alepha 0.14.2 → 0.14.4

package/src/server/cache/providers/ServerCacheProvider.ts

@@ -261,24 +261,55 @@ export class ServerCacheProvider {
         return;
       }
 
-      // Only process string responses (text, html, json, etc.)
-      // Buffer is not supported by alepha/cache for now
-      if (typeof response.body !== "string") {
-        return;
-      }
-
       // Don't cache error responses (status >= 400)
       if (response.status && response.status >= 400) {
         return;
       }
 
+      // Initialize headers if not present
+      response.headers ??= {};
+
       const key = this.createCacheKey(route, request);
+
+      // Handle ReadableStream responses (e.g., SSR streaming)
+      if (response.body instanceof ReadableStream && shouldStore) {
+        // Tee the stream: one for client, one for cache collection
+        const [clientStream, cacheStream] = (
+          response.body as ReadableStream<Uint8Array>
+        ).tee();
+
+        // Replace response body with client stream (continues streaming to client)
+        response.body = clientStream as typeof response.body;
+
+        // Collect cache stream in background (non-blocking)
+        this.collectStreamForCache(
+          cacheStream,
+          key,
+          response.status,
+          response.headers?.["content-type"],
+          shouldUseEtag,
+        )
+          .then((hash) => {
+            if (shouldUseEtag && hash) {
+              // Note: headers already sent for streaming, etag only useful for future requests
+              this.log.trace("Stream cached with hash", { key, hash });
+            }
+          })
+          .catch((err) => {
+            this.log.warn("Failed to cache stream", { key, error: err });
+          });
+
+        return;
+      }
+
+      // Only process string responses (text, html, json, etc.)
+      if (typeof response.body !== "string") {
+        return;
+      }
+
       const generatedEtag = this.generateETag(response.body);
       const lastModified = this.time.toISOString();
 
-      // Initialize headers if not present
-      response.headers ??= {};
-
       // Store response if storing is enabled
       if (shouldStore) {
         this.log.trace("Storing response", {
@@ -404,6 +435,60 @@ export class ServerCacheProvider {
 
     return `${route.method}:${route.path.replaceAll(":", "")}:${params.join(",").replaceAll(":", "")}`;
   }
+
+  /**
+   * Collect a ReadableStream into a string and store it in the cache.
+   * This runs in the background while the original stream is sent to the client.
+   *
+   * @param stream - The stream to collect
+   * @param key - Cache key
+   * @param status - HTTP status code
+   * @param contentType - Content-Type header
+   * @param generateEtag - Whether to generate and return an ETag
+   * @returns The generated ETag hash, or undefined
+   */
+  protected async collectStreamForCache(
+    stream: ReadableStream<Uint8Array>,
+    key: string,
+    status: number | undefined,
+    contentType: string | undefined,
+    generateEtag: boolean,
+  ): Promise<string | undefined> {
+    const chunks: Uint8Array[] = [];
+    const reader = stream.getReader();
+
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        chunks.push(value);
+      }
+
+      // Combine chunks into a single string
+      const decoder = new TextDecoder();
+      const body =
+        chunks
+          .map((chunk) => decoder.decode(chunk, { stream: true }))
+          .join("") + decoder.decode(); // Flush remaining
+
+      const hash = this.generateETag(body);
+      const lastModified = this.time.toISOString();
+
+      this.log.trace("Storing streamed response", { key });
+
+      await this.cache.set(key, {
+        body,
+        status,
+        contentType,
+        lastModified,
+        hash,
+      });
+
+      return generateEtag ? hash : undefined;
+    } finally {
+      reader.releaseLock();
+    }
+  }
 }
 
