effect 4.0.5 → 4.0.7

package/src/http/MultipartParser/internal/contentType.ts

@@ -16,7 +16,14 @@
  * quoted-pair   = "\" ( HTAB / SP / VCHAR / obs-text )
  */
 const paramRE =
-  /; *([!#$%&'*+.^\w`|~-]+)=("(?:[\v\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u{10ffff}]|\\[\v\u0020-\u{10ffff}])*"|[!#$%&'*+.^\w`|~-]+) */gu
+  /; *([!#$%&'*+.^\w`|~-]+)=("(?:[\t\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u{10ffff}]|\\[\t\u0020-\u{10ffff}])*"|[!#$%&'*+.^\w`|~-]+) */gu
+
+/**
+ * RegExp to match *( ";" disposition-parm ) in RFC 6266 sec 4.1, which allows
+ * optional whitespace around separators
+ */
+const dispositionParamRE =
+  /;[ \t]*([!#$%&'*+.^\w`|~-]+)[ \t]*=[ \t]*("(?:[\t\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u{10ffff}]|\\[\t\u0020-\u{10ffff}])*"|[!#$%&'*+.^\w`|~-]+)[ \t]*/gu
 
 /**
  * RegExp to match quoted-pair in RFC 7230 sec 3.2.6
@@ -24,7 +31,7 @@ const paramRE =
  * quoted-pair = "\" ( HTAB / SP / VCHAR / obs-text )
  * obs-text    = %x80-FF
  */
-const quotedPairRE = /\\([\v\u0020-\u{10ffff}])/gu
+const quotedPairRE = /\\([\t\u0020-\u{10ffff}])/gu
 
 /**
  * RegExp to match type in RFC 7231 sec 3.1.1.1
@@ -34,14 +41,13 @@ const quotedPairRE = /\\([\v\u0020-\u{10ffff}])/gu
  * subtype    = token
  */
 const mediaTypeRE = /^[!#$%&'*+.^\w|~-]+\/[!#$%&'*+.^\w|~-]+$/u
-const mediaTypeRENoSlash = /^[!#$%&'*+.^\w|~-]+$/u
+const dispositionTypeRE = /^[!#$%&'*+.^\w|~-]+$/u
 
 // default ContentType to prevent repeated object creation
 const defaultContentType = { value: "", parameters: Object.create(null) }
 
 export function parse(
-  header: string | undefined,
-  withoutSlash = false
+  header: string | undefined
 ): {
   readonly value: string
   readonly parameters: Record<string, string>
@@ -52,9 +58,8 @@ export function parse(
 
   let index = header.indexOf(";")
   const type = index !== -1 ? header.slice(0, index).trim() : header.trim()
-  const mediaRE = withoutSlash ? mediaTypeRENoSlash : mediaTypeRE
 
-  if (mediaRE.test(type) === false) {
+  if (mediaTypeRE.test(type) === false) {
     return defaultContentType
   }
 
@@ -87,7 +92,7 @@ export function parse(
       // remove quotes and escapes
       value = value.slice(1, value.length - 1)
 
-      if (!withoutSlash && quotedPairRE.test(value)) {
+      if (quotedPairRE.test(value)) {
         value = value.replace(quotedPairRE, "$1")
       }
     }
@@ -101,3 +106,99 @@ export function parse(
 
