cpeak 2.6.0 → 2.7.0

package/lib/types.ts

@@ -1,7 +1,15 @@
 import { IncomingMessage, ServerResponse } from "node:http";
+import type { Readable } from "node:stream";
+import type { Buffer } from "node:buffer";
+import type { CompressionOptions } from "./internal/types";
 
 export type { Cpeak } from "./index";
 
+// For constructor options passed to `cpeak()`
+export interface CpeakOptions {
+  compression?: boolean | CompressionOptions;
+}
+
 // Extending Node.js's Request and Response objects to add our custom properties
 export type StringMap = Record<string, string>;
 
@@ -23,7 +31,12 @@ export interface CpeakResponse extends ServerResponse {
   attachment: (filename?: string) => CpeakResponse;
   cookie: (name: string, value: string, options?: any) => CpeakResponse;
   redirect: (location: string) => void;
-  json: (data: any) => void;
+  json: (data: any) => void | Promise<void>; // sync when compression is off, async when enabled
+  compress: (
+    mime: string,
+    body: Buffer | string | Readable,
+    size?: number
+  ) => Promise<void>;
   [key: string]: any; // allow developers to add their onw extensions (e.g. res.test)
 }
 

package/lib/utils/auth.ts

@@ -2,6 +2,7 @@ import { randomBytes, pbkdf2, createHmac, timingSafeEqual } from "node:crypto";
 import { promisify } from "node:util";
 import type { Middleware } from "../types";
 import { frameworkError, ErrorCode } from "../index";
+import type { AuthOptions, PbkdfOptions } from "./types";
 
 const pbkdf2Async = promisify(pbkdf2);
 
@@ -15,29 +16,6 @@ const DEFAULTS = {
   tokenExpiry: 7 * 24 * 60 * 60 * 1000 // 7 days in ms
 } as const;
 
-export interface PbkdfOptions {
-  iterations?: number;
-  keylen?: number;
-  digest?: string;
-  saltSize?: number;
-}
-
-export interface AuthOptions extends PbkdfOptions {
-  secret: string;
-  saveToken: (
-    tokenId: string,
-    userId: string,
-    expiresAt: Date
-  ) => Promise<void>;
-  findToken: (
-    tokenId: string
-  ) => Promise<{ userId: string; expiresAt: Date } | null>;
-  tokenExpiry?: number;
-  hmacAlgorithm?: string;
-  tokenIdSize?: number;
-  revokeToken?: (tokenId: string) => Promise<void>;
-}
-
 export async function hashPassword(
   password: string,
   options?: PbkdfOptions

package/lib/utils/cookieParser.ts

@@ -1,17 +1,7 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import type { CpeakRequest, CpeakResponse, Next } from "../types";
 import { frameworkError, ErrorCode } from "../index";
-
-export interface CookieOptions {
-  signed?: boolean;
-  httpOnly?: boolean;
-  secure?: boolean;
-  sameSite?: "strict" | "lax" | "none";
-  maxAge?: number; // ms
-  expires?: Date;
-  path?: string;
-  domain?: string;
-}
+import type { CookieOptions } from "./types";
 
 // This will sign the cookie value with HMAC with the secret.
 // Ideal for data like user IDs or session IDs, where you want to ensure the integrity of the cookie value without encryption.

package/lib/utils/cors.ts

@@ -0,0 +1,109 @@
+import type { CpeakRequest, CpeakResponse, Next } from "../types";
+import type { CorsOptions, OriginInput } from "./types";
+
+// Append a value to an existing header without overwriting prior entries
+// (e.g. compression already sets `Vary: Accept-Encoding`).
+function appendVary(res: CpeakResponse, value: string) {
+  const existing = res.getHeader("Vary");
+  if (!existing) return res.setHeader("Vary", value);
+  const current = String(existing)
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  if (current.includes("*") || current.includes(value)) return;
+  res.setHeader("Vary", [...current, value].join(", "));
+}
+
+// Determine if the given origin is allowed based on the rule.
+// Examples of what developers can specify for the rule:
+// - `true` or `*`: allow all origins
+// - `false`: disallow all origins
+// - `"https://example.com"`: allow only this origin
+// - `["https://example.com", "https://foo.com"]`: allow these origins
+// - `/\.example\.com$/`: allow origins that match this regex
+// - `(origin) => origin === "https://example.com"`: custom function to determine if the origin is allowed
+async function isAllowed(
+  origin: string | undefined,
+  rule: OriginInput
+): Promise<boolean> {
+  if (rule === true || rule === "*") return true;
+  if (rule === false || !origin) return false;
+  if (typeof rule === "string") return rule === origin;
+  if (Array.isArray(rule)) return rule.includes(origin);
+  if (rule instanceof RegExp) return rule.test(origin);
+  if (typeof rule === "function") return await rule(origin);
+  return false;
+}
+
+const cors = (options: CorsOptions = {}) => {
+  const {
+    origin = "*",
+    methods = "GET,HEAD,PUT,PATCH,POST,DELETE",
+    allowedHeaders,
+    exposedHeaders,
+    credentials = false,
+    maxAge = 86400,
+    preflightContinue = false,
+    optionsSuccessStatus = 204
+  } = options;
+
+  const methodsStr = Array.isArray(methods) ? methods.join(",") : methods;
+  const allowedHeadersStr = Array.isArray(allowedHeaders)
+    ? allowedHeaders.join(",")
+    : allowedHeaders;
+  const exposedHeadersStr = Array.isArray(exposedHeaders)
+    ? exposedHeaders.join(",")
+    : exposedHeaders;
+
+  return async (req: CpeakRequest, res: CpeakResponse, next: Next) => {
+    const requestOrigin = req.headers.origin;
+
+    // Not a CORS request, nothing to do.
+    if (!requestOrigin) return next();
+
+    const allowed = await isAllowed(requestOrigin, origin);
+    if (!allowed) return next();
+
+    // We cannot combine Access-Control-Allow-Origin: * with
+    // Access-Control-Allow-Credentials: true. Browsers will flat-out reject it.
+    // Instead we'll reflect the origin.
+    const allowOriginValue =
+      origin === "*" && !credentials ? "*" : requestOrigin;
+    res.setHeader("Access-Control-Allow-Origin", allowOriginValue);
+    if (allowOriginValue !== "*") appendVary(res, "Origin");
+
+    if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
+    if (exposedHeadersStr)
+      res.setHeader("Access-Control-Expose-Headers", exposedHeadersStr);
+
+    const isPreflight =
+      req.method === "OPTIONS" &&
+      req.headers["access-control-request-method"] !== undefined;
+
+    if (!isPreflight) return next();
+
+    res.setHeader("Access-Control-Allow-Methods", methodsStr);
+
+    if (allowedHeadersStr) {
+      res.setHeader("Access-Control-Allow-Headers", allowedHeadersStr);
+    } else if (origin === "*") {
+      // If origin is *, just act like an echo chamber for requested headers. Give back whatever the browser asks for.
+      const requested = req.headers["access-control-request-headers"];
+      if (requested) res.setHeader("Access-Control-Allow-Headers", requested);
+    } else {
+      res.setHeader(
+        "Access-Control-Allow-Headers",
+        "Content-Type, Authorization"
+      );
+    }
+
+    res.setHeader("Access-Control-Max-Age", String(maxAge));
+
+    if (preflightContinue) return next();
+
+    res.statusCode = optionsSuccessStatus;
+    res.end();
+  };
+};
+
+export { cors };