 export type ServerRouteCache =

package/src/server/compress/providers/ServerCompressProvider.spec.ts

@@ -0,0 +1,31 @@
+import { Alepha } from "alepha";
+import { $action, ServerProvider } from "alepha/server";
+import { describe, it } from "vitest";
+import { AlephaServerCompress } from "../index.ts";
+
+class App {
+  hello = $action({
+    handler: () => "Hello, world!",
+  });
+}
+
+const a1 = Alepha.create().with(App).with(AlephaServerCompress);
+const a2 = Alepha.create().with(App);
+
+describe("ServerCompressProvider", () => {
+  it("should compress responses when enabled", async ({ expect }) => {
+    const serv1 = a1.inject(ServerProvider);
+    const serv2 = a2.inject(ServerProvider);
+
+    const resp1 = await fetch(`${serv1.hostname}/api/hello`, {
+      headers: { "Accept-Encoding": "gzip" },
+    });
+
+    const resp2 = await fetch(`${serv2.hostname}/api/hello`, {
+      headers: { "Accept-Encoding": "gzip" },
+    });
+
+    expect(resp1.headers.get("content-encoding")).toBe("gzip");
+    expect(resp2.headers.get("content-encoding")).toBeNull();
+  });
+});

package/src/server/compress/providers/ServerCompressProvider.ts

@@ -125,21 +125,82 @@ export class ServerCompressProvider {
       this.setHeaders(response, encoding);
       response.headers["content-length"] = compressed.length.toString();
       response.body = compressed;
+      return;
     }
 
     if (typeof body === "object" && body instanceof Readable) {
       this.setHeaders(response, encoding);
       response.body = body.pipe(compressor.stream({ params }));
+      return;
     }
 
     if (typeof body === "object" && body instanceof ReadableStream) {
       this.setHeaders(response, encoding);
-      response.body = Readable.fromWeb(body).pipe(
-        compressor.stream({ params }),
+      // For streaming responses, use flush mode to avoid buffering
+      response.body = this.createFlushingCompressStream(
+        body,
+        compressor.stream,
+        encoding,
+        params,
       );
     }
   }
 
+  /**
+   * Create a compressed stream that flushes after each chunk.
+   * This is essential for streaming SSR - ensures each chunk is sent immediately.
+   */
+  protected createFlushingCompressStream(
+    input: ReadableStream,
+    createCompressor: (options?: any) => Transform,
+    encoding: string,
+    params: Record<number, any>,
+  ): ReadableStream<Uint8Array> {
+    const compressor = createCompressor({
+      params,
+      flush: zlib.constants.Z_SYNC_FLUSH,
+    });
+    const reader = Readable.fromWeb(input);
+
+    return new ReadableStream<Uint8Array>({
+      start(controller) {
+        compressor.on("data", (chunk: Buffer) => {
+          controller.enqueue(new Uint8Array(chunk));
+        });
+
+        compressor.on("end", () => {
+          controller.close();
+        });
+
+        compressor.on("error", (err) => {
+          controller.error(err);
+        });
+
+        reader.on("data", (chunk: Buffer) => {
+          compressor.write(chunk);
+          // Force flush after each chunk for streaming
+          // Cast to any because flush() exists on zlib streams but not in Transform type
+          const zlibStream = compressor as any;
+          if (encoding === "gzip") {
+            zlibStream.flush(zlib.constants.Z_SYNC_FLUSH);
+          } else if (encoding === "br") {
+            zlibStream.flush(zlib.constants.BROTLI_OPERATION_FLUSH);
+          } else if (encoding === "zstd") {
+            zlibStream.flush();
+          }
+        });
+
+        reader.on("end", () => {
+          compressor.end();
+        });
+
+        reader.on("error", (err) => {
+          controller.error(err);
+        });
+      },
+    });
+  }
+
   protected getParams(
     encoding: keyof typeof ServerCompressProvider.compressors,
   ): Record<number, any> {

