botversion-sdk 2.2.2 → 2.2.3

package/interceptor.js

@@ -215,6 +215,20 @@ function parseCapturedBody(buffer, res) {
   return undefined;
 }
 
+// True when the request carries an upload (multipart) body that cannot be read safely
+function isMultipartContentType(value) {
+  return String(value || "")
+    .toLowerCase()
+    .includes("multipart/form-data");
+}
+
+// Adds the multipart marker to a request schema (creates an empty one if there are no fields)
+function withMultipartMarker(schema) {
+  const out = schema || { type: "object", properties: {} };
+  out["x-content-type"] = "multipart/form-data";
+  return out;
+}
+
 // Our own scan-trigger route must never be reported as one of the host's endpoints
 function isBotVersionInternalPath(path) {
   return String(path || "").indexOf("/__botversion/") === 0;
@@ -522,7 +536,16 @@ function attachInterceptor(app, client, options) {
       if (!reportedEndpoints.has(bodyKey)) {
         reportedEndpoints.add(bodyKey);
 
-        const jsonSchema = structureToJsonSchema(bodyStructure);
+        let jsonSchema = structureToJsonSchema(bodyStructure);
+        // Upload bodies can't be read here, so flag them as multipart instead of "no input"
+        if (
+          String((req.headers && req.headers["content-type"]) || "")
+            .toLowerCase()
+            .includes("multipart/form-data")
+        ) {
+          jsonSchema = jsonSchema || { type: "object", properties: {} };
+          jsonSchema["x-content-type"] = "multipart/form-data";
+        }
 
         setImmediate(function () {
           client
@@ -852,14 +875,18 @@ function attachNextJsInterceptor(client, options) {
           if (!reportedEndpoints.has(endpointKey)) {
             reportedEndpoints.add(endpointKey);
 
-            // Skip file uploads — too large and not JSON
             const contentType = req.headers["content-type"] || "";
             if (contentType.includes("multipart/form-data")) {
               client
                 .updateEndpoint({
                   method: method,
                   path: normalizedPath,
-                  requestBody: null,
+                  // Field names can't be read without consuming the upload stream, so flag it as multipart instead of "no input"
+                  requestBody: {
+                    type: "object",
+                    properties: {},
+                    "x-content-type": "multipart/form-data",
+                  },
                   detectedBy: "runtime",
                 })
                 .catch(function () {});
@@ -1078,9 +1105,13 @@ function attachFastifyInterceptor(fastify, client, options) {
           .updateEndpoint({
             method,
             path: normalizedPath,
-            requestBody: queryStructure
-              ? structureToJsonSchema(queryStructure)
-              : null,
+            requestBody: isMultipartContentType(request.headers["content-type"])
+              ? withMultipartMarker(
+                  queryStructure ? structureToJsonSchema(queryStructure) : null,
+                )
+              : queryStructure
+                ? structureToJsonSchema(queryStructure)
+                : null,
             detectedBy: "runtime-fastify",
           })
           .catch(function () {});
@@ -1100,6 +1131,8 @@ function attachFastifyInterceptor(fastify, client, options) {
 
     const body = request.body;
     if (!body) return;
+    // Upload bodies are reported as multipart by the first hook; their parts are not plain fields
+    if (isMultipartContentType(request.headers["content-type"])) return;
 
     const bodyStructure = buildBodyStructure(body);
     if (!bodyStructure) return;
@@ -1247,7 +1280,9 @@ function attachKoaInterceptor(app, client, options) {
           .updateEndpoint({
             method,
             path: normalizedPath,
-            requestBody: jsonSchema,
+            requestBody: isMultipartContentType(ctx.headers["content-type"])
+              ? withMultipartMarker(jsonSchema)
+              : jsonSchema,
             detectedBy: "runtime-koa",
           })
           .catch(function () {});
@@ -1324,7 +1359,11 @@ function attachHapiInterceptor(server, client, options) {
     const normalizedPath = normalizePath(path);
     const endpointKey = method + ":" + normalizedPath;
 
