acrylblends 0.2.0 → 0.4.0

package/plugins/acryl-router/src/core/middleware/method-not-allowed/index.test.ts

@@ -0,0 +1,292 @@
+import { methodNotAllowed } from './index.ts'
+import { App } from '../../app.ts'
+
+describe('Method Not Allowed Middleware', () => {
+  it('infers the environment from the app', () => {
+    const app = new App<{ Variables: { requestId: string } }>()
+    const middleware = methodNotAllowed({
+      app,
+      onMethodNotAllowed: (c) => c.text(c.var.requestId, 405),
+    })
+
+    expect(middleware).toBeTypeOf('function')
+  })
+
+  it('returns 405 with every allowed method for an existing path', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.get('/resource', (c) => c.text('GET'))
+    app.post('/resource', (c) => c.text('POST'))
+    app.delete('/resource', (c) => c.text('DELETE'))
+
+    const res = await app.request('/resource', { method: 'PUT' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('GET, HEAD, POST, DELETE')
+    expect(await res.text()).toBe('Method Not Allowed')
+
+    const resUsingCachedRouter = await app.request('/resource', { method: 'OPTIONS' })
+    expect(resUsingCachedRouter.status).toBe(405)
+    expect(resUsingCachedRouter.headers.get('Allow')).toBe('GET, HEAD, POST, DELETE')
+  })
+
+  it('does not affect an allowed method', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.get('/resource', (c) => c.text('GET'))
+
+    const res = await app.request('/resource')
+
+    expect(res.status).toBe(200)
+    expect(res.headers.has('Allow')).toBe(false)
+    expect(await res.text()).toBe('GET')
+  })
+
+  it('returns 404 when the path does not exist', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.get('/resource', (c) => c.text('GET'))
+
+    const res = await app.request('/missing', { method: 'POST' })
+
+    expect(res.status).toBe(404)
+    expect(res.headers.has('Allow')).toBe(false)
+  })
+
+  it('matches parameterized and overlapping routes without duplicate methods', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.get('/users/:id', (_c, next) => next())
+    app.get('/users/me', (c) => c.text('me'))
+    app.patch('/users/:id', (c) => c.text(c.req.param('id')))
+
+    const res = await app.request('/users/me', { method: 'POST' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('GET, HEAD, PATCH')
+  })
+
+  it('preserves an intentional 404 from a handler registered for the request method', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.get('/users/:id', (c) => c.notFound())
+    app.post('/users/:id', (c) => c.text('Created'))
+
+    const res = await app.request('/users/123')
+
+    expect(res.status).toBe(404)
+    expect(res.headers.has('Allow')).toBe(false)
+  })
+
+  it('preserves an intentional 404 for HEAD when a GET route is registered', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.get('/users/:id', (c) => c.notFound())
+    app.post('/users/:id', (c) => c.text('Created'))
+
+    const res = await app.request('/users/123', { method: 'HEAD' })
+
+    expect(res.status).toBe(404)
+    expect(res.headers.has('Allow')).toBe(false)
+  })
+
+  it('preserves a 404 returned by the error handler', async () => {
+    const app = new App()
+    app.onError((_error, c) => c.text('Handled error', 404))
+    app.use(methodNotAllowed({ app }))
+    app.use('/resource', () => {
+      throw new Error('boom')
+    })
+    app.get('/resource', (c) => c.text('GET'))
+
+    const res = await app.request('/resource', { method: 'POST' })
+
+    expect(res.status).toBe(404)
+    expect(res.headers.has('Allow')).toBe(false)
+    expect(await res.text()).toBe('Handled error')
+  })
+
+  it('returns 405 for HEAD when the path does not support GET', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.post('/resource', (c) => c.text('POST'))
+
+    const res = await app.request('/resource', { method: 'HEAD' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('POST')
+    expect(await res.text()).toBe('')
+  })
+
+  it('does not advertise explicit HEAD routes that App cannot dispatch', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.on('HEAD', '/resource', (c) => c.text('HEAD'))
+
+    const headRes = await app.request('/resource', { method: 'HEAD' })
+    expect(headRes.status).toBe(404)
+    expect(headRes.headers.has('Allow')).toBe(false)
+
+    const putRes = await app.request('/resource', { method: 'PUT' })
+    expect(putRes.status).toBe(404)
+    expect(putRes.headers.has('Allow')).toBe(false)
+  })
+
+  it('supports custom methods', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.on('PURGE', '/cache', (c) => c.text('Purged'))
+
+    const res = await app.request('/cache', { method: 'POST' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('PURGE')
+  })
+
