alado 3.2.3 → 3.5.0

package/dist/helpers/validate/context/validate-request-files.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateRequestFiles = validateRequestFiles;
+const file_signature_1 = require("./file-signature");
 function validateRequestFiles(context, request) {
     const { files } = context.request;
     if (files) {
         for (const file in files) {
-            const { required, mimetypes, maxSize, requiredError, maxSizeError, mimetypeError } = files[file];
+            const { required, mimetypes, maxSize, requiredError, maxSizeError, mimetypeError, verifyContent } = files[file];
             if (required && (!request.files || !request.files[file])) {
                 return requiredError;
             }
@@ -23,6 +24,10 @@ function validateRequestFiles(context, request) {
             if (size > maxSize) {
                 return maxSizeError;
             }
+            // the declared type is the client's word; the first bytes have to agree with it
+            if (verifyContent !== false && !(0, file_signature_1.matchesFileSignature)(mimetype, file_signature_1.uploadedFileHeads.get(uploaded))) {
+                return mimetypeError;
+            }
         }
         if (!context.options?.allowUnknownFields) {
             for (const f in request.files) {

package/dist/helpers/validate/context/validate-request-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-request-files.js","sourceRoot":"","sources":["../../../../src/helpers/validate/context/validate-request-files.ts"],"names":[],"mappings":";;AAEA,oDAiCC;AAjCD,SAAgB,oBAAoB,CAAC,OAAqB,EAAE,OAAY;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACjG,IAAI,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACzD,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,aAAa,CAAC;gBACvB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;gBACnB,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACd,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"validate-request-files.js","sourceRoot":"","sources":["../../../../src/helpers/validate/context/validate-request-files.ts"],"names":[],"mappings":";;AAGA,oDAqCC;AAvCD,qDAA2E;AAE3E,SAAgB,oBAAoB,CAAC,OAAqB,EAAE,OAAY;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAChH,IAAI,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACzD,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,aAAa,CAAC;gBACvB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;gBACnB,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,gFAAgF;YAChF,IAAI,aAAa,KAAK,KAAK,IAAI,CAAC,IAAA,qCAAoB,EAAC,QAAQ,EAAE,kCAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAChG,OAAO,aAAa,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACd,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/helpers/validate/context/validate-request-part.js

