acrylblends 0.2.0 → 0.4.0

package/plugins/acryl-router/src/core/middleware/bearer-auth/index.ts

@@ -0,0 +1,220 @@
+/**
+ * @module
+ * Bearer Auth Middleware for App.
+ */
+
+import type { Context } from '../../context.ts'
+import { HTTPException } from '../../http-exception.ts'
+import type { Env, MiddlewareHandler } from '../../types.ts'
+import { timingSafeEqual } from '../../utils/buffer.ts'
+import type { ContentfulStatusCode } from '../../utils/http-status.ts'
+
+const TOKEN_STRINGS = '[A-Za-z0-9._~+/-]+=*'
+const PREFIX = 'Bearer'
+const HEADER = 'Authorization'
+
+type MessageFunction = (c: Context) => string | object | Promise<string | object>
+type CustomizedErrorResponseOptions = {
+  wwwAuthenticateHeader?: string | object | MessageFunction
+  message?: string | object | MessageFunction
+}
+
+type BearerAuthOptions<E extends Env = Env> =
+  | {
+      token: string | string[]
+      realm?: string
+      prefix?: string
+      headerName?: string
+      hashFunction?: Function
+      /**
+       * @deprecated Use noAuthenticationHeader.message instead
+       */
+      noAuthenticationHeaderMessage?: string | object | MessageFunction
+      noAuthenticationHeader?: CustomizedErrorResponseOptions
+      /**
+       * @deprecated Use invalidAuthenticationHeader.message instead
+       */
+      invalidAuthenticationHeaderMessage?: string | object | MessageFunction
+      invalidAuthenticationHeader?: CustomizedErrorResponseOptions
+      /**
+       * @deprecated Use invalidToken.message instead
+       */
+      invalidTokenMessage?: string | object | MessageFunction
+      invalidToken?: CustomizedErrorResponseOptions
+    }
+  | {
+      realm?: string
+      prefix?: string
+      headerName?: string
+      verifyToken: (token: string, c: Context<E>) => boolean | Promise<boolean>
+      hashFunction?: Function
+      /**
+       * @deprecated Use noAuthenticationHeader.message instead
+       */
+      noAuthenticationHeaderMessage?: string | object | MessageFunction
+      noAuthenticationHeader?: CustomizedErrorResponseOptions
+      /**
+       * @deprecated Use invalidAuthenticationHeader.message instead
+       */
+      invalidAuthenticationHeaderMessage?: string | object | MessageFunction
+      invalidAuthenticationHeader?: CustomizedErrorResponseOptions
+      /**
+       * @deprecated Use invalidToken.message instead
+       */
+      invalidTokenMessage?: string | object | MessageFunction
+      invalidToken?: CustomizedErrorResponseOptions
+    }
+
+/**
+ * Bearer Auth Middleware for App.
+ *
+ *
+ * @template E - The environment type.
+ * @param {BearerAuthOptions} options - The options for the bearer authentication middleware.
+ * @param {string | string[]} [options.token] - The string or array of strings to validate the incoming bearer token against.
+ * @param {Function} [options.verifyToken] - The function to verify the token.
+ * @param {string} [options.realm=""] - The domain name of the realm, as part of the returned WWW-Authenticate challenge header.
+ * @param {string} [options.prefix="Bearer"] - The prefix (or known as `schema`) for the Authorization header value. If set to the empty string, no prefix is expected.
+ * @param {string} [options.headerName=Authorization] - The header name.
+ * @param {Function} [options.hashFunction] - A function to handle hashing for safe comparison of authentication tokens.
+ * @param {string | object | MessageFunction} [options.noAuthenticationHeader.message="Unauthorized"] - The no authentication header message.
+ * @param {string | object | MessageFunction} [options.noAuthenticationHeader.wwwAuthenticateHeader="Bearer realm=\"\""] - The response header value for the WWW-Authenticate header when no authentication header is provided.
+ * @param {string | object | MessageFunction} [options.invalidAuthenticationHeader.message="Bad Request"] - The invalid authentication header message.
+ * @param {string | object | MessageFunction} [options.invalidAuthenticationHeader.wwwAuthenticateHeader="Bearer error=\"invalid_request\""] - The response header value for the WWW-Authenticate header when authentication header is invalid.
