acrylblends 0.6.1 → 0.6.3

package/plugins/acryl-router/src/core/helper/proxy/index.test.ts

@@ -0,0 +1,356 @@
+import { proxy } from './index.ts'
+import { Acryl } from '../../app.ts'
+
+describe('Proxy Middleware', () => {
+  describe('proxy', () => {
+    beforeEach(() => {
+      global.fetch = vi.fn().mockImplementation(async (req) => {
+        if (req.url === 'https://example.com/ok') {
+          return Promise.resolve(new Response('ok'))
+        } else if (req.url === 'https://example.com/disconnect') {
+          const reader = req.body.getReader()
+          let response
+
+          req.signal.addEventListener('abort', () => {
+            response = req.signal.reason
+            reader.cancel()
+          })
+
+          await reader.read()
+
+          return Promise.resolve(new Response(response))
+        } else if (req.url === 'https://example.com/compressed') {
+          return Promise.resolve(
+            new Response('ok', {
+              headers: {
+                'Content-Encoding': 'gzip',
+                'Content-Length': '1',
+                'Content-Range': 'bytes 0-2/1024',
+                'X-Response-Id': '456',
+              },
+            })
+          )
+        } else if (req.url === 'https://example.com/uncompressed') {
+          return Promise.resolve(
+            new Response('ok', {
+              headers: {
+                'Content-Length': '2',
+                'Content-Range': 'bytes 0-2/1024',
+                'X-Response-Id': '456',
+              },
+            })
+          )
+        } else if (req.url === 'https://example.com/post' && req.method === 'POST') {
+          return Promise.resolve(new Response(`request body: ${await req.text()}`))
+        } else if (req.url === 'https://example.com/hop-by-hop') {
+          return Promise.resolve(
+            new Response('ok', {
+              headers: {
+                'Transfer-Encoding': 'chunked',
+              },
+            })
+          )
+        } else if (req.url === 'https://example.com/connection-listed') {
+          return Promise.resolve(
+            new Response('ok', {
+              headers: {
+                Connection: 'x-connection-scoped, bad name',
+                'X-Connection-Scoped': 'should not be forwarded',
+                'X-Normal': 'kept',
+              },
+            })
+          )
+        } else if (req.url === 'https://example.com/set-cookie') {
+          return Promise.resolve(
+            new Response('ok', {
+              headers: {
+                'Set-Cookie': 'test=123',
+              },
+            })
+          )
+        }
+        return Promise.resolve(new Response('not found', { status: 404 }))
+      })
+    })
+
+    it('compressed', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) =>
+        proxy(
+          new Request(`https://example.com/${c.req.param('path')}`, {
+            headers: {
+              'X-Request-Id': '123',
+              'Accept-Encoding': 'gzip',
+            },
+          })
+        )
+      )
+      const res = await app.request('/proxy/compressed')
+      const req = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][0]
+
+      expect(req.url).toBe('https://example.com/compressed')
+      expect(req.headers.get('X-Request-Id')).toBe('123')
+      expect(req.headers.get('Accept-Encoding')).toBeNull()
+
+      expect(res.status).toBe(200)
+      expect(res.headers.get('X-Response-Id')).toBe('456')
+      expect(res.headers.get('Content-Encoding')).toBeNull()
+      expect(res.headers.get('Content-Length')).toBeNull()
+      expect(res.headers.get('Content-Range')).toBe('bytes 0-2/1024')
+    })
+
+    it('uncompressed', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) =>
+        proxy(
+          new Request(`https://example.com/${c.req.param('path')}`, {
+            headers: {
+              'X-Request-Id': '123',
+              'Accept-Encoding': 'gzip',
+            },
+          })
+        )
+      )
+      const res = await app.request('/proxy/uncompressed')
+      const req = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][0]
+
+      expect(req.url).toBe('https://example.com/uncompressed')
+      expect(req.headers.get('X-Request-Id')).toBe('123')
+      expect(req.headers.get('Accept-Encoding')).toBeNull()
+
+      expect(res.status).toBe(200)
+      expect(res.headers.get('X-Response-Id')).toBe('456')
+      expect(res.headers.get('Content-Length')).toBe('2')
+      expect(res.headers.get('Content-Range')).toBe('bytes 0-2/1024')
+    })
+
+    it('POST request', async () => {
