-process API client (full filter chain + controller, no HTTP).\n     * Same testing story as WebpiecesServer.createApiClient().\n     */\n    // webpieces-disable no-any-unknown -- abstract constructor signature requires any[] args\n    createApiClient<T>(apiPrototype: abstract new (...args: any[]) => T): T {\n        return this.clientFactory.createApiClient(apiPrototype);\n    }\n\n    /**\n     * Escape hatch for advanced wiring (e.g. addRoute with a hand-built RouteDefinition).\n     */\n    getRouteBuilder(): RouteBuilderImpl {\n        return this.routeBuilder;\n    }\n\n    /**\n     * Compose the filter chain for one route and register it on the Express app.\n     */\n    private mountRoute(routeWithMeta: RouteHandlerWithMeta): void {\n        const service = this.routeBuilder.createRouteHandler(routeWithMeta);\n        const routeMeta = routeWithMeta.definition.routeMeta;\n\n        // ExpressWrapper handles the full request/response cycle per route:\n        // RequestContext.run, header read, manual JSON body parse, error->ProtocolError\n        const wrapper = this.middleware.createExpressWrapper(service, routeMeta);\n\n        this.registerHandler(\n            routeMeta.httpMethod,\n            routeMeta.path,\n            wrapper.execute.bind(wrapper),\n        );\n    }\n\n    private registerHandler(httpMethod: string, path: string, expressHandler: ExpressRouteHandler): void {\n        switch (httpMethod.toLowerCase()) {\n            case 'get':\n                this.app.get(path, expressHandler);\n                break;\n            case 'post':\n                this.app.post(path, expressHandler);\n                break;\n            case 'put':\n                this.app.put(path, expressHandler);\n                break;\n            case 'delete':\n                this.app.delete(path, expressHandler);\n                break;\n            case 'patch':\n                this.app.patch(path, expressHandler);\n                break;\n            default:\n                log.warn(`[WebpiecesRouteCreator] Unknown HTTP method: ${httpMethod}`);\n        }\n    }\n}\n"]}

package/src/filters/ContextFilter.js

@@ -94,7 +94,7 @@ let ContextFilter = class ContextFilter extends http_filters_1.Filter {
 };
 exports.ContextFilter = ContextFilter;
 exports.ContextFilter = ContextFilter = tslib_1.__decorate([
-    (0, http_routing_1.provideSingleton)(),
+    (0, http_routing_1.provideFrameworkSingleton)(),
     (0, inversify_1.injectable)(),
     tslib_1.__param(0, (0, inversify_1.inject)(core_util_1.HeaderRegistry)),
     tslib_1.__metadata("design:paramtypes", [core_util_1.HeaderRegistry])

