axiodb 22.17.1 → 22.19.1

package/lib/server/config/server.js

@@ -14,9 +14,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = createAxioDBControlServer;
 const fastify_1 = __importDefault(require("fastify"));
-const cors_1 = __importDefault(require("@fastify/cors"));
-const static_1 = __importDefault(require("@fastify/static"));
-const cookie_1 = __importDefault(require("@fastify/cookie"));
+const Cors_utils_1 = __importDefault(require("../../utility/Cors.utils"));
+const StaticFile_utils_1 = __importDefault(require("../../utility/StaticFile.utils"));
+const Cookie_utils_1 = require("../../utility/Cookie.utils");
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 const keys_1 = require("./keys");
@@ -44,17 +44,10 @@ function createAxioDBControlServer(AxioDBInstance_1) {
                 });
             }
         }));
-        yield AxioDBControlServer.register(cors_1.default, {
-            origin: keys_1.CORS_CONFIG.ORIGIN,
-            methods: keys_1.CORS_CONFIG.METHODS,
-            allowedHeaders: keys_1.CORS_CONFIG.ALLOWED_HEADERS,
-            credentials: keys_1.CORS_CONFIG.ALLOW_CREDENTIALS,
-            exposedHeaders: keys_1.CORS_CONFIG.EXPOSED_HEADERS,
-            maxAge: keys_1.CORS_CONFIG.MAX_AGE, // preflight cache duration
-        });
+        (0, Cors_utils_1.default)(AxioDBControlServer);
         // Cookie support for session-based authentication (no signing secret needed -
         // the cookie value is meaningless without a matching entry in SessionStore's map)
-        yield AxioDBControlServer.register(cookie_1.default);
+        (0, Cookie_utils_1.registerCookies)(AxioDBControlServer);
         AxioDBControlServer.addHook("onSend", (_request, reply) => __awaiter(this, void 0, void 0, function* () {
             for (const [header, value] of Object.entries(keys_1.SECURITY_HEADERS)) {
                 reply.header(header, value);
@@ -70,11 +63,7 @@ function createAxioDBControlServer(AxioDBInstance_1) {
             }
         });
         if (guiEnabled) {
-            yield AxioDBControlServer.register(static_1.default, {
-                root: keys_1.staticPath,
-                prefix: "/",
-                decorateReply: false,
-            });
+            (0, StaticFile_utils_1.default)(AxioDBControlServer, { root: keys_1.staticPath });
             AxioDBControlServer.get("/", (request, reply) => __awaiter(this, void 0, void 0, function* () {
                 const indexPath = path_1.default.join(keys_1.staticPath, "index.html");
                 const stream = fs_1.default.createReadStream(indexPath);

package/lib/utility/Cookie.utils.d.ts

@@ -0,0 +1,34 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+export interface CookieSerializeOptions {
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    expires?: Date;
+    httpOnly?: boolean;
+    secure?: boolean | "auto";
+    sameSite?: "lax" | "strict" | "none" | boolean;
+}
+export declare function parseCookieHeader(header: string): Record<string, string>;
+export declare function serializeCookie(name: string, value: string, options?: CookieSerializeOptions): string;
+declare module "fastify" {
+    interface FastifyRequest {
+        cookies: Record<string, string>;
+    }
+    interface FastifyReply {
+        setCookie(name: string, value: string, options?: CookieSerializeOptions): FastifyReply;
+        clearCookie(name: string, options?: Pick<CookieSerializeOptions, "path" | "domain">): FastifyReply;
+    }
+}
+/**
+ * Populates `request.cookies` and attaches the `setCookie` / `clearCookie`
+ * helpers to each reply.
+ *
+ * The reply helpers are assigned per-request rather than through `decorate`:
+ * a Fastify decorator lands on the instance, not on every reply object, so
+ * `reply.setCookie` would be undefined in route handlers.
+ */
+export declare function registerCookies(fastify: FastifyInstanceLike): void;
+interface FastifyInstanceLike {
+    addHook(name: string, hook: (request: FastifyRequest, reply: FastifyReply, done: (err?: Error) => void) => void): void;
+}
+export {};