+ * @param {string | object | MessageFunction} [options.invalidToken.message="Unauthorized"] - The invalid token message.
+ * @param {string | object | MessageFunction} [options.invalidToken.wwwAuthenticateHeader="Bearer error=\"invalid_token\""] - The response header value for the WWW-Authenticate header when token is invalid.
+ * @returns {MiddlewareHandler<E>} The middleware handler function.
+ * @throws {Error} If neither "token" nor "verifyToken" options are provided.
+ * @throws {HTTPException} If authentication fails, with 401 status code for missing or invalid token, or 400 status code for invalid request.
+ *
+ * @example
+ * ```ts
+ * const app = new App()
+ *
+ * const token = process.env.API_TOKEN // never a literal in source
+ *
+ * app.use('/api/*', bearerAuth({ token }))
+ *
+ * app.get('/api/page', (c) => {
+ *   return c.json({ message: 'You are authorized' })
+ * })
+ * ```
+ */
+export const bearerAuth = <E extends Env = Env>(
+  options: BearerAuthOptions<E>
+): MiddlewareHandler<E> => {
+  if (!('token' in options || 'verifyToken' in options)) {
+    throw new Error('bearer auth middleware requires options for "token" or "verifyToken"')
+  }
+  if (!options.realm) {
+    options.realm = ''
+  }
+  if (options.prefix === undefined) {
+    options.prefix = PREFIX
+  }
+
+  const realm = options.realm?.replace(/"/g, '\\"')
+  const prefix = options.prefix
+  const tokenRegexp = new RegExp(`^${TOKEN_STRINGS}$`)
+  const wwwAuthenticatePrefix = prefix === '' ? '' : `${prefix} `
+
+  const throwHTTPException = async (
+    c: Context,
+    status: ContentfulStatusCode,
+    wwwAuthenticateHeader: string | object | MessageFunction,
+    messageOption: string | object | MessageFunction
+  ): Promise<Response> => {
+    const wwwAuthenticateHeaderValue: string | object =
+      typeof wwwAuthenticateHeader === 'function'
+        ? await wwwAuthenticateHeader(c)
+        : wwwAuthenticateHeader
+
+    const headers = {
+      'WWW-Authenticate':
+        typeof wwwAuthenticateHeaderValue === 'string'
+          ? wwwAuthenticateHeaderValue
+          : `${wwwAuthenticatePrefix}${Object.entries(wwwAuthenticateHeaderValue)
+              .map(([key, value]) => `${key}="${value}"`)
+              .join(',')}`,
+    }
+    const responseMessage =
+      typeof messageOption === 'function' ? await messageOption(c) : messageOption
+    const res =
+      typeof responseMessage === 'string'
+        ? new Response(responseMessage, { status, headers })
+        : new Response(JSON.stringify(responseMessage), {
+            status,
+            headers: {
+              ...headers,
+              'content-type': 'application/json',
+            },
+          })
+    throw new HTTPException(status, { res })
+  }
+
+  return async function bearerAuth(c, next) {
+    const headerToken = c.req.header(options.headerName || HEADER)
+    if (!headerToken) {
+      // No Authorization header
+      await throwHTTPException(
+        c,
+        401,
+        options.noAuthenticationHeader?.wwwAuthenticateHeader ||
+          `${wwwAuthenticatePrefix}realm="${realm}"`,
+        options.noAuthenticationHeader?.message ||
+          options.noAuthenticationHeaderMessage ||
+          'Unauthorized'
+      )
+    } else {
+      let tokenValue: string | undefined
+
+      if (prefix === '') {
+        tokenValue = headerToken
+      } else {
+        const headerLower = headerToken.toLowerCase()
+        const prefixLower = prefix.toLowerCase()
+        if (headerLower.startsWith(prefixLower) && headerToken[prefix.length] === ' ') {
+          tokenValue = headerToken.slice(prefix.length).trimStart()
+        }
+      }
+
+      if (!tokenValue || !tokenRegexp.test(tokenValue)) {
+        // Invalid Request
+        await throwHTTPException(
+          c,
+          400,
+          options.invalidAuthenticationHeader?.wwwAuthenticateHeader ||
+            `${wwwAuthenticatePrefix}error="invalid_request"`,
+          options.invalidAuthenticationHeader?.message ||
+            options.invalidAuthenticationHeaderMessage ||
+            'Bad Request'
+        )
+      } else {
+        let equal = false
+        if ('verifyToken' in options) {
+          equal = await options.verifyToken(tokenValue, c)
+        } else if (typeof options.token === 'string') {
+          equal = await timingSafeEqual(options.token, tokenValue, options.hashFunction)
+        } else if (Array.isArray(options.token) && options.token.length > 0) {
+          for (const token of options.token) {
+            if (await timingSafeEqual(token, tokenValue, options.hashFunction)) {