package/src/filters/ContextFilter.js.map

@@ -1 +1 @@
-{"version":3,"file":"ContextFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/ContextFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAA6C;AAC7C,0DAAuE;AACvE,0DAAyD;AACzD,0DAAsE;AACtE,oDAAsE;AACtE,0EAAqE;AACrE,wDAAmD;AACnD,oDAAkD;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAI3C,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,qBAAuC;IAC9D,kBAAkB,CAAmB;IAE7C,YAC4B,QAAwB;QAEhD,KAAK,EAAE,CAAC;QAER,uEAAuE;QACvE,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAE3D,GAAG,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,0CAA0C,IAAI,CAAC,kBAAkB,CAAC,MAAM,eAAe,CAAC,CAAC;IAC3J,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,6EAA6E;QAC7E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE3B,4EAA4E;QAC5E,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxD,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnE,iCAAiC;QACjC,OAAO,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,0EAA0E;IAC9E,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,IAAgB;QACpC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACvB,4EAA4E;YAC5E,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,0EAA0E;QAC1E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC3C,2DAA2D;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;YACxE,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,oEAAoE;gBACpE,6BAAc,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,8DAA8D;QAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACK,eAAe;QACnB,IAAI,CAAC,6BAAc,CAAC,SAAS,CAAC,2CAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3C,6BAAc,CAAC,SAAS,CAAC,2CAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,iBAAiB;QACrB,OAAO,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC;CACJ,CAAA;AA9EY,sCAAa;wBAAb,aAAa;IAFzB,IAAA,+BAAgB,GAAE;IAClB,IAAA,sBAAU,GAAE;IAKJ,mBAAA,IAAA,kBAAM,EAAC,0BAAc,CAAC,CAAA;6CAAW,0BAAc;GAJ3C,aAAa,CA8EzB","sourcesContent":["import {inject, injectable} from 'inversify';\nimport { provideSingleton, MethodMeta } from '@webpieces/http-routing';\nimport { RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport { PlatformHeader, HeaderRegistry } from '@webpieces/core-util';\nimport {WebpiecesCoreHeaders} from \"../headers/WebpiecesCoreHeaders\";\nimport {ContextKeys} from \"../headers/ContextKeys\";\nimport { LogManager } from '@webpieces/core-util';\n\n/**\n * ContextFilter - Transfers platform headers and stores request metadata in RequestContext.\n * Priority: 2000 (executes first in filter chain)\n *\n * NEW: Now handles header transfer from RouterRequest to RequestContext\n * - Injects PlatformHeadersExtension instances via @multiInject (safe because filter created after modules load)\n * - Reads headers from RouterRequest (Express-independent)\n * - Transfers only headers marked with isWantTransferred=true\n * - Generates REQUEST_ID if not present\n *\n * RequestContext lifecycle:\n * 1. ExpressWrapper.execute() calls RequestContext.run() (establishes context)\n * 2. ExpressWrapper creates RouterReqResp and MethodMeta\n * 3. Filter chain executes, starting with ContextFilter\n * 4. ContextFilter transfers headers from RouterRequest to RequestContext\n * 5. ContextFilter stores metadata (METHOD_META, REQUEST_PATH, HTTP_METHOD)\n * 6. Downstream filters and controller can access headers + metadata\n * 7. Context auto-clears when RequestContext.run() completes\n */\nconst log = LogManager.getLogger('ContextFilter');\n\n@provideSingleton()\n@injectable()\nexport class ContextFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private transferredHeaders: PlatformHeader[];\n\n    constructor(\n        @inject(HeaderRegistry) registry: HeaderRegistry\n    ) {\n        super();\n\n        // The registry is the single source of truth (all modules' extensions,\n        // duplicate-validated at startup)\n        this.transferredHeaders = registry.getTransferredHeaders();\n\n        log.info(`[ContextFilter] Using ${registry.getHeaders().length} platform headers from HeaderRegistry (${this.transferredHeaders.length} transferred)`);\n    }\n\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        // Transfer platform headers from MethodMeta.requestHeaders to RequestContext\n        this.transferHeaders(meta);\n\n        // Store request metadata in context for other filters/controllers to access\n        RequestContext.putHeader(ContextKeys.METHOD_META, meta);\n        RequestContext.putHeader(ContextKeys.REQUEST_PATH, meta.path);\n        RequestContext.putHeader(ContextKeys.HTTP_METHOD, meta.httpMethod);\n\n        // Execute next filter/controller\n        return await nextFilter.invoke(meta);\n        // RequestContext is auto-cleared by ExpressWrapper when request completes\n    }\n\n    /**\n     * Transfer platform headers from MethodMeta.requestHeaders to RequestContext.\n     * Uses HeaderMethods.findTransferHeaders() to filter by isWantTransferred=true.\n     */\n    private transferHeaders(meta: MethodMeta): void {\n        if (!meta.requestHeaders) {\n            // No headers in test mode (createApiClient creates context but not headers)\n            this.ensureRequestId();\n            return;\n        }\n\n        // Transfer each header to RequestContext using RequestContext.putHeader()\n        for (const header of this.transferredHeaders) {\n            // Get values from requestHeaders (case-insensitive lookup)\n            const values = meta.requestHeaders.get(header.headerName.toLowerCase());\n            if (values && values.length > 0) {\n                // Use RequestContext.putHeader() which calls header.getHeaderName()\n                RequestContext.putHeader(header, values[0]);\n            }\n        }\n\n        // Clear request headers from MethodMeta - MUST FORCE USAGE of RequestContext!!!\n        meta.requestHeaders = undefined;\n\n        // Generate REQUEST_ID if not present (first service in chain)\n        this.ensureRequestId();\n    }\n\n    /**\n     * Ensure REQUEST_ID is set in RequestContext.\n     * Generates one if not present.\n     */\n    private ensureRequestId(): void {\n        if (!RequestContext.hasHeader(WebpiecesCoreHeaders.REQUEST_ID)) {\n            const requestId = this.generateRequestId();\n            RequestContext.putHeader(WebpiecesCoreHeaders.REQUEST_ID, requestId);\n        }\n    }\n\n    /**\n     * Generate a unique request ID.\n     * Format: req-{timestamp}-{random}\n     */\n    private generateRequestId(): string {\n        return `svrGenReqId-${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;\n    }\n}\n\n"]}
