buninu-browser 0.2.1 → 0.2.2

package/lib/network/network-service.js

@@ -34,7 +34,7 @@ const SAFELISTED_RESPONSE_HEADERS = new Set([
 const MAX_REQUESTS_PER_HOST = 6;
 // Which waiting request to a busy host goes next (lower first): documents,
 // then what blocks rendering or that a script waits for, then the rest.
-const PRIORITY = { document: 0, stylesheet: 1, fetch: 1, script: 2, metadata: 2, image: 3, video: 3, audio: 3 };
+const PRIORITY = { document: 0, iframe: 1, stylesheet: 1, fetch: 1, script: 2, metadata: 2, image: 3, video: 3, audio: 3 };
 
 export class NetworkService {
   #fetch;
@@ -73,8 +73,31 @@ export class NetworkService {
   }
 
   /** A top-level document load. */
-  async navigate(url, { onResponse } = {}) {
-    return this.#send({ url, method: "GET", headers: [], body: null }, {
+  /**
+   * Fetches a document to navigate to. A form POST (`post`) sends its body,
+   * with Origin and a Referer trimmed to the origin across origins
+   * (strict-origin-when-cross-origin); a redirect after it turns into a GET.
+   */
+  async navigate(url, { onResponse, post = null } = {}) {
+    const headers = [];
+    let method = "GET";
+    let body = null;
+    if (post) {
+      method = "POST";
+      body = post.body;
+      headers.push(["content-type", post.contentType]);
+      let from = null;
+      try { from = new URL(post.referrer); } catch {}
+      if (from && ["http:", "https:"].includes(from.protocol)) {
+        const target = new URL(url);
+        headers.push(["origin", from.origin]);
+        const downgrade = from.protocol === "https:" && target.protocol === "http:";
+        if (!downgrade) {
+          headers.push(["referer", from.origin === target.origin ? withoutFragment(from.href) : `${from.origin}/`]);
+        }
+      }
+    }
+    return this.#send({ url, method, headers, body }, {
       credentials: "include", site: null, topLevelNavigation: true,
     }, { onResponse, priority: PRIORITY.document });
   }
@@ -126,6 +149,60 @@ export class NetworkService {
     }
   }
 
+  /**
+   * A video or audio subresource whose body is delivered as it arrives.
+   * `emit` is called with `{ type: "head", ... }`, then `{ type: "chunk", data }`,
+   * then `{ type: "end" }` or `{ type: "error", error }`. Nothing is cached:
+   * a growing body is not a reusable response. The host slot stays held until
+   * the body has been read, same as a buffered subresource.
+   */
+  streamSubresource(url, documentUrl, kind, emit) {
+    const site = siteOf(documentUrl);
+    return this.#send({ url, method: "GET", headers: [], body: null }, {
+      credentials: "include", site,
+    }, {
+      priority: PRIORITY[kind] ?? PRIORITY.metadata,
+      onResponse: async (response, finalUrl) => {
+        const contentLength = Number(response.headers.get("content-length"));
+        try {
+          emit({
+            type: "head",
+            ok: response.status >= 200 && response.status <= 299,
+            status: response.status,
+            statusText: response.statusText ?? "",
+            url: finalUrl,
+            contentType: response.headers.get("content-type") ?? "",
+            contentLength: Number.isFinite(contentLength) ? contentLength : null,
+          });
+          const reader = response.body?.getReader?.();
+          if (!reader) {
+            emit({ type: "end" });
+            return { streamed: true };
+          }
+          let total = 0;
+          for (;;) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            if (!value?.byteLength) continue;
+            total += value.byteLength;
+            if (total > MAX_BODY_BYTES) {
+              emit({ type: "error", error: "Response body too large" });
+              await reader.cancel().catch(() => {});
+              return { streamed: true };
+            }
+            const copy = new Uint8Array(value.byteLength);
+            copy.set(value);
+            emit({ type: "chunk", data: copy });
+          }
+          emit({ type: "end" });
+        } catch (error) {
+          emit({ type: "error", error: String(error?.message ?? error) });
+        }
+        return { streamed: true };
+      },
+    });
+  }
+
   /**
    * A WebSocket opened by page script, using Bun's WebSocket: the handshake
    * carries the document's Origin, the target's cookies (as for an https/http
@@ -165,7 +242,7 @@ export class NetworkService {
    *   redirect?: "follow" | "error" | "manual" }} request
    * @param {string} documentUrl the requesting document (controller's record)
    */
-  async pageFetch(request, documentUrl) {
+  async pageFetch(request, documentUrl, { signal, onChunk = null } = {}) {
     const origin = new URL(documentUrl).origin;
     const url = new URL(request.url);
     const method = String(request.method ?? "GET").toUpperCase();
@@ -181,26 +258,40 @@ export class NetworkService {
     if (mode === "no-cors" && !SIMPLE_METHODS.has(method)) throw new TypeError(`${method} is not allowed in no-cors mode`);
 