+      const app = new Acryl()
+      app.all('/proxy/:path', (c) => {
+        return proxy(`https://example.com/${c.req.param('path')}`, {
+          ...c.req,
+          headers: {
+            ...c.req.header(),
+            'X-Request-Id': '123',
+            'Accept-Encoding': 'gzip',
+          },
+        })
+      })
+      const res = await app.request('/proxy/post', {
+        method: 'POST',
+        body: 'test',
+      })
+      const req = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][0]
+
+      expect(req.url).toBe('https://example.com/post')
+
+      expect(res.status).toBe(200)
+      expect(await res.text()).toBe('request body: test')
+    })
+
+    it('remove hop-by-hop headers', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) => proxy(`https://example.com/${c.req.param('path')}`, c.req))
+
+      const res = await app.request('/proxy/hop-by-hop', {
+        headers: {
+          Host: 'example.com',
+          Connection: 'keep-alive, custom-header',
+          'Keep-Alive': 'timeout=5, max=1000',
+          'Proxy-Authorization': 'Basic 123456',
+          'Custom-Header': 'test',
+          'Allowed-Custom-Header': 'test',
+        },
+      })
+      const req = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][0]
+
+      expect(req.headers.get('Host')).toBe('example.com')
+      expect(req.headers.get('Connection')).toBeNull()
+      expect(req.headers.get('Keep-Alive')).toBeNull()
+      expect(req.headers.get('Proxy-Authorization')).toBeNull()
+      expect(req.headers.get('Custom-Header')).toBe('test')
+      expect(req.headers.get('Allowed-Custom-Header')).toBe('test')
+
+      expect(res.headers.get('Transfer-Encoding')).toBeNull()
+    })
+
+    it('remove hop-by-hop headers with strictConnectionProcessing', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) =>
+        proxy(`https://example.com/${c.req.param('path')}`, {
+          ...c.req,
+          strictConnectionProcessing: true,
+        })
+      )
+
+      const res = await app.request('/proxy/hop-by-hop', {
+        headers: {
+          Host: 'example.com',
+          Connection: 'keep-alive, custom-header',
+          'Keep-Alive': 'timeout=5, max=1000',
+          'Proxy-Authorization': 'Basic 123456',
+          'Custom-Header': 'test',
+          'Allowed-Custom-Header': 'test',
+        },
+      })
+      const req = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][0]
+
+      expect(req.headers.get('Host')).toBe('example.com')
+      expect(req.headers.get('Connection')).toBeNull()
+      expect(req.headers.get('Keep-Alive')).toBeNull()
+      expect(req.headers.get('Proxy-Authorization')).toBeNull()
+      expect(req.headers.get('Custom-Header')).toBeNull()
+      expect(req.headers.get('Allowed-Custom-Header')).toBe('test')
+
+      expect(res.headers.get('Transfer-Encoding')).toBeNull()
+    })
+
+    it('invalid hop-by-hop headers with strictConnectionProcessing', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) =>
+        proxy(`https://example.com/${c.req.param('path')}`, {
+          ...c.req,
+          strictConnectionProcessing: true,
+        })
+      )
+
+      const res = await app.request('/proxy/hop-by-hop', {
+        headers: {
+          Host: 'example.com',
+          Connection: 'keep-alive, invalid-header invalid-header',
+          'Keep-Alive': 'timeout=5, max=1000',
+        },
+      })
+
+      expect(res.status).toBe(400)
+    })
+
+    it('specify hop-by-hop header by options', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) =>
+        proxy(`https://example.com/${c.req.param('path')}`, {
+          headers: {
+            'Proxy-Authorization': 'Basic 123456',
+          },
+        })
+      )
+
+      const res = await app.request('/proxy/hop-by-hop')
+      const req = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][0]
+
+      expect(req.headers.get('Proxy-Authorization')).toBe('Basic 123456')
+
+      expect(res.headers.get('Transfer-Encoding')).toBeNull()
+    })
+
+    it('remove response headers listed in the Connection header', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) => proxy(`https://example.com/${c.req.param('path')}`))
+      const res = await app.request('/proxy/connection-listed')
+      expect(res.status).toBe(200)
+      expect(res.headers.get('Connection')).toBeNull()
+      expect(res.headers.get('X-Connection-Scoped')).toBeNull()
+      expect(res.headers.get('X-Normal')).toBe('kept')
+    })
+
+    it('modify header', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) =>
+        proxy(`https://example.com/${c.req.param('path')}`, {