-    const body = request.payload;
+    // Upload payloads hold file streams, not plain fields, so they are never read as a body
+    const isUpload = isMultipartContentType(
+      request.headers && request.headers["content-type"],
+    );
+    const body = isUpload ? null : request.payload;
     // GET/DELETE inputs live in the query string, so their names are added too
     const bodyStructure = mergeQueryIntoStructure(
       buildBodyStructure(body),
@@ -1352,7 +1391,9 @@ function attachHapiInterceptor(server, client, options) {
           .updateEndpoint({
             method,
             path: normalizedPath,
-            requestBody: jsonSchema,
+            requestBody: isUpload
+              ? withMultipartMarker(jsonSchema)
+              : jsonSchema,
             detectedBy: "runtime-hapi",
           })
           .catch(function () {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "botversion-sdk",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "BotVersion SDK — auto-detect and register your API endpoints",
   "main": "index.js",
   "bin": {

package/scanner.js

@@ -80,7 +80,19 @@ function scanExpressFileStatically(filePath, seen) {
       method: effectiveMethod,
       path: routePath,
       description: "",
-      requestBody: bodyFields || queryFields,
+      requestBody:
+        mergeBodyWithMultipart(
+          bodyFields,
+          ["POST", "PUT", "PATCH"].includes(effectiveMethod)
+            ? extractMultipartFieldsFromFile(
+                sliceRouteSegment(content, match.index, routePattern.source),
+              ) ||
+                ((content.match(new RegExp(routePattern.source, "gi")) || [])
+                  .length === 1
+                  ? extractMultipartFieldsFromFile(content)
+                  : null)
+            : null,
+        ) || queryFields,
       routeParamMap: routeParamMap,
       responseBody: extractResponseFieldsForRoute(
         content,
@@ -239,6 +251,13 @@ function scanNextJsRoutes(pagesDir) {
                 : null);
         const queryFields = extractQueryFieldsFromFile(methodCode);
 
+        // Upload handlers read multipart fields, not req.body
+        const multipartFields =
+          method !== "GET" && method !== "DELETE"
+            ? extractMultipartFieldsFromFile(methodCode) ||
+              extractMultipartFieldsFromFile(fileContent)
+            : null;
+
         // GET inputs come from the query string; only this method's own code is read
         const getQueryFields =
           method === "GET"
@@ -252,7 +271,7 @@ function scanNextJsRoutes(pagesDir) {
 
         // For DELETE with no body fields, query params are the input
         const effectiveRequestBody =
-          bodyFields ||
+          mergeBodyWithMultipart(bodyFields, multipartFields) ||
           (method === "DELETE" && queryFields ? queryFields : null) ||
           getQueryFields;
 
@@ -462,6 +481,197 @@ function extractBodyFieldsFromFile(content) {
   return { type: "object", properties };
 }
 