   return result
 }
+
+// RFC 8187 ext-value: charset "'" [ language ] "'" value-chars
+const extValueRE = /^(utf-8|iso-8859-1)'[a-z0-9-]*'((?:%[0-9a-f]{2}|[!#$&+.^_`|~\w-])*)$/i
+const pctEncodedRE = /%([0-9a-f]{2})/gi
+
+/**
+ * Decodes an RFC 8187 ext-value, returning `undefined` when it is malformed.
+ * ISO-8859-1 is decoded byte by byte because `TextDecoder` treats it as
+ * windows-1252.
+ */
+function decodeExtValue(value: string): string | undefined {
+  const match = extValueRE.exec(value)
+  if (match === null) {
+    return undefined
+  }
+  if (match[1].toLowerCase() === "iso-8859-1") {
+    return match[2].replace(pctEncodedRE, (_, hex: string) => String.fromCharCode(parseInt(hex, 16)))
+  }
+  try {
+    return decodeURIComponent(match[2])
+  } catch {
+    return undefined
+  }
+}
+
+export interface ContentDisposition {
+  readonly value: string
+  readonly parameters: Record<string, string>
+  /** `filename*` decoded per RFC 8187, falling back to `filename` */
+  readonly filename: string | undefined
+}
+
+// default ContentDisposition to prevent repeated object creation
+const defaultContentDisposition: ContentDisposition = { ...defaultContentType, filename: undefined }
+
+/**
+ * Parses a Content-Disposition header according to RFC 6266, returning
+ * `undefined` when it is malformed, repeats a parameter or carries an
+ * undecodable `filename*`.
+ *
+ * Quoted-pairs are left as-is, so unescaped backslashes in file paths survive.
+ */
+export function parseDisposition(
+  header: string | ReadonlyArray<string> | undefined
+): ContentDisposition | undefined {
+  if (header === undefined) {
+    return defaultContentDisposition
+  } else if (typeof header !== "string") {
+    return undefined
+  }
+
+  let index = header.indexOf(";")
+  const type = index !== -1 ? header.slice(0, index).trim() : header.trim()
+
+  if (dispositionTypeRE.test(type) === false) {
+    return undefined
+  }
+
+  const parameters: Record<string, string> = Object.create(null)
+
+  if (index !== -1) {
+    let match: RegExpExecArray | null
+
+    dispositionParamRE.lastIndex = index
+
+    while ((match = dispositionParamRE.exec(header))) {
+      if (match.index !== index) {
+        return undefined
+      }
+
+      index += match[0].length
+      const key = match[1].toLowerCase()
+      const value = match[2]
+
+      if (key in parameters) {
+        return undefined
+      }
+
+      parameters[key] = value[0] === "\"" ? value.slice(1, value.length - 1) : value
+    }
+
+    if (index !== header.length) {
+      return undefined
+    }
+  }
+
+  let filename: string | undefined = parameters.filename
+  if ("filename*" in parameters) {
+    filename = decodeExtValue(parameters["filename*"])
+    if (filename === undefined) {
+      return undefined
+    }
+  }
+
+  return { value: type.toLowerCase(), parameters, filename }
+}

package/src/http/MultipartParser/internal/headers.ts

@@ -1,3 +1,4 @@
+import * as Bytes from "../../../Bytes.ts"
 import type { Continue, FailureReason, ReturnValue } from "../HeadersParser.ts"
 
 const constMaxPairs = 100
@@ -55,13 +56,6 @@ export function make() {
     return value
   }
 
-  function concatUint8Array(a: Uint8Array, b: Uint8Array): Uint8Array {
-    const newUint8Array = new Uint8Array(a.length + b.length)
-    newUint8Array.set(a)
-    newUint8Array.set(b, a.length)
-    return newUint8Array
-  }
-
   function error(reason: FailureReason) {
     return reset({ _tag: "Failure", reason, headers: state.headers })
   }
@@ -73,11 +67,8 @@ export function make() {
       endOffset = state.previousChunk.length
       previousCursor = endOffset
 
-      const newChunk = new Uint8Array(chunk.length + endOffset)
-      newChunk.set(state.previousChunk)
-      newChunk.set(chunk, endOffset)
+      chunk = Bytes.concat([state.previousChunk, chunk])
       state.previousChunk = undefined
-      chunk = newChunk
     }
     const end = chunk.length
 
