bxo 0.0.5-dev.73 → 0.0.5-dev.75

package/example/cookie-example.ts

@@ -0,0 +1,151 @@
+import BXO, { z } from "../src";
+
+async function main() {
+    const app = new BXO({ serve: { port: 3001 } });
+
+    // Example 1: Simple cookie setting
+    app.get("/set-simple-cookie", (ctx) => {
+        // Set a simple cookie
+        ctx.set.cookie("theme", "dark");
+        
+        return ctx.json({ message: "Simple cookie set!" });
+    });
+
+    // Example 2: Cookie with options
+    app.get("/set-secure-cookie", (ctx) => {
+        // Set a secure cookie with various options
+        ctx.set.cookie("sessionId", "abc123", {
+            httpOnly: true,
+            secure: true,
+            sameSite: "strict",
+            maxAge: 3600, // 1 hour
+            path: "/"
+        });
+        
+        return ctx.json({ message: "Secure cookie set!" });
+    });
+
+    // Example 3: Multiple cookies
+    app.get("/set-multiple-cookies", (ctx) => {
+        // Set multiple cookies
+        ctx.set.cookie("user", "john_doe", {
+            httpOnly: true,
+            maxAge: 86400 // 1 day
+        });
+        
+        ctx.set.cookie("preferences", "dark_mode", {
+            maxAge: 604800 // 1 week
+        });
+        
+        ctx.set.cookie("lastVisit", new Date().toISOString(), {
+            expires: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) // 30 days
+        });
+        
+        return ctx.json({ message: "Multiple cookies set!" });
+    });
+
+    // Example 4: Reading cookies
+    app.get("/read-cookies", (ctx) => {
+        return ctx.json({
+            message: "Current cookies:",
+            cookies: ctx.cookies,
+            theme: ctx.cookies.theme || "not set",
+            sessionId: ctx.cookies.sessionId || "not set",
+            user: ctx.cookies.user || "not set"
+        });
+    });
+
+    // Example 5: Login with cookie validation
+    app.post("/login", (ctx) => {
+        const { username, password } = ctx.body;
+        
+        // Simple validation (in real app, check against database)
+        if (username === "admin" && password === "password") {
+            // Set session cookie
+            ctx.set.cookie("sessionId", `session_${Date.now()}`, {
+                httpOnly: true,
+                secure: process.env.NODE_ENV === "production",
+                sameSite: "strict",
+                maxAge: 3600 // 1 hour
+            });
+            
+            ctx.set.cookie("username", username, {
+                maxAge: 3600
+            });
+            
+            return ctx.json({ 
+                message: "Login successful!",
+                username 
+            });
+        }
+        
+        return ctx.status(401, { error: "Invalid credentials" });
+    }, {
+        body: z.object({
+            username: z.string(),
+            password: z.string()
+        })
+    });
+
+    // Example 6: Protected route with cookie validation
+    app.get("/profile", (ctx) => {
+        const sessionId = ctx.cookies.sessionId;
+        const username = ctx.cookies.username;
+        
+        if (!sessionId) {
+            return ctx.status(401, { error: "Not authenticated" });
+        }
+        
+        return ctx.json({ 
+            message: "Welcome to your profile!",
+            username,
+            sessionId: sessionId.substring(0, 10) + "..." // Don't expose full session ID
+        });
+    }, {
+        cookies: z.object({
+            sessionId: z.string().optional(),
+            username: z.string().optional()
+        })
+    });
+
+    // Example 7: Logout (clear cookies)
+    app.post("/logout", (ctx) => {
+        // Clear cookies by setting them with maxAge: 0
+        ctx.set.cookie("sessionId", "", {
+            maxAge: 0,
+            path: "/"
+        });
+        
+        ctx.set.cookie("username", "", {
+            maxAge: 0,
+            path: "/"
+        });
+        
+        return ctx.json({ message: "Logged out successfully" });
+    });
+
+    // Example 8: Cookie with domain and path
+    app.get("/set-domain-cookie", (ctx) => {
+        ctx.set.cookie("globalPref", "enabled", {
+            domain: "localhost", // or your domain
+            path: "/api",
+            maxAge: 86400
+        });
+        
+        return ctx.json({ message: "Domain-specific cookie set!" });
+    });
+
+    app.start();
+    console.log(`Cookie example server running on http://localhost:${app.server?.port}`);
+    console.log("\nTry these endpoints:");
+    console.log("GET  /set-simple-cookie");
+    console.log("GET  /set-secure-cookie");
+    console.log("GET  /set-multiple-cookies");
+    console.log("GET  /read-cookies");
+    console.log("POST /login (with body: {\"username\": \"admin\", \"password\": \"password\"})");
+    console.log("GET  /profile");
+    console.log("POST /logout");
+    console.log("GET  /set-domain-cookie");
+}
+
+main().catch(console.error);