package/lib/utility/Cookie.utils.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCookieHeader = parseCookieHeader;
+exports.serializeCookie = serializeCookie;
+exports.registerCookies = registerCookies;
+/**
+ * Cookie support for the control server.
+ *
+ * Sessions are server-side: the cookie carries only a `sid` that must match an
+ * entry in `SessionStore`, so the value itself needs no integrity protection.
+ * What this has to get right is correct parsing - a mis-split cookie would
+ * silently drop a valid session or authenticate the wrong one.
+ */
+const COOKIE_PAIR = /; */;
+function decode(value) {
+    if (!value.includes("%") && !value.includes("+")) {
+        return value;
+    }
+    try {
+        return decodeURIComponent(value);
+    }
+    catch (_a) {
+        // A malformed escape must not fail the whole request - hand back the raw
+        // value so it simply misses the session lookup instead.
+        return value;
+    }
+}
+function parseCookieHeader(header) {
+    const result = {};
+    for (const pair of header.split(COOKIE_PAIR)) {
+        const index = pair.indexOf("=");
+        if (index < 0) {
+            continue;
+        }
+        const name = pair.slice(0, index).trim();
+        // First occurrence wins, matching how browsers and the plugin behave.
+        if (name.length === 0 || name in result) {
+            continue;
+        }
+        result[name] = decode(pair.slice(index + 1).trim());
+    }
+    return result;
+}
+function serializeCookie(name, value, options = {}) {
+    var _a;
+    let cookie = `${name}=${encodeURIComponent(value)}`;
+    if (options.maxAge !== undefined) {
+        cookie += `; Max-Age=${Math.floor(options.maxAge)}`;
+    }
+    if (options.domain) {
+        cookie += `; Domain=${options.domain}`;
+    }
+    cookie += `; Path=${(_a = options.path) !== null && _a !== void 0 ? _a : "/"}`;
+    if (options.expires) {
+        cookie += `; Expires=${options.expires.toUTCString()}`;
+    }
+    if (options.httpOnly) {
+        cookie += "; HttpOnly";
+    }
+    if (options.secure) {
+        cookie += "; Secure";
+    }
+    if (options.sameSite && options.sameSite !== true) {
+        const mode = String(options.sameSite);
+        cookie += `; SameSite=${mode.charAt(0).toUpperCase()}${mode.slice(1)}`;
+    }
+    return cookie;
+}
+/**
+ * Populates `request.cookies` and attaches the `setCookie` / `clearCookie`
+ * helpers to each reply.
+ *
+ * The reply helpers are assigned per-request rather than through `decorate`:
+ * a Fastify decorator lands on the instance, not on every reply object, so
+ * `reply.setCookie` would be undefined in route handlers.
+ */
+function registerCookies(fastify) {
+    fastify.addHook("onRequest", (request, reply, done) => {
+        const header = request.headers.cookie;
+        request.cookies = header ? parseCookieHeader(header) : {};
+        reply.setCookie = (name, value, options = {}) => {
+            // "auto" follows the connection, so a plain-HTTP dev server still receives a
+            // usable cookie while any TLS-terminated deployment gets the secure flag.
+            const secure = options.secure === "auto" ? request.protocol === "https" : options.secure;
+            reply.header("Set-Cookie", serializeCookie(name, value, Object.assign(Object.assign({}, options), { secure })));
+            return reply;
+        };
+        reply.clearCookie = (name, options = {}) => {
+            reply.header("Set-Cookie", serializeCookie(name, "", Object.assign(Object.assign({}, options), { maxAge: 0, expires: new Date(0) })));
+            return reply;
+        };
+        done();
+    });
+}

package/lib/utility/Cors.utils.d.ts

@@ -0,0 +1,13 @@
+import type { FastifyInstance } from "fastify";
+/**
+ * CORS for the control server, written against the same `CORS_CONFIG` the
+ * `@fastify/cors` plugin used.
+ *
+ * Two behaviours are deliberate:
+ *  - The origin is echoed back verbatim, never `*`. Browsers reject a wildcard
+ *    on a credentialed (cookie-bearing) request, and the GUI's session cookie is
+ *    exactly that.
+ *  - `Vary: Origin` is always sent, so a shared cache cannot serve one origin's
+ *    response to another.
+ */
+export default function registerCors(fastify: FastifyInstance): void;

package/lib/utility/Cors.utils.js

@@ -0,0 +1,47 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = registerCors;
+const keys_1 = require("../server/config/keys");
+/**
+ * CORS for the control server, written against the same `CORS_CONFIG` the
+ * `@fastify/cors` plugin used.
+ *
+ * Two behaviours are deliberate:
+ *  - The origin is echoed back verbatim, never `*`. Browsers reject a wildcard
+ *    on a credentialed (cookie-bearing) request, and the GUI's session cookie is
+ *    exactly that.
+ *  - `Vary: Origin` is always sent, so a shared cache cannot serve one origin's
+ *    response to another.
+ */
+function registerCors(fastify) {
+    fastify.addHook("onRequest", (request, reply) => __awaiter(this, void 0, void 0, function* () {
+        const origin = request.headers.origin;
+        if (origin && keys_1.CORS_CONFIG.ORIGIN.includes(origin)) {
+            reply.header("Access-Control-Allow-Origin", origin);
+            reply.header("Access-Control-Allow-Credentials", String(keys_1.CORS_CONFIG.ALLOW_CREDENTIALS));
+            reply.header("Access-Control-Expose-Headers", keys_1.CORS_CONFIG.EXPOSED_HEADERS.join(", "));
+        }
+        reply.header("Vary", "Origin");
+        if (request.method !== "OPTIONS") {
+            return;
+        }
+        // Echo back what the browser asked for; falling back to our list would
+        // reject a legitimate request carrying an extra standard header.
+        const requested = request.headers["access-control-request-headers"];
+        reply.header("Access-Control-Allow-Headers", requested !== null && requested !== void 0 ? requested : keys_1.CORS_CONFIG.ALLOWED_HEADERS.join(", "));
+        reply.header("Access-Control-Allow-Methods", keys_1.CORS_CONFIG.METHODS.join(", "));
+        reply.header("Access-Control-Max-Age", String(keys_1.CORS_CONFIG.MAX_AGE));
+        // A preflight never reaches a route, so answer it here rather than needing
+        // a throwaway OPTIONS handler on every router.
+        yield reply.code(204).send();
+    }));
+}