+{"version":3,"file":"ContextFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/ContextFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAA6C;AAC7C,0DAAgF;AAChF,0DAAyD;AACzD,0DAAsE;AACtE,oDAAsE;AACtE,0EAAqE;AACrE,wDAAmD;AACnD,oDAAkD;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAI3C,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,qBAAuC;IAC9D,kBAAkB,CAAmB;IAE7C,YAC4B,QAAwB;QAEhD,KAAK,EAAE,CAAC;QAER,uEAAuE;QACvE,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAE3D,GAAG,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,0CAA0C,IAAI,CAAC,kBAAkB,CAAC,MAAM,eAAe,CAAC,CAAC;IAC3J,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,6EAA6E;QAC7E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE3B,4EAA4E;QAC5E,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxD,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnE,iCAAiC;QACjC,OAAO,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,0EAA0E;IAC9E,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,IAAgB;QACpC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACvB,4EAA4E;YAC5E,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,0EAA0E;QAC1E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC3C,2DAA2D;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;YACxE,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,oEAAoE;gBACpE,6BAAc,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,8DAA8D;QAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACK,eAAe;QACnB,IAAI,CAAC,6BAAc,CAAC,SAAS,CAAC,2CAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3C,6BAAc,CAAC,SAAS,CAAC,2CAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,iBAAiB;QACrB,OAAO,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC;CACJ,CAAA;AA9EY,sCAAa;wBAAb,aAAa;IAFzB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IAKJ,mBAAA,IAAA,kBAAM,EAAC,0BAAc,CAAC,CAAA;6CAAW,0BAAc;GAJ3C,aAAa,CA8EzB","sourcesContent":["import {inject, injectable} from 'inversify';\nimport { provideFrameworkSingleton, MethodMeta } from '@webpieces/http-routing';\nimport { RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport { PlatformHeader, HeaderRegistry } from '@webpieces/core-util';\nimport {WebpiecesCoreHeaders} from \"../headers/WebpiecesCoreHeaders\";\nimport {ContextKeys} from \"../headers/ContextKeys\";\nimport { LogManager } from '@webpieces/core-util';\n\n/**\n * ContextFilter - Transfers platform headers and stores request metadata in RequestContext.\n * Priority: 2000 (executes first in filter chain)\n *\n * NEW: Now handles header transfer from RouterRequest to RequestContext\n * - Injects PlatformHeadersExtension instances via @multiInject (safe because filter created after modules load)\n * - Reads headers from RouterRequest (Express-independent)\n * - Transfers only headers marked with isWantTransferred=true\n * - Generates REQUEST_ID if not present\n *\n * RequestContext lifecycle:\n * 1. ExpressWrapper.execute() calls RequestContext.run() (establishes context)\n * 2. ExpressWrapper creates RouterReqResp and MethodMeta\n * 3. Filter chain executes, starting with ContextFilter\n * 4. ContextFilter transfers headers from RouterRequest to RequestContext\n * 5. ContextFilter stores metadata (METHOD_META, REQUEST_PATH, HTTP_METHOD)\n * 6. Downstream filters and controller can access headers + metadata\n * 7. Context auto-clears when RequestContext.run() completes\n */\nconst log = LogManager.getLogger('ContextFilter');\n\n@provideFrameworkSingleton()\n@injectable()\nexport class ContextFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private transferredHeaders: PlatformHeader[];\n\n    constructor(\n        @inject(HeaderRegistry) registry: HeaderRegistry\n    ) {\n        super();\n\n        // The registry is the single source of truth (all modules' extensions,\n        // duplicate-validated at startup)\n        this.transferredHeaders = registry.getTransferredHeaders();\n\n        log.info(`[ContextFilter] Using ${registry.getHeaders().length} platform headers from HeaderRegistry (${this.transferredHeaders.length} transferred)`);\n    }\n\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        // Transfer platform headers from MethodMeta.requestHeaders to RequestContext\n        this.transferHeaders(meta);\n\n        // Store request metadata in context for other filters/controllers to access\n        RequestContext.putHeader(ContextKeys.METHOD_META, meta);\n        RequestContext.putHeader(ContextKeys.REQUEST_PATH, meta.path);\n        RequestContext.putHeader(ContextKeys.HTTP_METHOD, meta.httpMethod);\n\n        // Execute next filter/controller\n        return await nextFilter.invoke(meta);\n        // RequestContext is auto-cleared by ExpressWrapper when request completes\n    }\n\n    /**\n     * Transfer platform headers from MethodMeta.requestHeaders to RequestContext.\n     * Uses HeaderMethods.findTransferHeaders() to filter by isWantTransferred=true.\n     */\n    private transferHeaders(meta: MethodMeta): void {\n        if (!meta.requestHeaders) {\n            // No headers in test mode (createApiClient creates context but not headers)\n            this.ensureRequestId();\n            return;\n        }\n\n        // Transfer each header to RequestContext using RequestContext.putHeader()\n        for (const header of this.transferredHeaders) {\n            // Get values from requestHeaders (case-insensitive lookup)\n            const values = meta.requestHeaders.get(header.headerName.toLowerCase());\n            if (values && values.length > 0) {\n                // Use RequestContext.putHeader() which calls header.getHeaderName()\n                RequestContext.putHeader(header, values[0]);\n            }\n        }\n\n        // Clear request headers from MethodMeta - MUST FORCE USAGE of RequestContext!!!\n        meta.requestHeaders = undefined;\n\n        // Generate REQUEST_ID if not present (first service in chain)\n        this.ensureRequestId();\n    }\n\n    /**\n     * Ensure REQUEST_ID is set in RequestContext.\n     * Generates one if not present.\n     */\n    private ensureRequestId(): void {\n        if (!RequestContext.hasHeader(WebpiecesCoreHeaders.REQUEST_ID)) {\n            const requestId = this.generateRequestId();\n            RequestContext.putHeader(WebpiecesCoreHeaders.REQUEST_ID, requestId);\n        }\n    }\n\n    /**\n     * Generate a unique request ID.\n     * Format: req-{timestamp}-{random}\n     */\n    private generateRequestId(): string {\n        return `svrGenReqId-${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;\n    }\n}\n\n"]}