package/example/passthrough-validation-example.ts

@@ -0,0 +1,115 @@
+import BXO, { z } from "../src";
+
+async function main() {
+    const app = new BXO({ serve: { port: 3002 } });
+
+    // Example 1: Header validation with passthrough
+    app.get("/api/headers", (ctx) => {
+        return ctx.json({
+            message: "Headers received",
+            // All headers are available, including extra ones not in schema
+            allHeaders: ctx.headers,
+            // Schema-validated headers are typed
+            contentType: ctx.headers["content-type"],
+            authorization: ctx.headers["authorization"]
+        });
+    }, {
+        headers: z.object({
+            "content-type": z.string().optional(),
+            "authorization": z.string().optional()
+        }).passthrough() // This allows extra headers to pass through
+    });
+
+    // Example 2: Cookie validation with passthrough
+    app.get("/api/cookies", (ctx) => {
+        return ctx.json({
+            message: "Cookies received",
+            // All cookies are available, including extra ones not in schema
+            allCookies: ctx.cookies,
+            // Schema-validated cookies are typed
+            sessionId: ctx.cookies.sessionId,
+            theme: ctx.cookies.theme
+        });
+    }, {
+        cookies: z.object({
+            sessionId: z.string().optional(),
+            theme: z.enum(["light", "dark"]).optional()
+        }).passthrough() // This allows extra cookies to pass through
+    });
+
+    // Example 3: Both headers and cookies with passthrough
+    app.post("/api/auth", (ctx) => {
+        return ctx.json({
+            message: "Authentication successful",
+            headers: {
+                // Only the required headers are typed
+                contentType: ctx.headers["content-type"],
+                authorization: ctx.headers["authorization"],
+                // But all headers are available
+                allHeaders: ctx.headers
+            },
+            cookies: {
+                // Only the required cookies are typed
+                sessionId: ctx.cookies.sessionId,
+                theme: ctx.cookies.theme,
+                // But all cookies are available
+                allCookies: ctx.cookies
+            }
+        });
+    }, {
+        headers: z.object({
+            "content-type": z.string(),
+            "authorization": z.string()
+        }).passthrough(),
+        cookies: z.object({
+            sessionId: z.string(),
+            theme: z.enum(["light", "dark"])
+        }).passthrough(),
+        body: z.object({
+            username: z.string(),
+            password: z.string()
+        })
+    });
+
+    // Example 4: Without passthrough (strict validation)
+    app.get("/api/strict", (ctx) => {
+        return ctx.json({
+            message: "Strict validation - only schema fields available",
+            headers: ctx.headers,
+            cookies: ctx.cookies
+        });
+    }, {
+        headers: z.object({
+            "content-type": z.string().optional()
+        }), // No passthrough - will fail if extra headers are present
+        cookies: z.object({
+            sessionId: z.string().optional()
+        }) // No passthrough - will fail if extra cookies are present
+    });
+
+    // Example 5: Demonstrating the difference
+    app.get("/api/demo", (ctx) => {
+        // Set some cookies to demonstrate
+        ctx.set.cookie("sessionId", "abc123");
+        ctx.set.cookie("theme", "dark");
+        ctx.set.cookie("extraCookie", "this-will-be-available-with-passthrough");
+        
+        return ctx.json({
+            message: "Check the cookies in your browser dev tools",
+            note: "extraCookie will be available in /api/cookies but not in /api/strict"
+        });
+    });
+
+    app.start();
+    console.log(`Passthrough validation example server running on http://localhost:${app.server?.port}`);
+    console.log("\nTry these endpoints:");
+    console.log("GET  /api/headers (with extra headers)");
+    console.log("GET  /api/cookies (with extra cookies)");
+    console.log("POST /api/auth (with both headers and cookies)");
+    console.log("GET  /api/strict (strict validation - may fail with extra fields)");
+    console.log("GET  /api/demo (sets some cookies for testing)");
+    console.log("\nExample with curl:");
+    console.log('curl -H "Content-Type: application/json" -H "Authorization: Bearer token123" -H "X-Custom-Header: value" -b "sessionId=abc123; theme=dark; extraCookie=test" http://localhost:3002/api/headers');
+}
+
+main().catch(console.error);

package/package.json

@@ -5,7 +5,7 @@
     ".": "./src/index.ts",
     "./plugins": "./plugins/index.ts"
   },
-  "version": "0.0.5-dev.73",
+  "version": "0.0.5-dev.75",
   "type": "module",
   "devDependencies": {
     "@types/bun": "latest"

package/src/index.ts

@@ -1,6 +1,5 @@
 import { z } from "zod";
 