package/lib/utils/index.ts

@@ -3,9 +3,8 @@ import { serveStatic } from "./serveStatic";
 import { render } from "./render";
 import { swagger } from "./swagger";
 import { auth, hashPassword, verifyPassword } from "./auth";
-import type { AuthOptions, PbkdfOptions } from "./auth";
 import { cookieParser } from "./cookieParser";
-import type { CookieOptions } from "./cookieParser";
+import { cors } from "./cors";
 
 export {
   serveStatic,
@@ -15,6 +14,6 @@ export {
   auth,
   hashPassword,
   verifyPassword,
-  cookieParser
+  cookieParser,
+  cors
 };
-export type { AuthOptions, PbkdfOptions, CookieOptions };

package/lib/utils/render.ts

@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import { frameworkError } from "../";
+import { compressAndSend } from "../internal/compression";
 import type { CpeakRequest, CpeakResponse, Next } from "../types";
 
 function renderTemplate(
@@ -70,6 +71,12 @@ const render = () => {
 
       let fileStr = await fs.readFile(path, "utf-8");
       const finalStr = renderTemplate(fileStr, data);
+
+      if (res._compression) {
+        await compressAndSend(res, mime, finalStr, res._compression);
+        return;
+      }
+
       res.setHeader("Content-Type", mime);
       res.end(finalStr);
     };

package/lib/utils/types.ts

@@ -0,0 +1,51 @@
+export interface PbkdfOptions {
+  iterations?: number;
+  keylen?: number;
+  digest?: string;
+  saltSize?: number;
+}
+
+export interface AuthOptions extends PbkdfOptions {
+  secret: string;
+  saveToken: (
+    tokenId: string,
+    userId: string,
+    expiresAt: Date
+  ) => Promise<void>;
+  findToken: (
+    tokenId: string
+  ) => Promise<{ userId: string; expiresAt: Date } | null>;
+  tokenExpiry?: number;
+  hmacAlgorithm?: string;
+  tokenIdSize?: number;
+  revokeToken?: (tokenId: string) => Promise<void>;
+}
+
+export interface CookieOptions {
+  signed?: boolean;
+  httpOnly?: boolean;
+  secure?: boolean;
+  sameSite?: "strict" | "lax" | "none";
+  maxAge?: number; // ms
+  expires?: Date;
+  path?: string;
+  domain?: string;
+}
+
+export type OriginInput =
+  | string
+  | string[]
+  | RegExp
+  | boolean
+  | ((origin: string | undefined) => boolean | Promise<boolean>);
+
+export interface CorsOptions {
+  origin?: OriginInput;
+  methods?: string | string[];
+  allowedHeaders?: string | string[];
+  exposedHeaders?: string | string[];
+  credentials?: boolean;
+  maxAge?: number;
+  preflightContinue?: boolean;
+  optionsSuccessStatus?: number;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cpeak",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "A minimal and fast Node.js HTTP framework.",
   "type": "module",
   "scripts": {
@@ -10,12 +10,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/agile8118/cpeak.git"
+    "url": "https://github.com/Cododev-Technology/cpeak.git"
   },
   "bugs": {
-    "url": "https://github.com/agile8118/cpeak/issues"
+    "url": "https://github.com/Cododev-Technology/cpeak/issues"
   },
-  "homepage": "https://github.com/agile8118/cpeak#readme",
+  "homepage": "https://github.com/Cododev-Technology/cpeak#readme",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",