+              equal = true
+              break
+            }
+          }
+        }
+        if (!equal) {
+          // Invalid Token
+          await throwHTTPException(
+            c,
+            401,
+            options.invalidToken?.wwwAuthenticateHeader ||
+              `${wwwAuthenticatePrefix}error="invalid_token"`,
+            options.invalidToken?.message || options.invalidTokenMessage || 'Unauthorized'
+          )
+        }
+      }
+    }
+    await next()
+  }
+}

package/plugins/acryl-router/src/core/middleware/body-limit/index.test.ts

@@ -0,0 +1,273 @@
+import { bodyLimit } from './index.ts'
+import { App } from '../../app.ts'
+
+const buildRequestInit = (init: RequestInit = {}): RequestInit & { duplex: 'half' } => {
+  const headers: Record<string, string> = {
+    'Content-Type': 'text/plain',
+  }
+  if (typeof init.body === 'string') {
+    headers['Content-Length'] = init.body.length.toString()
+  }
+  return {
+    method: 'POST',
+    headers,
+    body: null,
+    ...init,
+    duplex: 'half',
+  }
+}
+
+describe('Body Limit Middleware', () => {
+  let app: App
+
+  const exampleText = 'data is so hot' // 14byte
+  const exampleText2 = 'data is so hot and cute' // 23byte
+
+  beforeEach(() => {
+    app = new App()
+    app.use('*', bodyLimit({ maxSize: 14 }))
+    app.get('/', (c) => c.text('index'))
+    app.post('/body-limit-15byte', async (c) => {
+      return c.text(await c.req.raw.text())
+    })
+  })
+
+  describe('GET request', () => {
+    it('should return 200 response', async () => {
+      const res = await app.request('/')
+      expect(res).not.toBeNull()
+      expect(res.status).toBe(200)
+      expect(await res.text()).toBe('index')
+    })
+  })
+
+  describe('POST request', () => {
+    describe('string body', () => {
+      it('should return 200 response', async () => {
+        const res = await app.request('/body-limit-15byte', buildRequestInit({ body: exampleText }))
+
+        expect(res).not.toBeNull()
+        expect(res.status).toBe(200)
+        expect(await res.text()).toBe(exampleText)
+      })
+
+      it('should return 413 response', async () => {
+        const res = await app.request(
+          '/body-limit-15byte',
+          buildRequestInit({ body: exampleText2 })
+        )
+
+        expect(res).not.toBeNull()
+        expect(res.status).toBe(413)
+        expect(await res.text()).toBe('Payload Too Large')
+      })
+    })
+
+    describe('ReadableStream body', () => {
+      it('should return 200 response', async () => {
+        const contents = ['a', 'b', 'c']
+        const stream = new ReadableStream({
+          start(controller) {
+            while (contents.length) {
+              controller.enqueue(new TextEncoder().encode(contents.shift() as string))
+            }
+            controller.close()
+          },
+        })
+        const res = await app.request('/body-limit-15byte', buildRequestInit({ body: stream }))
+
+        expect(res).not.toBeNull()
+        expect(res.status).toBe(200)
+        expect(await res.text()).toBe('abc')
+      })
+
+      it('should return 413 response', async () => {
+        const readSpy = vi.fn().mockImplementation(() => {
+          return {
+            done: false,
+            value: new TextEncoder().encode(exampleText),
+          }
+        })
+        const stream = new ReadableStream()
+        vi.spyOn(stream, 'getReader').mockReturnValue({
+          read: readSpy,
+        } as unknown as ReadableStreamDefaultReader)
+        const res = await app.request('/body-limit-15byte', buildRequestInit({ body: stream }))
+
+        expect(res).not.toBeNull()
+        expect(res.status).toBe(413)
+        expect(readSpy).toHaveBeenCalledTimes(2)
+        expect(await res.text()).toBe('Payload Too Large')
+      })
+    })
+  })
+
+  describe('custom error handler', () => {
+    beforeEach(() => {
+      app = new App()
+      app.post(
+        '/text-limit-15byte-custom',
+        bodyLimit({
+          maxSize: 15,
+          onError: (c) => {
+            return c.text('no', 413)
+          },
+        }),
+        (c) => {
+          return c.text('yes')
+        }
+      )
+    })
+
+    it('should return the custom error handler', async () => {
+      const res = await app.request(
+        '/text-limit-15byte-custom',
+        buildRequestInit({ body: exampleText2 })
+      )
+
+      expect(res).not.toBeNull()
+      expect(res.status).toBe(413)
+      expect(await res.text()).toBe('no')
+    })
+  })
+
+  describe('Transfer-Encoding and Content-Length headers', () => {