package/src/filters/LogApiFilter.js

@@ -52,7 +52,7 @@ let LogApiFilter = class LogApiFilter extends http_filters_1.Filter {
 };
 exports.LogApiFilter = LogApiFilter;
 exports.LogApiFilter = LogApiFilter = tslib_1.__decorate([
-    (0, http_routing_1.provideSingleton)(),
+    (0, http_routing_1.provideFrameworkSingleton)(),
     (0, inversify_1.injectable)(),
     tslib_1.__param(0, (0, inversify_1.inject)(core_util_2.HeaderRegistry)),
     tslib_1.__param(1, (0, inversify_1.inject)(core_util_2.HeaderMethods)),

package/src/filters/LogApiFilter.js.map

@@ -1 +1 @@
-{"version":3,"file":"LogApiFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/LogApiFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAA6C;AAC7C,0DAA2F;AAC3F,0DAAsE;AACtE,oDAAkD;AAClD,oDAK8B;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AAI1C,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,qBAAuC;IAMlC;IAL3B,UAAU,CAAa;IACvB,UAAU,CAAmB;IAErC,YAC4B,QAAwB,EACjB,aAA4B;QAE3D,KAAK,EAAE,CAAC;QAFuB,kBAAa,GAAb,aAAa,CAAe;QAI3D,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;QAExC,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,MAAM,uCAAuC,CAAC,CAAC;QAEhG,IAAI,CAAC,UAAU,GAAG,IAAI,sBAAU,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,0FAA0F;QAC1F,MAAM,aAAa,GAAG,IAAI,mCAAoB,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAEzF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,KAAK,IAAsB,EAAE;YACxC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxG,OAAO,IAAI,yBAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;CACJ,CAAA;AApCY,oCAAY;uBAAZ,YAAY;IAFxB,IAAA,+BAAgB,GAAE;IAClB,IAAA,sBAAU,GAAE;IAMJ,mBAAA,IAAA,kBAAM,EAAC,0BAAc,CAAC,CAAA;IACtB,mBAAA,IAAA,kBAAM,EAAC,yBAAa,CAAC,CAAA;6CADY,0BAAc;QACF,yBAAa;GANtD,YAAY,CAoCxB","sourcesContent":["import {inject, injectable} from 'inversify';\nimport {provideSingleton, MethodMeta, RequestContextReader} from '@webpieces/http-routing';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport { LogManager } from '@webpieces/core-util';\nimport {\n    PlatformHeader,\n    HeaderMethods,\n    HeaderRegistry,\n    LogApiCall,\n} from '@webpieces/core-util';\n\n/**\n * LogApiFilter - Structured API logging for all requests/responses.\n * Priority: 1800 (after ContextFilter at 2000, before custom filters)\n *\n * Logging patterns (via LogApiCall):\n * - [API-SVR-req] Class.method /url request={...} headers={...}\n * - [API-SVR-resp-SUCCESS] Class.method response={...}\n * - [API-SVR-resp-FAIL] Class.method error=... (server errors: 500, 502, 504)\n * - [API-SVR-resp-OTHER] Class.method errorType=... (user errors: 400, 401, 403, 404, 266)\n *\n * Headers are read from RequestContext (NOT from meta.requestHeaders which is undefined\n * after ContextFilter runs at priority 2000).\n *\n * User errors (HttpBadRequestError, etc.) are logged as OTHER, not FAIL,\n * because they are expected behavior from the server's perspective.\n */\nconst log = LogManager.getLogger('LogApiFilter');\n\n@provideSingleton()\n@injectable()\nexport class LogApiFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private logApiCall: LogApiCall;\n    private allHeaders: PlatformHeader[];\n\n    constructor(\n        @inject(HeaderRegistry) registry: HeaderRegistry,\n        @inject(HeaderMethods) private headerMethods: HeaderMethods\n    ) {\n        super();\n\n        // The registry is the single source of truth (all modules' extensions,\n        // duplicate-validated at startup). Log map keys use loggerMdcKey when set.\n        this.allHeaders = registry.getHeaders();\n\n        log.info(`[LogApiFilter] Using ${this.allHeaders.length} platform headers from HeaderRegistry`);\n\n        this.logApiCall = new LogApiCall();\n    }\n\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        // Build header map from RequestContext (headers are already transferred by ContextFilter)\n        const contextReader = new RequestContextReader();\n        const headers = this.headerMethods.buildSecureMapForLogs(this.allHeaders, contextReader);\n\n        // Wrap nextFilter.invoke in a method that returns the response\n        const method = async (): Promise<unknown> => {\n            const wpResponse = await nextFilter.invoke(meta);\n            return wpResponse.response;\n        };\n\n        const response = await this.logApiCall.execute(\"SVR\", meta.routeMeta, meta.requestDto, headers, method);\n        return new WpResponse(response);\n    }\n}\n"]}
+{"version":3,"file":"LogApiFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/LogApiFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAA6C;AAC7C,0DAAoG;AACpG,0DAAsE;AACtE,oDAAkD;AAClD,oDAK8B;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AAI1C,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,qBAAuC;IAMlC;IAL3B,UAAU,CAAa;IACvB,UAAU,CAAmB;IAErC,YAC4B,QAAwB,EACjB,aAA4B;QAE3D,KAAK,EAAE,CAAC;QAFuB,kBAAa,GAAb,aAAa,CAAe;QAI3D,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;QAExC,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,MAAM,uCAAuC,CAAC,CAAC;QAEhG,IAAI,CAAC,UAAU,GAAG,IAAI,sBAAU,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,0FAA0F;QAC1F,MAAM,aAAa,GAAG,IAAI,mCAAoB,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAEzF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,KAAK,IAAsB,EAAE;YACxC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxG,OAAO,IAAI,yBAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;CACJ,CAAA;AApCY,oCAAY;uBAAZ,YAAY;IAFxB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IAMJ,mBAAA,IAAA,kBAAM,EAAC,0BAAc,CAAC,CAAA;IACtB,mBAAA,IAAA,kBAAM,EAAC,yBAAa,CAAC,CAAA;6CADY,0BAAc;QACF,yBAAa;GANtD,YAAY,CAoCxB","sourcesContent":["import {inject, injectable} from 'inversify';\nimport {provideFrameworkSingleton, MethodMeta, RequestContextReader} from '@webpieces/http-routing';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport { LogManager } from '@webpieces/core-util';\nimport {\n    PlatformHeader,\n    HeaderMethods,\n    HeaderRegistry,\n    LogApiCall,\n} from '@webpieces/core-util';\n\n/**\n * LogApiFilter - Structured API logging for all requests/responses.\n * Priority: 1800 (after ContextFilter at 2000, before custom filters)\n *\n * Logging patterns (via LogApiCall):\n * - [API-SVR-req] Class.method /url request={...} headers={...}\n * - [API-SVR-resp-SUCCESS] Class.method response={...}\n * - [API-SVR-resp-FAIL] Class.method error=... (server errors: 500, 502, 504)\n * - [API-SVR-resp-OTHER] Class.method errorType=... (user errors: 400, 401, 403, 404, 266)\n *\n * Headers are read from RequestContext (NOT from meta.requestHeaders which is undefined\n * after ContextFilter runs at priority 2000).\n *\n * User errors (HttpBadRequestError, etc.) are logged as OTHER, not FAIL,\n * because they are expected behavior from the server's perspective.\n */\nconst log = LogManager.getLogger('LogApiFilter');\n\n@provideFrameworkSingleton()\n@injectable()\nexport class LogApiFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private logApiCall: LogApiCall;\n    private allHeaders: PlatformHeader[];\n\n    constructor(\n        @inject(HeaderRegistry) registry: HeaderRegistry,\n        @inject(HeaderMethods) private headerMethods: HeaderMethods\n    ) {\n        super();\n\n        // The registry is the single source of truth (all modules' extensions,\n        // duplicate-validated at startup). Log map keys use loggerMdcKey when set.\n        this.allHeaders = registry.getHeaders();\n\n        log.info(`[LogApiFilter] Using ${this.allHeaders.length} platform headers from HeaderRegistry`);\n\n        this.logApiCall = new LogApiCall();\n    }\n\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        // Build header map from RequestContext (headers are already transferred by ContextFilter)\n        const contextReader = new RequestContextReader();\n        const headers = this.headerMethods.buildSecureMapForLogs(this.allHeaders, contextReader);\n\n        // Wrap nextFilter.invoke in a method that returns the response\n        const method = async (): Promise<unknown> => {\n            const wpResponse = await nextFilter.invoke(meta);\n            return wpResponse.response;\n        };\n\n        const response = await this.logApiCall.execute(\"SVR\", meta.routeMeta, meta.requestDto, headers, method);\n        return new WpResponse(response);\n    }\n}\n"]}