+          headers: {
+            'Set-Cookie': 'test=123',
+          },
+        }).then((res) => {
+          res.headers.delete('Set-Cookie')
+          res.headers.set('X-Response-Id', '456')
+          return res
+        })
+      )
+      const res = await app.request('/proxy/set-cookie')
+      expect(res.headers.get('Set-Cookie')).toBeNull()
+      expect(res.headers.get('X-Response-Id')).toBe('456')
+    })
+
+    it('does not propagate undefined request headers', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) =>
+        proxy(`https://example.com/${c.req.param('path')}`, {
+          headers: {
+            ...c.req.header(),
+            Authorization: undefined,
+          },
+        })
+      )
+      await app.request('/proxy/ok', {
+        headers: {
+          Authorization: 'Bearer 123',
+        },
+      })
+      const req = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][0]
+      expect(req.headers.get('Authorization')).toBeNull()
+    })
+
+    it('client disconnect', async () => {
+      const app = new Acryl()
+      const controller = new AbortController()
+      app.post('/proxy/:path', (c) => proxy(`https://example.com/${c.req.param('path')}`, c.req))
+      const resPromise = app.request('/proxy/disconnect', {
+        method: 'POST',
+        body: 'test',
+        signal: controller.signal,
+      })
+      controller.abort('client disconnect')
+      const res = await resPromise
+      expect(await res.text()).toBe('client disconnect')
+    })
+
+    it('not found', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) => proxy(`https://example.com/${c.req.param('path')}`))
+      const res = await app.request('/proxy/404')
+      expect(res.status).toBe(404)
+    })
+
+    it('pass a Request object to proxyInit', async () => {
+      const app = new Acryl()
+      app.get('/proxy/:path', (c) => {
+        const req = new Request(c.req.raw, {
+          headers: {
+            'X-Request-Id': '123',
+            'Accept-Encoding': 'gzip',
+          },
+        })
+        return proxy(`https://example.com/${c.req.param('path')}`, req)
+      })
+      const res = await app.request('/proxy/compressed')
+      const req = (global.fetch as ReturnType<typeof vi.fn>).mock.calls[0][0]
+
+      expect(req.url).toBe('https://example.com/compressed')
+      expect(req.headers.get('X-Request-Id')).toBe('123')
+      expect(req.headers.get('Accept-Encoding')).toBeNull()
+
+      expect(res.status).toBe(200)
+      expect(await res.text()).toBe('ok')
+    })
+
+    it('Should call the custom fetch method when specified', async () => {
+      const customFetch = vi.fn().mockImplementation(async (req: Request) => {
+        const text = await req.text()
+        return new Response('custom fetch response. message:' + text)
+      })
+      const app = new Acryl()
+      app.post('/', (c) => {
+        return proxy(`https://example.com/`, {
+          customFetch,
+          ...c.req,
+        })
+      })
+      const res = await app.request('/', {
+        method: 'POST',
+        body: 'hi',
+      })
+      expect(res.status).toBe(200)
+      expect(await res.text()).toBe('custom fetch response. message:hi')
+    })
+  })
+})

package/plugins/acryl-router/src/core/helper/proxy/index.ts

@@ -0,0 +1,203 @@
+/**
+ * @module
+ * Proxy Helper for Acryl.
+ */
+
+import { HTTPException } from '../../http-exception.ts'
+import type { RequestHeader } from '../../utils/headers.ts'
+import type { HeadersInit } from '../../utils/types.ts'
+
+// https://datatracker.ietf.org/doc/html/rfc2616#section-13.5.1
+const hopByHopHeaders = [
+  'connection',
+  'keep-alive',
+  'proxy-authenticate',
+  'proxy-authorization',
+  'te',
+  'trailer',
+  'transfer-encoding',
+  'upgrade',
+]
+
+// https://datatracker.ietf.org/doc/html/rfc9110#section-5.6.2
+const ALLOWED_TOKEN_PATTERN = /^[!#$%&'*+\-.0-9A-Z^_`a-z|~]+$/
+
+interface ProxyRequestInit extends Omit<RequestInit, 'headers'> {
+  raw?: Request
+  headers?:
+    | HeadersInit
+    | [string, string][]
+    | Record<RequestHeader, string | undefined>
+    | Record<string, string | undefined>
+  customFetch?: (request: Request) => Promise<Response>
+  /**
+   * Enable strict RFC 9110 compliance for Connection header processing.
+   *
+   * - `false` (default): Ignores Connection header to prevent potential
+   *   Hop-by-Hop Header Injection attacks. Recommended for untrusted clients.
+   * - `true`: Processes Connection header per RFC 9110 and removes listed headers.
+   *   Only use in trusted environments.