-
 type Method =
     | "GET"
     | "POST"
@@ -52,6 +51,16 @@ type QueryObject = Record<string, string | string[]>;
 type CookieObject = Record<string, string>;
 type HeaderObject = Record<string, string>;
 
+export type CookieOptions = {
+    domain?: string;
+    expires?: Date;
+    httpOnly?: boolean;
+    maxAge?: number;
+    path?: string;
+    sameSite?: "strict" | "lax" | "none";
+    secure?: boolean;
+};
+
 // Lifecycle hook types
 export type BeforeRequestHook = (req: Request, ctx?: Partial<Context<any, any>>) => Request | Response | Promise<Request | Response | void>;
 export type AfterRequestHook = (req: Request, res: Response, ctx?: Partial<Context<any, any>>) => Response | Promise<Response | void>;
@@ -65,7 +74,10 @@ export type Context<P extends string = string, S extends RouteSchema | undefined
     headers: S extends RouteSchema ? InferOr<S["headers"], HeaderObject> : HeaderObject;
     cookies: S extends RouteSchema ? InferOr<S["cookies"], CookieObject> : CookieObject;
     body: S extends RouteSchema ? InferOr<S["body"], unknown> : unknown;
-    set: { headers: Record<string, string> };
+    set: { 
+        headers: Record<string, string | string[]>;
+        cookie: (name: string, value: string, options?: CookieOptions) => void;
+    };
     json: <T>(data: T, status?: number) => Response;
     text: (data: string, status?: number) => Response;
     status: <T extends number>(status: T, data: InferResponse<S, T>) => Response;
@@ -108,6 +120,42 @@ function parseCookies(cookieHeader: string | null): CookieObject {
     return out;
 }
 
+function serializeCookie(name: string, value: string, options: CookieOptions = {}): string {
+    let cookie = `${name}=${encodeURIComponent(value)}`;
+    
+    if (options.domain) {
+        cookie += `; Domain=${options.domain}`;
+    }
+    
+    if (options.path) {
+        cookie += `; Path=${options.path}`;
+    } else {
+        cookie += `; Path=/`;
+    }
+    
+    if (options.expires) {
+        cookie += `; Expires=${options.expires.toUTCString()}`;
+    }
+    
+    if (options.maxAge !== undefined) {
+        cookie += `; Max-Age=${options.maxAge}`;
+    }
+    
+    if (options.httpOnly) {
+        cookie += `; HttpOnly`;
+    }
+    
+    if (options.secure) {
+        cookie += `; Secure`;
+    }
+    
+    if (options.sameSite) {
+        cookie += `; SameSite=${options.sameSite}`;
+    }
+    
+    return cookie;
+}
+
 function parseQuery(searchParams: URLSearchParams): QueryObject;
 function parseQuery<T extends z.ZodTypeAny>(searchParams: URLSearchParams, schema: T): z.infer<T>;
 function parseQuery(searchParams: URLSearchParams, schema?: z.ZodTypeAny): any {
@@ -161,9 +209,18 @@ function buildMatcher(path: string): { regex: RegExp | null; names: string[] } {
     return { regex, names };
 }
 
-function mergeHeaders(base: HeadersInit | undefined, extra: Record<string, string>): Headers {
+function mergeHeaders(base: HeadersInit | undefined, extra: Record<string, string | string[]>): Headers {
     const h = new Headers(base);
-    for (const [k, v] of Object.entries(extra)) h.set(k, v);
+    for (const [k, v] of Object.entries(extra)) {
+        if (Array.isArray(v)) {
+            // For arrays (like Set-Cookie), append each value as a separate header
+            for (const value of v) {
+                h.append(k, value);
+            }
+        } else {
+            h.set(k, v);
+        }
+    }
     return h;
 }
 
@@ -277,7 +334,9 @@ export default class BXO {
         this.server = Bun.serve({
             ...this.serveOptions,
             routes: nativeRoutes as any,
-            fetch: (req: Request) => this.dispatchAny(req, nativeRoutes)
+            fetch: (req: Request) => {
+                return new Response("Not Found", { status: 404 });
+            }
         });
     }
 
@@ -347,7 +406,7 @@ export default class BXO {
         try {
             queryObj = route.schema?.query ? parseQuery(url.searchParams, route.schema.query as any) : parseQuery(url.searchParams);
         } catch (err: any) {
-            const payload = err?.issues ? { error: "Validation Error", issues: err.issues } : { error: "Validation Error" };
+            const payload = err?.issues ? { error: "Validation Error", issues: err.issues } : { error: "Validation Error", issues: [], message: err.message };
             return new Response(JSON.stringify(payload), { status: 400, headers: { "Content-Type": "application/json" } });
         }
 
