adorn-api 1.0.12 → 1.0.14

package/dist/express.cjs

@@ -167,11 +167,25 @@ function computeBoundRoutes(controllers, manifest) {
 var import_ajv = __toESM(require("ajv"), 1);
 var import_ajv_formats = __toESM(require("ajv-formats"), 1);
 var ValidationErrorResponse = class extends Error {
+  /**
+   * HTTP status code for validation errors.
+   */
+  statusCode;
+  /**
+   * Detailed validation errors.
+   */
+  errors;
+  /**
+   * Creates a new ValidationErrorResponse.
+   * 
+   * @param statusCode - HTTP status code (typically 400)
+   * @param errors - Array of validation errors
+   */
   constructor(statusCode, errors) {
     super("Validation failed");
+    this.name = "ValidationErrorResponse";
     this.statusCode = statusCode;
     this.errors = errors;
-    this.name = "ValidationErrorResponse";
   }
 };
 function createValidator() {
@@ -216,7 +230,7 @@ async function getMtime(filePath) {
 async function loadArtifacts(options) {
   const { outDir } = options;
   const cacheKey = import_node_path.default.resolve(outDir);
-  let entry = artifactCache.get(cacheKey);
+  const entry = artifactCache.get(cacheKey);
   const openapiPath = import_node_path.default.join(outDir, "openapi.json");
   const manifestPath = import_node_path.default.join(outDir, "manifest.json");
   const validatorsPath = import_node_path.default.join(outDir, "validators.mjs");
@@ -477,13 +491,16 @@ function getRawQueryString(req) {
   if (index === -1) return "";
   return url.slice(index + 1);
 }
-function parseDeepObjectParams(rawQuery, names) {
+function parseDeepObjectParams(rawQuery, names, maxDepth = 5) {
   const out = {};
   if (!rawQuery || names.size === 0) return out;
   const params = new URLSearchParams(rawQuery);
   for (const [key, value] of params.entries()) {
     const path3 = parseBracketPath(key);
     if (path3.length === 0) continue;
+    if (path3.length > maxDepth) {
+      throw new Error(`Query parameter nesting depth (${path3.length}) exceeds maximum of ${maxDepth}`);
+    }
     const root = path3[0];
     if (!names.has(root)) continue;
     assignDeepValue(out, path3, value);
@@ -596,10 +613,10 @@ function createAuthMiddleware(authConfig, routeAuth, globalSecurity) {
 }
 
 // src/adapter/express/validation.ts
-function validateRequestWithPrecompiled(route, req, validators) {
+function validateRequestWithPrecompiled(route, req, validators, maxDepth = 5) {
   const errors = [];
   const deepNames = new Set(route.args.query.filter((q) => q.serialization?.style === "deepObject").map((q) => q.name));
-  const deepValues = deepNames.size > 0 ? parseDeepObjectParams(getRawQueryString(req), deepNames) : {};
+  const deepValues = deepNames.size > 0 ? parseDeepObjectParams(getRawQueryString(req), deepNames, maxDepth) : {};
   if (route.args.body) {
     const validator = validators[route.operationId]?.body;
     if (validator) {
@@ -622,10 +639,10 @@ function validateRequestWithPrecompiled(route, req, validators) {
     if (q.content === "application/json" && typeof value === "string") {
       try {
         value = JSON.parse(value);
-      } catch (e) {
+      } catch {
         errors.push({
           path: `#/query/${q.name}`,
-          message: `Invalid JSON string`,
+          message: "Invalid JSON string",
           keyword: "json",
           params: {}
         });
@@ -635,11 +652,11 @@ function validateRequestWithPrecompiled(route, req, validators) {
   }
   return errors.length > 0 ? errors : null;
 }
-function validateRequest(route, req, openapi, validator) {
+function validateRequest(route, req, openapi, validator, maxDepth = 5) {
   const openapiOperation = getOpenApiOperation(openapi, route);
   const paramSchemaIndex = getParamSchemaIndex(openapiOperation);
   const deepNames = new Set(route.args.query.filter((q) => q.serialization?.style === "deepObject").map((q) => q.name));
-  const deepValues = deepNames.size > 0 ? parseDeepObjectParams(getRawQueryString(req), deepNames) : {};
+  const deepValues = deepNames.size > 0 ? parseDeepObjectParams(getRawQueryString(req), deepNames, maxDepth) : {};
   const errors = [];
   if (route.args.body) {
     const bodySchema = getSchemaByRef(openapi, route.args.body.schemaRef);
@@ -663,10 +680,10 @@ function validateRequest(route, req, openapi, validator) {
     if (q.content === "application/json" && typeof value === "string") {
       try {
         value = JSON.parse(value);
-      } catch (e) {
+      } catch {
         errors.push({
           path: `#/query/${q.name}`,
-          message: `Invalid JSON string`,
+          message: "Invalid JSON string",
           keyword: "json",
           params: {}
         });
@@ -744,7 +761,7 @@ function validateRequest(route, req, openapi, validator) {
 