@@ -182,10 +173,7 @@ export function make() {
             } else if (state.crlf >= 2) {
               state.value = state.value === undefined
                 ? chunk.subarray(start, i - state.crlf)
-                : concatUint8Array(
-                  state.value,
-                  chunk.subarray(start, i - state.crlf)
-                )
+                : Bytes.concat([state.value, chunk.subarray(start, i - state.crlf)])
               const value = decoder.decode(state.value)
               if (state.headers[state.key] === undefined) {
                 state.headers[state.key] = value
@@ -229,7 +217,7 @@ export function make() {
         if (i === end) {
           state.value = state.value === undefined
             ? chunk.subarray(start, end)
-            : concatUint8Array(state.value, chunk.subarray(start, end))
+            : Bytes.concat([state.value, chunk.subarray(start, end)])
           return constContinue
         }
       }

package/src/http/MultipartParser/internal/multipart.ts

@@ -1,3 +1,4 @@
+import * as Bytes from "../../../Bytes.ts"
 import * as ByteSize from "../../../ByteSize.ts"
 import type { Config, MultipartError, PartInfo } from "../../MultipartParser.ts"
 import * as CT from "./contentType.ts"
@@ -117,18 +118,10 @@ export function make({
           if (state.isFile) {
             state.onChunk(null)
           } else {
-            if (state.fieldChunks.length === 1) {
-              onField(state.info, state.fieldChunks[0])
-            } else {
-              const buf = new Uint8Array(state.fieldSize)
-              let offset = 0
-              for (let i = 0; i < state.fieldChunks.length; i++) {
-                const chunk = state.fieldChunks[i]
-                buf.set(chunk, offset)
-                offset += chunk.length
-              }
-              onField(state.info, buf)
-            }
+            onField(
+              state.info,
+              state.fieldChunks.length === 1 ? state.fieldChunks[0] : Bytes.concat(state.fieldChunks)
+            )
             state.fieldSize = 0
             state.fieldChunks = []
           }
@@ -167,36 +160,21 @@ export function make({
         }
 
         const contentType = CT.parse(result.headers["content-type"] as string)
-        const contentDisposition = CT.parse(
-          result.headers["content-disposition"] as string,
-          true
-        )
+        const contentDisposition = CT.parseDisposition(result.headers["content-disposition"])
 
         if (
-          "form-data" === contentDisposition.value &&
-          !("name" in contentDisposition.parameters)
+          contentDisposition === undefined ||
+          ("form-data" === contentDisposition.value && !("name" in contentDisposition.parameters))
         ) {
           skipBody()
           return onError(errInvalidDisposition)
         }
 
-        let encodedFilename: string | undefined
-        if ("filename*" in contentDisposition.parameters) {
-          const parts = contentDisposition.parameters["filename*"].split("''")
-          if (parts.length === 2) {
-            try {
-              encodedFilename = decodeURIComponent(parts[1])
-            } catch {
-              encodedFilename = parts[1]
-            }
-          }
-        }
-
         state.info = {
           name: contentDisposition.parameters.name ?? "",
-          filename: encodedFilename ?? contentDisposition.parameters.filename,
+          filename: contentDisposition.filename,
           contentType: contentType.value === ""
-            ? contentDisposition.parameters.filename !== undefined
+            ? contentDisposition.filename !== undefined
               ? "application/octet-stream"
               : "text/plain"
             : contentType.value,

package/src/http/Url.ts

@@ -68,7 +68,12 @@ const baseUrl = (): string | undefined => {
     globalThis.location.origin !== undefined &&
     globalThis.location.pathname !== undefined
   ) {
-    return location.origin + location.pathname
+    const base = location.origin + location.pathname
+    try {
+      return new URL(base).href
+    } catch {
+      return undefined
+    }
   }
   return undefined
 }

package/src/http/UrlParams.ts

@@ -870,7 +870,9 @@ const currentRedactedNames = (): ReadonlyArray<string | RegExp> =>
  *
  * **Details**
  *
- * Defaults include `AWSAccessKeyId`, `Signature`, `sig` and `X-Goog-Signature`.
+ * Defaults match the OpenTelemetry `url.full` list: `X-Amz-Signature`,
+ * `X-Amz-Credential`, `X-Amz-Security-Token`, `AWSAccessKeyId`, `Signature`,
+ * `sig` and `X-Goog-Signature`.
  * A custom list replaces the defaults. Matching uses `isRedactedName`.
  * Redaction leaves request URLs and parameter values unchanged. `Redacted`
  * values are redacted regardless of this list.
@@ -883,6 +885,9 @@ export const CurrentRedactedNames = Context.Reference<
   ReadonlyArray<string | RegExp>
 >("effect/http/UrlParams/CurrentRedactedNames", {
   defaultValue: () => [
+    "X-Amz-Signature",
+    "X-Amz-Credential",
+    "X-Amz-Security-Token",
     "AWSAccessKeyId",
     "Signature",
     "sig",

