acrylblends 0.3.0 → 0.4.1

package/plugins/acryl-router/src/core/middleware/context-storage/index.test.ts

@@ -0,0 +1,43 @@
+import { contextStorage, getContext, tryGetContext } from './index.ts'
+import { App } from '../../app.ts'
+
+describe('Context Storage Middleware', () => {
+  type Env = {
+    Variables: {
+      message: string
+    }
+  }
+
+  const app = new App<Env>()
+
+  app.use(contextStorage())
+  app.use(async (c, next) => {
+    c.set('message', 'App is hot!!')
+    await next()
+  })
+  app.get('/', (c) => {
+    return c.text(getMessage())
+  })
+  app.get('/optional', (c) => {
+    const optionalContext = tryGetContext<Env>()
+    return c.text(optionalContext?.var.message ?? 'no context')
+  })
+
+  const getMessage = () => {
+    return getContext<Env>().var.message
+  }
+
+  it('Should get context', async () => {
+    const res = await app.request('/')
+    expect(await res.text()).toBe('App is hot!!')
+  })
+
+  it('Should return undefined when context is missing', () => {
+    expect(tryGetContext<Env>()).toBeUndefined()
+  })
+
+  it('Should get context when available via tryGetContext', async () => {
+    const res = await app.request('/optional')
+    expect(await res.text()).toBe('App is hot!!')
+  })
+})

package/plugins/acryl-router/src/core/middleware/context-storage/index.ts

@@ -0,0 +1,58 @@
+/**
+ * @module
+ * Context Storage Middleware for App.
+ */
+
+import { AsyncLocalStorage } from 'node:async_hooks'
+import type { Context } from '../../context.ts'
+import type { Env, MiddlewareHandler } from '../../types.ts'
+
+const asyncLocalStorage = new AsyncLocalStorage<Context>()
+
+/**
+ * Context Storage Middleware for App.
+ *
+ *
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * type Env = {
+ *   Variables: {
+ *     message: string
+ *   }
+ * }
+ *
+ * const app = new App<Env>()
+ *
+ * app.use(contextStorage())
+ *
+ * app.use(async (c, next) => {
+ *   c.set('message', 'App is hot!!')
+ *   await next()
+ * })
+ *
+ * app.get('/', async (c) => c.text(getMessage()))
+ *
+ * const getMessage = () => {
+ *   return getContext<Env>().var.message
+ * }
+ * ```
+ */
+export const contextStorage = (): MiddlewareHandler => {
+  return async function contextStorage(c, next) {
+    await asyncLocalStorage.run(c, next)
+  }
+}
+
+export const tryGetContext = <E extends Env = Env>(): Context<E> | undefined => {
+  return asyncLocalStorage.getStore() as Context<E> | undefined
+}
+
+export const getContext = <E extends Env = Env>(): Context<E> => {
+  const context = tryGetContext<E>()
+  if (!context) {
+    throw new Error('Context is not available')
+  }
+  return context
+}

package/plugins/acryl-router/src/core/middleware/cors/index.test.ts

@@ -0,0 +1,532 @@
+import { App } from '../../app.ts'
+import { cors } from './index.ts'
+
+describe('CORS by Middleware', () => {
+  const app = new App()
+
+  app.use('/api/*', cors())
+
+  app.use(
+    '/api2/*',
+    cors({
+      origin: 'http://example.com',
+      allowHeaders: ['X-Custom-Header', 'Upgrade-Insecure-Requests'],
+      allowMethods: ['POST', 'GET', 'OPTIONS'],
+      exposeHeaders: ['Content-Length', 'X-Kuma-Revision'],
+      maxAge: 600,
+      credentials: true,
+    })
+  )
+
+  app.use(
+    '/api3/*',
+    cors({
+      origin: ['http://example.com', 'http://example.org', 'http://example.dev'],
+    })
+  )
+
+  app.use(
+    '/api4/*',
+    cors({
+      origin: (origin) => (origin.endsWith('.example.com') ? origin : 'http://example.com'),
+    })
+  )
+
+  app.use('/api5/*', cors())
+
+  app.use(
+    '/api6/*',
+    cors({
+      origin: 'http://example.com',
+    })
+  )
+  app.use(
+    '/api6/*',
+    cors({
+      origin: 'http://example.com',
+    })
+  )
+
+  app.use(
+    '/api7/*',
+    cors({
+      origin: (origin) => (origin === 'http://example.com' ? origin : '*'),
+      allowMethods: (origin) =>
+        origin === 'http://example.com'
+          ? ['GET', 'HEAD', 'POST', 'PATCH', 'DELETE']
+          : ['GET', 'HEAD'],
+    })
+  )
+
+  app.use(
+    '/api8/*',
+    cors({
+      origin: (origin) =>
+        new Promise<string>((resolve) =>
+          resolve(origin.endsWith('.example.com') ? origin : 'http://example.com')
+        ),
+    })
+  )
+
+  app.use(
+    '/api9/*',
+    cors({
+      origin: (origin) =>
+        new Promise<string>((resolve) => resolve(origin === 'http://example.com' ? origin : '*')),
+      allowMethods: (origin) =>
+        new Promise<string[]>((resolve) =>
+          resolve(
+            origin === 'http://example.com'
+              ? ['GET', 'HEAD', 'POST', 'PATCH', 'DELETE']
+              : ['GET', 'HEAD']
+          )