+  it('compares request methods case-sensitively', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.patch('/item', (c) => c.text('PATCH'))
+
+    const request = new Request('http://localhost/item', { method: 'PATCH' })
+    Object.defineProperty(request, 'method', { value: 'patch' })
+    const res = await app.request(request)
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('PATCH')
+  })
+
+  it('works with routes mounted using app.route()', async () => {
+    const api = new App()
+    api.get('/resource', (c) => c.text('GET'))
+    api.post('/resource', (c) => c.text('POST'))
+
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.route('/api', api)
+
+    const res = await app.request('/api/resource', { method: 'DELETE' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('GET, HEAD, POST')
+  })
+
+  it('works when installed in an app mounted using app.route()', async () => {
+    const api = new App().basePath('/v1')
+    api.use(methodNotAllowed({ app: api }))
+    api.get('/resource', (c) => c.text('GET'))
+    api.post('/resource', (c) => c.text('POST'))
+
+    const app = new App()
+    app.route('/api', api)
+
+    const res = await app.request('/api/v1/resource', { method: 'DELETE' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('GET, HEAD, POST')
+  })
+
+  it('ignores ALL routes when collecting allowed methods', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.all('/resource', (_c, next) => next())
+
+    const res = await app.request('/resource', { method: 'POST' })
+
+    expect(res.status).toBe(404)
+    expect(res.headers.has('Allow')).toBe(false)
+  })
+
+  it('does not invoke the error handler for a 405 response', async () => {
+    const app = new App()
+    const onError = vi.fn(() => new Response('error', { status: 500 }))
+    app.onError(onError)
+    app.use(methodNotAllowed({ app }))
+    app.get('/resource', (c) => c.text('GET'))
+
+    const res = await app.request('/resource', { method: 'POST' })
+
+    expect(res.status).toBe(405)
+    expect(onError).not.toHaveBeenCalled()
+  })
+
+  it('preserves downstream headers and lets outer middleware observe the final status', async () => {
+    const app = new App()
+    let observedStatus: number | undefined
+
+    app.use(async (c, next) => {
+      await next()
+      observedStatus = c.res.status
+    })
+    app.use(methodNotAllowed({ app }))
+    app.use(async (c, next) => {
+      await next()
+      c.header('X-Downstream', 'true')
+    })
+    app.get('/resource', (c) => c.text('GET'))
+
+    const res = await app.request('/resource', { method: 'POST' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('X-Downstream')).toBe('true')
+    expect(observedStatus).toBe(405)
+  })
+
+  it('replaces stale representation headers from the not-found response', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.get('/resource', (c) => c.text('GET'))
+    app.post('/resource', (c) => c.text('POST'))
+    app.notFound((c) =>
+      c.text('Missing', 404, {
+        Allow: 'BOGUS',
+        'Content-Length': '7',
+      })
+    )
+
+    const res = await app.request('/resource', { method: 'PUT' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('GET, HEAD, POST')
+    expect(res.headers.has('Content-Length')).toBe(false)
+    expect(await res.text()).toBe('Method Not Allowed')
+  })
+
+  it('supports a custom method-not-allowed response', async () => {
+    const app = new App()
+    app.use(
+      methodNotAllowed({
+        app,
+        onMethodNotAllowed: (c, allowedMethods) =>
+          c.json({ error: 'Method Not Allowed', allowedMethods }, 405, {
+            Allow: allowedMethods.join(', '),
+          }),
+      })
+    )
+    app.get('/resource', (c) => c.text('GET'))
+    app.post('/resource', (c) => c.text('POST'))
+
+    const res = await app.request('/resource', { method: 'PUT' })
+
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('GET, HEAD, POST')
+    expect(res.headers.get('Content-Type')).toMatch(/^application\/json/)
+    expect(await res.json()).toEqual({
+      error: 'Method Not Allowed',
+      allowedMethods: ['GET', 'HEAD', 'POST'],
+    })
+  })
+
+  it('leaves a non-404 custom not-found response unchanged', async () => {
+    const app = new App()
+    app.use(methodNotAllowed({ app }))
+    app.get('/resource', (c) => c.text('GET'))
+    app.notFound((c) => c.text('Missing', 410))
+
+    const res = await app.request('/resource', { method: 'POST' })
+
+    expect(res.status).toBe(410)
+    expect(res.headers.has('Allow')).toBe(false)
+    expect(await res.text()).toBe('Missing')
+  })
+})

package/plugins/acryl-router/src/core/middleware/method-not-allowed/index.ts

@@ -0,0 +1,141 @@
+/**
+ * @module
+ * Method Not Allowed Middleware for App.
