fastify 5.8.4 → 5.9.0

package/test/reply-trailers.test.js

@@ -192,6 +192,46 @@ test('error in trailers should be ignored', (t, testDone) => {
   })
 })
 
+test('send is called once when multiple trailer callbacks run synchronously', (t, testDone) => {
+  t.plan(6)
+  const fastify = Fastify()
+  let endCalls = 0
+  let addTrailersCalls = 0
+
+  fastify.get('/', function (request, reply) {
+    const originalEnd = reply.raw.end.bind(reply.raw)
+    reply.raw.end = function (...args) {
+      endCalls++
+      return originalEnd(...args)
+    }
+    const originalAddTrailers = reply.raw.addTrailers.bind(reply.raw)
+    reply.raw.addTrailers = function (...args) {
+      addTrailersCalls++
+      return originalAddTrailers(...args)
+    }
+    reply.trailer('Return-Early', function (reply, payload, done) {
+      done(null, 'a')
+    })
+    reply.trailer('Content-MD5', function (reply, payload, done) {
+      done(null, 'b')
+    })
+    reply.send('hello')
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/'
+  }, (error, res) => {
+    t.assert.ifError(error)
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(res.trailers['return-early'], 'a')
+    t.assert.strictEqual(res.trailers['content-md5'], 'b')
+    t.assert.strictEqual(endCalls, 1)
+    t.assert.strictEqual(addTrailersCalls, 1)
+    testDone()
+  })
+})
+
 describe('trailer handler counter', () => {
   const data = JSON.stringify({ hello: 'world' })
   const hash = createHash('md5')
@@ -266,6 +306,36 @@ describe('trailer handler counter', () => {
       testDone()
     })
   })
+
+  test('mixed callback and promise trailers only use the first completion', (t, testDone) => {
+    t.plan(7)
+    const fastify = Fastify()
+
+    fastify.get('/', function (request, reply) {
+      reply.trailer('Async', function (reply, payload, done) {
+        setTimeout(() => done(null, 'async'), 10)
+      })
+      reply.trailer('Mixed', function (reply, payload, done) {
+        done(null, 'correct')
+        return Promise.resolve('corrupted')
+      })
+      reply.send('hello')
+    })
+
+    fastify.inject({
+      method: 'GET',
+      url: '/'
+    }, (error, res) => {
+      t.assert.ifError(error)
+      t.assert.strictEqual(res.statusCode, 200)
+      t.assert.strictEqual(res.headers['transfer-encoding'], 'chunked')
+      t.assert.strictEqual(res.headers.trailer, 'async mixed')
+      t.assert.strictEqual(res.trailers.async, 'async')
+      t.assert.strictEqual(res.trailers.mixed, 'correct')
+      t.assert.ok(!res.headers['content-length'])
+      testDone()
+    })
+  })
 })
 
 test('removeTrailer', (t, testDone) => {

package/test/request-media-type.test.js

@@ -0,0 +1,105 @@
+'use strict'
+
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('request.mediaType should match the content-type header', async (t) => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.post('/', (request, reply) => {
+    t.assert.strictEqual(request.mediaType, 'application/json')
+    reply.send({ mediaType: request.mediaType })
+  })
+
+  const response = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    body: JSON.stringify({ hello: 'world' }),
+    headers: {
+      'content-type': 'application/json'
+    }
+  })
+  const body = await response.json()
+  t.assert.strictEqual(body.mediaType, 'application/json')
+})
+
+test('request.mediaType should strip the charset parameter', async (t) => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.post('/', (request, reply) => {
+    t.assert.strictEqual(request.mediaType, 'application/json')
+    reply.send({ mediaType: request.mediaType })
+  })
+
+  const response = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    body: JSON.stringify({ hello: 'world' }),
+    headers: {
+      'content-type': 'application/json; charset=utf-8'
+    }
+  })
+  const body = await response.json()
+  t.assert.strictEqual(body.mediaType, 'application/json')
+})
+
+test('request.mediaType should strip the space', async (t) => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.post('/', (request, reply) => {
+    t.assert.strictEqual(request.mediaType, 'application/json')
+    reply.send({ mediaType: request.mediaType })
+  })
+
+  const response = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    body: JSON.stringify({ hello: 'world' }),
+    headers: {
+      'content-type': ' application/json ; charset=utf-8'
+    }
+  })
+  const body = await response.json()
+  t.assert.strictEqual(body.mediaType, 'application/json')
+})
+
+test('request.mediaType supported in hooks', async (t) => {
+  t.plan(5)
+
+  const fastify = Fastify()
+
+  fastify.post('/', {
+    preParsing: (request, reply, payload, done) => {
+      t.assert.strictEqual(request.mediaType, 'application/json')
+      done(null, payload)
+    },
+    preValidation: (request, reply, done) => {
+      t.assert.strictEqual(request.mediaType, 'application/json')
+      done()
+    },
+    preHandler: (request, reply, done) => {
+      t.assert.strictEqual(request.mediaType, 'application/json')
+      done()
+    }
+  }, (request, reply) => {
+    t.assert.strictEqual(request.mediaType, 'application/json')
+    reply.send({ mediaType: request.mediaType })
+  })
+
+  const response = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    body: JSON.stringify({ hello: 'world' }),
+    headers: {
+      'content-type': 'application/json'
+    }
+  })
+  const body = await response.json()
+  t.assert.strictEqual(body.mediaType, 'application/json')
+})