+        ),
+    })
+  )
+
+  app.use(
+    '/api10/*',
+    cors({
+      origin: '*',
+      credentials: true,
+    })
+  )
+
+  app.get('/api/abc', (c) => {
+    return c.json({ success: true })
+  })
+
+  app.get('/api/vary-header', () => {
+    return new Response(JSON.stringify({ success: true }), {
+      headers: {
+        Vary: 'X-Custom-Vary-Value',
+      },
+    })
+  })
+
+  app.get('/api2/abc', (c) => {
+    return c.json({ success: true })
+  })
+
+  app.get('/api3/abc', (c) => {
+    return c.json({ success: true })
+  })
+
+  app.get('/api3/vary-header', () => {
+    return new Response(JSON.stringify({ success: true }), {
+      headers: {
+        Vary: 'X-Custom-Vary-Value',
+      },
+    })
+  })
+
+  app.get('/api4/abc', (c) => {
+    return c.json({ success: true })
+  })
+
+  app.get('/api5/abc', () => {
+    return new Response(JSON.stringify({ success: true }))
+  })
+
+  app.get('/api7/abc', () => {
+    return new Response(JSON.stringify({ success: true }))
+  })
+
+  app.get('/api10/abc', (c) => {
+    return c.json({ success: true })
+  })
+
+  it('GET default', async () => {
+    const res = await app.request('http://localhost/api/abc')
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res.headers.get('Vary')).toBeNull()
+  })
+
+  it('Preflight default', async () => {
+    const req = new Request('https://localhost/api/abc', {
+      method: 'OPTIONS',
+      headers: {
+        'Access-Control-Request-Method': 'QUERY',
+        'Access-Control-Request-Headers': 'X-PINGOTHER, Content-Type',
+      },
+    })
+    const res = await app.request(req)
+
+    expect(res.status).toBe(204)
+    expect(res.statusText).toBe('No Content')
+    expect(res.headers.get('Access-Control-Allow-Methods')?.split(',')).toEqual([
+      'GET',
+      'HEAD',
+      'PUT',
+      'POST',
+      'DELETE',
+      'PATCH',
+      'QUERY',
+    ])
+    expect(res.headers.get('Access-Control-Allow-Headers')?.split(',')).toEqual([
+      'X-PINGOTHER',
+      'Content-Type',
+    ])
+  })
+
+  it('Preflight handles a large Access-Control-Request-Headers value', async () => {
+    const req = new Request('https://localhost/api/abc', { method: 'OPTIONS' })
+    req.headers.append('Access-Control-Request-Headers', 'x' + ' '.repeat(200000) + 'x')
+    const res = await app.request(req)
+    expect(res.status).toBe(204)
+  })
+
+  it('Preflight with options', async () => {
+    const req = new Request('https://localhost/api2/abc', {
+      method: 'OPTIONS',
+      headers: { origin: 'http://example.com' },
+    })
+    const res = await app.request(req)
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+    expect(res.headers.get('Vary')?.split(/\s*,\s*/)).toEqual(expect.arrayContaining(['Origin']))
+    expect(res.headers.get('Access-Control-Allow-Headers')?.split(/\s*,\s*/)).toEqual([
+      'X-Custom-Header',
+      'Upgrade-Insecure-Requests',
+    ])
+    expect(res.headers.get('Access-Control-Allow-Methods')?.split(/\s*,\s*/)).toEqual([
+      'POST',
+      'GET',
+      'OPTIONS',
+    ])
+    expect(res.headers.get('Access-Control-Expose-Headers')?.split(/\s*,\s*/)).toEqual([
+      'Content-Length',
+      'X-Kuma-Revision',
+    ])
+    expect(res.headers.get('Access-Control-Max-Age')).toBe('600')
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true')
+  })
+
+  it('Disallow an unmatched origin', async () => {
+    const req = new Request('https://localhost/api2/abc', {
+      method: 'OPTIONS',
+      headers: { origin: 'http://example.net' },
+    })
+    const res = await app.request(req)
+    expect(res.headers.has('Access-Control-Allow-Origin')).toBeFalsy()
+  })
+
+  it('Allow multiple origins', async () => {
+    let req = new Request('http://localhost/api3/abc', {
+      headers: {
+        Origin: 'http://example.org',
+      },
+    })
+    let res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.org')
+
+    req = new Request('http://localhost/api3/abc')
+    res = await app.request(req)
+    expect(
+      res.headers.has('Access-Control-Allow-Origin'),
+      'An unmatched origin should be disallowed'
+    ).toBeFalsy()
+
+    req = new Request('http://localhost/api3/abc', {
+      headers: {
+        Referer: 'http://example.net/',
+      },
+    })
+    res = await app.request(req)
+    expect(
+      res.headers.has('Access-Control-Allow-Origin'),
+      'An unmatched origin should be disallowed'
+    ).toBeFalsy()
+  })
+
+  it('Set "Origin" to Vary header', async () => {
+    const res = await app.request('http://localhost/api3/abc', {
+      headers: {
+        Origin: 'http://example.com',
+      },
+    })