+ */
+
+import type { Context } from '../../context.ts'
+import { basePath, matchedRoutes } from '../../helper/route/index.ts'
+import type { App } from '../../app.ts'
+import { METHOD_NAME_ALL } from '../../router.ts'
+import { TrieRouter } from '../../router/trie-router/index.ts'
+import type { Env, MiddlewareHandler } from '../../types.ts'
+
+type MethodNotAllowedHandler<E extends Env> = (
+  c: Context<E>,
+  allowedMethods: string[]
+) => Response | Promise<Response>
+
+type MethodNotAllowedOptions<E extends Env> = {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  app: App<E, any, any>
+  onMethodNotAllowed?: MethodNotAllowedHandler<E>
+}
+
+/**
+ * Method Not Allowed Middleware for App.
+ *
+ * Returns a `405 Method Not Allowed` response with an `Allow` header when the request path
+ * matches a registered route but the request method is not supported.
+ *
+ * @param {MethodNotAllowedOptions} options - The options for the middleware.
+ * @param {App} options.app - The App instance used by the application.
+ * @param {MethodNotAllowedHandler} [options.onMethodNotAllowed] - Generates the response, including its `Allow` header.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new App()
+ *
+ * app.use(methodNotAllowed({ app }))
+ *
+ * app.get('/hello', (c) => c.text('Hello!'))
+ * app.post('/hello', (c) => c.text('Posted!'))
+ *
+ * // PUT /hello -> 405 Method Not Allowed
+ * // Allow: GET, HEAD, POST
+ * ```
+ *
+ * @example
+ * ```ts
+ * app.use(
+ *   methodNotAllowed({
+ *     app,
+ *     onMethodNotAllowed: (c, methods) =>
+ *       c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
+ *   })
+ * )
+ * ```
+ */
+export const methodNotAllowed = <E extends Env = Env>(
+  options: MethodNotAllowedOptions<E>
+): MiddlewareHandler<E> => {
+  let methodRouter: TrieRouter<string[]> | undefined
+
+  return async function methodNotAllowed(c, next) {
+    const routeIndex = c.req.routeIndex
+    await next()
+
+    if (c.res.status !== 404) {
+      return
+    }
+
+    if (c.error) {
+      return
+    }
+
+    if (!methodRouter) {
+      const methodsByPath = new Map<string, Set<string>>()
+
+      for (const route of options.app.routes) {
+        // App does not distinguish middleware registered with `app.use()` from handlers
+        // registered with `app.all()`, so `ALL` routes cannot contribute to the Allow header.
+        if (route.method === METHOD_NAME_ALL || route.method === 'HEAD') {
+          continue
+        }
+
+        const methods = methodsByPath.get(route.path) ?? new Set<string>()
+        methods.add(route.method)
+
+        // App dispatches HEAD requests to GET routes.