+    beforeEach(() => {
+      app = new App()
+      app.use('*', bodyLimit({ maxSize: 10 }))
+      app.post('/test', async (c) => {
+        return c.text(await c.req.text())
+      })
+    })
+
+    it('should prioritize Transfer-Encoding over Content-Length', async () => {
+      // Create a chunked body that exceeds the limit
+      const largeContent = 'this is a large content that exceeds 10 bytes'
+      const chunks = [largeContent.slice(0, 20), largeContent.slice(20)]
+
+      const stream = new ReadableStream({
+        start(controller) {
+          chunks.forEach((chunk) => {
+            controller.enqueue(new TextEncoder().encode(chunk))
+          })
+          controller.close()
+        },
+      })
+
+      const res = await app.request('/test', {
+        method: 'POST',
+        headers: {
+          'Content-Length': '5', // Small content-length (bypass attempt)
+          'Transfer-Encoding': 'chunked', // But chunked encoding with large content
+        },
+        body: stream,
+        duplex: 'half',
+      } as RequestInit)
+
+      // Should reject based on actual chunked content size, not Content-Length
+      expect(res.status).toBe(413)
+    })
+
+    it('should handle only Content-Length header correctly', async () => {
+      const smallContent = 'small'
+      const res = await app.request('/test', buildRequestInit({ body: smallContent }))
+
+      expect(res.status).toBe(200)
+      expect(await res.text()).toBe(smallContent)
+    })
+
+    it('should handle only Transfer-Encoding header correctly', async () => {
+      const content = 'test'
+      const stream = new ReadableStream({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode(content))
+          controller.close()
+        },
+      })
+
+      const res = await app.request('/test', {
+        method: 'POST',
+        headers: {
+          'Transfer-Encoding': 'chunked',
+        },
+        body: stream,
+        duplex: 'half',
+      } as RequestInit)
+
+      expect(res.status).toBe(200)
+      expect(await res.text()).toBe(content)
+    })
+  })
+
+  describe('chunked body bypass scenarios', () => {
+    const handler = vi.fn()
+
+    const buildOversizedRequestInit = (): RequestInit & { duplex: 'half' } => ({
+      method: 'POST',
+      headers: { 'Transfer-Encoding': 'chunked' },
+      body: new ReadableStream({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode('1234'))
+          controller.enqueue(new TextEncoder().encode('5678901234567890'))
+          controller.close()
+        },
+      }),
+      duplex: 'half',
+    })
+
+    beforeEach(() => {
+      handler.mockReset()
+      app = new App()
+      app.use('*', bodyLimit({ maxSize: 8 }))
+      app.post('/no-read', (c) => {
+        handler()
+        return c.text('NO-READ-OK')
+      })
+      app.post('/partial-read', async (c) => {
+        handler()
+        const reader = c.req.raw.body?.getReader()
+        const chunk = reader ? await reader.read() : { value: undefined }
+        return c.text(new TextDecoder().decode(chunk.value))
+      })
+      app.post('/swallow-error', async (c) => {
+        handler()
+        const body = c.req.raw.body
+        if (!body) {
+          return c.text('no body')
+        }
+        const reader = body.getReader()
+        let seen = ''
+        try {
+          for (;;) {
+            const { done, value } = await reader.read()
+            if (done) {
+              break
+            }
+            seen += new TextDecoder().decode(value)
+          }
+        } catch {
+          // intentionally swallow read errors
+        }
+        return c.text(`processed:${seen}`)
+      })
+    })
+
+    it('should reject when handler does not read the body', async () => {
+      const res = await app.request('/no-read', buildOversizedRequestInit())
+      expect(res.status).toBe(413)
+      expect(handler).not.toHaveBeenCalled()
+    })
+
+    it('should reject when handler reads only the first chunk', async () => {
+      const res = await app.request('/partial-read', buildOversizedRequestInit())
+      expect(res.status).toBe(413)
+      expect(handler).not.toHaveBeenCalled()
+    })
+
+    it('should reject when handler swallows body read errors', async () => {
+      const res = await app.request('/swallow-error', buildOversizedRequestInit())
+      expect(res.status).toBe(413)
+      expect(handler).not.toHaveBeenCalled()
+    })
+  })
+})

package/plugins/acryl-router/src/core/middleware/body-limit/index.ts

@@ -0,0 +1,110 @@
+/**
+ * @module
+ * Body Limit Middleware for App.
