bazis 0.98.6 → 0.98.8

package/core/http/HttpServer.ts

@@ -6,7 +6,8 @@ import { HttpContext } from "./HttpContext/HttpContext";
 import { holdResponseScope } from "./HttpContext/responseLifetime";
 import { inspectableRedirectResponse } from "./HttpContext/inspectableRedirects";
 import { accessLog } from "./Middleware/accessLog";
-import { cors, isPreflight, preflightResponse } from "./Middleware/cors";
+import { cors, corsOptionsOf, isPreflight, preflightResponse, type CorsOptions } from "./Middleware/cors";
+import { isCorrelationIdMiddleware } from "./correlation/createCorrelationIdMiddleware";
 import { errorHandler } from "./Middleware/errorHandler";
 import { runPipeline } from "./Middleware/pipeline";
 import { applySecurityHeaders, securityHeaders } from "./Middleware/securityHeaders";
@@ -75,6 +76,8 @@ export class HttpServer implements HostedService {
   private server?: ReturnType<typeof Bun.serve>;
   private router?: Router;
   private readVersion: VersionReader = () => undefined;
+  /** CORS options for every preflight: `cors` or a `cors()` among the global middleware. */
+  private globalCors: CorsOptions | undefined;
   /** Body cap in bytes; `undefined` when the limit is disabled (`maxBodyBytes: 0`). */
   private readonly maxBodyBytes?: number;
   private readonly requestScopeDisposeTimeoutMs?: number;
@@ -151,6 +154,12 @@ export class HttpServer implements HostedService {
     if (this.options.securityHeaders !== false) {
       serverChain.push(securityHeaders(this.options.securityHeaders ?? {}));
     }
+    const serverMiddleware = this.collectServerMiddleware();
+    // A global correlation middleware wraps the error boundary, so error
+    // responses (401, 403, 500, a thrown NotFoundError) and the responses
+    // produced before routing (404, 405, 413, preflight, docs, health) carry
+    // the request id, and the error log line runs inside its request context.
+    serverChain.push(...serverMiddleware.filter(isCorrelationIdMiddleware));
     // Unexpected errors go to the application logger, like the access log.
     const errorLogger = this.resolver.tryResolve(LOGGER);
     serverChain.push(
@@ -162,7 +171,9 @@ export class HttpServer implements HostedService {
       }),
     );
     this.shortCircuitChain = [...serverChain];
-    serverChain.push(...this.collectServerMiddleware());
+    // A global `cors()` among the middleware answers preflights like `cors`.
+    this.globalCors = this.options.cors || serverMiddleware.map(corsOptionsOf).find((options) => options !== undefined);
+    serverChain.push(...serverMiddleware.filter((middleware) => !isCorrelationIdMiddleware(middleware)));
 
     const builder = new RouterBuilder(
       serverChain,
@@ -367,9 +378,11 @@ export class HttpServer implements HostedService {
       }
     }
 
-    if (this.options.cors && isPreflight(request)) {
-      const corsOptions = this.options.cors;
-      return this.runShortCircuit(request, url, clientIp, () => preflightResponse(corsOptions, request));
+    if (isPreflight(request)) {
+      const corsOptions = this.globalCors ?? this.routeCors(request, url);
+      if (corsOptions !== undefined) {
+        return this.runShortCircuit(request, url, clientIp, () => preflightResponse(corsOptions, request));
+      }
     }
 
     const segments = parseRequestPath(url.pathname);
@@ -430,6 +443,15 @@ export class HttpServer implements HostedService {
     }
   }
 