@@ -1,76 +1,153 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateRequestPart = validateRequestPart;
-const nonProcessingRequestParts = [
+const nonProcessingRequestParts = new Set([
     'files',
     'auth',
-];
+]);
+// parts that keep undeclared fields even when allowUnknownFields is off
+const openRequestParts = new Set([
+    'headers',
+    'rawBody',
+]);
+const hasOwn = (target, property) => target !== null && target !== undefined && Object.prototype.hasOwnProperty.call(target, property);
+function isThenable(value) {
+    return value !== null && typeof value === 'object' && typeof value.then === 'function';
+}
 function validateRequestPart(key, context, request) {
-    if (nonProcessingRequestParts.includes(key)) {
+    if (nonProcessingRequestParts.has(key)) {
         return;
     }
-    const definitions = context?.request[key] || {};
-    if (!Object.keys(definitions).length &&
-        !context.options?.allowUnknownFields &&
-        ![
-            'headers',
-            'rawBody',
-        ].includes(key)) {
-        request[key] = {};
-    }
+    const definitions = context?.request[key];
     let hasDefinitions = false;
-    for (const _ in context.request[key]) {
+    for (const _ in definitions) {
         hasDefinitions = true;
         break;
     }
     if (!hasDefinitions) {
+        if (!context.options?.allowUnknownFields && !openRequestParts.has(key)) {
+            request[key] = {};
+        }
         return;
     }
     return validateDeclaredProperties(key, context, request);
 }
-async function validateDeclaredProperties(key, context, request) {
-    for (const property in context.request[key]) {
-        const { validation, transform, isJSON } = context.request[key][property];
-        const { required, handler, error } = validation;
-        if (required && (!request[key] || !Object.prototype.hasOwnProperty.apply(request[key], [property]))) {
+/**
+ * Validates one declared property. Runs synchronously and only returns a Promise
+ * when the validation handler or the transform does, so plain validators cost no microtasks.
+ */
+function validateProperty(key, property, definition, request) {
+    const { validation, transform, isJSON } = definition;
+    const { required, handler, error } = validation;
+    const part = request[key];
+    const present = hasOwn(part, property);
+    if (required && !present) {
+        return error;
+    }
+    if (!handler || !present) {
+        return;
+    }
+    let value = part[property];
+    if (isJSON && typeof value === 'string') {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            // keep the raw string
+        }
+    }
+    // the configured error, never the exception text (it may describe internals)
+    const fail = () => error;
+    const applyTransform = () => {
+        if (!transform) {
+            return;
+        }
+        const transformed = transform.apply(request, [value]);
+        if (isThenable(transformed)) {
+            return Promise.resolve(transformed).then((v) => {
+                request[key][property] = v;
+                return undefined;
+            }, fail);
+        }
+        request[key][property] = transformed;
+    };
+    try {
+        const isValid = handler.apply(request, [value]);
+        if (isThenable(isValid)) {
+            // a rejection or a throwing transform both end up as the configured error
+            return Promise.resolve(isValid)
+                .then((ok) => (ok ? applyTransform() : error))
+                .then(undefined, fail);
+        }
+        if (!isValid) {
             return error;
         }
-        if (handler && Object.prototype.hasOwnProperty.apply(request[key], [property])) {
-            try {
-                let value = request[key][property];
-                const copiedValue = request[key][property];
-                if (isJSON && typeof value === 'string') {
-                    try {
-                        value = JSON.parse(value);
-                    }
-                    catch (e) {
-                        value = copiedValue;
-                    }
-                }
-                const isValid = await handler.apply(request, [value]);
-                if (!isValid) {
-                    return error;
-                }
-                if (transform) {
-                    request[key][property] = await transform.apply(request, [value]);
-                }
+        return applyTransform();
+    }
+    catch {
+        return error;
+    }
+}
+function stripUnknownFields(key, context, request) {
+    if (context.options?.allowUnknownFields || openRequestParts.has(key)) {
+        return;
+    }
+    const definitions = context.request[key];
+    const part = request[key];
+    if (part !== null && typeof part === 'object' && !Array.isArray(part) && definitions) {
+        // copy instead of `delete`: deleting keys turns the object into a slow dictionary-mode
+        // object, which the handler and JSON.stringify then pay for
+        let unknown = false;
+        for (const prop in part) {
+            if (!Object.prototype.hasOwnProperty.call(definitions, prop)) {
+                unknown = true;
+                break;
             }
-            catch {
-                // the configured error, never the exception text (it may describe internals)
-                return error;
+        }
+        if (unknown) {
+            const known = {};
+            for (const prop in part) {
+                if (Object.prototype.hasOwnProperty.call(definitions, prop)) {
+                    known[prop] = part[prop];
+                }
             }
+            request[key] = known;
         }
+        return;
     }
-    if (!context.options?.allowUnknownFields) {
-        for (const prop in request[key]) {
-            if (![
-                'headers',
-                'rawBody',
-            ].includes(key) &&
-                (!context.request[key] || !Object.prototype.hasOwnProperty.apply(context.request[key], [prop]))) {
-                delete request[key][prop];
-            }
+    for (const prop in request[key]) {
+        if (!definitions || !Object.prototype.hasOwnProperty.call(definitions, prop)) {
+            delete request[key][prop];
+        }
+    }
+}
+async function finishAsync(key, context, request, properties, index, pending) {
+    let error = await pending;
+    if (error) {
+        return error;
+    }
+    for (let i = index + 1; i < properties.length; i++) {
+        const property = properties[i];
+        error = await validateProperty(key, property, context.request[key][property], request);
+        if (error) {
+            return error;
+        }
+    }
+    stripUnknownFields(key, context, request);
+}
+function validateDeclaredProperties(key, context, request) {
+    const definitions = context.request[key];
+    const properties = Object.keys(definitions);
+    for (let i = 0; i < properties.length; i++) {
+        const property = properties[i];
+        const result = validateProperty(key, property, definitions[property], request);
+        if (isThenable(result)) {
+            return finishAsync(key, context, request, properties, i, result);
+        }
+        if (result) {
+            return result;
         }
     }
+    stripUnknownFields(key, context, request);
 }
 //# sourceMappingURL=validate-request-part.js.map