+// Reads field names from multipart/file-upload handlers (formData, multer, formidable).
+// Returns null when the file is not an upload handler, so other routes are unaffected.
+function extractMultipartFieldsFromFile(content) {
+  const text = String(content || "");
+  const usesFormData =
+    /formData\s*\(|readFormData\s*\(|parseMultipartFormData\s*\(/.test(text);
+  const usesMulter = /multer|upload\.(single|array|fields|any)\s*\(/.test(text);
+  const usesFormidable = /formidable|koa-?body/i.test(text);
+  // NestJS interceptors, AdonisJS request.file("x"), Nuxt readMultipartFormData, Hapi multipart payloads
+  const usesNest =
+    /\b(?:FileInterceptor|FilesInterceptor|FileFieldsInterceptor|AnyFilesInterceptor)\s*\(/.test(
+      text,
+    );
+  const usesRequestFile = /\brequest\.(?:file|files)\s*\(\s*['"`]/.test(text);
+  const usesNuxtParts = /readMultipartFormData\s*\(/.test(text);
+  const usesHapiPayload = /\bmultipart\s*:\s*(?:true|\{)/.test(text);
+  const usesOtherUpload =
+    usesNest || usesRequestFile || usesNuxtParts || usesHapiPayload;
+  if (!usesFormData && !usesMulter && !usesFormidable && !usesOtherUpload)
+    return null;
+
+  const fields = {}; // name -> "file" | "string"
+
+  if (usesFormData) {
+    // Only read .get() calls on the variable that holds the parsed form,
+    // so headers.get(...) / searchParams.get(...) are never mistaken for form fields
+    const formVars = [];
+    for (const fv of text.matchAll(
+      /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?(?:[\w$.]+\.formData|readFormData|(?:unstable_)?parseMultipartFormData)\s*\(/g,
+    )) {
+      formVars.push(fv[1]);
+    }
+    const readFormGet = function (m) {
+      const varName = m[1];
+      const fieldName = m[2];
+      let kind = "string";
+      if (varName) {
+        const fileUse = new RegExp(
+          "\\b" +
+            varName +
+            "\\b\\s*(?:as\\s+File|instanceof\\s+File|\\.(?:arrayBuffer|stream|size|type|name)\\b)|instanceof\\s+File",
+        );
+        if (fileUse.test(text)) kind = "file";
+      }
+      if (fields[fieldName] !== "file") fields[fieldName] = kind;
+    };
+    formVars.forEach(function (formVar) {
+      const safeVar = formVar.replace(/\$/g, "\\$");
+      const getRe = new RegExp(
+        "(?:(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*)?\\b" +
+          safeVar +
+          "\\s*\\.(?:get|getAll)\\s*\\(\\s*['\"`]([^'\"`]+)['\"`]\\s*\\)",
+        "g",
+      );
+      for (const m of text.matchAll(getRe)) readFormGet(m);
+    });
+    // Inline form: (await request.formData()).get("file")
+    const inlineRe =
+      /(?:(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*)?\(\s*await\s+[\w$.]+\.formData\s*\(\s*\)\s*\)\s*\.(?:get|getAll)\s*\(\s*['"`]([^'"`]+)['"`]\s*\)/g;
+    for (const m of text.matchAll(inlineRe)) readFormGet(m);
+  }
+
+  if (usesMulter) {
+    // upload.single("file") / upload.array("files")
+    for (const m of text.matchAll(
+      /\.(?:single|array)\s*\(\s*['"`]([^'"`]+)['"`]/g,
+    )) {
+      fields[m[1]] = "file";
+    }
+    // upload.fields([{ name: "avatar" }, { name: "docs" }])
+    for (const block of text.matchAll(/\.fields\s*\(\s*\[([\s\S]*?)\]\s*\)/g)) {
+      for (const n of block[1].matchAll(/name\s*:\s*['"`]([^'"`]+)['"`]/g)) {
+        fields[n[1]] = "file";
+      }
+    }
+  }
+
+  if (usesFormidable) {
+    // files.file / files["file"]  and  fields.title / fields["title"]
+    for (const m of text.matchAll(
+      /\bfiles(?:\?\.|\.)([A-Za-z_$][\w$]*)|\bfiles\s*\[\s*['"`]([^'"`]+)['"`]\s*\]/g,
+    )) {
+      fields[m[1] || m[2]] = "file";
+    }
+    for (const m of text.matchAll(
+      /\bfields(?:\?\.|\.)([A-Za-z_$][\w$]*)|\bfields\s*\[\s*['"`]([^'"`]+)['"`]\s*\]/g,
+    )) {
+      const name = m[1] || m[2];