+  /** CORS options of the route a preflight asks about (its `Access-Control-Request-Method`). */
+  private routeCors(request: Request, url: URL): CorsOptions | undefined {
+    const segments = parseRequestPath(url.pathname);
+    const method = request.headers.get("access-control-request-method")?.trim().toUpperCase();
+    if (!segments || !method) return undefined;
+    const match = this.router!.match(method, segments, this.readVersion(request, url));
+    return match.kind === "matched" ? match.action.cors : undefined;
+  }
+
   private async runShortCircuit(
     request: Request,
     url: URL,

package/core/http/Middleware/accessLog.ts

@@ -7,7 +7,7 @@ export interface AccessLogEntry {
   readonly method: string;
   readonly path: string;
   readonly status: number;
-  /** Wall-clock time spent in the pipeline, in milliseconds. */
+  /** Wall-clock time spent in the pipeline, in milliseconds, rounded to 0.01. */
   readonly durationMs: number;
   /** Correlation id from {@link createCorrelationIdMiddleware}, if present. */
   readonly requestId?: string;
@@ -73,7 +73,7 @@ export function accessLog(options: AccessLogOptions = {}): HttpMiddleware {
             method: ctx.method,
             path: ctx.path,
             status: ctx.response?.status ?? 0,
-            durationMs: performance.now() - startedAt,
+            durationMs: Math.round((performance.now() - startedAt) * 100) / 100,
             ...(typeof requestId === "string" ? { requestId } : {}),
           });
         }

package/core/http/Middleware/cors.ts

@@ -22,6 +22,14 @@ export interface CorsOptions {
 
 const DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"] as const;
 
+/** Options of a middleware created by {@link cors}; the server answers preflights with them. */
+const CORS_OPTIONS = Symbol("bazis:http:cors-options");
+
+/** Options of a {@link cors} middleware, or undefined for any other middleware. */
+export function corsOptionsOf(middleware: HttpMiddleware): CorsOptions | undefined {
+  return (middleware as HttpMiddleware & { [CORS_OPTIONS]?: CorsOptions })[CORS_OPTIONS];
+}
+
 function assertSafeCorsOptions(options: CorsOptions): void {
   if (!options.credentials) {
     return;
@@ -119,12 +127,14 @@ export function preflightResponse(options: CorsOptions, request: Request): Respo
 
 /**
  * CORS middleware: adds response headers for cross-origin requests.
- * Use globally via `httpModule({ cors })` (which also answers preflights)
- * or per controller/route via `@Middleware(cors({...}))`.
+ * Use globally via `httpModule({ cors })` or per controller/route via
+ * `@Middleware(cors({...}))`. Either way the server answers preflights
+ * (`OPTIONS` with `Access-Control-Request-Method`) with these options: a
+ * route's own `cors()` applies to preflights of that route.
  */
 export function cors(options: CorsOptions = {}): HttpMiddleware {
   assertSafeCorsOptions(options);
-  return async (ctx, next) => {
+  const middleware: HttpMiddleware = async (ctx, next) => {
     await next();
     const requestOrigin = ctx.header("origin");
     if (!ctx.response) {
@@ -157,4 +167,6 @@ export function cors(options: CorsOptions = {}): HttpMiddleware {
       }
     }
   };
+  Object.defineProperty(middleware, CORS_OPTIONS, { value: options });
+  return middleware;
 }

package/core/http/Routing/Router.ts

@@ -1,4 +1,5 @@
 import type { HttpMiddleware } from "../Middleware/types";
+import type { CorsOptions } from "../Middleware/cors";
 import { HttpSetupError } from "../Errors/HttpError";
 import { INVALID } from "../Binding/convert";
 import type { SegmentConstraint, TemplateSegment } from "./template";
@@ -13,6 +14,8 @@ export interface RouteAction {
   readonly name: string;
   /** Action-specific body cap in bytes; undefined inherits the server cap. */
   readonly maxBodyBytes?: number;
+  /** Options of the action's or controller's `cors()` middleware, for preflights. */
+  readonly cors?: CorsOptions;
 }
 