package/test/request-port.test.js

@@ -0,0 +1,72 @@
+'use strict'
+
+const test = require('node:test')
+const Request = require('../lib/request')
+
+test('.port parses port correctly', (t) => {
+  const fixtures = [
+    {
+      expected: 80,
+      req: {
+        headers: {
+          host: 'example.com:80'
+        }
+      }
+    },
+    {
+      expected: 443,
+      req: {
+        headers: {
+          host: 'example.com:443'
+        }
+      }
+    },
+    {
+      expected: 80,
+      req: {
+        headers: {
+          host: '[::1]:80'
+        }
+      }
+    },
+    {
+      expected: 443,
+      req: {
+        headers: {
+          host: '[::1]:443'
+        }
+      }
+    },
+    {
+      expected: null,
+      req: {
+        headers: {
+          host: '[::1]'
+        }
+      }
+    },
+    {
+      expected: 80,
+      req: {
+        headers: {
+          ':authority': '1.2.3.4:80'
+        }
+      }
+    },
+    {
+      expected: null,
+      req: {
+        headers: {}
+      }
+    }
+  ]
+
+  for (const fixture of fixtures) {
+    const req = new Request(1, {}, fixture.req, '', {}, {})
+    t.assert.equal(
+      req.port,
+      fixture.expected,
+      `${fixture.req.headers.host} should parse to ${fixture.expected}`
+    )
+  }
+})

package/test/route-prefix.test.js

@@ -241,6 +241,40 @@ test('Prefix with trailing /', (t, testDone) => {
   completion.patience.then(testDone)
 })
 
+test('Prefix with trailing / and nested prefix without leading /', (t, testDone) => {
+  t.plan(4)
+  const fastify = Fastify()
+
+  fastify.register(function (fastify, opts, done) {
+    fastify.register(function (fastify, opts, done) {
+      fastify.get('/route', (req, reply) => {
+        reply.send({ hello: 'world' })
+      })
+      done()
+    }, { prefix: 'inner' })
+    done()
+  }, { prefix: '/v1/' })
+
+  const completion = waitForCb({ steps: 2 })
+  fastify.inject({
+    method: 'GET',
+    url: '/v1/inner/route'
+  }, (err, res) => {
+    t.assert.ifError(err)
+    t.assert.deepStrictEqual(JSON.parse(res.payload), { hello: 'world' })
+    completion.stepIn()
+  })
+  fastify.inject({
+    method: 'GET',
+    url: '/v1//inner/route'
+  }, (err, res) => {
+    t.assert.ifError(err)
+    t.assert.strictEqual(res.statusCode, 404)
+    completion.stepIn()
+  })
+  completion.patience.then(testDone)
+})
+
 test('Prefix works multiple levels deep', (t, testDone) => {
   t.plan(2)
   const fastify = Fastify()

package/test/router-options.test.js

@@ -6,6 +6,7 @@ const querystring = require('node:querystring')
 const Fastify = require('../')
 const {
   FST_ERR_BAD_URL,
+  FST_ERR_MAX_PARAM_LENGTH,
   FST_ERR_ASYNC_CONSTRAINT
 } = require('../lib/errors')
 