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+    expect(res.headers.get('Vary')).toBe('Origin')
+  })
+
+  it('Keep original Vary header', async () => {
+    const res = await app.request('http://localhost/api/vary-header', {
+      headers: {
+        Origin: 'http://example.com',
+      },
+    })
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res.headers.get('Vary')).toBe('X-Custom-Vary-Value')
+  })
+
+  it('Append "Origin" to Vary header, if response has some Vary header', async () => {
+    const res = await app.request('http://localhost/api3/vary-header', {
+      headers: {
+        Origin: 'http://example.com',
+      },
+    })
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+    expect(res.headers.get('Vary')).toBe('X-Custom-Vary-Value, Origin')
+  })
+
+  it('Append "Origin" to Vary header on OPTIONS preflight, if response has some Vary header', async () => {
+    const testApp = new App()
+    testApp.use('/api/*', async (c, next) => {
+      c.header('Vary', 'Accept-Encoding', { append: true })
+      await next()
+    })
+    testApp.use(
+      '/api/*',
+      cors({
+        origin: 'http://example.com',
+        allowHeaders: ['X-Custom-Header'],
+      })
+    )
+    testApp.all('/api/test', (c) => c.text('ok'))
+
+    const res = await testApp.request('http://localhost/api/test', {
+      method: 'OPTIONS',
+      headers: {
+        Origin: 'http://example.com',
+        'Access-Control-Request-Headers': 'X-Custom-Header',
+      },
+    })
+
+    expect(res.status).toBe(204)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+    expect(res.headers.get('Vary')).toBe('Accept-Encoding, Origin, Access-Control-Request-Headers')
+  })
+
+  it('Allow origins by function', async () => {
+    let req = new Request('http://localhost/api4/abc', {
+      headers: {
+        Origin: 'http://subdomain.example.com',
+      },
+    })
+    let res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://subdomain.example.com')
+
+    req = new Request('http://localhost/api4/abc')
+    res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+
+    req = new Request('http://localhost/api4/abc', {
+      headers: {
+        Referer: 'http://evil-example.com/',
+      },
+    })
+    res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+  })
+
+  it('Allow origins by promise returning function', async () => {
+    let req = new Request('http://localhost/api8/abc', {
+      headers: {
+        Origin: 'http://subdomain.example.com',
+      },
+    })
+    let res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://subdomain.example.com')
+
+    req = new Request('http://localhost/api8/abc')
+    res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+
+    req = new Request('http://localhost/api8/abc', {
+      headers: {
+        Referer: 'http://evil-example.com/',
+      },
+    })
+    res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+  })
+
+  it('With raw Response object', async () => {
+    const res = await app.request('http://localhost/api5/abc')
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res.headers.get('Vary')).toBeNull()
+  })
+
+  it('Should not return duplicate header values', async () => {
+    const res = await app.request('http://localhost/api6/abc', {
+      headers: {
+        origin: 'http://example.com',
+      },
+    })
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+  })
+
+  it('Allow methods by function', async () => {
+    const req = new Request('http://localhost/api7/abc', {
+      headers: {
+        Origin: 'http://example.com',
+      },
+      method: 'OPTIONS',
+    })
+    const res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+    expect(res.headers.get('Access-Control-Allow-Methods')).toBe('GET,HEAD,POST,PATCH,DELETE')
+
+    const req2 = new Request('http://localhost/api7/abc', {
+      headers: {
+        Origin: 'http://example.org',
+      },
+      method: 'OPTIONS',
+    })
+    const res2 = await app.request(req2)
+    expect(res2.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res2.headers.get('Access-Control-Allow-Methods')).toBe('GET,HEAD')
+  })
+
+  it('Allow methods by promise returning function', async () => {
+    const req = new Request('http://localhost/api9/abc', {
+      headers: {
+        Origin: 'http://example.com',
+      },
+      method: 'OPTIONS',
+    })
+    const res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+    expect(res.headers.get('Access-Control-Allow-Methods')).toBe('GET,HEAD,POST,PATCH,DELETE')
+
+    const req2 = new Request('http://localhost/api9/abc', {
+      headers: {
+        Origin: 'http://example.org',
+      },
+      method: 'OPTIONS',