package/src/filters/RecordingFilter.js

@@ -79,7 +79,7 @@ let RecordingFilter = class RecordingFilter extends http_filters_1.Filter {
 };
 exports.RecordingFilter = RecordingFilter;
 exports.RecordingFilter = RecordingFilter = tslib_1.__decorate([
-    (0, http_routing_1.provideSingleton)(),
+    (0, http_routing_1.provideFrameworkSingleton)(),
     (0, inversify_1.injectable)()
     // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility
     ,

package/src/filters/RecordingFilter.js.map

@@ -1 +1 @@
-{"version":3,"file":"RecordingFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/RecordingFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAA+C;AAC/C,0DAMiC;AACjC,0DAAyD;AACzD,0DAAsE;AACtE,oDAQ8B;AAC9B,2EAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AAII,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAuC;IAI5B;IACR;IAJ5B,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;IAE5C,YAC4C,MAAuB,EAC/B,QAAwB;QAExD,KAAK,EAAE,CAAC;QAHgC,WAAM,GAAN,MAAM,CAAiB;QAC/B,aAAQ,GAAR,QAAQ,CAAgB;IAG5D,CAAC;IAED,sGAAsG;IACtG,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC/B,OAAO,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,2CAAoB,EAAE,CAAC;QAC5C,6BAAc,CAAC,SAAS,CAAC,wBAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE1D,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEtD,4HAA4H;QAC5H,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,cAAc,CAAC,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACnD,OAAO,QAAQ,CAAC;QACpB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,cAAc,CAAC,eAAe,GAAG,IAAI,yBAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9E,MAAM,GAAG,CAAC;QACd,CAAC;gBAAS,CAAC;YACP,6BAAc,CAAC,MAAM,CAAC,wBAAY,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;YAC7D,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,oBAAoB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,4EAA4E;QAC5E,OAAO,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEO,mBAAmB,CAAC,IAAgB;QACxC,yEAAyE;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,mCAAoB,EAAE,CAAC,CAAC;QAChH,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;QAC1E,OAAO,IAAI,4BAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;CACJ,CAAA;AA1DY,0CAAe;0BAAf,eAAe;IAH3B,IAAA,+BAAgB,GAAE;IAClB,IAAA,sBAAU,GAAE;IACb,sGAAsG;;IAK7F,mBAAA,IAAA,kBAAM,EAAC,qCAAsB,CAAC,CAAA;IAC9B,mBAAA,IAAA,kBAAM,EAAC,0BAAc,CAAC,CAAA;6CADyB,8BAAe;QACrB,0BAAc;GALnD,eAAe,CA0D3B","sourcesContent":["import { inject, injectable } from 'inversify';\nimport {\n    provideSingleton,\n    MethodMeta,\n    RequestContextReader,\n    WebpiecesConfig,\n    WEBPIECES_CONFIG_TOKEN,\n} from '@webpieces/http-routing';\nimport { RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport {\n    HeaderMethods,\n    HeaderRegistry,\n    RecordedEndpoint,\n    RecordedError,\n    RecorderKeys,\n    WebpiecesCoreHeaders,\n    toError,\n} from '@webpieces/core-util';\nimport { TestCaseRecorderImpl } from '../recorder/TestCaseRecorderImpl';\n\n/**\n * RecordingFilter - Records a request as a replayable test case (port of Java\n * RecordingFilter).\n *\n * Suggested priority: 1850 (after ContextFilter 2000 so the RECORDING header\n * has been transferred to the context, after AuthFilter 1900 so only real\n * authorized flows are recorded, before LogApiFilter 1800).\n *\n * Activates when WebpiecesConfig.recordingAlwaysOn is set OR the request\n * carries WebpiecesCoreHeaders.RECORDING (x-webpieces-recording). While\n * active, a TestCaseRecorderImpl travels in the RequestContext under\n * RecorderKeys.RECORDER; the http-client proxy and recordable() wrappers add\n * every downstream call. On completion the fixture + generated spec are\n * logged (and written to config.recordingDir when set).\n *\n * Recording NEVER alters the response - failures inside the recorder are\n * caught and logged.\n */\n@provideSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\nexport class RecordingFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private headerMethods = new HeaderMethods();\n\n    constructor(\n        @inject(WEBPIECES_CONFIG_TOKEN) private config: WebpiecesConfig,\n        @inject(HeaderRegistry) private registry: HeaderRegistry,\n    ) {\n        super();\n    }\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        if (!this.isRecordingRequested()) {\n            return await nextFilter.invoke(meta);\n        }\n\n        const recorder = new TestCaseRecorderImpl();\n        RequestContext.putHeader(RecorderKeys.RECORDER, recorder);\n\n        const serverEndpoint = this.buildServerEndpoint(meta);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- capture failure into the recording, then rethrow unchanged\n        try {\n            const response = await nextFilter.invoke(meta);\n            serverEndpoint.successResponse = response.response;\n            return response;\n        } catch (err: unknown) {\n            const error = toError(err);\n            serverEndpoint.failureResponse = new RecordedError(error.name, error.message);\n            throw err;\n        } finally {\n            RequestContext.remove(RecorderKeys.RECORDER.getHeaderName());\n            recorder.spitOutTestCase(serverEndpoint, this.config.recordingDir);\n        }\n    }\n\n    private isRecordingRequested(): boolean {\n        if (this.config.recordingAlwaysOn) {\n            return true;\n        }\n        // ContextFilter (priority 2000) already transferred the header into context\n        return RequestContext.hasHeader(WebpiecesCoreHeaders.RECORDING);\n    }\n\n    private buildServerEndpoint(meta: MethodMeta): RecordedEndpoint {\n        // Masked snapshot of the magic context (secured values masked, MDC keys)\n        const logMap = this.headerMethods.buildSecureMapForLogs(this.registry.getHeaders(), new RequestContextReader());\n        const ctxSnapshot: Record<string, string> = {};\n        for (const entry of logMap.entries()) {\n            ctxSnapshot[entry[0]] = entry[1];\n        }\n\n        const apiName = meta.routeMeta.controllerClassName ?? 'UnknownController';\n        return new RecordedEndpoint(apiName, meta.methodName, [meta.requestDto], ctxSnapshot);\n    }\n}\n"]}