package/src/server/cookies/providers/ServerCookiesProvider.spec.ts

@@ -0,0 +1,253 @@
+import { Alepha, t } from "alepha";
+import { $action, AlephaServer } from "alepha/server";
+import { describe, expect, test } from "vitest";
+import { $cookie, AlephaServerCookies } from "../index.ts";
+
+// A strong, 32-character secret for testing purposes
+const TEST_COOKIE_SECRET = "DCf6DvpLAfwy8XdPRucMO4tPS6dVCHob";
+
+// --- Test Application Setup ---
+
+class CookieTestApp {
+  // 1. Basic Cookie
+  session = $cookie({
+    name: "session",
+    schema: t.object({ userId: t.number(), role: t.text() }),
+  });
+
+  // 2. Signed Cookie
+  signed = $cookie({
+    name: "signed_session",
+    schema: t.text(),
+    sign: true,
+  });
+
+  // 3. Encrypted Cookie
+  encrypted = $cookie({
+    name: "encrypted_secret",
+    schema: t.object({ apiKey: t.text() }),
+    encrypt: true,
+  });
+
+  // 4. Compressed, Signed, and Encrypted Cookie with TTL
+  secure_all = $cookie({
+    name: "ultra_secure",
+    schema: t.object({ data: t.text() }),
+    compress: true,
+    sign: true,
+    encrypt: true,
+    ttl: [1, "hour"],
+  });
+
+  // An action to test the cookie functionality in a request cycle
+  cookie_test = $action({
+    schema: {
+      response: t.object({
+        incomingSession: t.optional(this.session.options.schema),
+        reqCookies: t.object({
+          req: t.record(t.text(), t.text()),
+          res: t.record(t.text(), t.any()),
+        }),
+      }),
+    },
+    handler: ({ cookies }) => {
+      // Set some cookies
+      this.session.set({ userId: 123, role: "admin" });
+      this.signed.set("i-am-signed");
+      this.encrypted.set({ apiKey: "secret-key" });
+      this.secure_all.set({ data: "super sensitive data" });
+
+      // Read a cookie from the request
+      const incomingSession = this.session.get({ cookies });
+
+      // Delete a cookie
+      if (incomingSession?.role === "guest") {
+        this.signed.del();
+      }
+
+      return { incomingSession, reqCookies: cookies };
+    },
+  });
+}
+
+const alepha = Alepha.create({
+  env: {
+    COOKIE_SECRET: TEST_COOKIE_SECRET,
+  },
+})
+  .with(AlephaServer)
+  .with(AlephaServerCookies);
+
+const app = alepha.inject(CookieTestApp);
+
+// Helper to simulate a request and capture the response headers
+const makeRequest = async (incomingCookieHeader = "") => {
+  const response = await app.cookie_test.fetch(
+    {},
+    {
+      request: { headers: { cookie: incomingCookieHeader } },
+    },
+  );
+  return {
+    data: response.data,
+    // The fetch client in tests might not handle multiple headers the same way a browser does.
+    // We get the raw header to properly check it.
+    setCookieHeader: response.raw?.headers.get("set-cookie"),
+  };
+};
+
+describe("ServerCookiesProvider", () => {
+  test("should set and get a basic cookie", async () => {
+    const { data, setCookieHeader } = await makeRequest();
+
+    // The handler receives no initial cookie
+    expect(data.incomingSession).toBeUndefined();
+
+    // Check if the response sets the cookie correctly
+    expect(setCookieHeader).toBeDefined();
+    const decodedValue = JSON.parse(
+      decodeURIComponent(setCookieHeader!.match(/session=([^;]*)/)![1]),
+    );
+    expect(decodedValue).toEqual({ userId: 123, role: "admin" });
+  });
+
+  test("should correctly read an incoming cookie", async () => {
+    const sessionData = { userId: 456, role: "user" };
+    const cookieHeader = `session=${encodeURIComponent(JSON.stringify(sessionData))}`;
+
+    const { data } = await makeRequest(cookieHeader);
+
+    // The handler should have received and parsed the cookie
+    expect(data.incomingSession).toEqual(sessionData);
+  });
+
+  test("should set and get a signed cookie", async () => {
+    const { setCookieHeader } = await makeRequest();
+    const signedCookie = setCookieHeader!.match(/signed_session=([^;]*)/)![1];
+
+    // Make a new request with the signed cookie
+    const { data } = await makeRequest(`signed_session=${signedCookie}`);
+
+    // The `get` method should successfully validate the signature and return the value