     const sendCredentials = credentials === "include" || (credentials === "same-origin" && sameOrigin);
-    const context = { credentials: sendCredentials ? "include" : "omit", site: siteOf(documentUrl), origin };
+    const context = { credentials: sendCredentials ? "include" : "omit", site: siteOf(documentUrl), origin, referrer: documentUrl };
+    const stream = onChunk ? (response, finalUrl, redirected, type, responseHeaders = [...response.headers]) =>
+      this.#streamResult(response, finalUrl, redirected, type, responseHeaders, onChunk) : null;
 
     if (sameOrigin) {
       return this.#send({ url: url.href, method, headers, body: request.body ?? null }, context, {
-        redirect: request.redirect ?? "follow", corsOrigin: null, priority: PRIORITY.fetch,
+        redirect: request.redirect ?? "follow", corsOrigin: null, priority: PRIORITY.fetch, signal,
+        onResponse: stream ? (response, finalUrl, redirected) => stream(response, finalUrl, redirected, "basic") : null,
       });
     }
     if (mode === "no-cors") {
       const response = await this.#send({ url: url.href, method, headers: headers.filter(isSafelistedHeader), body: request.body ?? null },
-        context, { redirect: "follow", corsOrigin: null, priority: PRIORITY.fetch });
+        context, { redirect: "follow", corsOrigin: null, priority: PRIORITY.fetch, signal });
       return { ...response, type: "opaque", status: 0, statusText: "", url: "", headers: [], body: new Uint8Array(0), redirected: false };
     }
     // CORS: preflight unless the request is "simple" (Fetch §4.8).
     const needsPreflight = !SIMPLE_METHODS.has(method) || headers.some((header) => !isSafelistedHeader(header));
     if (needsPreflight) await this.#preflight(url, method, headers, origin, context);
     const response = await this.#send({ url: url.href, method, headers, body: request.body ?? null }, context, {
-      redirect: request.redirect ?? "follow", corsOrigin: origin, priority: PRIORITY.fetch,
+      redirect: request.redirect ?? "follow", corsOrigin: origin, priority: PRIORITY.fetch, signal,
+      onResponse: stream ? async (incoming, finalUrl, redirected) => {
+        const raw = [...incoming.headers];
+        if (!corsAllowed(raw, origin, context.credentials === "include")) return null;
+        const exposed = new Set((header(raw, "access-control-expose-headers") ?? "")
+          .split(",").map((name) => name.trim().toLowerCase()).filter(Boolean));
+        const exposeAll = exposed.has("*") && context.credentials !== "include";
+        const visible = raw.filter(([name]) => SAFELISTED_RESPONSE_HEADERS.has(name) || exposed.has(name) || exposeAll);
+        return stream(incoming, finalUrl, redirected, "cors", visible);
+      } : null,
     });
+    if (response.streaming) return response;
     const allowed = corsAllowed(response.rawHeaders, origin, context.credentials === "include");
     if (!allowed) throw new TypeError(`CORS: ${url.href} did not allow origin ${origin}`);
+    if (response.type === "opaqueredirect") return response;
     const exposed = new Set((header(response.rawHeaders, "access-control-expose-headers") ?? "")
       .split(",").map((name) => name.trim().toLowerCase()).filter(Boolean));
     const exposeAll = exposed.has("*") && context.credentials !== "include";
@@ -255,14 +346,30 @@ export class NetworkService {
    * Sends a request, following redirects by hand so cookies apply to every hop.
    * Each hop holds one of its host's request slots until its body is read.
    */
-  async #send(request, context, { redirect = "follow", corsOrigin = null, onResponse = null, priority = PRIORITY.metadata } = {}) {
+  async #send(request, context, {
+    redirect = "follow", corsOrigin = null, onResponse = null, priority = PRIORITY.metadata, signal = undefined,
+  } = {}) {
     let { url, method, body } = request;
     const baseHeaders = request.headers;
     let redirected = false;
     for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
       const headers = new Headers(baseHeaders);
-      if (this.#userAgent) headers.set("user-agent", this.#userAgent);
+      if (this.#userAgent) {
+        headers.set("user-agent", this.#userAgent);
+        const chrome = /(?:Chrome|Chromium)\/(\d+)/.exec(this.#userAgent)?.[1];
+        if (chrome) {