+    })
+    const res2 = await app.request(req2)
+    expect(res2.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res2.headers.get('Access-Control-Allow-Methods')).toBe('GET,HEAD')
+  })
+
+  it('Does not set allow methods when function returns an empty array', async () => {
+    for (const allowMethods of [() => [], async () => []]) {
+      const app = new App()
+      app.use(cors({ allowMethods }))
+
+      const res = await app.request('http://localhost/', { method: 'OPTIONS' })
+
+      expect(res.headers.get('Access-Control-Allow-Methods')).toBeNull()
+    }
+  })
+
+  it('Emits the wildcard, not the reflected origin, when credentials is true with wildcard origin', async () => {
+    const res = await app.request('http://localhost/api10/abc', {
+      headers: {
+        Origin: 'http://example.com',
+      },
+    })
+
+    expect(res.status).toBe(200)
+    // Must not reflect the request origin; the wildcard + credentials combination
+    // is rejected by the browser (fail closed). A wildcard response does not vary
+    // by Origin, so no Vary header is set.
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true')
+    expect(res.headers.get('Vary')).toBeNull()
+  })
+
+  it('Preflight emits the wildcard, not the reflected origin, when credentials is true with wildcard origin', async () => {
+    const req = new Request('http://localhost/api10/abc', {
+      method: 'OPTIONS',
+      headers: {
+        Origin: 'http://example.com',
+      },
+    })
+    const res = await app.request(req)
+
+    expect(res.status).toBe(204)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true')
+  })
+
+  it('Emits the wildcard with no Origin header when credentials is true with wildcard origin', async () => {
+    const res = await app.request('http://localhost/api10/abc')
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true')
+  })
+
+  it('Emits the wildcard for every origin (never reflects) when credentials is true with wildcard origin', async () => {
+    const res1 = await app.request('http://localhost/api10/abc', {
+      headers: { Origin: 'http://example.com' },
+    })
+    const res2 = await app.request('http://localhost/api10/abc', {
+      headers: { Origin: 'http://other.com' },
+    })
+
+    expect(res1.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res2.headers.get('Access-Control-Allow-Origin')).toBe('*')
+  })
+
+  it('Origin: null gets the wildcard, not a reflected null origin, with credentials', async () => {
+    const res = await app.request('http://localhost/api10/abc', {
+      headers: { Origin: 'null' },
+    })
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true')
+  })
+
+  it('Should not reflect an arbitrary Origin when credentials is true with default origin', async () => {
+    const app = new App()
+    app.use('*', cors({ credentials: true }))
+    app.get('/api/me', (c) => c.json({ secret: 'private user data' }))
+
+    // A wildcard/default origin must not be turned into a reflect-any-origin
+    // credentialed policy; the browser must keep rejecting it (fail closed).
+    for (const origin of ['https://attacker.example', 'http://evil.test', 'null']) {
+      const res = await app.request('http://localhost/api/me', { headers: { Origin: origin } })
+      expect(res.headers.get('Access-Control-Allow-Origin')).not.toBe(origin)
+    }
+  })
+
+  it('Preflight should not approve an arbitrary Origin when credentials is true with default origin', async () => {
+    const app = new App()
+    app.use('*', cors({ credentials: true }))
+    app.delete('/api/account', (c) => c.json({ deleted: true }))
+
+    const res = await app.request(
+      new Request('http://localhost/api/account', {
+        method: 'OPTIONS',
+        headers: {
+          Origin: 'https://attacker.example',
+          'Access-Control-Request-Method': 'DELETE',
+          'Access-Control-Request-Headers': 'X-CSRF',
+        },
+      })
+    )
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).not.toBe('https://attacker.example')
+  })
+
+  it('Options without origin fall back to wildcard default', async () => {
+    const subApp = new App()
+    subApp.use('/api/*', cors({ allowMethods: ['GET', 'POST'] }))
+    subApp.get('/api/abc', (c) => c.json({ ok: true }))
+
+    const res = await subApp.request('http://localhost/api/abc')
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+
+    const preflight = await subApp.request(
+      new Request('http://localhost/api/abc', { method: 'OPTIONS' })
+    )
+    expect(preflight.headers.get('Access-Control-Allow-Methods')?.split(/\s*,\s*/)).toEqual([
+      'GET',
+      'POST',
+    ])
+  })
+})