+{"version":3,"file":"RecordingFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/RecordingFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAA+C;AAC/C,0DAMiC;AACjC,0DAAyD;AACzD,0DAAsE;AACtE,oDAQ8B;AAC9B,2EAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AAII,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAuC;IAI5B;IACR;IAJ5B,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;IAE5C,YAC4C,MAAuB,EAC/B,QAAwB;QAExD,KAAK,EAAE,CAAC;QAHgC,WAAM,GAAN,MAAM,CAAiB;QAC/B,aAAQ,GAAR,QAAQ,CAAgB;IAG5D,CAAC;IAED,sGAAsG;IACtG,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC/B,OAAO,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,2CAAoB,EAAE,CAAC;QAC5C,6BAAc,CAAC,SAAS,CAAC,wBAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE1D,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEtD,4HAA4H;QAC5H,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,cAAc,CAAC,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACnD,OAAO,QAAQ,CAAC;QACpB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,cAAc,CAAC,eAAe,GAAG,IAAI,yBAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9E,MAAM,GAAG,CAAC;QACd,CAAC;gBAAS,CAAC;YACP,6BAAc,CAAC,MAAM,CAAC,wBAAY,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;YAC7D,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,oBAAoB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,4EAA4E;QAC5E,OAAO,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEO,mBAAmB,CAAC,IAAgB;QACxC,yEAAyE;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,mCAAoB,EAAE,CAAC,CAAC;QAChH,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;QAC1E,OAAO,IAAI,4BAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;CACJ,CAAA;AA1DY,0CAAe;0BAAf,eAAe;IAH3B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,sGAAsG;;IAK7F,mBAAA,IAAA,kBAAM,EAAC,qCAAsB,CAAC,CAAA;IAC9B,mBAAA,IAAA,kBAAM,EAAC,0BAAc,CAAC,CAAA;6CADyB,8BAAe;QACrB,0BAAc;GALnD,eAAe,CA0D3B","sourcesContent":["import { inject, injectable } from 'inversify';\nimport {\n    provideFrameworkSingleton,\n    MethodMeta,\n    RequestContextReader,\n    WebpiecesConfig,\n    WEBPIECES_CONFIG_TOKEN,\n} from '@webpieces/http-routing';\nimport { RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport {\n    HeaderMethods,\n    HeaderRegistry,\n    RecordedEndpoint,\n    RecordedError,\n    RecorderKeys,\n    WebpiecesCoreHeaders,\n    toError,\n} from '@webpieces/core-util';\nimport { TestCaseRecorderImpl } from '../recorder/TestCaseRecorderImpl';\n\n/**\n * RecordingFilter - Records a request as a replayable test case (port of Java\n * RecordingFilter).\n *\n * Suggested priority: 1850 (after ContextFilter 2000 so the RECORDING header\n * has been transferred to the context, after AuthFilter 1900 so only real\n * authorized flows are recorded, before LogApiFilter 1800).\n *\n * Activates when WebpiecesConfig.recordingAlwaysOn is set OR the request\n * carries WebpiecesCoreHeaders.RECORDING (x-webpieces-recording). While\n * active, a TestCaseRecorderImpl travels in the RequestContext under\n * RecorderKeys.RECORDER; the http-client proxy and recordable() wrappers add\n * every downstream call. On completion the fixture + generated spec are\n * logged (and written to config.recordingDir when set).\n *\n * Recording NEVER alters the response - failures inside the recorder are\n * caught and logged.\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\nexport class RecordingFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private headerMethods = new HeaderMethods();\n\n    constructor(\n        @inject(WEBPIECES_CONFIG_TOKEN) private config: WebpiecesConfig,\n        @inject(HeaderRegistry) private registry: HeaderRegistry,\n    ) {\n        super();\n    }\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        if (!this.isRecordingRequested()) {\n            return await nextFilter.invoke(meta);\n        }\n\n        const recorder = new TestCaseRecorderImpl();\n        RequestContext.putHeader(RecorderKeys.RECORDER, recorder);\n\n        const serverEndpoint = this.buildServerEndpoint(meta);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- capture failure into the recording, then rethrow unchanged\n        try {\n            const response = await nextFilter.invoke(meta);\n            serverEndpoint.successResponse = response.response;\n            return response;\n        } catch (err: unknown) {\n            const error = toError(err);\n            serverEndpoint.failureResponse = new RecordedError(error.name, error.message);\n            throw err;\n        } finally {\n            RequestContext.remove(RecorderKeys.RECORDER.getHeaderName());\n            recorder.spitOutTestCase(serverEndpoint, this.config.recordingDir);\n        }\n    }\n\n    private isRecordingRequested(): boolean {\n        if (this.config.recordingAlwaysOn) {\n            return true;\n        }\n        // ContextFilter (priority 2000) already transferred the header into context\n        return RequestContext.hasHeader(WebpiecesCoreHeaders.RECORDING);\n    }\n\n    private buildServerEndpoint(meta: MethodMeta): RecordedEndpoint {\n        // Masked snapshot of the magic context (secured values masked, MDC keys)\n        const logMap = this.headerMethods.buildSecureMapForLogs(this.registry.getHeaders(), new RequestContextReader());\n        const ctxSnapshot: Record<string, string> = {};\n        for (const entry of logMap.entries()) {\n            ctxSnapshot[entry[0]] = entry[1];\n        }\n\n        const apiName = meta.routeMeta.controllerClassName ?? 'UnknownController';\n        return new RecordedEndpoint(apiName, meta.methodName, [meta.requestDto], ctxSnapshot);\n    }\n}\n"]}