@@ -84,7 +85,7 @@ test('Should honor maxParamLength option', async (t) => {
     method: 'GET',
     url: '/test/123456789abcd'
   })
-  t.assert.strictEqual(resError.statusCode, 404)
+  t.assert.strictEqual(resError.statusCode, 414)
 })
 
 test('Should expose router options via getters on request and reply', (t, done) => {
@@ -262,6 +263,130 @@ test('Should honor disableRequestLogging option in frameworkErrors wrapper - FST
   )
 })
 
+test('Should honor frameworkErrors option - FST_ERR_MAX_PARAM_LENGTH', (t, done) => {
+  t.plan(3)
+  const fastify = Fastify({
+    maxParamLength: 1,
+    frameworkErrors: function (err, req, res) {
+      if (err instanceof FST_ERR_MAX_PARAM_LENGTH) {
+        t.assert.ok(true)
+      } else {
+        t.assert.fail()
+      }
+      res.send(`${err.message} - ${err.code}`)
+    }
+  })
+
+  fastify.get('/test/:id', (req, res) => {
+    res.send('{ hello: \'world\' }')
+  })
+
+  fastify.inject(
+    {
+      method: 'GET',
+      url: '/test/123'
+    },
+    (err, res) => {
+      t.assert.ifError(err)
+      t.assert.strictEqual(res.body, '\'/test/123\' is exceeding the max param length - FST_ERR_MAX_PARAM_LENGTH')
+      done()
+    }
+  )
+})
+
+test('Should supply Fastify request to the logger in frameworkErrors wrapper - FST_ERR_MAX_PARAM_LENGTH', (t, done) => {
+  t.plan(8)
+
+  const REQ_ID = 'REQ-1234'
+  const logStream = split(JSON.parse)
+
+  const fastify = Fastify({
+    maxParamLength: 1,
+    frameworkErrors: function (err, req, res) {
+      t.assert.deepStrictEqual(req.id, REQ_ID)
+      t.assert.deepStrictEqual(req.raw.httpVersion, '1.1')
+      res.send(`${err.message} - ${err.code}`)
+    },
+    logger: {
+      stream: logStream,
+      serializers: {
+        req (request) {
+          t.assert.deepStrictEqual(request.id, REQ_ID)
+          return { httpVersion: request.raw.httpVersion }
+        }
+      }
+    },
+    genReqId: () => REQ_ID
+  })
+
+  fastify.get('/test/:id', (req, res) => {
+    res.send('{ hello: \'world\' }')
+  })
+
+  logStream.on('data', (json) => {
+    t.assert.deepStrictEqual(json.msg, 'incoming request')
+    t.assert.deepStrictEqual(json.reqId, REQ_ID)
+    t.assert.deepStrictEqual(json.req.httpVersion, '1.1')
+  })
+
+  fastify.inject(
+    {
+      method: 'GET',
+      url: '/test/123'
+    },
+    (err, res) => {
+      t.assert.ifError(err)
+      t.assert.strictEqual(res.body, '\'/test/123\' is exceeding the max param length - FST_ERR_MAX_PARAM_LENGTH')
+      done()
+    }
+  )
+})
+
+test('Should honor disableRequestLogging option in frameworkErrors wrapper - FST_ERR_MAX_PARAM_LENGTH', (t, done) => {
+  t.plan(2)
+
+  const logStream = split(JSON.parse)
+
+  const fastify = Fastify({
+    disableRequestLogging: true,
+    maxParamLength: 1,
+    frameworkErrors: function (err, req, res) {
+      res.send(`${err.message} - ${err.code}`)
+    },
+    logger: {
+      stream: logStream,
+      serializers: {
+        req () {
+          t.assert.fail('should not be called')
+        },
+        res () {
+          t.assert.fail('should not be called')
+        }
+      }
+    }
+  })
+
+  fastify.get('/test/:id', (req, res) => {
+    res.send('{ hello: \'world\' }')
+  })
+
+  logStream.on('data', (json) => {
+    t.assert.fail('should not be called')
+  })
+
+  fastify.inject(
+    {
+      method: 'GET',
+      url: '/test/123'
+    },
+    (err, res) => {
+      t.assert.ifError(err)
+      t.assert.strictEqual(res.body, '\'/test/123\' is exceeding the max param length - FST_ERR_MAX_PARAM_LENGTH')
+      done()
+    }
+  )
+})
+
 test('Should honor frameworkErrors option - FST_ERR_ASYNC_CONSTRAINT', (t, done) => {
   t.plan(3)
 