package/src/http/internal/compression.ts

@@ -155,13 +155,12 @@ const acceptMember = /^([a-z0-9!#$%&'*+.^_`|~-]+)(?:;q=(0(?:\.[0-9]{0,3})?|1(?:\
  * @internal
  */
 export const parseAcceptEncoding = (header: string): ReadonlyMap<string, number> | undefined => {
-  const trimmed = header.trim()
-  if (trimmed === "") {
-    return undefined
-  }
   const accepted = new Map<string, number>()
-  for (const part of trimmed.split(",")) {
+  for (const part of header.split(",")) {
     const member = part.trim().toLowerCase().replace(/[ \t]*;[ \t]*/g, ";")
+    if (member === "") {
+      continue
+    }
     const match = acceptMember.exec(member)
     if (match === null) {
       return undefined

package/src/http/internal/decompression.ts

@@ -13,6 +13,7 @@ import { HttpServerError, RequestParseError } from "../HttpServerError.ts"
 import * as HttpServerRequest from "../HttpServerRequest.ts"
 import * as Multipart from "../Multipart.ts"
 import * as UrlParams from "../UrlParams.ts"
+import * as lazyStream from "./lazyStream.ts"
 
 /**
  * @internal
@@ -80,6 +81,8 @@ export class DecompressedRequest extends Inspectable.Class implements HttpServer
       readonly url?: string
       readonly headers?: Headers.Headers
       readonly remoteAddress?: Option.Option<string>
+      readonly peerAddress?: Option.Option<string>
+      readonly protocol?: "http" | "https"
     }
   ): HttpServerRequest.HttpServerRequest {
     return new DecompressedRequest(this.inner.modify(options), this.codings, this.maxDecompressedSize)
@@ -109,10 +112,24 @@ export class DecompressedRequest extends Inspectable.Class implements HttpServer
     return this.inner.remoteAddress
   }
 
+  get peerAddress(): Option.Option<string> {
+    return this.inner.peerAddress
+  }
+
+  get protocol(): "http" | "https" | undefined {
+    return this.inner.protocol
+  }
+
   get upgrade(): Effect.Effect<Socket.Socket, HttpServerError> {
     return this.inner.upgrade
   }
 
+  upgradeWith(
+    options: { readonly headers?: Headers.Input | undefined }
+  ): Effect.Effect<Socket.Socket, HttpServerError> {
+    return this.inner.upgradeWith(options)
+  }
+
   // Platform accessors such as `NodeHttpServerRequest.toServerResponse` read
   // the response handle from the request.
   get response(): unknown {
@@ -120,7 +137,8 @@ export class DecompressedRequest extends Inspectable.Class implements HttpServer
   }
 
   get stream(): Stream.Stream<Uint8Array, HttpServerError> {
-    return Stream.unwrap(Effect.withFiber((fiber) => {
+    // Read the inner body only once the decompressed body is pulled.
+    return lazyStream.openOnFirstPull(Stream.unwrap(Effect.withFiber((fiber) => {
       const limit = this.maxDecompressedSize ?? fiber.getRef(HttpIncomingMessage.MaxBodySize) ??
         defaultMaxDecompressedSize
       return Effect.succeed(Stream.fromReadableStream({
@@ -149,7 +167,7 @@ export class DecompressedRequest extends Inspectable.Class implements HttpServer
         },
         onError: (cause) => cause instanceof HttpServerError ? cause : this.parseError(cause)
       }))
-    }))
+    })))
   }
 
   private bytesEffect: Effect.Effect<Uint8Array, HttpServerError> | undefined
@@ -186,10 +204,15 @@ export class DecompressedRequest extends Inspectable.Class implements HttpServer
 
