fastify 5.12.1 → 5.12.2

package/test/schema-feature.test.js

@@ -471,6 +471,164 @@ test('Should emit a warning for every route with undefined schema', (t, testDone
   })
 })
 
+test('Default validator compiler is initialized for a route whose only schema is false', async (t) => {
+  t.plan(2)
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  fastify.post('/body', {
+    handler: echoBody,
+    schema: {
+      body: false
+    }
+  })
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/body',
+    payload: {}
+  })
+
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.ok(fastify.validatorCompiler, 'validator compiler is initialized')
+})
+
+test('Boolean false request schemas reject every request and no handler executes', async (t) => {
+  t.plan(5)
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  let bodyExecuted = false
+  let qsExecuted = false
+  let paramsExecuted = false
+  let headersExecuted = false
+
+  fastify.post('/body', {
+    handler: async () => { bodyExecuted = true; return { protectedActionExecuted: true } },
+    schema: { body: false }
+  })
+  fastify.get('/querystring', {
+    handler: async () => { qsExecuted = true; return { protectedActionExecuted: true } },
+    schema: { querystring: false }
+  })
+  fastify.post('/params/:id', {
+    handler: async () => { paramsExecuted = true; return { protectedActionExecuted: true } },
+    schema: { params: false }
+  })
+  fastify.post('/headers', {
+    handler: async () => { headersExecuted = true; return { protectedActionExecuted: true } },
+    schema: { headers: false }
+  })
+
+  const r1 = await fastify.inject({ method: 'POST', url: '/body', payload: {} })
+  t.assert.strictEqual(r1.statusCode, 400)
+  const r2 = await fastify.inject({ method: 'GET', url: '/querystring' })
+  t.assert.strictEqual(r2.statusCode, 400)
+  const r3 = await fastify.inject({ method: 'POST', url: '/params/1' })
+  t.assert.strictEqual(r3.statusCode, 400)
+  const r4 = await fastify.inject({ method: 'POST', url: '/headers' })
+  t.assert.strictEqual(r4.statusCode, 400)
+
+  t.assert.deepStrictEqual({
+    bodyExecuted,
+    qsExecuted,
+    paramsExecuted,
+    headersExecuted
+  }, {
+    bodyExecuted: false,
+    qsExecuted: false,
+    paramsExecuted: false,
+    headersExecuted: false
+  })
+})
+
+test('Custom validator compiler receives the literal boolean false schema', async (t) => {
+  t.plan(3)
+  const received = []
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  fastify.post('/body', {
+    handler: async () => ({ ok: true }),
+    schema: { body: false },
+    validatorCompiler: ({ schema, httpPart }) => {
+      received.push({ schema, httpPart })
+      return () => { throw new Error('should not validate') }
+    }
+  })
+
+  await fastify.ready()
+  t.assert.strictEqual(received.length, 1)
+  t.assert.strictEqual(received[0].schema, false)
+  t.assert.strictEqual(received[0].httpPart, 'body')
+})
+
+test('FSTWRN001 is emitted only for explicitly undefined schemas, not boolean false', async (t) => {
+  t.plan(4)
+  const spyData = spyWarning(FSTWRN001)
+  t.after(spyData.restore)
+
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  fastify.post('/false-body', {
+    handler: async () => ({ ok: true }),
+    schema: { body: false }
+  })
+  fastify.post('/undefined-body', {
+    handler: async () => ({ ok: true }),
+    schema: { body: undefined }
+  })
+
+  await fastify.ready()
+  t.assert.strictEqual(spyData.callCount(), 1)
+  t.assert.deepStrictEqual(spyData.calls[0], { arguments: ['body', 'POST', '/undefined-body'], result: true })
+
+  const r1 = await fastify.inject({ method: 'POST', url: '/false-body', payload: {} })
+  t.assert.strictEqual(r1.statusCode, 400)
+  const r2 = await fastify.inject({ method: 'POST', url: '/undefined-body', payload: {} })
+  t.assert.strictEqual(r2.statusCode, 200)
+})
+
+test('Invalid null schema fails closed during schema compilation', async (t) => {
+  t.plan(3)
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  let handlerExecuted = false
+  fastify.post('/null-body', {
+    handler: async () => { handlerExecuted = true; return { ok: true } },
+    schema: { body: null }
+  })
+
+  await t.assert.rejects(fastify.ready(), (err) => {
+    t.assert.strictEqual(err.code, 'FST_ERR_SCH_VALIDATION_BUILD')
+    return true
+  })
+  t.assert.strictEqual(handlerExecuted, false)
+})
+
+test('Boolean false request schema via the query alias rejects every request', async (t) => {
+  const fastify = Fastify()
+  let handlerExecuted = false
+
+  // `query` is a documented alias for `querystring`; a deny-all `false` must be
+  // aliased and enforced just like the canonical key.
+  fastify.get('/', {
+    handler: async () => { handlerExecuted = true; return { protectedActionExecuted: true } },
+    schema: { query: false }
+  })
+
+  const res = await fastify.inject({ method: 'GET', url: '/?x=1' })
+
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.strictEqual(handlerExecuted, false)
+})
+
+test('Setting both query and querystring still throws (boolean false included)', async (t) => {
+  const fastify = Fastify()
+  fastify.get('/', {
+    handler: async () => ({ ok: true }),
+    schema: { query: false, querystring: false }
+  })
+  await t.assert.rejects(fastify.ready())
+})
+
 test('First level $ref', (t, testDone) => {
   t.plan(2)
   const fastify = Fastify()

package/test/schema-special-usage.test.js

@@ -939,6 +939,87 @@ test('Supports async AJV validation', (t, testDone) => {
   completion.patience.then(testDone)
 })
 
+// @see https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
+test('async validation result must not replace the request body (value collision)', async (t) => {
+  const fastify = Fastify()
+  fastify.post('/', {
+    schema: {
+      body: {
+        $async: true,
+        type: 'object',
+        additionalProperties: true,
+        properties: { hello: { type: 'string' } }
+      }
+    },
+    handler: async (request) => request.body
+  })
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ hello: 'world', value: { hello: 'evil' } })
+  })
+
+  t.assert.strictEqual(res.statusCode, 200)
+  // The validated body must be preserved; a `value` key must NOT replace it.
+  t.assert.deepStrictEqual(res.json(), { hello: 'world', value: { hello: 'evil' } })
+})
+
+// @see https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
+test('async validation result must not be treated as an error (error collision)', async (t) => {
+  const fastify = Fastify()
+  fastify.post('/', {
+    schema: {
+      body: {
+        $async: true,
+        type: 'object',
+        additionalProperties: true,
+        properties: { hello: { type: 'string' } }
+      }
+    },
+    handler: async (request) => request.body
+  })
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ hello: 'world', error: 'boom' })
+  })
+
+  // An `error` key in the payload must NOT be treated as a validation failure.
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.deepStrictEqual(res.json(), { hello: 'world', error: 'boom' })
+})
+
+test('async custom validator resolving false uses its validation errors', async t => {
+  const fastify = Fastify()
+  fastify.setValidatorCompiler(() => {
+    const validate = () => Promise.resolve(false)
+    validate.errors = [{
+      instancePath: '',
+      schemaPath: '#/custom',
+      keyword: 'custom',
+      params: {},
+      message: 'must pass custom validation'
+    }]
+    return validate
+  })
+  fastify.post('/', {
+    schema: { body: { type: 'object' } }
+  }, async () => ({ ok: true }))
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    payload: {}
+  })
+
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.strictEqual(res.json().code, 'FST_ERR_VALIDATION')
+})
+
 test('Check all the async AJV validation paths', async (t) => {
   const fastify = Fastify({
     exposeHeadRoutes: false,

package/test/schema-validation.test.js

@@ -7,6 +7,8 @@ const AJV = require('ajv')
 const Schema = require('fluent-json-schema')
 const { waitForCb } = require('./helper')
 const { kRequestContentType } = require('../lib/symbols')
+const { spyWarning } = require('process-warning')
+const { FSTSEC002 } = require('../lib/warnings')
 
 const customSchemaCompilers = {
   body: new AJV({
@@ -1615,3 +1617,379 @@ test('coercion of empty string to null with nullable types', async t => {
   })
   assert.strictEqual(JSON.parse(res.payload).param, null)
 })
+
+test('header schema dependencies with canonical-case names are enforced', async t => {
+  const fastify = Fastify()
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: {
+          'X-Admin': { type: 'string', const: 'true' },
+          'X-Admin-Token': { type: 'string', const: 'server-secret' }
+        },
+        dependencies: {
+          'X-Admin': ['X-Admin-Token']
+        }
+      }
+    }
+  }, async () => {
+    return { adminAction: true }
+  })
+
+  await fastify.ready()
+
+  // Missing the token required by the dependency must be rejected even though
+  // the dependency trigger is written in canonical case. Node.js stores the
+  // received header as `x-admin`, and the normalized schema must lowercase the
+  // dependency trigger so Ajv sees it and enforces the token assertion.
+  const missingToken = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true' }
+  })
+  t.assert.strictEqual(missingToken.statusCode, 400)
+  t.assert.strictEqual(missingToken.json().code, 'FST_ERR_VALIDATION')
+
+  // Direct property constraints remain active: a wrong token is rejected too.
+  const wrongToken = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true', 'X-Admin-Token': 'wrong' }
+  })
+  t.assert.strictEqual(wrongToken.statusCode, 400)
+  t.assert.strictEqual(wrongToken.json().code, 'FST_ERR_VALIDATION')
+
+  const valid = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true', 'X-Admin-Token': 'server-secret' }
+  })
+  t.assert.strictEqual(valid.statusCode, 200)
+  t.assert.deepStrictEqual(valid.json(), { adminAction: true })
+})
+
+test('header schema dependencies: lowercase-equivalent schema behaves identically', async t => {
+  const fastify = Fastify()
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: {
+          'x-admin': { type: 'string', const: 'true' },
+          'x-admin-token': { type: 'string', const: 'server-secret' }
+        },
+        dependencies: {
+          'x-admin': ['x-admin-token']
+        }
+      }
+    }
+  }, async () => {
+    return { adminAction: true }
+  })
+
+  await fastify.ready()
+
+  const missingToken = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true' }
+  })
+  t.assert.strictEqual(missingToken.statusCode, 400)
+  t.assert.strictEqual(missingToken.json().code, 'FST_ERR_VALIDATION')
+
+  const wrongToken = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true', 'X-Admin-Token': 'wrong' }
+  })
+  t.assert.strictEqual(wrongToken.statusCode, 400)
+  t.assert.strictEqual(wrongToken.json().code, 'FST_ERR_VALIDATION')
+
+  const valid = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true', 'X-Admin-Token': 'server-secret' }
+  })
+  t.assert.strictEqual(valid.statusCode, 200)
+  t.assert.deepStrictEqual(valid.json(), { adminAction: true })
+})
+
+test('header schema dependencies are normalized in nested subschemas', async t => {
+  const fastify = Fastify()
+
+  // The dependency lives inside an `allOf` subschema; its trigger and dependent
+  // names must be lowercased the same way as root-level `dependencies`.
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        allOf: [{
+          properties: { 'X-Admin': { type: 'string', const: 'true' } },
+          dependencies: { 'X-Admin': ['X-Admin-Token'] }
+        }]
+      }
+    }
+  }, async () => {
+    return { ok: true }
+  })
+
+  await fastify.ready()
+
+  const missingToken = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true' }
+  })
+  t.assert.strictEqual(missingToken.statusCode, 400)
+  t.assert.strictEqual(missingToken.json().code, 'FST_ERR_VALIDATION')
+
+  const valid = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true', 'X-Admin-Token': 'server-secret' }
+  })
+  t.assert.strictEqual(valid.statusCode, 200)
+})
+
+test('header schema dependencies are normalized in local $ref definitions', async t => {
+  const fastify = Fastify()
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        $ref: '#/definitions/Headers',
+        definitions: {
+          Headers: {
+            type: 'object',
+            properties: {
+              'X-Admin': { type: 'string', const: 'true' },
+              'X-Admin-Token': { type: 'string', const: 'server-secret' }
+            },
+            dependencies: {
+              'X-Admin': ['X-Admin-Token']
+            }
+          }
+        }
+      }
+    }
+  }, async () => {
+    return { ok: true }
+  })
+
+  await fastify.ready()
+
+  const missingToken = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true' }
+  })
+  t.assert.strictEqual(missingToken.statusCode, 400)
+  t.assert.strictEqual(missingToken.json().code, 'FST_ERR_VALIDATION')
+
+  const valid = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true', 'X-Admin-Token': 'server-secret' }
+  })
+  t.assert.strictEqual(valid.statusCode, 200)
+})
+