+    expect(app.signed.get({ cookies: data.reqCookies })).toBe("i-am-signed");
+  });
+
+  test("should reject a tampered signed cookie", async () => {
+    const { setCookieHeader } = await makeRequest();
+    let tamperedCookie = setCookieHeader!.match(/signed_session=([^;]*)/)![1];
+    tamperedCookie += "tampered"; // alter the cookie value
+
+    const { data } = await makeRequest(`signed_session=${tamperedCookie}`);
+
+    // The get should fail and return undefined
+    expect(app.signed.get({ cookies: data.reqCookies })).toBeUndefined();
+  });
+
+  test("should set and get an encrypted cookie", async () => {
+    const { setCookieHeader } = await makeRequest();
+    const encryptedCookie = setCookieHeader!.match(
+      /encrypted_secret=([^;]*)/,
+    )![1];
+
+    // The value should not be plain text
+    expect(decodeURIComponent(encryptedCookie)).not.toContain("secret-key");
+
+    const { data } = await makeRequest(`encrypted_secret=${encryptedCookie}`);
+
+    expect(app.encrypted.get({ cookies: data.reqCookies })).toEqual({
+      apiKey: "secret-key",
+    });
+  });
+
+  test("should reject a tampered encrypted cookie", async () => {
+    const { setCookieHeader } = await makeRequest();
+    const tamperedCookie = setCookieHeader!.match(
+      /encrypted_secret=([^;]*)/,
+    )![1];
+
+    const { data } = await makeRequest(
+      `encrypted_secret=aa${tamperedCookie}aa`,
+    );
+
+    // The get should fail (throw internally) and return undefined
+    expect(app.encrypted.get({ cookies: data.reqCookies })).toBeUndefined();
+  });
+
+  test("should handle a combination of compress, sign, and encrypt", async () => {
+    const { setCookieHeader } = await makeRequest();
+    const secureCookie = setCookieHeader!.match(/ultra_secure=([^;]*)/)![1];
+
+    const { data } = await makeRequest(`ultra_secure=${secureCookie}`);
+
+    expect(app.secure_all.get({ cookies: data.reqCookies })).toEqual({
+      data: "super sensitive data",
+    });
+  });
+
+  test("should delete a cookie", async () => {
+    const sessionData = { userId: 789, role: "guest" };
+    const cookieHeader = `session=${encodeURIComponent(JSON.stringify(sessionData))}`;
+
+    const { setCookieHeader } = await makeRequest(cookieHeader);
+
+    // The handler should detect role === 'guest' and delete the signed cookie
+    expect(setCookieHeader).toContain("signed_session=; Path=/; Max-Age=0");
+  });
+
+  test("should serialize all cookie attributes correctly", async () => {
+    class AttrApp {
+      advanced = $cookie({
+        name: "advanced",
+        schema: t.text(),
+        path: "/admin",
+        ttl: [30, "minutes"],
+        httpOnly: true,
+        secure: true,
+        sameSite: "strict",
+        domain: "example.com",
+      });
+      test = $action({
+        handler: () => {
+          this.advanced.set("value");
+        },
+      });
+    }
+
+    const attrAlepha = Alepha.create({
+      env: { COOKIE_SECRET: TEST_COOKIE_SECRET },
+    })
+      .with(AlephaServer)
+      .with(AlephaServerCookies)
+      .with(AttrApp);
+
+    await attrAlepha.start();
+
+    const response = await attrAlepha.inject(AttrApp).test.fetch();
+    const setCookieHeader = response.headers.get("set-cookie");
+    expect(setCookieHeader).toContain("Max-Age=1800");
+    expect(setCookieHeader).toContain("Path=/admin");
+    expect(setCookieHeader).toContain("HttpOnly");
+    expect(setCookieHeader).toContain("SameSite=strict");
+    expect(setCookieHeader).toContain("Domain=example.com");
+    // Secure flag is not added in tests unless protocol is https, which is handled by the provider
+  });
+
+  // test("should throw if secret is missing for secure cookies", async () => {
+  // 	class AppWithMissingSecret {
+  // 		badCookie = $cookie({
+  // 			name: "bad",
+  // 			schema: t.text(),
+  // 			sign: true,
+  // 		});
+  // 	}
+  //
+  // 	const alephaWithoutSecret = Alepha.create()
+  // 		.with(AlephaServer)
+  // 		.with(AlephaServerCookies)
+  // 		.with(AppWithMissingSecret);
+  //
+  // 	await expect(() => alephaWithoutSecret.start()).rejects.toThrow(
+  // 		/COOKIE_SECRET environment variable is not set/,
+  // 	);
+  // });
+});