package/dist/helpers/validate/context/validate-request-part.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-request-part.js","sourceRoot":"","sources":["../../../../src/helpers/validate/context/validate-request-part.ts"],"names":[],"mappings":";;AASA,kDA4BC;AAnCD,MAAM,yBAAyB,GAAa;IAC1C,OAAO;IACP,MAAM;CACP,CAAC;AAIF,SAAgB,mBAAmB,CACjC,GAAyB,EACzB,OAAqB,EACrB,OAAY;IAEZ,IAAI,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChD,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;QAChC,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB;QACpC,CAAC;YACC,SAAS;YACT,SAAS;SACV,CAAC,QAAQ,CAAC,GAAG,CAAC,EACf,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,cAAc,GAAY,KAAK,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM;IACR,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,OAAO,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,GAAyB,EACzB,OAAqB,EACrB,OAAY;IAEZ,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAuB,CAAC;QAC/F,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAEhD,IAAI,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC;gBACH,IAAI,KAAK,GAAQ,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAQ,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC5B,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,KAAK,GAAG,WAAW,CAAC;oBACtB,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;gBAC7E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IACE,CAAC;gBACC,SAAS;gBACT,SAAS;aACV,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACf,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAC/F,CAAC;gBACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"validate-request-part.js","sourceRoot":"","sources":["../../../../src/helpers/validate/context/validate-request-part.ts"],"names":[],"mappings":";;AAqBA,kDAqBC;AAxCD,MAAM,yBAAyB,GAAgB,IAAI,GAAG,CAAC;IACrD,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AACH,wEAAwE;AACxE,MAAM,gBAAgB,GAAgB,IAAI,GAAG,CAAC;IAC5C,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAIH,MAAM,MAAM,GAAG,CAAC,MAAW,EAAE,QAAgB,EAAW,EAAE,CACxD,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEpG,SAAS,UAAU,CAAC,KAAU;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;AACzF,CAAC;AAED,SAAgB,mBAAmB,CACjC,GAAyB,EACzB,OAAqB,EACrB,OAAY;IAEZ,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,cAAc,GAAY,KAAK,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM;IACR,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,OAAO;IACT,CAAC;IACD,OAAO,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,GAAyB,EACzB,QAAgB,EAChB,UAA8B,EAC9B,OAAY;IAEZ,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IACrD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAChD,MAAM,IAAI,GAAQ,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAY,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEhD,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,KAAK,GAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,GAAG,GAAqB,EAAE,CAAC,KAAK,CAAC;IAC3C,MAAM,cAAc,GAAG,GAAiD,EAAE;QACxE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAQ,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAM,EAAoB,EAAE;gBACpE,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;IACvC,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAQ,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,0EAA0E;YAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;iBAC5B,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;iBAClD,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAyB,EAAE,OAAqB,EAAE,OAAY;IACxF,IAAI,OAAO,CAAC,OAAO,EAAE,kBAAkB,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAQ,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAQ,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;QACrF,uFAAuF;QACvF,4DAA4D;QAC5D,IAAI,OAAO,GAAY,KAAK,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC7D,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAQ,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAyB,EACzB,OAAqB,EACrB,OAAY,EACZ,UAAoB,EACpB,KAAa,EACb,OAAkC;IAElC,IAAI,KAAK,GAAqB,MAAM,OAAO,CAAC;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,IAAI,CAAC,GAAW,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAW,UAAU,CAAC,CAAC,CAAC,CAAC;QACvC,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAuB,EAAE,OAAO,CAAC,CAAC;QAC7G,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,0BAA0B,CACjC,GAAyB,EACzB,OAAqB,EACrB,OAAY;IAEZ,MAAM,WAAW,GAAQ,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAa,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAW,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAW,UAAU,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAuB,EAAE,OAAO,CAAC,CAAC;QACrG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,MAAmC,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/options/alado-server-options.d.ts