 // src/adapter/express/router.ts
 async function createExpressRouter(options) {
-  const { controllers, artifactsDir = ".adorn", middleware = {}, defaultPageSize = 10 } = options;
+  const { controllers, artifactsDir = ".adorn", middleware = {}, defaultPageSize = 10, queryOptions } = options;
   let manifest;
   let openapi;
   let precompiledValidators = null;
@@ -814,10 +831,15 @@ async function createExpressRouter(options) {
     }
     router[method](route.fullPath, ...middlewareChain, async (req, res, next) => {
       try {
-        const validationErrors = precompiledValidators ? validateRequestWithPrecompiled(route, req, precompiledValidators) : validateRequest(route, req, openapi, validator);
+        const maxDepth = queryOptions?.maxNestingDepth ?? 5;
+        const validationErrors = precompiledValidators ? validateRequestWithPrecompiled(route, req, precompiledValidators, maxDepth) : validateRequest(route, req, openapi, validator, maxDepth);
         if (validationErrors) {
           return res.status(400).json(formatValidationErrors(validationErrors));
         }
+        const deepNames = new Set(
+          route.args.query.filter((q) => q.serialization?.style === "deepObject").map((q) => q.name)
+        );
+        const deepValues = deepNames.size > 0 ? parseDeepObjectParams(getRawQueryString(req), deepNames, maxDepth) : {};
         const instance = getInstance(route.controllerCtor);
         const handler = instance[route.methodName];
         if (typeof handler !== "function") {
@@ -843,13 +865,13 @@ async function createExpressRouter(options) {
           }
           if (jsonArgs.length > 0) {
             for (const q of jsonArgs) {
-              const rawValue = req.query[q.name];
+              const rawValue = q.serialization?.style === "deepObject" ? deepValues[q.name] : req.query[q.name];
               if (rawValue === void 0 || rawValue === null) continue;
               let parsed = rawValue;
               if (typeof rawValue === "string" && rawValue.length > 0) {
                 try {
                   parsed = JSON.parse(rawValue);
-                } catch (e) {
+                } catch {
                   parsed = rawValue;
                 }
               }
@@ -863,7 +885,7 @@ async function createExpressRouter(options) {
           }
           if (standardArgs.length > 0) {
             for (const q of standardArgs) {
-              const rawValue = req.query[q.name];
+              const rawValue = q.serialization?.style === "deepObject" ? deepValues[q.name] : req.query[q.name];
               if (rawValue === void 0) continue;
               const parsed = parseQueryValue(rawValue, q);
               const paramSchema = getParamSchemaFromIndex(paramSchemaIndex, "query", q.name) ?? (q.schemaRef ? getSchemaByRef(openapi, q.schemaRef) : null) ?? schemaFromType(q.schemaType);
@@ -975,41 +997,40 @@ function setupSwagger(options = {}) {
 var import_express3 = __toESM(require("express"), 1);
 var import_node_path4 = __toESM(require("path"), 1);
 function bootstrap(options) {
-  return new Promise(async (resolve2, reject) => {
-    try {
-      const {
-        controllers,
-        port: userPort,
-        host: userHost,
-        artifactsDir: userArtifactsDir = ".adorn",
-        enableSwagger = true,
-        swaggerPath = "/docs",
-        swaggerJsonPath = "/docs/openapi.json",
-        middleware,
-        auth,
-        coerce
-      } = options;
-      if (controllers.length === 0) {
-        reject(new Error("At least one controller must be provided to bootstrap()."));
-        return;
-      }
-      const envPort = process.env.PORT;
-      const port = userPort ?? (envPort !== void 0 ? Number(envPort) : 3e3);
-      const host = userHost ?? process.env.HOST ?? "0.0.0.0";
-      if (isNaN(port) || port < 0 || port > 65535) {
-        reject(new Error(`Invalid port: ${port}. Port must be between 0 and 65535.`));
-        return;
-      }
-      const absoluteArtifactsDir = import_node_path4.default.isAbsolute(userArtifactsDir) ? userArtifactsDir : import_node_path4.default.resolve(process.cwd(), userArtifactsDir);
-      const app = (0, import_express3.default)();
-      app.use(import_express3.default.json());
-      const router = await createExpressRouter({
-        controllers,
-        artifactsDir: absoluteArtifactsDir,
-        middleware,
-        auth,
-        coerce
-      });
+  return new Promise((resolve2, reject) => {
+    const {
+      controllers,
+      port: userPort,
+      host: userHost,
+      artifactsDir: userArtifactsDir = ".adorn",
+      enableSwagger = true,
+      swaggerPath = "/docs",
+      swaggerJsonPath = "/docs/openapi.json",
+      middleware,
+      auth,
+      coerce
+    } = options;
+    if (controllers.length === 0) {
+      reject(new Error("At least one controller must be provided to bootstrap()."));
+      return;
+    }
+    const envPort = process.env.PORT;
+    const port = userPort ?? (envPort !== void 0 ? Number(envPort) : 3e3);
+    const host = userHost ?? process.env.HOST ?? "0.0.0.0";
+    if (isNaN(port) || port < 0 || port > 65535) {
+      reject(new Error(`Invalid port: ${port}. Port must be between 0 and 65535.`));
+      return;
+    }
+    const absoluteArtifactsDir = import_node_path4.default.isAbsolute(userArtifactsDir) ? userArtifactsDir : import_node_path4.default.resolve(process.cwd(), userArtifactsDir);
+    const app = (0, import_express3.default)();
+    app.use(import_express3.default.json());
+    createExpressRouter({
+      controllers,
+      artifactsDir: absoluteArtifactsDir,
+      middleware,
+      auth,
+      coerce
+    }).then((router) => {
       app.use(router);
       if (enableSwagger) {
         const displayHost = host === "0.0.0.0" ? "localhost" : host;
@@ -1056,9 +1077,7 @@ function bootstrap(options) {
           reject(new Error(`Failed to start server: ${error.message}`));
         }
       });
-    } catch (error) {
-      reject(error);
-    }
+    }).catch(reject);
   });
 }
 // Annotate the CommonJS export names for ESM import in node: