fastify 5.12.4 → 5.12.6

package/test/content-type-parser-async-context.test.js

@@ -0,0 +1,76 @@
+'use strict'
+
+const { AsyncLocalStorage, AsyncResource, createHook, executionAsyncId } = require('node:async_hooks')
+const { setImmediate: immediate } = require('node:timers/promises')
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('content type parser callbacks restore request context and destroy their resources', async t => {
+  const storage = new AsyncLocalStorage()
+  const external = new AsyncResource('external-parser')
+  const resources = new Set()
+  const destroyed = new Set()
+  const hook = createHook({
+    init (id, type) {
+      if (type === 'content-type-parser:run') resources.add(id)
+    },
+    destroy (id) {
+      if (resources.has(id)) destroyed.add(id)
+    }
+  }).enable()
+  const app = Fastify()
+  t.after(async () => {
+    hook.disable()
+    external.emitDestroy()
+    storage.disable()
+    await app.close()
+  })
+
+  app.addHook('onRequest', (request, reply, done) => {
+    storage.run({ id: request.headers['x-request-id'] }, done)
+  })
+
+  app.addContentTypeParser('application/custom', { parseAs: 'string' }, (request, body, done) => {
+    external.runInAsyncScope(() => {
+      t.assert.strictEqual(storage.getStore(), undefined)
+      setImmediate(() => {
+        if (body === 'error') {
+          done(new Error('parser failed'))
+        } else {
+          done(null, body)
+        }
+      })
+    })
+  })
+
+  function assertContext (request) {
+    t.assert.deepStrictEqual(storage.getStore(), { id: request.headers['x-request-id'] })
+    t.assert.ok(resources.has(executionAsyncId()))
+  }
+
+  app.setErrorHandler((error, request, reply) => {
+    assertContext(request)
+    reply.code(400).send({ error: error.message, id: storage.getStore().id })
+  })
+  app.post('/', (request, reply) => {
+    assertContext(request)
+    return { body: request.body, id: storage.getStore().id }
+  })
+
+  const responses = await Promise.all(['first', 'second', 'error'].map(id => app.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/custom', 'x-request-id': id },
+    payload: id
+  })))
+
+  t.assert.deepStrictEqual(responses.map(response => response.statusCode), [200, 200, 400])
+  t.assert.deepStrictEqual(responses.map(response => response.json()), [
+    { body: 'first', id: 'first' },
+    { body: 'second', id: 'second' },
+    { error: 'parser failed', id: 'error' }
+  ])
+  await immediate()
+  t.assert.strictEqual(resources.size, 3)
+  t.assert.deepStrictEqual(destroyed, resources)
+})

package/test/custom-parser.4.test.js

@@ -6,6 +6,46 @@ const jsonParser = require('fast-json-body')
 
 process.removeAllListeners('warning')
 
+test('parameterized parser matches preserve precedence and encapsulation on repeated requests', async t => {
+  const fastify = Fastify()
+  t.after(() => fastify.close())
+
+  fastify.addContentTypeParser('application/custom', { parseAs: 'string' }, (request, body, done) => {
+    done(null, 'parent')
+  })
+  fastify.addContentTypeParser('application/custom; version=2', { parseAs: 'string' }, (request, body, done) => {
+    done(null, 'version 2')
+  })
+  fastify.post('/', request => request.body)
+
+  fastify.register(async child => {
+    child.removeContentTypeParser('application/custom')
+    child.addContentTypeParser('application/custom', { parseAs: 'string' }, (request, body, done) => {
+      done(null, 'child')
+    })
+    child.post('/child', request => request.body)
+  })
+
+  for (let i = 0; i < 3; i++) {
+    for (const [url, contentType, expected] of [
+      ['/', 'application/custom; charset=utf-8', 'parent'],
+      ['/child', 'application/custom; charset=utf-8', 'child'],
+      ['/', 'application/custom; version=2', 'version 2'],
+      ['/child', 'application/custom; version=2', 'version 2'],
+      ['/', 'Application/Custom ; Charset="utf-8"', 'parent']
+    ]) {
+      const response = await fastify.inject({
+        method: 'POST',
+        url,
+        headers: { 'content-type': contentType },
+        payload: 'body'
+      })
+      t.assert.strictEqual(response.statusCode, 200)
+      t.assert.strictEqual(response.body, expected)
+    }
+  }
+})
+
 test('should prefer string content types over RegExp ones', async (t) => {
   t.plan(6)
   const fastify = Fastify()

package/test/http2/plain.test.js

@@ -68,6 +68,51 @@ test('http2 plain test', async t => {
   })
 })
 
