asljs-server 0.2.0 → 0.2.1

package/README.md

@@ -26,10 +26,11 @@ Or without installing:
   - `asljs-server --port 8080`
   - `asljs-server --host 0.0.0.0 --port 8080`
 
-## JSON API
+## File API
 
-- `GET /api/json?file=name[.json]` returns the JSON file
-- `PUT|POST /api/json?file=name[.json]` writes JSON (pretty-printed)
+- `GET /api/file?path=path` returns the file contents
+- `PUT|POST /api/file?path=path` writes the file
+- `GET /api/files?path=path` lists all files in the directory
 
 ## Live reload
 

package/cli.js

@@ -1,3 +1,3 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 import './dist/cli.js';

package/dist/server.js

@@ -20,6 +20,36 @@ const safeJsonName = (name) => typeof name === 'string'
     && /^[a-zA-Z0-9._/-]+$/.test(name)
     ? name
     : null;
+const safeRelativeApiPath = (value, { allowEmpty = false } = {}) => {
+    if (value === null
+        || value === undefined) {
+        return allowEmpty
+            ? ''
+            : null;
+    }
+    if (typeof value !== 'string')
+        return null;
+    if (value === '')
+        return allowEmpty
+            ? ''
+            : null;
+    if (!/^[a-zA-Z0-9._/-]+$/.test(value))
+        return null;
+    // Force URL-style separators.
+    if (value.includes('\\'))
+        return null;
+    if (value.startsWith('/'))
+        return null;
+    const parts = value.split('/');
+    for (const part of parts) {
+        if (!part
+            || part === '.'
+            || part === '..') {
+            return null;
+        }
+    }
+    return value;
+};
 function readBody(request, limit) {
     return new Promise((resolve, reject) => {
         let size = 0;
@@ -76,50 +106,47 @@ export function startServer({ root = '.', port = 3000, host = 'localhost', logge
         }, 50);
     };
     watchStaticTree(FILES_DIR, () => broadcastReload());
-    // ---------- JSON API helpers
-    const jsonFilePath = (name) => {
-        const base = safeJsonName(name);
-        if (!base)
-            return null;
-        const file = base.endsWith('.json')
-            ? base
-            : (base + '.json');
-        const full = path.join(FILES_DIR, file);
+    // ---------- File API helpers
+    const fileApiPath = (relativePath) => {
+        const full = path.join(FILES_DIR, relativePath);
         return isPathInside(full, FILES_DIR)
             ? full
             : null;
     };
-    async function handleJsonApi(request, response, url) {
+    async function handleFileApi(request, response, url) {
         await fsp.mkdir(FILES_DIR, { recursive: true });
-        const name = url.searchParams.get('file');
-        const file = jsonFilePath(name);
-        if (!file) {
-            return send.badRequest(response, 'Invalid "file" name. Allowed: [a-zA-Z0-9._-] and optional .json');
+        const relativePath = safeRelativeApiPath(url.searchParams.get('path'));
+        if (!relativePath) {
+            return send.badRequest(response, 'Invalid "path". Use a relative path with URL-style separators.');
+        }
+        const filePath = fileApiPath(relativePath);
+        if (!filePath) {
+            return send.forbidden(response);
         }
         if (request.method === 'GET') {
-            try {
-                return send.json(response, 200, await fsp.readFile(file, 'utf8'));
-            }
-            catch (e) {
-                if (e && typeof e === 'object' && 'code' in e && e.code === 'ENOENT')
-                    return send.notFound(response, 'JSON file not found');
-                throw e;
-            }
+            return send.file(response, filePath);
         }
         if (request.method === 'PUT'
             || request.method === 'POST') {
             try {
                 // 1MB limit
                 const body = await readBody(request, 1000000);
-                let parsed;
-                try {
-                    parsed = JSON.parse(body);
+                await fsp.mkdir(path.dirname(filePath), { recursive: true });
+                // Preserve the old behavior for JSON files.
+                if (path.extname(filePath).toLowerCase() === '.json') {
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(body);
+                    }
+                    catch {
+                        return send.badRequest(response, 'Invalid JSON');
+                    }
+                    await fsp.writeFile(filePath, JSON.stringify(parsed, null, 2) + '\n', 'utf8');
                 }
-                catch {
-                    return send.badRequest(response, 'Invalid JSON');
+                else {
+                    await fsp.writeFile(filePath, body, 'utf8');
                 }
-                await fsp.writeFile(file, JSON.stringify(parsed, null, 2) + '\n', 'utf8');
-                return send.api(response, { file: path.basename(file) });
+                return send.api(response, { path: relativePath });
             }
             catch (error) {
                 return send.apiError(response, error);
@@ -127,15 +154,60 @@ export function startServer({ root = '.', port = 3000, host = 'localhost', logge
         }
         return send.methodNotAllowed(response, 'GET, PUT, POST');
     }
+    async function handleFilesApi(request, response, url) {
+        if (request.method !== 'GET') {
+            return send.methodNotAllowed(response, 'GET');
+        }
+        await fsp.mkdir(FILES_DIR, { recursive: true });
+        const relativePath = safeRelativeApiPath(url.searchParams.get('path'), { allowEmpty: true });
+        if (relativePath === null) {
+            return send.badRequest(response, 'Invalid "path". Use a relative directory path.');
+        }
+        const directoryPath = fileApiPath(relativePath);
+        if (!directoryPath) {
+            return send.forbidden(response);
+        }
+        try {
+            const stat = await fsp.stat(directoryPath);
+            if (!stat.isDirectory()) {
+                return send.badRequest(response, '"path" must point to a directory');
+            }
+        }
+        catch (error) {
+            if (error
+                && typeof error === 'object'
+                && 'code' in error
+                && error.code === 'ENOENT') {
+                return send.notFound(response, 'Directory not found');
+            }
+            return send.error(response, error);
+        }
+        try {
+            const entries = await fsp.readdir(directoryPath, { withFileTypes: true });
+            const files = entries
+                .filter(e => e.isFile())
+                .map(e => e.name)
+                .sort((a, b) => a.localeCompare(b));
+            return send.api(response, { path: relativePath,
+                files });
+        }
+        catch (error) {
+            return send.apiError(response, error);
+        }
+    }
     async function serveStatic(request, response, url) {
         const pathname = decodeURIComponent(url.pathname);
         // SSE endpoint
         if (pathname === '/__events') {
             return serveSSE(request, response);
         }
-        // JSON API: /api/json?file=name[.json]
-        if (pathname === '/api/json') {
-            return handleJsonApi(request, response, url);
+        // File API: /api/file?path=relative/path.ext
+        if (pathname === '/api/file') {
+            return handleFileApi(request, response, url);
+        }
+        // Directory listing API: /api/files?path=relative/dir
+        if (pathname === '/api/files') {
+            return handleFilesApi(request, response, url);
         }
         // Resolve file path
         let filePath = path.normalize(path.join(FILES_DIR, pathname));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "asljs-server",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "A lightweight development-time static files server. Supports live-reload. Provides filesystem read-write API.",
   "type": "module",
   "main": "server.js",