@@ -355,27 +414,27 @@ export default class BXO {
         try {
             const contentType = req.headers.get("content-type") || "";
             if (contentType.includes("application/json")) {
-                const raw = await req.json();
+                const raw = await req.json().catch(() => undefined);
                 bodyObj = route.schema?.body ? (route.schema.body as any).parse(raw) : raw;
             } else if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-                const fd = await req.formData();
-                const raw = formDataToObject(fd);
+                const fd = await req.formData().catch(() => undefined);
+                const raw = formDataToObject(fd || new FormData());
                 bodyObj = route.schema?.body ? (route.schema.body as any).parse(raw) : raw;
             } else if (contentType.includes("text/")) {
-                const raw = await req.text();
+                const raw = await req.text().catch(() => undefined);
                 bodyObj = route.schema?.body ? (route.schema.body as any).parse(raw) : raw;
             } else if (contentType) {
                 // Unknown content-type: provide ArrayBuffer
-                const raw = await req.arrayBuffer();
+                const raw = await req.arrayBuffer().catch(() => undefined);
                 bodyObj = route.schema?.body ? (route.schema.body as any).parse(raw) : raw;
             } else {
                 // No content-type: try JSON then text, otherwise undefined
                 try {
-                    const raw = await req.json();
+                    const raw = await req.json().catch(() => undefined);
                     bodyObj = route.schema?.body ? (route.schema.body as any).parse(raw) : raw;
                 } catch {
                     try {
-                        const raw = await req.text();
+                        const raw = await req.text().catch(() => undefined);
                         bodyObj = route.schema?.body ? (route.schema.body as any).parse(raw) : raw;
                     } catch {
                         bodyObj = undefined;
@@ -386,7 +445,7 @@ export default class BXO {
                 return new Response(JSON.stringify({ error: "Body is required" }), { status: 400, headers: { "Content-Type": "application/json" } });
             }
         } catch (err: any) {
-            const payload = err?.issues ? { error: "Validation Error", issues: err.issues } : { error: "Validation Error" };
+            const payload = err?.issues ? { error: "Validation Error", issues: err.issues } : { error: "Validation Error", issues: [], message: err.message };
             return new Response(JSON.stringify(payload), { status: 400, headers: { "Content-Type": "application/json" } });
         }
 
@@ -400,7 +459,22 @@ export default class BXO {
             headers: headerObj,
             cookies: cookieObj,
             body: bodyObj,
-            set: { headers: {} },
+            set: { 
+                headers: {},
+                cookie: (name: string, value: string, options: CookieOptions = {}) => {
+                    const cookieString = serializeCookie(name, value, options);
+                    const existingCookies = ctx.set.headers["Set-Cookie"];
+                    if (existingCookies) {
+                        if (Array.isArray(existingCookies)) {
+                            existingCookies.push(cookieString);
+                        } else {
+                            ctx.set.headers["Set-Cookie"] = [existingCookies, cookieString];
+                        }
+                    } else {
+                        ctx.set.headers["Set-Cookie"] = [cookieString];
+                    }
+                }
+            },
             json: (data, status = 200) => {
                 // Response validation if declared
                 if (route.schema?.response?.[status]) {
@@ -449,13 +523,23 @@ export default class BXO {
         if (route.schema) {
             try {
                 if (route.schema.headers) {
-                    (route.schema.headers as any).parse(headerObj);
+                    const headerSchema = route.schema.headers as any;
+                    if (headerSchema.passthrough) {
+                        headerSchema.passthrough().parse(headerObj);
+                    } else {
+                        headerSchema.parse(headerObj);
+                    }
                 }
                 if (route.schema.cookies) {
-                    (route.schema.cookies as any).parse(cookieObj);
+                    const cookieSchema = route.schema.cookies as any;
+                    if (cookieSchema.passthrough) {
+                        cookieSchema.passthrough().parse(cookieObj);
+                    } else {
+                        cookieSchema.parse(cookieObj);
+                    }
                 }
             } catch (err: any) {
-                const payload = err?.issues ? { error: "Validation Error", issues: err.issues } : { error: "Validation Error" };
+                const payload = err?.issues ? { error: "Validation Error", issues: err.issues } : { error: "Validation Error", issues: [], message: err.message };
                 return new Response(JSON.stringify(payload), { status: 400, headers: { "Content-Type": "application/json" } });
             }
         }