   get multipartStream(): Stream.Stream<Multipart.Part, Multipart.MultipartError> {
     return Stream.pipeThroughChannel(
-      Stream.mapError(
-        this.stream,
-        (cause) => Multipart.MultipartError.fromReason(multipartReasons.get(cause) ?? "InternalError", cause)
-      ),
+      Stream.mapError(this.stream, (cause) =>
+        // Failures raised by this request come from the client's data. Failures
+        // passed through from the inner request are transport errors.
+        Multipart.MultipartError.fromReason(
+          cause.reason instanceof RequestParseError && cause.reason.request === this
+            ? cause.reason.reason ?? "Parse"
+            : "InternalError",
+          cause
+        )),
       Multipart.makeChannel(this.headers)
     )
   }
@@ -202,25 +225,17 @@ export class DecompressedRequest extends Inspectable.Class implements HttpServer
   private parseError(
     cause: unknown,
     description?: string,
-    multipartReason: MultipartReason = "Parse"
+    reason: RequestParseError["reason"] = "Parse"
   ): HttpServerError {
-    const error = new HttpServerError({
+    return new HttpServerError({
       reason: new RequestParseError({
         request: this,
+        reason,
         ...(description === undefined ? undefined : { description }),
         ...(cause === undefined ? undefined : { cause })
       })
     })
-    multipartReasons.set(error, multipartReason)
-    return error
   }
 }
 
 const textDecoder = new TextDecoder()
-
-type MultipartReason = "Parse" | "BodyTooLarge"
-
-// Failures caused by the client's data, keyed to the multipart reason they map
-// to. Transport errors from the inner request are absent and map to
-// `InternalError`.
-const multipartReasons = new WeakMap<HttpServerError, MultipartReason>()

package/src/http/internal/httpBody.ts

@@ -11,9 +11,17 @@ export const updateHeaders = (headers: Headers.Headers, body: HttpBody.HttpBody)
   headers = body.contentType === undefined
     ? Headers.remove(headers, "content-type")
     : Headers.set(headers, "content-type", body.contentType)
-  return body.contentLength === undefined
+  return updateContentLength(headers, body)
+}
+
+/**
+ * @internal
+ */
+export const updateContentLength = (headers: Headers.Headers, body: HttpBody.HttpBody): Headers.Headers => {
+  const contentLength = body._tag === "Empty" || body._tag === "FormData" ? undefined : body.contentLength
+  return contentLength === undefined
     ? Headers.remove(headers, "content-length")
-    : Headers.set(headers, "content-length", body.contentLength.toString())
+    : Headers.set(headers, "content-length", contentLength.toString())
 }
 
 /**

package/src/http/internal/lazyStream.ts

@@ -0,0 +1,25 @@
+import type * as Arr from "../../Array.ts"
+import * as Channel from "../../Channel.ts"
+import * as Effect from "../../Effect.ts"
+import type * as Pull from "../../Pull.ts"
+import * as Stream from "../../Stream.ts"
+
+/**
+ * Opens `stream` on its first pull rather than when it is run, so a consumer
+ * that runs it without pulling, such as a Web `ReadableStream`, leaves the
+ * body unread.
+ *
+ * @internal
+ */
+export const openOnFirstPull = <A, E, R>(stream: Stream.Stream<A, E, R>): Stream.Stream<A, E, R> =>
+  Stream.fromChannel(Channel.fromTransform((_, scope) =>
+    Effect.sync(() => {
+      let pull: Pull.Pull<Arr.NonEmptyReadonlyArray<A>, E, void, R> | undefined
+      return Effect.suspend(() =>
+        pull ?? Effect.flatMap(Channel.toPullScoped(stream.channel, scope), (upstream) => {
+          pull = upstream
+          return upstream
+        })
+      )
+    })
+  ))