+      if (!fields[name]) fields[name] = "string";
+    }
+  }
+
+  if (usesNest) {
+    // @UseInterceptors(FileInterceptor("file")) / FilesInterceptor("files")
+    for (const m of text.matchAll(
+      /\b(?:FileInterceptor|FilesInterceptor)\s*\(\s*['"`]([^'"`]+)['"`]/g,
+    )) {
+      fields[m[1]] = "file";
+    }
+    // FileFieldsInterceptor([{ name: "avatar" }, { name: "docs" }])
+    for (const block of text.matchAll(
+      /\bFileFieldsInterceptor\s*\(\s*\[([\s\S]*?)\]/g,
+    )) {
+      for (const n of block[1].matchAll(/name\s*:\s*['"`]([^'"`]+)['"`]/g)) {
+        fields[n[1]] = "file";
+      }
+    }
+  }
+
+  if (usesRequestFile) {
+    // request.file("avatar") / request.files("docs")
+    for (const m of text.matchAll(
+      /\brequest\.(?:file|files)\s*\(\s*['"`]([^'"`]+)['"`]/g,
+    )) {
+      fields[m[1]] = "file";
+    }
+  }
+
+  if (usesNuxtParts) {
+    // readMultipartFormData(event) -> parts.find((p) => p.name === "file")
+    for (const m of text.matchAll(
+      /(?:(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*)?[^\n;]*?\.name\s*===?\s*['"`]([^'"`]+)['"`]/g,
+    )) {
+      let kind = "string";
+      if (m[1]) {
+        const safeVar = m[1].replace(/\$/g, "\\$");
+        const fileUse = new RegExp(
+          "\\b" + safeVar + "\\b\\s*(?:\\?\\.|\\.)\\s*(?:filename|type)\\b",
+        );
+        if (fileUse.test(text)) kind = "file";
+      }
+      if (fields[m[2]] !== "file") fields[m[2]] = kind;
+    }
+  }
+
+  if (usesHapiPayload) {
+    // request.payload.file / const { file, title } = request.payload
+    const addHapiField = function (name) {
+      if (!/^[A-Za-z_$][\w$]*$/.test(name) || fields[name]) return;
+      const safeName = name.replace(/\$/g, "\\$");
+      const fileLike = new RegExp(
+        "\\b" + safeName + "\\b\\s*(?:\\?\\.|\\.)\\s*(?:hapi|_data|pipe)\\b",
+      ).test(text);
+      fields[name] = fileLike ? "file" : "string";
+    };
+    for (const m of text.matchAll(/\bpayload(?:\?\.|\.)([A-Za-z_$][\w$]*)/g)) {
+      addHapiField(m[1]);
+    }
+    for (const d of text.matchAll(/\{([^}]+)\}\s*=\s*[\w$.]*\bpayload\b/g)) {
+      d[1].split(",").forEach(function (f) {
+        addHapiField(f.trim().split(":")[0].split("=")[0].trim());
+      });
+    }
+  }
+
+  const names = Object.keys(fields);
+  if (names.length === 0) return null;
+
+  const properties = {};
+  names.forEach(function (n) {
+    properties[n] =
+      fields[n] === "file"
+        ? { type: "string", format: "binary" }
+        : { type: "string" };
+  });
+  return {
+    type: "object",
+    properties: properties,
+    "x-content-type": "multipart/form-data",
+  };
+}
+
+// Start of any Fastify route definition, used to cut a file into per-route pieces
+const FASTIFY_ROUTE_START =
+  "(?:fastify|app|server|router)\\.(?:get|post|put|delete|patch|route)\\s*\\(";
+
+// Combines text fields read from req.body with file fields from the upload parser
+function mergeBodyWithMultipart(bodyFields, multipartFields) {
+  if (!multipartFields) return bodyFields;
+  if (!bodyFields) return multipartFields;
+  return {
+    type: "object",
+    properties: Object.assign(
+      {},
+      bodyFields.properties,
+      multipartFields.properties,
+    ),
+    "x-content-type": "multipart/form-data",
+  };
+}
+
 function scanNextJsAppRoutes(appDir) {
   const fs = require("fs");
   const path = require("path");
@@ -507,6 +717,11 @@ function scanNextJsAppRoutes(appDir) {
                 ? extractAppRouterBodyFields(content)
                 : null);
         const queryFields = extractQueryFieldsFromFile(methodCode);
+        const multipartFields =
+          method !== "GET" && method !== "DELETE"
+            ? extractMultipartFieldsFromFile(methodCode) ||
+              extractMultipartFieldsFromFile(content)
+            : null;
 