+test('header schema dependencies: subschema-form dependency values are normalized', async t => {
+  const fastify = Fastify()
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: { 'X-Admin': { type: 'string', const: 'true' } },
+        dependencies: {
+          'X-Admin': {
+            properties: { 'X-Admin-Token': { type: 'string', const: 'server-secret' } },
+            required: ['X-Admin-Token']
+          }
+        }
+      }
+    }
+  }, async () => {
+    return { ok: true }
+  })
+
+  await fastify.ready()
+
+  const missingToken = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true' }
+  })
+  t.assert.strictEqual(missingToken.statusCode, 400)
+  t.assert.strictEqual(missingToken.json().code, 'FST_ERR_VALIDATION')
+
+  const valid = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Admin': 'true', 'X-Admin-Token': 'server-secret' }
+  })
+  t.assert.strictEqual(valid.statusCode, 200)
+})
+
+test('header schema lowercasing does not mutate the input schema', async t => {
+  const headers = {
+    type: 'object',
+    properties: {
+      'X-Admin': { type: 'string', const: 'true' },
+      'X-Admin-Token': { type: 'string', const: 'server-secret' }
+    },
+    dependencies: {
+      'X-Admin': ['X-Admin-Token']
+    }
+  }
+  const schema = { headers }
+  const schemaBefore = JSON.stringify(schema)
+  const headersBefore = JSON.stringify(headers)
+
+  const fastify = Fastify()
+  fastify.get('/', { schema }, async () => {
+    return { ok: true }
+  })
+  await fastify.ready()
+
+  t.assert.strictEqual(JSON.stringify(schema), schemaBefore)
+  t.assert.strictEqual(JSON.stringify(headers), headersBefore)
+})
+
+test('header schema with an external $ref emits FSTSEC002 (case-normalization does not reach it)', async t => {
+  const spyData = spyWarning(FSTSEC002)
+  t.after(spyData.restore)
+
+  const fastify = Fastify()
+  fastify.addSchema({
+    $id: 'http://example.com/admin-headers',
+    type: 'object',
+    properties: {
+      'X-Admin': { type: 'string', const: 'true' },
+      'X-Admin-Token': { type: 'string', const: 'server-secret' }
+    },
+    dependencies: { 'X-Admin': ['X-Admin-Token'] }
+  })
+  fastify.post('/', {
+    schema: { headers: { $ref: 'http://example.com/admin-headers#' } }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  t.assert.strictEqual(spyData.callCount(), 1)
+  t.assert.deepStrictEqual(spyData.calls[0].arguments, ['POST', '/', 'http://example.com/admin-headers#'])
+})
+
+test('inline and local $ref header schemas do not emit FSTSEC002', async t => {
+  const spyData = spyWarning(FSTSEC002)
+  t.after(spyData.restore)
+
+  const fastify = Fastify()
+  // inline header schema
+  fastify.get('/inline', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: { 'X-Admin': { type: 'string' } },
+        dependencies: { 'X-Admin': ['X-Admin-Token'] }
+      }
+    }
+  }, async () => ({ ok: true }))
+  // local same-document $ref header schema
+  fastify.get('/local', {
+    schema: {
+      headers: {
+        type: 'object',
+        $ref: '#/definitions/h',
+        definitions: {
+          h: {
+            type: 'object',
+            properties: { 'X-Admin': { type: 'string' } },
+            dependencies: { 'X-Admin': ['X-Admin-Token'] }
+          }
+        }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  t.assert.strictEqual(spyData.callCount(), 0)
+})
+
+test('header schema normalization traverses dependent schema keywords', async t => {
+  const fastify = Fastify({
+    ajv: { customOptions: { strictSchema: false } }
+  })
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        dependentSchemas: {
+          'X-Admin': {
+            properties: { 'X-Admin-Token': { type: 'string' } }
+          }
+        },
+        dependentRequired: {
+          'X-Admin': ['X-Admin-Token']
+        }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+  t.assert.ok(true)
+})
+
+test('header schema normalization preserves malformed keyword values for validation errors', async t => {
+  const fastify = Fastify()
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: null,
+        required: null,
+        dependencies: null,
+        dependentSchemas: null,
+        dependentRequired: null,
+        definitions: null
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await t.assert.rejects(fastify.ready())
+})
+
+test('header schema detects an external $ref nested in an array', async t => {
+  const spyData = spyWarning(FSTSEC002)
+  t.after(spyData.restore)
+
+  const fastify = Fastify()
+  fastify.addSchema({
+    $id: 'http://example.com/nested-admin-headers',
+    type: 'object',
+    properties: { 'X-Admin': { type: 'string' } }
+  })
+  fastify.post('/', {
+    schema: {
+      headers: {
+        allOf: [{ $ref: 'http://example.com/nested-admin-headers#' }]
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  t.assert.strictEqual(spyData.callCount(), 1)
+  t.assert.deepStrictEqual(spyData.calls[0].arguments, [
+    'POST',
+    '/',
+    'http://example.com/nested-admin-headers#'
+  ])
+})