@@ -16,4 +16,6 @@ export type AladoServerOptions = {
     verbose?: boolean;
     appId?: string;
     maxBodySizeBytes?: number;
+    trustProxy?: boolean | number;
+    caseSensitiveRoutes?: boolean;
 };

package/dist/options/request-processor-options.d.ts

@@ -9,4 +9,5 @@ export type RequestProcessorOptions = {
     logger?: AladoServerLogger;
     verbose?: boolean;
     maxBodySizeBytes?: number;
+    trustProxy?: boolean | number;
 };

package/dist/options/router-options.d.ts

@@ -5,4 +5,5 @@ export type RouterOptions = {
     cors: CorsOptions;
     openApiDoc?: OpenApiDoc;
     logger?: AladoServerLogger;
+    caseSensitiveRoutes?: boolean;
 };

package/dist/request-processor/request-processor.d.ts

@@ -2,11 +2,15 @@ import { IncomingMessage, ServerResponse } from 'http';
 import { RequestProcessorOptions } from '../options/index.js';
 import { AladoServerError, Response } from '../dto/index.js';
 /**
- * Maps a request URL to a Swagger UI asset name, or undefined if it is not one.
- * The result is always an exact entry of the swagger-ui-dist listing, so no
- * part of the URL ever reaches the filesystem (no `..`, no subdirectories).
+ * Maps a request path (already through clearRoutePath, query string removed) to a Swagger UI
+ * file name, or undefined if it is not one. Files are only served under the docs route; the docs
+ * page sets <base href="<route>/"> so its relative asset URLs resolve there. Only a docs route of
+ * "/" serves files from the root. The result is always an exact entry of the swagger-ui-dist
+ * listing, so no part of the URL ever reaches the filesystem (no `..`, no subdirectories).
  */
-export declare function resolveSwaggerUiFile(url: string, docsRoute: string): string | undefined;
+export declare function resolveSwaggerUiFile(pathname: string, docsRoute: string): string | undefined;
+/** Swagger UI's index.html, with a <base> so its relative asset URLs stay under the docs route. */
+export declare function swaggerIndexHtml(html: string, docsRoute: string): string;
 /**
  * Errors that carry an HTTP status (thrown on purpose, e.g. `{ statusCode: 404,
  * message }`, or produced by the body parser) keep their status and message.
@@ -14,11 +18,17 @@ export declare function resolveSwaggerUiFile(url: string, docsRoute: string): st
  * details only go to the logger.
  */
 export declare function toClientError(e: any): AladoServerError;
+export declare function clientIp(req: IncomingMessage, trustProxy?: boolean | number): string;
 export declare class RequestProcessor {
     private readonly options;
+    private swaggerIndex;
+    private swaggerInitializer;
+    private corsStatic?;
+    private corsMethods;
     constructor(requestProcessorOptions: RequestProcessorOptions);
     protected respond(res: ServerResponse, response: Response<any>, backgroundHeaders?: Record<string, string>): void;
     protected respondError(res: ServerResponse, error: AladoServerError, headers?: Record<string, string>): void;
     process(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    protected corsHeaders(allowedMethods: string[] | undefined, origin: string): Record<string, string>;
     protected logError(e: Error): void;
 }