+test('http2 response trailers do not use transfer-encoding', async t => {
+  const fastify = Fastify({ http2: true })
+
+  fastify.get('/', async (request, reply) => {
+    reply.trailer('x-checksum', async () => 'abc')
+    return 'hello'
+  })
+
+  await fastify.listen({ port: 0, host: '127.0.0.1' })
+
+  const client = http2.connect(`http://127.0.0.1:${fastify.server.address().port}`)
+  t.after(() => {
+    client.close()
+    return fastify.close()
+  })
+
+  const response = await new Promise((resolve, reject) => {
+    const request = client.request({
+      [http2.constants.HTTP2_HEADER_METHOD]: http2.constants.HTTP2_METHOD_GET,
+      [http2.constants.HTTP2_HEADER_PATH]: '/'
+    })
+    const result = { body: '' }
+
+    request.setEncoding('utf8')
+    request.on('response', headers => {
+      result.headers = headers
+    })
+    request.on('trailers', trailers => {
+      result.trailers = trailers
+    })
+    request.on('data', chunk => {
+      result.body += chunk
+    })
+    request.on('error', reject)
+    request.on('end', () => resolve(result))
+    request.end()
+  })
+
+  t.assert.strictEqual(response.headers[':status'], 200)
+  t.assert.strictEqual(response.headers['transfer-encoding'], undefined)
+  t.assert.strictEqual(response.headers.trailer, 'x-checksum')
+  t.assert.strictEqual(response.body, 'hello')
+  t.assert.strictEqual(response.trailers['x-checksum'], 'abc')
+})
+
 test('http2 large non-stream replies are sent completely', async t => {
   const modes = ['buffer', 'string']
 

package/test/internals/reply.test.js

@@ -35,7 +35,7 @@ const doGet = async function (url) {
 
 test('Once called, Reply should return an object with methods', t => {
   t.plan(16)
-  const response = { res: 'res' }
+  const response = { res: 'res', getHeader: () => undefined }
   const context = {
     config: { onSend: [] },
     schema: {},
@@ -1003,6 +1003,35 @@ test('reply can set multiple instances of same header', async t => {
   t.assert.deepStrictEqual(result.headers.getSetCookie(), ['one', 'two'])
 })
 
+test('reply.header does not mutate a set-cookie array passed by the caller', async t => {
+  t.plan(5)
+
+  const fastify = require('../../')()
+  const defaults = ['a=1']
+
+  fastify.get('/headers', function (req, reply) {
+    reply
+      .header('set-cookie', defaults)
+      .header('set-cookie', 'b=2')
+      .send({})
+  })
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+  t.after(() => fastify.close())
+
+  const first = await fetch(`${fastifyServer}/headers`)
+  t.assert.deepStrictEqual(first.headers.getSetCookie(), ['a=1', 'b=2'])
+  const second = await fetch(`${fastifyServer}/headers`)
+  t.assert.deepStrictEqual(second.headers.getSetCookie(), ['a=1', 'b=2'])
+  t.assert.deepStrictEqual(defaults, ['a=1'])
+
+  const reply = new Reply({ setHeader () {}, removeHeader () {} }, {}, {})
+  const cookies = ['one']
+  reply.header('set-cookie', cookies).header('set-cookie', 'two')
+  t.assert.deepStrictEqual(reply.getHeader('set-cookie'), ['one', 'two'])
+  t.assert.deepStrictEqual(cookies, ['one'])
+})
+
 test('reply.hasHeader returns correct values', async t => {
   t.plan(2)
 

package/test/internals/validation.test.js

@@ -10,6 +10,72 @@ const { normalizeSchema } = require('../../lib/schemas')
 const symbols = require('../../lib/validation').symbols
 const { kSchemaVisited } = require('../../lib/symbols')
 
+for (const [part, symbol] of [
+  ['params', symbols.paramsSchema],
+  ['body', symbols.bodySchema],
+  ['query', symbols.querystringSchema],
+  ['headers', symbols.headersSchema]
+]) {
+  for (const async of [false, true]) {
+    test(`validate reads only the validated ${part} once (${async ? 'async' : 'sync'})`, async t => {
+      const request = {}
+      const value = { hello: 'world' }
+      let reads = 0
+      let calls = 0
+
+      for (const name of ['params', 'body', 'query', 'headers']) {
+        Object.defineProperty(request, name, {
+          get () {
+            t.assert.strictEqual(name, part, 'unvalidated request parts must not be read')
+            reads++
+            return value
+          }
+        })
+      }
+
+      const context = {
+        [symbol]: data => {
+          calls++
+          t.assert.strictEqual(data, value)
+          return async ? Promise.resolve(data) : true
+        }
+      }
+
+      t.assert.strictEqual(await validation.validate(context, request), false)
+      t.assert.strictEqual(reads, 1)
+      t.assert.strictEqual(calls, 1)
+    })
+  }
+}
+
+test('validate skips a body without a matching content-type schema', t => {
+  const context = { [symbols.bodySchema]: { 'application/json': () => true } }
+  const request = {
+    mediaType: 'text/plain',
+    get body () {
+      t.assert.fail('an unvalidated body must not be read')
+    }
+  }
+
+  t.assert.strictEqual(validation.validate(context, request), false)
+})
+
+test('validate passes null for an undefined request part and preserves other values', t => {
+  for (const value of [undefined, null, false, 0, '']) {
+    let calls = 0
+    const context = {
+      [symbols.bodySchema]: data => {
+        calls++
+        t.assert.strictEqual(data, value === undefined ? null : value)
+        return true
+      }
+    }
+
+    t.assert.strictEqual(validation.validate(context, { body: value }), false)
+    t.assert.strictEqual(calls, 1)
+  }
+})
+
 test('Symbols', t => {
   t.plan(5)
   t.assert.strictEqual(typeof symbols.responseSchema, 'symbol')

package/test/reply-media-type.test.js

@@ -129,3 +129,60 @@ test('reply.mediaType should reflect the last type set', async (t) => {
   const body = response.body
   t.assert.strictEqual(body, 'mediaType = text/plain')
 })
+
+test('reply.mediaType should match the content-type set via raw.setHeader', async (t) => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.get('/', (request, reply) => {
+    reply.raw.setHeader('content-type', 'application/json; charset=utf-8')
+    t.assert.strictEqual(reply.mediaType, 'application/json')
+    reply.send({ mediaType: reply.mediaType })
+  })
+
+  const response = await fastify.inject({
+    method: 'GET',
+    url: '/'
+  })
+  const body = await response.json()
+  t.assert.strictEqual(body.mediaType, 'application/json')
+})
+
+test('reply.mediaType should match case-insensitive content-type set via raw.setHeader', async (t) => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.get('/', (request, reply) => {
+    reply.raw.setHeader('Content-Type', 'text/html; charset=utf-8')
+    t.assert.strictEqual(reply.mediaType, 'text/html')
+    reply.send(reply.mediaType)
+  })
+
+  const response = await fastify.inject({
+    method: 'GET',
+    url: '/'
+  })
+  t.assert.strictEqual(response.body, 'text/html')
+})
+
+test('reply.mediaType should prioritize reply.type over raw.setHeader', async (t) => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.get('/', (request, reply) => {
+    reply.raw.setHeader('content-type', 'application/xml')
+    reply.type('application/json')
+    t.assert.strictEqual(reply.mediaType, 'application/json')
+    reply.send({ mediaType: reply.mediaType })
+  })
+
+  const response = await fastify.inject({
+    method: 'GET',
+    url: '/'
+  })
+  const body = await response.json()
+  t.assert.strictEqual(body.mediaType, 'application/json')
+})

package/test/rfc-10008.test.js

@@ -99,12 +99,9 @@ describe('RFC 10008', () => {
     t.assert.equal(res.json().code, 'FST_ERR_CTP_INVALID_JSON_BODY')
   })
 
-  test('should return 400 if no content is provided for QUERY method', async (t) => {
-    // If a media type is specified but is inconsistent
-    // with the actual request content, a 400 (Bad Request)
-    // can be returned. That is, a server is not allowed to
-    // infer a media type from the request content and then
-    // override a missing or "erroneous" value (i.e., "content sniffing").
+  test('should return 200 if body is empty but media type allows it for QUERY method', async (t) => {
+    // If a media type is set and allows the body to be empty,
+    // the server must allow it.
     t.plan(2)
 
     const fastify = Fastify()
@@ -116,11 +113,11 @@ describe('RFC 10008', () => {
     const res = await fastify.inject({
       method: 'QUERY',
       url: '/query',
-      headers: { 'Content-Type': 'application/json' }
+      headers: { 'Content-Type': 'text/plain' }
     })
 
-    t.assert.equal(res.statusCode, 400)
-    t.assert.equal(res.json().code, 'FST_ERR_ROUTE_MISSING_CONTENT')
+    t.assert.equal(res.statusCode, 200)
+    t.assert.equal(res.body, '')
   })
 
   test('should return 415 if unsupported media type is provided for QUERY method', async (t) => {

package/test/schema-validation.test.js

@@ -8,7 +8,7 @@ const Schema = require('fluent-json-schema')
 const { waitForCb } = require('./helper')
 const { kRequestContentType } = require('../lib/symbols')
 const { spyWarning } = require('process-warning')
-const { FSTSEC002 } = require('../lib/warnings')
+const { FSTSEC002, FSTSEC003 } = require('../lib/warnings')
 
 const customSchemaCompilers = {
   body: new AJV({
@@ -1921,6 +1921,52 @@ test('inline and local $ref header schemas do not emit FSTSEC002', async t => {
   t.assert.strictEqual(spyData.callCount(), 0)
 })
 
+test('header schema with a $ref inside propertyNames emits FSTSEC003 (case-normalization does not reach it)', async t => {
+  const spyData = spyWarning(FSTSEC003)
+  t.after(spyData.restore)
+
+  const fastify = Fastify()
+  fastify.post('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        propertyNames: { $ref: '#/definitions/denied' },
+        definitions: {
+          denied: { not: { enum: ['X-Debug-Override'] } }
+        }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  t.assert.strictEqual(spyData.callCount(), 1)
+  t.assert.deepStrictEqual(spyData.calls[0].arguments, ['POST', '/', '#/definitions/denied'])
+})
+
+test('header schema detects a $ref inside propertyNames nested in an array', async t => {
+  const spyData = spyWarning(FSTSEC003)
+  t.after(spyData.restore)
+
+  const fastify = Fastify()
+  fastify.post('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        propertyNames: { not: { anyOf: [{ $ref: '#/definitions/denied' }] } },
+        definitions: {
+          denied: { enum: ['X-Debug-Override'] }
+        }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  t.assert.strictEqual(spyData.callCount(), 1)
+  t.assert.deepStrictEqual(spyData.calls[0].arguments, ['POST', '/', '#/definitions/denied'])
+})
+
 test('header schema normalization traverses dependent schema keywords', async t => {
   const fastify = Fastify({
     ajv: { customOptions: { strictSchema: false } }
@@ -1993,3 +2039,207 @@ test('header schema detects an external $ref nested in an array', async t => {
     'http://example.com/nested-admin-headers#'
   ])
 })
+
+test('header schema propertyNames: not-enum deny-list is lowercased', async t => {
+  const fastify = Fastify()
+
+  // A `propertyNames` subschema validates each header name itself, so strings in
+  // its `enum` are header names. They must be lowercased the same way as
+  // `required` entries, otherwise a deny-list written in the usual header case
+  // never matches the lowercased request object.
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        propertyNames: { not: { enum: ['X-Debug-Override'] } }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  const blocked = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Debug-Override': '1' }
+  })
+  t.assert.strictEqual(blocked.statusCode, 400)
+  t.assert.strictEqual(blocked.json().code, 'FST_ERR_VALIDATION')
+
+  const ok = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Other': '1' }
+  })
+  t.assert.strictEqual(ok.statusCode, 200)
+})
+
+test('header schema propertyNames: non-string enum items are left untouched', async t => {
+  const fastify = Fastify({
+    ajv: { customOptions: { strictSchema: false } }
+  })
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        propertyNames: { not: { enum: ['X-Debug-Override', 42, null] } }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  const blocked = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Debug-Override': '1' }
+  })
+  t.assert.strictEqual(blocked.statusCode, 400)
+
+  const ok = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Other': '1' }
+  })
+  t.assert.strictEqual(ok.statusCode, 200)
+})
+
+test('header schema propertyNames: not-const deny-list is lowercased', async t => {
+  const fastify = Fastify()