package/.pi/self-learning-memory/README.md

@@ -1,8 +0,0 @@
-# Self-learning memory
-
-This folder is auto-managed by pi-self-learning.
-
-- daily/: day-by-day reflections
-- monthly/: monthly summaries
-- core/CORE.md: top-ranked durable learnings
-- long-term-memory.md: complete learning history

package/.pi/self-learning-memory/core/CORE.md

@@ -1,33 +0,0 @@
-# Core Learnings
-
-Most important durable learnings collected over time.
-Last updated: 2026-08-18T19:46:43.092Z
-
-This file keeps only top-ranked, most repeated items.
-For the complete history, see long-term-memory.md.
-
-Ranked by frequency + recency (with light decay over time).
-
-## High-value learnings
-- Closed PR #1 without merging after confirming its head SHA was already the intended private `main` commit.
-- Fetched current `origin/main` and `origin/5.x`, verified each security commit’s parent exactly matched the corresponding remote tip, then used an atomic push.
-- Verified public and private `main`/`5.x` refs matched, fast-forwarded local `main`, deleted temporary security branches, and confirmed a clean synchronized checkout.
-- Obtained explicit approval before public disclosure, then atomically fast-forwarded `origin/main` to `af079bd4` and `origin/5.x` to `8acfea7e`, verifying both refs with `git ls-remote`.
-- Fast-forwarded local `main` to `origin/main` and confirmed a clean synchronized status.
-- Do not retry forbidden workspace GraphQL actions; use permitted repository operations or ask the user for an authorized alternative before attempting comments or metadata changes.
-- Before any security-fix push, explicitly ask whether targets are the private advisory fork, public `origin`, or both; treat a draft advisory as a warning, not implicit authorization policy.
-- Always state push destinations and exact resulting refs, e.g. `advisory-ghsa-3m5p/main` changed while `origin/main` remained at `6e95cb9f`.
-- Run workspace-sensitive PR operations separately: attempt the comment, record an expected permission denial, then independently close only if authorized.
-- Describe PR state from verified fields (`CLOSED`, `mergedAt: null`, head/base OIDs) rather than inferring that it is empty.
-
-## Watch-outs
-- Private PR #1 remained open after its head commit had already been placed on private `main`; its mergeability was `UNKNOWN` and it was no longer the correct landing path.
-- Local `main` and temporary security branches were left out of sync after updating the remote branches.
-- Direct public branch updates bypassed the repository’s pull-request-only rules, so ancestry and target refs required explicit validation to avoid unsafe rewrites.
-- Initially pushed the security fix only to the private advisory fork, leaving `origin/main` and `origin/5.x` unchanged without first confirming the intended publication target.
-- After pushing remote refs, local `main` remained one commit behind, creating temporary local/remote inconsistency.
-- A GraphQL `addComment` action was attempted despite workspace-repository restrictions; the denial indicates an intentional permission boundary that should not be bypassed.
-- Assumed the draft advisory meant `origin/main` and `origin/5.x` must remain untouched without first confirming whether the user expected public pushes.
-- Reported that the private branches were complete without clearly distinguishing advisory-fork refs from public `origin` refs, prompting the user to stop and verify deployment status.
-- Combined PR closing with an unsupported workspace-repository comment under `set -e`, causing the entire command to fail before the close could occur.
-- Called the PR “now-empty” even though GitHub still reported it as mergeable with different head and base OIDs.