package/src/filters/ServiceAuthFilter.js

@@ -76,7 +76,7 @@ let ServiceAuthFilter = class ServiceAuthFilter extends http_filters_1.Filter {
 };
 exports.ServiceAuthFilter = ServiceAuthFilter;
 exports.ServiceAuthFilter = ServiceAuthFilter = tslib_1.__decorate([
-    (0, core_context_1.provideSingleton)(),
+    (0, core_context_1.provideFrameworkSingleton)(),
     (0, inversify_1.injectable)()
     // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility
 ], ServiceAuthFilter);

package/src/filters/ServiceAuthFilter.js.map

@@ -1 +1 @@
-{"version":3,"file":"ServiceAuthFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/ServiceAuthFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AACvC,mCAAyC;AACzC,0DAA2E;AAC3E,0DAAkF;AAClF,oDAAmF;AACnF,0DAAgE;AAChE,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAEtD;;;;;;;;GAQG;AAII,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,qBAAuC;IAE1E,sGAAsG;IAC7F,KAAK,CAAC,MAAM,CACjB,IAAgB,EAChB,UAAoD;QAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACvC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7C,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,WAAW,CAAC,OAAiB;QACvC,MAAM,MAAM,GAAG,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAuB,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAqB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,iCAAqB,CAAC,qBAAqB,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,mBAAmB,CAAC,SAAiB;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,iCAAqB,CAAC,sBAAsB,SAAS,qBAAqB,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,QAAQ,GAAG,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAuB,CAAC;QACpG,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,MAA0B;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,CAAC;IAEO,kBAAkB,CAAC,CAAS,EAAE,CAAS;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;CACJ,CAAA;AA7DY,8CAAiB;4BAAjB,iBAAiB;IAH7B,IAAA,+BAAgB,GAAE;IAClB,IAAA,sBAAU,GAAE;IACb,sGAAsG;GACzF,iBAAiB,CA6D7B","sourcesContent":["import { injectable } from 'inversify';\nimport { timingSafeEqual } from 'crypto';\nimport { provideSingleton, RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service, MethodMeta } from '@webpieces/http-filters';\nimport { HttpUnauthorizedError, WebpiecesCoreHeaders } from '@webpieces/core-util';\nimport { verifyOidcFromCallers } from '@webpieces/gcp-identity';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('ServiceAuthFilter');\n\n/**\n * ServiceAuthFilter - framework filter that enforces the SERVICE-to-service auth modes\n * (@AuthOidc, @AuthSharedSecret). Priority 1950: runs right after ContextFilter (2000)\n * so the credential headers are already in RequestContext, and before app filters.\n *\n * This is what secures Cloud Tasks delivery: a @PubSub endpoint marked @AuthOidc only\n * accepts a request carrying a valid Google OIDC token from an allowed caller SA. The\n * `public` and `jwt` modes are NOT this filter's job (jwt stays in the app AuthFilter).\n */\n@provideSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\nexport class ServiceAuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\n    override async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        const authMeta = meta.authMeta;\n        if (authMeta) {\n            const mode = authMeta.mode;\n            if (mode.kind === 'oidc') {\n                await this.enforceOidc(mode.callers);\n            } else if (mode.kind === 'shared-secret') {\n                this.enforceSharedSecret(mode.secretEnv);\n            }\n        }\n        return nextFilter.invoke(meta);\n    }\n\n    /** Verify a Google OIDC bearer token from an allowed caller service account. */\n    private async enforceOidc(callers: string[]): Promise<void> {\n        const header = RequestContext.getHeader(WebpiecesCoreHeaders.AUTHORIZATION) as string | undefined;\n        const token = this.stripBearer(header);\n        if (!token) {\n            throw new HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');\n        }\n        const result = await verifyOidcFromCallers(token, callers);\n        if (!result.ok) {\n            throw new HttpUnauthorizedError(`OIDC auth failed: ${result.reason ?? 'unknown'}`);\n        }\n        log.debug(`OIDC caller verified: ${result.email}`);\n    }\n\n    /** Constant-time compare of the shared-secret header against process.env[secretEnv]. */\n    private enforceSharedSecret(secretEnv: string): void {\n        const expected = process.env[secretEnv];\n        if (!expected) {\n            throw new HttpUnauthorizedError(`Shared secret env '${secretEnv}' is not configured`);\n        }\n        const provided = RequestContext.getHeader(WebpiecesCoreHeaders.SHARED_SECRET) as string | undefined;\n        if (!provided || !this.constantTimeEquals(provided, expected)) {\n            throw new HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');\n        }\n    }\n\n    private stripBearer(header: string | undefined): string | undefined {\n        if (!header) {\n            return undefined;\n        }\n        const prefix = 'Bearer ';\n        return header.startsWith(prefix) ? header.substring(prefix.length) : header;\n    }\n\n    private constantTimeEquals(a: string, b: string): boolean {\n        const bufA = Buffer.from(a, 'utf8');\n        const bufB = Buffer.from(b, 'utf8');\n        if (bufA.length !== bufB.length) {\n            return false;\n        }\n        return timingSafeEqual(bufA, bufB);\n    }\n}\n"]}
+{"version":3,"file":"ServiceAuthFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/ServiceAuthFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AACvC,mCAAyC;AACzC,0DAAoF;AACpF,0DAAkF;AAClF,oDAAmF;AACnF,0DAAgE;AAChE,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAEtD;;;;;;;;GAQG;AAII,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,qBAAuC;IAE1E,sGAAsG;IAC7F,KAAK,CAAC,MAAM,CACjB,IAAgB,EAChB,UAAoD;QAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACvC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7C,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,WAAW,CAAC,OAAiB;QACvC,MAAM,MAAM,GAAG,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAuB,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAqB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,iCAAqB,CAAC,qBAAqB,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,mBAAmB,CAAC,SAAiB;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,iCAAqB,CAAC,sBAAsB,SAAS,qBAAqB,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,QAAQ,GAAG,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAuB,CAAC;QACpG,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,MAA0B;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,CAAC;IAEO,kBAAkB,CAAC,CAAS,EAAE,CAAS;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;CACJ,CAAA;AA7DY,8CAAiB;4BAAjB,iBAAiB;IAH7B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,sGAAsG;GACzF,iBAAiB,CA6D7B","sourcesContent":["import { injectable } from 'inversify';\nimport { timingSafeEqual } from 'crypto';\nimport { provideFrameworkSingleton, RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service, MethodMeta } from '@webpieces/http-filters';\nimport { HttpUnauthorizedError, WebpiecesCoreHeaders } from '@webpieces/core-util';\nimport { verifyOidcFromCallers } from '@webpieces/gcp-identity';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('ServiceAuthFilter');\n\n/**\n * ServiceAuthFilter - framework filter that enforces the SERVICE-to-service auth modes\n * (@AuthOidc, @AuthSharedSecret). Priority 1950: runs right after ContextFilter (2000)\n * so the credential headers are already in RequestContext, and before app filters.\n *\n * This is what secures Cloud Tasks delivery: a @PubSub endpoint marked @AuthOidc only\n * accepts a request carrying a valid Google OIDC token from an allowed caller SA. The\n * `public` and `jwt` modes are NOT this filter's job (jwt stays in the app AuthFilter).\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\nexport class ServiceAuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\n    override async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        const authMeta = meta.authMeta;\n        if (authMeta) {\n            const mode = authMeta.mode;\n            if (mode.kind === 'oidc') {\n                await this.enforceOidc(mode.callers);\n            } else if (mode.kind === 'shared-secret') {\n                this.enforceSharedSecret(mode.secretEnv);\n            }\n        }\n        return nextFilter.invoke(meta);\n    }\n\n    /** Verify a Google OIDC bearer token from an allowed caller service account. */\n    private async enforceOidc(callers: string[]): Promise<void> {\n        const header = RequestContext.getHeader(WebpiecesCoreHeaders.AUTHORIZATION) as string | undefined;\n        const token = this.stripBearer(header);\n        if (!token) {\n            throw new HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');\n        }\n        const result = await verifyOidcFromCallers(token, callers);\n        if (!result.ok) {\n            throw new HttpUnauthorizedError(`OIDC auth failed: ${result.reason ?? 'unknown'}`);\n        }\n        log.debug(`OIDC caller verified: ${result.email}`);\n    }\n\n    /** Constant-time compare of the shared-secret header against process.env[secretEnv]. */\n    private enforceSharedSecret(secretEnv: string): void {\n        const expected = process.env[secretEnv];\n        if (!expected) {\n            throw new HttpUnauthorizedError(`Shared secret env '${secretEnv}' is not configured`);\n        }\n        const provided = RequestContext.getHeader(WebpiecesCoreHeaders.SHARED_SECRET) as string | undefined;\n        if (!provided || !this.constantTimeEquals(provided, expected)) {\n            throw new HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');\n        }\n    }\n\n    private stripBearer(header: string | undefined): string | undefined {\n        if (!header) {\n            return undefined;\n        }\n        const prefix = 'Bearer ';\n        return header.startsWith(prefix) ? header.substring(prefix.length) : header;\n    }\n\n    private constantTimeEquals(a: string, b: string): boolean {\n        const bufA = Buffer.from(a, 'utf8');\n        const bufB = Buffer.from(b, 'utf8');\n        if (bufA.length !== bufB.length) {\n            return false;\n        }\n        return timingSafeEqual(bufA, bufB);\n    }\n}\n"]}