         const routeParamMap = buildRouteParamMap(routePath, []);
 
@@ -515,7 +730,7 @@ function scanNextJsAppRoutes(appDir) {
           path: routePath,
           description: "",
           requestBody:
-            bodyFields ||
+            mergeBodyWithMultipart(bodyFields, multipartFields) ||
             (method === "DELETE" && queryFields ? queryFields : null) ||
             (method === "GET"
               ? removePathParamFields(
@@ -1548,7 +1763,14 @@ function scanFastifyRoutes(cwd) {
           method,
           path: routePath,
           description: "",
-          requestBody: bodyFields,
+          requestBody: mergeBodyWithMultipart(
+            bodyFields,
+            needsBody
+              ? extractMultipartFieldsFromFile(
+                  sliceRouteSegment(content, match.index, FASTIFY_ROUTE_START),
+                )
+              : null,
+          ),
           routeParamMap,
           detectedBy: "static-scan-fastify",
         });
@@ -1577,7 +1799,14 @@ function scanFastifyRoutes(cwd) {
           method,
           path: routePath,
           description: "",
-          requestBody: bodyFields,
+          requestBody: mergeBodyWithMultipart(
+            bodyFields,
+            needsBody
+              ? extractMultipartFieldsFromFile(
+                  sliceRouteSegment(content, match.index, FASTIFY_ROUTE_START),
+                )
+              : null,
+          ),
           routeParamMap,
           detectedBy: "static-scan-fastify",
         });
@@ -1613,7 +1842,18 @@ function scanFastifyRoutes(cwd) {
             method,
             path: routePath,
             description: "",
-            requestBody: bodyFields,
+            requestBody: mergeBodyWithMultipart(
+              bodyFields,
+              needsBody
+                ? extractMultipartFieldsFromFile(
+                    sliceRouteSegment(
+                      content,
+                      match.index,
+                      FASTIFY_ROUTE_START,
+                    ),
+                  )
+                : null,
+            ),
             routeParamMap,
             detectedBy: "static-scan-fastify",
           });
@@ -1744,7 +1984,14 @@ function scanNestJsRoutes(cwd) {
           method,
           path: normalizedPath,
           description: "",
-          requestBody: bodyFields,
+          requestBody: mergeBodyWithMultipart(
+            bodyFields,
+            needsBody
+              ? extractMultipartFieldsFromFile(
+                  sliceRouteSegment(content, match.index, methodPattern.source),
+                )
+              : null,
+          ),
           routeParamMap,
           detectedBy: "static-scan-nestjs",
         });
@@ -1847,7 +2094,14 @@ function scanKoaRoutes(cwd) {
           method,
           path: routePath,
           description: "",
-          requestBody: bodyFields,
+          requestBody: mergeBodyWithMultipart(
+            bodyFields,
+            needsBody
+              ? extractMultipartFieldsFromFile(
+                  sliceRouteSegment(content, match.index, routePattern.source),
+                )
+              : null,
+          ),
           routeParamMap,
           detectedBy: "static-scan-koa",
         });
@@ -1947,7 +2201,14 @@ function scanHapiRoutes(cwd) {
           method,
           path: routePath,
           description: "",
-          requestBody: bodyFields,
+          requestBody: mergeBodyWithMultipart(
+            bodyFields,
+            needsBody
+              ? extractMultipartFieldsFromFile(
+                  sliceRouteSegment(content, match.index, routePattern.source),
+                )
+              : null,
+          ),
           routeParamMap,
           detectedBy: "static-scan-hapi",
         });
@@ -2048,7 +2309,14 @@ function scanAdonisRoutes(cwd) {
           method,
           path: routePath,
           description: "",
-          requestBody: bodyFields,
+          requestBody: mergeBodyWithMultipart(
+            bodyFields,
+            needsBody
+              ? extractMultipartFieldsFromFile(
+                  sliceRouteSegment(content, match.index, routePattern.source),
+                )
+              : null,
+          ),
           routeParamMap,
           detectedBy: "static-scan-adonis",
         });
@@ -2134,7 +2402,18 @@ function scanNuxtServerRoutes(cwd) {
           method: m,
           path: finalPath,
           description: "",
-          requestBody: null,
+          requestBody:
+            m !== "GET" && m !== "DELETE"
+              ? (function () {
+                  try {
+                    return extractMultipartFieldsFromFile(
+                      fs.readFileSync(fullPath, "utf8"),
+                    );
+                  } catch (e) {
+                    return null;
+                  }
+                })()
+              : null,
           routeParamMap,
           detectedBy: "static-scan-nuxt",
         });
@@ -2223,7 +2502,14 @@ function scanSvelteKitServerRoutes(cwd) {
           method,
           path: routePath || "/",
           description: "",
-          requestBody: bodyFields,
+          requestBody: mergeBodyWithMultipart(
+            bodyFields,
+            needsBody
+              ? extractMultipartFieldsFromFile(
+                  getMethodSegment(content, method, methods, "app") || content,
+                )
+              : null,
+          ),
           routeParamMap,
           detectedBy: "static-scan-sveltekit",
         });
@@ -2340,7 +2626,10 @@ function scanRemixServerRoutes(cwd) {
           if (seen.has(key)) return;
           seen.add(key);
 
-          const bodyFields = extractBodyFieldsFromFile(content);
+          const bodyFields = mergeBodyWithMultipart(
+            extractBodyFieldsFromFile(content),
+            extractMultipartFieldsFromFile(content),
+          );
           endpoints.push({
             method,
             path: routePath,