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        propertyNames: { not: { const: 'X-Debug-Override' } }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  const blocked = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Debug-Override': '1' }
+  })
+  t.assert.strictEqual(blocked.statusCode, 400)
+  t.assert.strictEqual(blocked.json().code, 'FST_ERR_VALIDATION')
+})
+
+test('header schema propertyNames: enum/const are lowercased inside combinators', async t => {
+  const fastify = Fastify()
+
+  // The header-name `enum`/`const` can be nested under combinators inside
+  // `propertyNames`; the lowercasing context must propagate through them.
+  fastify.get('/anyOf', {
+    schema: {
+      headers: {
+        type: 'object',
+        propertyNames: { not: { anyOf: [{ enum: ['X-Debug-Override'] }] } }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  fastify.get('/oneOf', {
+    schema: {
+      headers: {
+        type: 'object',
+        propertyNames: { not: { oneOf: [{ const: 'X-Debug-Override' }] } }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  for (const url of ['/anyOf', '/oneOf']) {
+    const blocked = await fastify.inject({
+      method: 'GET',
+      url,
+      headers: { 'X-Debug-Override': '1' }
+    })
+    t.assert.strictEqual(blocked.statusCode, 400, `${url} should block the header`)
+    t.assert.strictEqual(blocked.json().code, 'FST_ERR_VALIDATION')
+  }
+})
+
+test('header schema propertyNames: lowercase-equivalent schema behaves identically', async t => {
+  const fastify = Fastify()
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        propertyNames: { not: { enum: ['x-debug-override'] } }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  const blocked = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: { 'X-Debug-Override': '1' }
+  })
+  t.assert.strictEqual(blocked.statusCode, 400)
+  t.assert.strictEqual(blocked.json().code, 'FST_ERR_VALIDATION')
+})
+
+test('header schema propertyNames: enum/const values in header value schemas are not lowercased', async t => {
+  const fastify = Fastify()
+
+  // `enum`/`const` inside a property value subschema hold header *values*, not
+  // names, and must be preserved with their original case.
+  fastify.get('/enum', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: { 'X-Mode': { type: 'string', enum: ['MIXED', 'lowercase'] } }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  fastify.get('/const', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: { 'X-Mode': { type: 'string', const: 'MIXED' } }
+      }
+    }
+  }, async () => ({ ok: true }))
+
+  await fastify.ready()
+
+  const enumMixed = await fastify.inject({
+    method: 'GET',
+    url: '/enum',
+    headers: { 'X-Mode': 'MIXED' }
+  })
+  t.assert.strictEqual(enumMixed.statusCode, 200)
+
+  const constMixed = await fastify.inject({
+    method: 'GET',
+    url: '/const',
+    headers: { 'X-Mode': 'MIXED' }
+  })
+  t.assert.strictEqual(constMixed.statusCode, 200)
+})
+
+test('header schema propertyNames lowercasing does not mutate the input schema', async t => {
+  const headers = {
+    type: 'object',
+    propertyNames: { not: { enum: ['X-Debug-Override'], const: 'X-Other' } }
+  }
+  const schema = { headers }
+  const schemaBefore = JSON.stringify(schema)
+  const headersBefore = JSON.stringify(headers)
+
+  const fastify = Fastify()
+  fastify.get('/', { schema }, async () => ({ ok: true }))
+  await fastify.ready()
+
+  t.assert.strictEqual(JSON.stringify(schema), schemaBefore)
+  t.assert.strictEqual(JSON.stringify(headers), headersBefore)
+})

package/test/types/route.tst.ts

@@ -495,6 +495,12 @@ expect(fastify().hasRoute({
   method: 'GET'
 })).type.toBe<boolean>()
 
+fastify().hasRoute({
+  url: '/',
+  // @ts-expect-error  Type 'string[]' is not assignable to type 'HTTPMethods'.
+  method: ['GET', 'POST']
+})
+
 expect(fastify().hasRoute({
   url: '/',
   method: 'GET',
@@ -539,6 +545,12 @@ expect(
   })
 ).type.toBe<Omit<FindMyWayFindResult<RawServerDefault>, 'store'>>()
 
+fastify().findRoute({
+  url: '/',
+  // @ts-expect-error  Type 'string[]' is not assignable to type 'HTTPMethods'.
+  method: ['GET', 'POST']
+})
+
 // we should not expose store
 expect(fastify().findRoute({
   url: '/',