+ */
+
+import type { Context } from '../../context.ts'
+import { HTTPException } from '../../http-exception.ts'
+import type { MiddlewareHandler } from '../../types.ts'
+
+const ERROR_MESSAGE = 'Payload Too Large'
+
+type OnError = (c: Context) => Response | Promise<Response>
+type BodyLimitOptions = {
+  maxSize: number
+  onError?: OnError
+}
+
+/**
+ * Body Limit Middleware for App.
+ *
+ *
+ * @param {BodyLimitOptions} options - The options for the body limit middleware.
+ * @param {number} options.maxSize - The maximum body size allowed.
+ * @param {OnError} [options.onError] - The error handler to be invoked if the specified body size is exceeded.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new App()
+ *
+ * app.post(
+ *   '/upload',
+ *   bodyLimit({
+ *     maxSize: 50 * 1024, // 50kb
+ *     onError: (c) => {
+ *       return c.text('overflow :(', 413)
+ *     },
+ *   }),
+ *   async (c) => {
+ *     const body = await c.req.parseBody()
+ *     if (body['file'] instanceof File) {
+ *       console.log(`Got file sized: ${body['file'].size}`)
+ *     }
+ *     return c.text('pass :)')
+ *   }
+ * )
+ * ```
+ */
+export const bodyLimit = (options: BodyLimitOptions): MiddlewareHandler => {
+  const onError: OnError =
+    options.onError ||
+    (() => {
+      const res = new Response(ERROR_MESSAGE, {
+        status: 413,
+      })
+      throw new HTTPException(413, { res })
+    })
+  const maxSize = options.maxSize
+
+  return async function bodyLimit(c, next) {
+    if (!c.req.raw.body) {
+      // maybe GET or HEAD request
+      return next()
+    }
+
+    const hasTransferEncoding = c.req.raw.headers.has('transfer-encoding')
+    const hasContentLength = c.req.raw.headers.has('content-length')
+
+    if (hasContentLength && !hasTransferEncoding) {
+      // Only Content-Length present - we can trust it
+      const contentLength = parseInt(c.req.raw.headers.get('content-length') || '0', 10)
+      return contentLength > maxSize ? onError(c) : next()
+    }
+
+    // Transfer-Encoding present (chunked) or no length headers.
+    // Per RFC 7230, when both are present Transfer-Encoding takes precedence
+    // and Content-Length is ignored. Read the body up-front so the size check
+    // is final before the handler runs, regardless of how (or whether) the
+    // handler reads the body.
+    let size = 0
+    const chunks: Uint8Array[] = []
+    const rawReader = c.req.raw.body.getReader()
+    for (;;) {
+      const { done, value } = await rawReader.read()
+      if (done) {
+        break
+      }
+      size += value.length
+      if (size > maxSize) {
+        return onError(c)
+      }
+      chunks.push(value)
+    }
+
+    const requestInit: RequestInit & { duplex: 'half' } = {
+      body: new ReadableStream({
+        start(controller) {
+          for (const chunk of chunks) {
+            controller.enqueue(chunk)
+          }
+          controller.close()
+        },
+      }),
+      duplex: 'half',
+    }
+    c.req.raw = new Request(c.req.raw, requestInit as RequestInit)
+
+    return next()
+  }
+}