package/src/index.d.ts

@@ -1,8 +1,7 @@
-export { WebpiecesServer } from './WebpiecesServer';
-export { WebpiecesFactory } from './WebpiecesFactory';
+export { WebpiecesExpress } from './WebpiecesExpress';
 export { WebpiecesMiddleware } from './WebpiecesMiddleware';
 export { WebpiecesRouteCreator } from './WebpiecesRouteCreator';
-export { InProcessApiClientFactory } from './InProcessApiClientFactory';
+export { InProcessApiClientFactory } from '@webpieces/http-routing';
 export { ContextFilter } from './filters/ContextFilter';
 export { LogApiFilter } from './filters/LogApiFilter';
 export { RecordingFilter } from './filters/RecordingFilter';
@@ -13,4 +12,5 @@ export { recordable } from './recorder/recordable';
 export { WebpiecesModule } from './modules/WebpiecesModule';
 export { WebpiecesCoreHeaders } from './headers/WebpiecesCoreHeaders';
 export { HeaderRegistry } from '@webpieces/core-util';
-export { RouteHandler, ExpressRouteHandler, MethodMeta, RouteBuilderImpl, RouteHandlerWithMeta, FilterWithMeta, HttpFilter, FilterMatcher, FilterDefinition, } from '@webpieces/http-routing';
+export { RouteHandler, MethodMeta, RouteBuilderImpl, RouteHandlerWithMeta, FilterWithMeta, HttpFilter, FilterMatcher, FilterDefinition, } from '@webpieces/http-routing';
+export { ExpressRouteHandler } from './WebpiecesMiddleware';