@@ -507,6 +632,67 @@ test('Should honor disableRequestLogging function in frameworkErrors wrapper - F
   )
 })
 
+test('Should honor disableRequestLogging function in frameworkErrors wrapper - FST_ERR_MAX_PARAM_LENGTH', (t, done) => {
+  t.plan(4)
+
+  let logCallCount = 0
+  const logStream = split(JSON.parse)
+
+  const fastify = Fastify({
+    maxParamLength: 1,
+    disableRequestLogging: (req) => {
+      // Disable logging for URLs containing 'silent'
+      return req.url.includes('silent')
+    },
+    frameworkErrors: function (err, req, res) {
+      res.send(`${err.message} - ${err.code}`)
+    },
+    logger: {
+      stream: logStream,
+      level: 'info'
+    }
+  })
+
+  fastify.get('/test/:id', (req, res) => {
+    res.send('{ hello: \'world\' }')
+  })
+
+  logStream.on('data', (json) => {
+    if (json.msg === 'incoming request') {
+      logCallCount++
+    }
+  })
+
+  // First request: URL does not contain 'silent', so logging should happen
+  fastify.inject(
+    {
+      method: 'GET',
+      url: '/test/123'
+    },
+    (err, res) => {
+      t.assert.ifError(err)
+      t.assert.strictEqual(res.body, '\'/test/123\' is exceeding the max param length - FST_ERR_MAX_PARAM_LENGTH')
+
+      // Second request: URL contains 'silent', so logging should be disabled
+      fastify.inject(
+        {
+          method: 'GET',
+          url: '/silent/123'
+        },
+        (err2, res2) => {
+          t.assert.ifError(err2)
+          // Give time for any potential log events
+          setImmediate(() => {
+            // Only the first request should have logged
+            t.assert.strictEqual(logCallCount, 1)
+            done()
+          })
+        }
+      )
+    }
+  )
+})
+
 test('Should honor disableRequestLogging function in frameworkErrors wrapper - FST_ERR_ASYNC_CONSTRAINT', (t, done) => {
   t.plan(4)
 
@@ -615,7 +801,7 @@ test('Should honor routerOptions.defaultRoute', async t => {
   t.assert.strictEqual(res.payload, 'default route')
 })
 
-test('Should honor routerOptions.badUrl', async t => {
+test('Should honor routerOptions.onBadUrl', async t => {
   t.plan(3)
   const fastify = Fastify({
     routerOptions: {
@@ -625,7 +811,7 @@ test('Should honor routerOptions.badUrl', async t => {
       onBadUrl: function (path, _, res) {
         t.assert.ok('bad url called')
         res.statusCode = 400
-        res.end(`Bath URL: ${path}`)
+        res.end(`Bad URL: ${path}`)
       }
     }
   })
@@ -636,7 +822,32 @@ test('Should honor routerOptions.badUrl', async t => {
 
   const res = await fastify.inject('/hello/%world')
   t.assert.strictEqual(res.statusCode, 400)
-  t.assert.strictEqual(res.payload, 'Bath URL: /hello/%world')
+  t.assert.strictEqual(res.payload, 'Bad URL: /hello/%world')
+})
+
+test('Should honor routerOptions.onMaxParamLength', async t => {
+  t.plan(3)
+  const fastify = Fastify({
+    routerOptions: {
+      defaultRoute: function (_, res) {
+        t.asset.fail('default route should not be called')
+      },
+      maxParamLength: 10,
+      onMaxParamLength: function (path, _, res) {
+        t.assert.ok('max param length called')
+        res.statusCode = 414
+        res.end(`URL: ${path}`)
+      }
+    }
+  })
+
+  fastify.get('/hello/:id', (req, res) => {
+    res.send({ hello: 'world' })
+  })
+
+  const res = await fastify.inject('/hello/12345678901')
+  t.assert.strictEqual(res.statusCode, 414)
+  t.assert.strictEqual(res.payload, 'URL: /hello/12345678901')
 })
 