+        if (route.method === 'GET') {
+          methods.add('HEAD')
+        }
+
+        methodsByPath.set(route.path, methods)
+      }
+
+      methodRouter = new TrieRouter()
+      for (const [path, methods] of methodsByPath) {
+        methodRouter.add(METHOD_NAME_ALL, path, [...methods])
+      }
+    }
+
+    let requestPath = c.req.path
+    const routes = matchedRoutes(c)
+    const currentRoute = routes[routeIndex]
+    const sourceRoute = options.app.routes.find((route) => route.handler === methodNotAllowed)
+    if (currentRoute && sourceRoute) {
+      const currentBasePathParts = basePath(c, routeIndex).split('/').filter(Boolean)
+      const sourceBasePathLength = sourceRoute.basePath.split('/').filter(Boolean).length
+      const mountBasePathParts = currentBasePathParts.slice(
+        0,
+        currentBasePathParts.length - sourceBasePathLength
+      )
+      if (mountBasePathParts.length > 0) {
+        const mountBasePath = `/${mountBasePathParts.join('/')}`
+        requestPath = c.req.path.slice(mountBasePath.length) || '/'
+      }
+    }
+
+    const allowedMethods = new Set<string>()
+    for (const [methods] of methodRouter.match(METHOD_NAME_ALL, requestPath)[0]) {
+      for (const method of methods) {
+        allowedMethods.add(method)
+      }
+    }
+
+    if (allowedMethods.size === 0 || allowedMethods.has(c.req.method)) {
+      return
+    }
+
+    // Prevent stale headers from being carried over from the 404 response.
+    c.res.headers.delete('Allow')
+    c.res.headers.delete('Content-Length')
+
+    const methods = [...allowedMethods]
+    const allow = methods.join(', ')
+    c.res = options.onMethodNotAllowed
+      ? await options.onMethodNotAllowed(c, methods)
+      : c.text('Method Not Allowed', 405, { Allow: allow })
+  }
+}

package/plugins/acryl-router/src/core/middleware/method-override/index.test.ts

@@ -0,0 +1,221 @@
+import { App } from '../../app.ts'
+import { methodOverride } from './index.ts'
+
+describe('Method Override Middleware', () => {
+  describe('Form', () => {
+    const app = new App()
+    app.use('/posts/*', methodOverride({ app }))
+    app.use('/posts-custom/*', methodOverride({ app, form: 'custom-input-name' }))
+    app.on(['post', 'delete'], ['/posts', '/posts-custom'], async (c) => {
+      const form = await c.req.formData()
+      return c.json({
+        method: c.req.method,
+        message: form.get('message'),
+        contentType: c.req.header('content-type') ?? '',
+      })
+    })
+
+    describe('multipart/form-data', () => {
+      it('Should override POST to DELETE', async () => {
+        const form = new FormData()
+        form.append('message', 'Hello')
+        form.append('_method', 'DELETE')
+        const res = await app.request('/posts', {
+          body: form,
+          method: 'POST',
+        })
+        expect(res.status).toBe(200)
+        const data = await res.json()
+        expect(data.method).toBe('DELETE')
+        expect(data.message).toBe('Hello')
+        expect(data.contentType).toMatch(/^multipart\/form-data;/)
+      })
+
+      it('Should override POST to DELETE - with a custom form input name', async () => {
+        const form = new FormData()
+        form.append('message', 'Hello')
+        form.append('custom-input-name', 'DELETE')
+        const res = await app.request('/posts-custom', {
+          body: form,
+          method: 'POST',
+        })
+        expect(res.status).toBe(200)
+        const data = await res.json()
+        expect(data.method).toBe('DELETE')
+        expect(data.message).toBe('Hello')
+        expect(data.contentType).toMatch(/^multipart\/form-data;/)
+      })
+
+      it('Should override POST to PATCH - not found', async () => {
+        const form = new FormData()
+        form.append('message', 'Hello')
+        form.append('_method', 'PATCH')
+        const res = await app.request('/posts', {
+          body: form,
+          method: 'POST',
+        })
+        expect(res.status).toBe(404)
+      })
+    })
+
+    describe('application/x-www-form-urlencoded', () => {
+      it('Should override POST to DELETE', async () => {
+        const params = new URLSearchParams()
+        params.append('message', 'Hello')
+        params.append('_method', 'DELETE')
+        const res = await app.request('/posts', {
+          body: params,
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+          method: 'POST',
+        })
+        expect(res.status).toBe(200)
+        const data = await res.json()
+        expect(data.method).toBe('DELETE')