 interface RouteEntry {

package/core/http/Routing/RouterBuilder.ts

@@ -6,6 +6,7 @@ import { controllerMetaOf, type ActionMeta, type ControllerMeta } from "../Decor
 import { HttpSetupError } from "../Errors/HttpError";
 import type { HttpContext } from "../HttpContext/HttpContext";
 import type { ActionFilterHooks, HttpMiddleware } from "../Middleware/types";
+import { corsOptionsOf } from "../Middleware/cors";
 import { normalizeResult } from "../Results/normalize";
 import type { ApiVersioningOptions, RouteMiddlewareComposer } from "../options";
 import { createAuthorizeComposer } from "../Authorization/authorizeComposer";
@@ -84,6 +85,7 @@ export class RouterBuilder {
         version,
         name: `${controllerClass.name}.${String(methodName)}`,
         maxBodyBytes: action.maxBodyBytes,
+        cors: routeCors(meta, action),
       };
       for (const declaration of action.routes) {
         const versionSegment = useUrlVersioning && version !== undefined ? `v${version}` : undefined;
@@ -192,6 +194,19 @@ export class RouterBuilder {
  * but has no bindings was most likely added or changed after the last codegen:
  * its arguments would silently get wrong values, so the server refuses to start.
  */
+/** The action's own `cors()` wins over the controller's. */
+function routeCors(meta: ControllerMeta, action: ActionMeta): ReturnType<typeof corsOptionsOf> {
+  for (const middleware of [...action.middleware].reverse()) {
+    const options = corsOptionsOf(middleware);
+    if (options !== undefined) return options;
+  }
+  for (const middleware of [...meta.middleware].reverse()) {
+    const options = corsOptionsOf(middleware);
+    if (options !== undefined) return options;
+  }
+  return undefined;
+}
+
 function assertBindingsFresh(
   controllerClass: Class<object>,
   methodName: string | symbol,

package/core/http/correlation/createCorrelationIdMiddleware.ts

@@ -14,6 +14,14 @@ export interface CorrelationIdMiddlewareOptions {
   readonly validateIncomingId?: (value: string) => boolean;
 }
 
+/** Marks the middleware so the server also applies it to responses produced before routing. */
+const CORRELATION_ID_MIDDLEWARE = Symbol("bazis:http:correlation-id");
+
+/** True for a middleware created by {@link createCorrelationIdMiddleware}. */
+export function isCorrelationIdMiddleware(middleware: HttpMiddleware): boolean {
+  return (middleware as HttpMiddleware & { [CORRELATION_ID_MIDDLEWARE]?: true })[CORRELATION_ID_MIDDLEWARE] === true;
+}
+
 const DEFAULT_REQUEST_ID = /^[A-Za-z0-9][A-Za-z0-9._:@/+\-=]{0,127}$/;
 const TRACEPARENT = /^[\da-f]{2}-([\da-f]{32})-([\da-f]{16})-[\da-f]{2}(?:-[\x21-\x7e]+)?$/i;
 
@@ -21,6 +29,8 @@ const TRACEPARENT = /^[\da-f]{2}-([\da-f]{32})-([\da-f]{16})-[\da-f]{2}(?:-[\x21
  * Ensures one correlation ID per HTTP request: reads `x-request-id` or
  * generates a UUID, stores it on {@link HttpContext.state}, echoes it on the
  * response, and binds it to async local storage for application logs.
+ * Registered among the server's global middleware, it also applies to the
+ * responses the server produces before routing (404, 405, 413, preflight).
  */
 export function createCorrelationIdMiddleware(
   options: CorrelationIdMiddlewareOptions = {},
@@ -29,7 +39,7 @@ export function createCorrelationIdMiddleware(
   const generateId = options.generateId ?? (() => crypto.randomUUID());
   const validateIncomingId = options.validateIncomingId ?? ((value: string) => DEFAULT_REQUEST_ID.test(value));
 
-  return async (ctx, next) => {
+  const middleware: HttpMiddleware = async (ctx, next) => {
     const incoming = ctx.header(headerName);
     const trimmedIncoming = incoming?.trim();
     const generated = (): string => {
@@ -64,6 +74,8 @@ export function createCorrelationIdMiddleware(
       });
     }
   };
+  Object.defineProperty(middleware, CORRELATION_ID_MIDDLEWARE, { value: true });
+  return middleware;
 }
 
 function normalizeTraceparent(value: string | undefined): string | undefined {

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.6" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.8" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.98.6",
+  "version": "0.98.8",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",