+   *
+   * @default false
+   * @see https://datatracker.ietf.org/doc/html/rfc9110#section-7.6.1
+   */
+  strictConnectionProcessing?: boolean
+}
+
+interface ProxyFetch {
+  (input: string | URL | Request, init?: ProxyRequestInit): Promise<Response>
+}
+
+const buildRequestInitFromRequest = (
+  request: Request | undefined,
+  strictConnectionProcessing: boolean
+): RequestInit & { duplex?: 'half' } => {
+  if (!request) {
+    return {}
+  }
+
+  const headers = new Headers(request.headers)
+
+  if (strictConnectionProcessing) {
+    // https://datatracker.ietf.org/doc/html/rfc9110#section-7.6.1
+    // Parse Connection header and remove listed headers (MUST per RFC 9110)
+    const connectionValue = headers.get('connection')
+    if (connectionValue) {
+      const headerNames = connectionValue.split(',').map((h) => h.trim())
+      // Validate header names per RFC 9110 Section 5.6.2 (token syntax)
+      const invalidHeaders = headerNames.filter((h) => !ALLOWED_TOKEN_PATTERN.test(h))
+
+      if (invalidHeaders.length > 0) {
+        throw new HTTPException(400, {
+          message: `Invalid Connection header value: ${invalidHeaders.join(', ')}`,
+        })
+      }
+      headerNames.forEach((headerName) => {
+        headers.delete(headerName)
+      })
+    }
+  }
+
+  hopByHopHeaders.forEach((header) => {
+    headers.delete(header)
+  })
+
+  return {
+    method: request.method,
+    body: request.body,
+    duplex: request.body ? 'half' : undefined,
+    headers,
+    signal: request.signal,
+  }
+}
+
+const preprocessRequestInit = (requestInit: RequestInit): RequestInit => {
+  if (
+    !requestInit.headers ||
+    Array.isArray(requestInit.headers) ||
+    requestInit.headers instanceof Headers
+  ) {
+    return requestInit
+  }
+
+  const headers = new Headers()
+  for (const [key, value] of Object.entries(requestInit.headers)) {
+    if (value == null) {
+      // delete header if value is null or undefined
+      headers.delete(key)
+    } else {
+      headers.set(key, value)
+    }
+  }
+  requestInit.headers = headers
+  return requestInit
+}
+
+/**
+ * Fetch API wrapper for proxy.
+ * The parameters and return value are the same as for `fetch` (except for the proxy-specific options).
+ *
+ * The "Accept-Encoding" header is replaced with an encoding that the current runtime can handle.
+ * Unnecessary response headers are deleted and a Response object is returned that can be returned
+ * as is as a response from the handler.
+ *
+ * @example
+ * ```ts
+ * app.get('/proxy/:path', (c) => {
+ *   return proxy(`http://${originServer}/${c.req.param('path')}`, {
+ *     headers: {
+ *       ...c.req.header(), // optional, specify only when forwarding all the request data (including credentials) is necessary.
+ *       'X-Forwarded-For': '127.0.0.1',
+ *       'X-Forwarded-Host': c.req.header('host'),
+ *       Authorization: undefined, // do not propagate request headers contained in c.req.header('Authorization')
+ *     },
+ *   }).then((res) => {
+ *     res.headers.delete('Set-Cookie')
+ *     return res
+ *   })
+ * })
+ *
+ * app.all('/proxy/:path', (c) => {
+ *   return proxy(`http://${originServer}/${c.req.param('path')}`, {
+ *     ...c.req, // optional, specify only when forwarding all the request data (including credentials) is necessary.
+ *     headers: {
+ *       ...c.req.header(),
+ *       'X-Forwarded-For': '127.0.0.1',
+ *       'X-Forwarded-Host': c.req.header('host'),
+ *       Authorization: undefined, // do not propagate request headers contained in c.req.header('Authorization')
+ *     },
+ *   })
+ * })
+ *
+ * // Strict RFC compliance mode (use only in trusted environments)
+ * app.get('/internal-proxy/:path', (c) => {
+ *   return proxy(`http://${internalServer}/${c.req.param('path')}`, {
+ *     ...c.req,
+ *     strictConnectionProcessing: true,
+ *   })
+ * })
+ * ```
+ */
+export const proxy: ProxyFetch = async (input, proxyInit) => {
+  const {
+    raw,
+    customFetch,
+    strictConnectionProcessing = false,
+    ...requestInit
+  } = proxyInit instanceof Request ? { raw: proxyInit } : (proxyInit ?? {})
+
+  const req = new Request(input, {
+    ...buildRequestInitFromRequest(raw, strictConnectionProcessing),
+    ...preprocessRequestInit(requestInit as RequestInit),
+  })
+  req.headers.delete('accept-encoding')
+
+  const res = await (customFetch || fetch)(req)
+  const resHeaders = new Headers(res.headers)
+
+  // https://datatracker.ietf.org/doc/html/rfc9110#section-7.6.1
+  // Remove headers listed in the response's own Connection header (MUST per RFC 9110)
+  const connectionValue = resHeaders.get('connection')
+  if (connectionValue) {
+    connectionValue
+      .split(',')
+      .map((h) => h.trim())
+      .filter((h) => ALLOWED_TOKEN_PATTERN.test(h))
+      .forEach((h) => resHeaders.delete(h))
+  }
+
+  hopByHopHeaders.forEach((header) => {
+    resHeaders.delete(header)
+  })
+  if (resHeaders.has('content-encoding')) {
+    resHeaders.delete('content-encoding')
+    // Content-Length is the size of the compressed content, not the size of the original content
+    resHeaders.delete('content-length')
+  }
+
+  return new Response(res.body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers: resHeaders,
+  })
+}