+        expect(data.message).toBe('Hello')
+        expect(data.contentType).toBe('application/x-www-form-urlencoded')
+      })
+
+      it('Should override POST to DELETE - with a custom form input name', async () => {
+        const params = new URLSearchParams()
+        params.append('message', 'Hello')
+        params.append('custom-input-name', 'DELETE')
+        const res = await app.request('/posts-custom', {
+          body: params,
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+          method: 'POST',
+        })
+        expect(res.status).toBe(200)
+        const data = await res.json()
+        expect(data.method).toBe('DELETE')
+        expect(data.message).toBe('Hello')
+        expect(data.contentType).toBe('application/x-www-form-urlencoded')
+      })
+
+      it('Should override POST to DELETE - with charset in Content-Type', async () => {
+        const params = new URLSearchParams()
+        params.append('message', 'Hello')
+        params.append('_method', 'DELETE')
+        const res = await app.request('/posts', {
+          body: params,
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
+          },
+          method: 'POST',
+        })
+        expect(res.status).toBe(200)
+        const data = await res.json()
+        expect(data.method).toBe('DELETE')
+        expect(data.message).toBe('Hello')
+      })
+
+      it('Should override POST to PATCH - not found', async () => {
+        const form = new FormData()
+        form.append('message', 'Hello')
+        form.append('_method', 'PATCH')
+        const res = await app.request('/posts', {
+          body: form,
+          method: 'POST',
+        })
+        expect(res.status).toBe(404)
+      })
+    })
+  })
+
+  describe('Header', () => {
+    const app = new App()
+    app.use('/posts/*', methodOverride({ app, header: 'X-METHOD-OVERRIDE' }))
+    app.on(['get', 'post', 'delete'], '/posts', async (c) => {
+      return c.json({
+        method: c.req.method,
+        headerValue: c.req.header('X-METHOD-OVERRIDE') ?? null,
+      })
+    })
+
+    it('Should override POST to DELETE', async () => {
+      const res = await app.request('/posts', {
+        method: 'POST',
+        headers: {
+          'X-METHOD-OVERRIDE': 'DELETE',
+        },
+      })
+      expect(res.status).toBe(200)
+      expect(await res.json()).toEqual({
+        method: 'DELETE',
+        headerValue: null,
+      })
+    })
+
+    it('Should not override GET request', async () => {
+      const res = await app.request('/posts', {
+        method: 'GET',
+        headers: {
+          'X-METHOD-OVERRIDE': 'DELETE',
+        },
+      })
+      expect(res.status).toBe(200)
+      expect(await res.json()).toEqual({
+        method: 'GET',
+        headerValue: 'DELETE', // It does not modify the headers.
+      })
+    })
+  })
+
+  describe('Query', () => {
+    const app = new App()
+    app.use('/posts/*', methodOverride({ app, query: '_method' }))
+    app.on(['get', 'post', 'delete'], '/posts', async (c) => {
+      return c.json({
+        method: c.req.method,
+        queryValue: c.req.query('_method') ?? null,
+      })
+    })
+
+    it('Should override POST to DELETE', async () => {
+      const res = await app.request('/posts?_method=delete', {
+        method: 'POST',
+      })
+      expect(res.status).toBe(200)
+      expect(await res.json()).toEqual({
+        method: 'DELETE',
+        queryValue: null,
+      })
+    })
+
+    it('Should override POST to DELETE when the request has a body', async () => {
+      const app = new App()
+      app.use('/posts/*', methodOverride({ app, query: '_method' }))
+      app.on(['post', 'delete'], '/posts', async (c) => {
+        return c.json({
+          method: c.req.method,
+          body: await c.req.text(),
+          queryValue: c.req.query('_method') ?? null,
+        })
+      })
+      const res = await app.request('/posts?_method=delete', {
+        method: 'POST',
+        body: new URLSearchParams({ message: 'Hello' }),
+      })
+      expect(res.status).toBe(200)
+      expect(await res.json()).toEqual({
+        method: 'DELETE',
+        body: 'message=Hello',
+        queryValue: null,
+      })
+    })
+
+    it('Should not override GET request', async () => {
+      const res = await app.request('/posts?_method=delete', {
+        method: 'GET',
+      })
+      expect(res.status).toBe(200)
+      expect(await res.json()).toEqual({
+        method: 'GET',
+        queryValue: 'delete', // It does not modify the queries.
+      })
+    })
+  })
+})