 test('Should honor routerOptions.ignoreTrailingSlash', async t => {
@@ -727,7 +938,7 @@ test('Should honor routerOptions.maxParamLength', async (t) => {
     method: 'GET',
     url: '/test/123456789abcd'
   })
-  t.assert.strictEqual(resError.statusCode, 404)
+  t.assert.strictEqual(resError.statusCode, 414)
 })
 
 test('Should honor routerOptions.allowUnsafeRegex', async (t) => {
@@ -854,11 +1065,11 @@ test('Should honor routerOptions.buildPrettyMeta', async (t) => {
     }
   })
 
-  fastify.get('/test', () => {})
-  fastify.get('/test/hello', () => {})
-  fastify.get('/testing', () => {})
-  fastify.get('/testing/:param', () => {})
-  fastify.put('/update', () => {})
+  fastify.get('/test', () => { })
+  fastify.get('/test/hello', () => { })
+  fastify.get('/testing', () => { })
+  fastify.get('/testing/:param', () => { })
+  fastify.put('/update', () => { })
 
   await fastify.ready()
 
@@ -928,7 +1139,7 @@ test('Should honor routerOptions.maxParamLength over maxParamLength option', asy
     method: 'GET',
     url: '/test/123456789abcd'
   })
-  t.assert.strictEqual(resError.statusCode, 404)
+  t.assert.strictEqual(resError.statusCode, 414)
 })
 
 test('Should honor routerOptions.allowUnsafeRegex over allowUnsafeRegex option', async (t) => {

package/test/schema-serialization.test.js

@@ -1169,3 +1169,111 @@ test('allow default as status code and used as last fallback', (t, testDone) =>
     testDone()
   })
 })
+
+test('response schema is applied when Content-Type has whitespace before parameters', (t, testDone) => {
+  t.plan(3)
+
+  const fastify = Fastify()
+  fastify.get('/', {
+    schema: {
+      response: {
+        200: {
+          content: {
+            'application/json': {
+              schema: {
+                type: 'object',
+                required: ['public'],
+                additionalProperties: false,
+                properties: {
+                  public: { type: 'string' }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }, function (req, reply) {
+    reply.header('Content-Type', 'application/json ; charset=utf-8')
+    reply.send({ public: 'ok', secret: 'SHOULD_BE_STRIPPED' })
+  })
+
+  fastify.inject('/', (err, res) => {
+    t.assert.ifError(err)
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.deepStrictEqual(res.json(), { public: 'ok' })
+    testDone()
+  })
+})
+
+test('response schema is applied when Content-Type has tab before semicolon', (t, testDone) => {
+  t.plan(3)
+
+  const fastify = Fastify()
+  fastify.get('/', {
+    schema: {
+      response: {
+        200: {
+          content: {
+            'application/json': {
+              schema: {
+                type: 'object',
+                required: ['public'],
+                additionalProperties: false,
+                properties: {
+                  public: { type: 'string' }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }, function (req, reply) {
+    reply.header('Content-Type', 'application/json\t; charset=utf-8')
+    reply.send({ public: 'ok', secret: 'SHOULD_BE_STRIPPED' })
+  })
+
+  fastify.inject('/', (err, res) => {
+    t.assert.ifError(err)
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.deepStrictEqual(res.json(), { public: 'ok' })
+    testDone()
+  })
+})
+
+test('response schema is applied when Content-Type has trailing semicolon only', (t, testDone) => {
+  t.plan(3)
+
+  const fastify = Fastify()
+  fastify.get('/', {
+    schema: {
+      response: {
+        200: {
+          content: {
+            'application/json': {
+              schema: {
+                type: 'object',
+                required: ['public'],
+                additionalProperties: false,
+                properties: {
+                  public: { type: 'string' }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }, function (req, reply) {
+    reply.header('Content-Type', 'application/json ;')
+    reply.send({ public: 'ok', secret: 'SHOULD_BE_STRIPPED' })
+  })
+
+  fastify.inject('/', (err, res) => {
+    t.assert.ifError(err)
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.deepStrictEqual(res.json(), { public: 'ok' })
+    testDone()
+  })
+})