package/lib/utility/StaticFile.utils.d.ts

@@ -0,0 +1,15 @@
+import type { FastifyInstance } from "fastify";
+/**
+ * Maps a URL path to a file inside `root`, or returns null when the result would
+ * escape it. Any traversal sequence resolves outside `root` and is rejected here.
+ */
+export declare function resolveWithinRoot(root: string, urlPath: string): string | null;
+export interface StaticOptions {
+    root: string;
+}
+/**
+ * Serves files from `root` for GET/HEAD requests that no route has claimed.
+ * Registered as an `onRequest` hook rather than a wildcard route so it composes
+ * with the existing router instead of competing with it.
+ */
+export default function registerStatic(fastify: FastifyInstance, options: StaticOptions): void;

package/lib/utility/StaticFile.utils.js

@@ -0,0 +1,113 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWithinRoot = resolveWithinRoot;
+exports.default = registerStatic;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Static file serving for the control server.
+ *
+ * The job was never just "read a file" - it was mapping a request path to a file
+ * inside a fixed root without ever escaping it. That containment is the part
+ * worth keeping explicit, so it is written out here rather than left implicit:
+ * every candidate path is resolved and compared against the root, and the
+ * `onRequest` dot-dot guard in `config/server.ts` is a second layer in front.
+ */
+const MIME_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".webp": "image/webp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+    ".eot": "application/vnd.ms-fontobject",
+    ".map": "application/json; charset=utf-8",
+    ".txt": "text/plain; charset=utf-8",
+    ".wasm": "application/wasm",
+};
+function contentTypeFor(filePath) {
+    var _a;
+    return (_a = MIME_TYPES[path_1.default.extname(filePath).toLowerCase()]) !== null && _a !== void 0 ? _a : "application/octet-stream";
+}
+/**
+ * Maps a URL path to a file inside `root`, or returns null when the result would
+ * escape it. Any traversal sequence resolves outside `root` and is rejected here.
+ */
+function resolveWithinRoot(root, urlPath) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(urlPath);
+    }
+    catch (_a) {
+        return null;
+    }
+    const candidate = path_1.default.resolve(root, `.${path_1.default.posix.normalize(`/${decoded}`)}`);
+    const rootWithSep = root.endsWith(path_1.default.sep) ? root : root + path_1.default.sep;
+    if (candidate !== root && !candidate.startsWith(rootWithSep)) {
+        return null;
+    }
+    return candidate;
+}
+/**
+ * Serves files from `root` for GET/HEAD requests that no route has claimed.
+ * Registered as an `onRequest` hook rather than a wildcard route so it composes
+ * with the existing router instead of competing with it.
+ */
+function registerStatic(fastify, options) {
+    const root = path_1.default.resolve(options.root);
+    fastify.addHook("onRequest", (request, reply) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (request.method !== "GET" && request.method !== "HEAD") {
+            return;
+        }
+        // A reply already sent means a route or an earlier hook claimed the request.
+        if (reply.sent) {
+            return;
+        }
+        const urlPath = ((_a = request.raw.url) !== null && _a !== void 0 ? _a : "/").split("?", 1)[0];
+        const target = resolveWithinRoot(root, urlPath);
+        if (target === null) {
+            return;
+        }
+        let stats;
+        try {
+            stats = yield fs_1.default.promises.stat(target);
+        }
+        catch (_b) {
+            return;
+        }
+        // Directories fall through so the app can serve its own index route.
+        if (!stats.isFile()) {
+            return;
+        }
+        const type = contentTypeFor(target);
+        reply.header("Content-Type", type);
+        reply.header("Content-Length", String(stats.size));
+        if (request.method === "HEAD") {
+            yield reply.code(200).send();
+            return;
+        }
+        yield reply.type(type).send(fs_1.default.createReadStream(target));
+    }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axiodb",
-  "version": "22.17.1",
+  "version": "22.19.1",
   "description": "The embedded database for Node.js. Replaces SQLite, LowDB, NeDB & raw JSON files with MongoDB-style queries, ACID transactions, zero native dependencies, and built-in InMemoryCache. No compilation, no platform issues. Perfect for desktop apps, CLI tools, and embedded systems.",
   "main": "./lib/config/DB.js",
   "types": "./lib/config/DB.d.ts",
@@ -59,10 +59,7 @@
     "url": "https://github.com/nexoral/AxioDB"
   },
   "dependencies": {
-    "@fastify/cookie": "^10.0.1",
-    "@fastify/cors": "^11.0.1",
     "@fastify/multipart": "^9.0.3",
-    "@fastify/static": "^10.1.3",
     "fastify": "^5.8.5",
     "tar": "^7.5.16"
   },