collabmd 0.1.32 → 0.1.34

package/src/server/infrastructure/http/create-request-handler.js

@@ -70,8 +70,7 @@ export function createRequestHandler(
     workspaceMutationCoordinator,
   });
 
-  return async function handleRequest(req, res) {
-    const originalRequestUrl = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+  function handleBasePathRedirect(req, res, originalRequestUrl) {
     if (
       config.basePath
       && (req.method === 'GET' || req.method === 'HEAD')
@@ -80,50 +79,56 @@ export function createRequestHandler(
       const location = `${config.basePath}/${originalRequestUrl.search}`;
       res.writeHead(308, { Location: location });
       res.end();
-      return;
+      return true;
     }
+    return false;
+  }
 
-    const requestUrl = createRequestUrlWithPathname(
-      originalRequestUrl,
-      stripBasePath(originalRequestUrl.pathname, config.basePath),
-    );
-    const isSameOriginWrite = isSameOriginWriteRequest(req, requestUrl);
-
-    setHeaders(res, SECURITY_HEADERS);
-
-    if (req.method === 'OPTIONS') {
-      const requestedMethod = String(req.headers['access-control-request-method'] || '').toUpperCase();
-      const preflightTargetsWrite = WRITE_METHODS.has(requestedMethod);
-      if (preflightTargetsWrite && !isSameOriginWrite) {
-        jsonResponse(req, res, 403, { error: 'Cross-origin write requests are not allowed' });
-        return;
-      }
+  function handleCorsPreflight(req, res, isSameOriginWrite) {
+    if (req.method !== 'OPTIONS') {
+      return false;
+    }
 
-      if (isSameOriginWrite) {
-        applyCorsHeaders(res, req.headers.origin);
-      }
+    const requestedMethod = String(req.headers['access-control-request-method'] || '').toUpperCase();
+    const preflightTargetsWrite = WRITE_METHODS.has(requestedMethod);
+    if (preflightTargetsWrite && !isSameOriginWrite) {
+      jsonResponse(req, res, 403, { error: 'Cross-origin write requests are not allowed' });
+      return true;
+    }
 
-      res.writeHead(204);
-      res.end();
-      return;
+    if (isSameOriginWrite) {
+      applyCorsHeaders(res, req.headers.origin);
     }
 
+    res.writeHead(204);
+    res.end();
+    return true;
+  }
+
+  function handleCorsWriteGuard(req, res, isSameOriginWrite) {
     if (WRITE_METHODS.has(req.method) && !isSameOriginWrite) {
       jsonResponse(req, res, 403, { error: 'Cross-origin write requests are not allowed' });
-      return;
+      return true;
+    }
+    return false;
+  }
+
+  async function handleTestEndpoints(req, res, requestUrl) {
+    if (config.nodeEnv !== 'test') {
+      return false;
     }
 
-    if (config.nodeEnv === 'test' && requestUrl.pathname === '/api/test/reset-state' && req.method === 'POST') {
+    if (requestUrl.pathname === '/api/test/reset-state' && req.method === 'POST') {
       await fileSystemSyncService?.resetForExternalStateChange?.();
       await roomRegistry?.reset?.();
       await backlinkIndex?.build?.();
       await workspaceMutationCoordinator?.initialize?.();
       await fileSystemSyncService?.resetForExternalStateChange?.();
       jsonResponse(req, res, 200, { ok: true });
-      return;
+      return true;
     }
 
-    if (config.nodeEnv === 'test' && requestUrl.pathname === '/api/test/hydrate-delay' && req.method === 'POST') {
+    if (requestUrl.pathname === '/api/test/hydrate-delay' && req.method === 'POST') {
       const body = await parseJsonBody(req).catch(() => ({}));
       testControls.wsRoomHydrateDelayMs = Math.max(0, Number(body?.delayMs) || 0);
       await fileSystemSyncService?.resetForExternalStateChange?.();
@@ -132,6 +137,36 @@ export function createRequestHandler(
       await workspaceMutationCoordinator?.initialize?.();
       await fileSystemSyncService?.resetForExternalStateChange?.();
       jsonResponse(req, res, 200, { delayMs: testControls.wsRoomHydrateDelayMs, ok: true });
+      return true;
+    }
+
+    return false;
+  }
+
+  return async function handleRequest(req, res) {
+    const originalRequestUrl = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+
+    if (handleBasePathRedirect(req, res, originalRequestUrl)) {
+      return;
+    }
+
+    const requestUrl = createRequestUrlWithPathname(
+      originalRequestUrl,
+      stripBasePath(originalRequestUrl.pathname, config.basePath),
+    );
+    const isSameOriginWrite = isSameOriginWriteRequest(req, requestUrl);
+
+    setHeaders(res, SECURITY_HEADERS);
+
+    if (handleCorsPreflight(req, res, isSameOriginWrite)) {
+      return;
+    }
+
+    if (handleCorsWriteGuard(req, res, isSameOriginWrite)) {
+      return;
+    }
+
+    if (await handleTestEndpoints(req, res, requestUrl)) {
       return;
     }