+          headers.set("sec-ch-ua", `"Not:A-Brand";v="99", "Chromium";v="${chrome}", "Google Chrome";v="${chrome}"`);
+          headers.set("sec-ch-ua-mobile", /\bMobile\b/.test(this.#userAgent) ? "?1" : "?0");
+          headers.set("sec-ch-ua-platform", `"${/Android/.test(this.#userAgent) ? "Android" : /Windows/.test(this.#userAgent) ? "Windows" : /Macintosh/.test(this.#userAgent) ? "macOS" : "Linux"}"`);
+        }
+      }
       if (corsOrigin) headers.set("origin", corsOrigin);
+      if (context.referrer && !headers.has("referer")) {
+        const from = new URL(context.referrer);
+        const target = new URL(url);
+        const downgrade = from.protocol === "https:" && target.protocol === "http:";
+        if (!downgrade) headers.set("referer", from.origin === target.origin ? withoutFragment(from.href) : `${from.origin}/`);
+      }
       if (context.credentials === "include") {
         const cookie = this.#cookies.header(url, {
           site: context.site, topLevelNavigation: Boolean(context.topLevelNavigation), method,
@@ -271,13 +378,13 @@ export class NetworkService {
       }
       const release = await this.#hosts.acquire(url, priority);
       try {
-        const response = await this.#request(url, { method, headers, body, redirect: "manual" });
+        const response = await this.#request(url, { method, headers, body, redirect: "manual", signal });
         if (context.credentials === "include") this.#cookies.store(url, response.headers.getSetCookie?.() ?? []);
         const location = response.headers.get("location");
         if ([301, 302, 303, 307, 308].includes(response.status) && location) {
           await response.arrayBuffer().catch(() => {});
           if (redirect === "error") throw new TypeError("Redirect was not allowed");
-          if (redirect === "manual") return await this.#result(response, url, redirected, "opaqueredirect");
+          if (redirect === "manual") return opaqueRedirect(response);
           const next = new URL(location, url);
           if (!["http:", "https:"].includes(next.protocol)) throw new TypeError(`Redirect to ${next.protocol} is not allowed`);
           if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === "POST")) {
@@ -289,7 +396,7 @@ export class NetworkService {
           continue;
         }
         if (onResponse) {
-          const handled = await onResponse(response, url);
+          const handled = await onResponse(response, url, redirected);
           if (handled) return handled;
         }
         return await this.#result(response, url, redirected, "basic");
@@ -318,6 +425,47 @@ export class NetworkService {
       body: buffer,
     };
   }
+
+  async #streamResult(response, url, redirected, type, visibleHeaders, onChunk) {
+    const rawHeaders = [...response.headers];
+    const result = {
+      ok: response.status >= 200 && response.status <= 299,
+      status: response.status, statusText: response.statusText, url, redirected, type,
+      headers: visibleHeaders.filter(([name]) => name !== "set-cookie" && name !== "set-cookie2"),
+      contentType: response.headers.get("content-type") ?? "",
+    };
+    onChunk({ type: "head", result });
+    const reader = response.body?.getReader?.();
+    if (reader) {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (value?.byteLength) onChunk({ type: "chunk", data: new Uint8Array(value) });
+      }
+    }
+    onChunk({ type: "end" });
+    return { ...result, rawHeaders, body: new Uint8Array(0), streaming: true };
+  }
+}
+
+/**
+ * The opaque-redirect filtered response a `redirect: "manual"` fetch gets
+ * (Fetch §2.2.6): status 0 and no headers or body for the page. The redirect's
+ * body was already drained to free the connection; the raw headers stay for
+ * the CORS check.
+ */
+function opaqueRedirect(response) {
+  return {
+    ok: false, status: 0, statusText: "", url: "", redirected: false, type: "opaqueredirect",
+    rawHeaders: [...response.headers], headers: [], contentType: "", body: new Uint8Array(0),
+  };
+}
+
+/** A URL without its fragment, as a Referer carries it. */
+function withoutFragment(href) {
+  const url = new URL(href);
+  url.hash = "";
+  return url.href;
 }
 
 function isSafelistedHeader([name, value]) {
@@ -402,4 +550,3 @@ class HostThrottle {
     };
   }
 }
-