package/src/http/internal/requestState.ts

@@ -0,0 +1,33 @@
+import * as Context from "../../Context.ts"
+import * as Effect from "../../Effect.ts"
+import type { PreResponseHandler } from "../HttpEffect.ts"
+
+/**
+ * Mutable state owned by the root that handles a single server request.
+ *
+ * @internal
+ */
+export class RequestState {
+  preResponseHandler: PreResponseHandler | undefined = undefined
+  loggerDisabled = false
+}
+
+/**
+ * Provided by request roots alongside `HttpServerRequest`. It has no default,
+ * so writes outside a request do not reach shared state.
+ *
+ * @internal
+ */
+export const CurrentRequestState = Context.Service<RequestState>("effect/http/HttpEffect/CurrentRequestState")
+
+/**
+ * @internal
+ */
+export const appendPreResponseHandlerUnsafe = (context: Context.Context<never>, handler: PreResponseHandler): void => {
+  const state = Context.getOrUndefined(context, CurrentRequestState)
+  if (state === undefined) return
+  const prev = state.preResponseHandler
+  state.preResponseHandler = prev ?
+    (request, response) => Effect.flatMap(prev(request, response), (response) => handler(request, response))
+    : handler
+}

package/src/http/internal/urlParams.ts

@@ -3,3 +3,32 @@ import * as Redacted from "../../Redacted.ts"
 /** @internal */
 export const unwrap = (value: string | Redacted.Redacted): string =>
   typeof value === "string" ? value : Redacted.value(value)
+
+/** @internal */
+export const stripSearchAndHash = (url: string): string => {
+  const queryIndex = url.indexOf("?")
+  const hashIndex = url.indexOf("#")
+
+  if (queryIndex === -1) {
+    return hashIndex === -1 ? url : url.slice(0, hashIndex)
+  }
+  if (hashIndex === -1) {
+    return url.slice(0, queryIndex)
+  }
+  return url.slice(0, Math.min(queryIndex, hashIndex))
+}
+
+const originForm = /^\/(?![/\\])/
+
+/** @internal */
+export const toPath = (url: string): string => {
+  // Origin-form targets and "*" are already paths; absolute URLs can carry credentials.
+  if (url === "*" || originForm.test(url)) {
+    return stripSearchAndHash(url)
+  }
+  try {
+    return new URL(url, "http://localhost").pathname
+  } catch {
+    return "<invalid URL>"
+  }
+}

package/src/http/internal/webResponse.ts

@@ -0,0 +1,20 @@
+/**
+ * Returns the original Web `Response` of a fetch-backed client response.
+ * Wrappers forward it to the response they wrap.
+ *
+ * @internal
+ */
+export const WebSourceSymbol = "~effect/http/HttpClientResponse/WebSource"
+
+/**
+ * @internal
+ */
+export interface WebSource {
+  readonly [WebSourceSymbol]: () => globalThis.Response | undefined
+}
+
+/**
+ * @internal
+ */
+export const getWebSource = (self: object): globalThis.Response | undefined =>
+  (self as Partial<WebSource>)[WebSourceSymbol]?.()

package/src/http-api/HttpApi.ts

@@ -322,7 +322,7 @@ const extractResponseContent = (
 
   function add(schema: Schema.Top) {
     const body = HttpApiSchema.isWithHeaders(schema) ? schema.schema : schema
-    if (HttpApiSchema.isStreamSchema(body)) return
+    if (HttpApiSchema.isStreamSchema(body) || HttpApiSchema.isUpgrade(body)) return
     const status = getStatus(schema)
     const schemas = map.get(status)
     if (schemas === undefined) {
@@ -371,12 +371,9 @@ export class AdditionalSchemas extends Context.Service<
  *
  * Header codecs receive all HTTP headers, including undeclared transport
  * headers such as `content-type`, `content-length`, `host`, `user-agent` and
- * proxy headers. Without `HeadersParseOptions`, headers use `ParseOptions`:
- *
- * - `onExcessProperty: "error"` rejects real requests and `WithHeaders`
- *   responses with transport headers.
- * - `onExcessProperty: "preserve"` includes transport headers in the decoded
- *   value.
+ * proxy headers. Without `HeadersParseOptions`, headers use `ParseOptions`, so
+ * `onExcessProperty: "error"` rejects real requests and `WithHeaders` responses
+ * with transport headers.
  *
  * Set `HeadersParseOptions` to `{}` at the API level to use Schema defaults for
  * headers, even if an endpoint sets `ParseOptions`.