fastify 6.0.0-alpha.4 → 6.0.0-alpha.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "6.0.0-alpha.4",
+  "version": "6.0.0-alpha.6",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -18,12 +18,13 @@
     "lint:fix": "eslint --fix",
     "lint:markdown": "markdownlint-cli2",
     "lint:eslint": "eslint",
-    "prepublishOnly": "cross-env PREPUBLISH=true borp --reporter=@jsumners/line-reporter && npm run test:validator:integrity && npm run build:sync-version",
+    "prepublishOnly": "npm run test:version && cross-env PREPUBLISH=true borp --reporter=@jsumners/line-reporter && npm run test:validator:integrity && npm run build:sync-version",
     "test": "npm run lint && npm run unit && npm run test:types",
     "test:ci": "npm run unit && npm run test:types",
     "test:report": "npm run lint && npm run unit:report && npm run test:types",
     "test:validator:integrity": "npm run build:validation && git diff --quiet --ignore-all-space --ignore-blank-lines --ignore-cr-at-eol lib/error-serializer.js && git diff --quiet --ignore-all-space --ignore-blank-lines --ignore-cr-at-eol lib/config-validator.js",
     "test:types": "tstyche",
+    "test:version": "node --test test/build/version.test.js",
     "test:watch": "npm run unit -- --watch --coverage-report=none --reporter=terse",
     "unit": "borp",
     "unit:report": "c8 --reporter html borp --reporter=@jsumners/line-reporter",
@@ -148,6 +149,10 @@
       "name": "Jean Michelet",
       "email": "jean.antoine.michelet@gmail.com",
       "url": "https://github.com/jean-michelet"
+    },
+    {
+      "name": "Antonio Tripodi",
+      "url": "https://github.com/Tony133"
     }
   ],
   "license": "MIT",
@@ -210,7 +215,7 @@
     "abstract-logging": "^2.0.1",
     "avvio": "^9.0.0",
     "fast-json-stringify": "^7.0.0",
-    "find-my-way": "^9.6.0",
+    "find-my-way": "^9.10.0",
     "light-my-request": "^6.0.0",
     "pino": "^9.14.0 || ^10.1.0",
     "process-warning": "^5.1.0",

package/test/child-logger-factory.test.js

@@ -126,3 +126,28 @@ test('should throw error if invalid logger is returned', (t, done) => {
     }, { code: 'FST_ERR_LOG_INVALID_LOGGER' })
   })
 })
+
+test('request child loggers only receive a level when the route sets one', async t => {
+  t.plan(3)
+
+  const fastify = Fastify({ logger: { level: 'info', stream: { write () {} } } })
+  const levels = []
+  fastify.setChildLoggerFactory(function (logger, bindings, opts) {
+    // an empty level would make pino reset the level of every request child
+    levels.push(Object.hasOwn(opts, 'level') ? opts.level : 'inherited')
+    return logger.child(bindings, opts)
+  })
+
+  fastify.get('/', (req, reply) => {
+    reply.send(req.log.level)
+  })
+  fastify.get('/warn', { logLevel: 'warn' }, (req, reply) => {
+    reply.send(req.log.level)
+  })
+
+  t.after(() => fastify.close())
+
+  t.assert.strictEqual((await fastify.inject('/')).body, 'info')
+  t.assert.strictEqual((await fastify.inject('/warn')).body, 'warn')
+  t.assert.deepStrictEqual(levels, ['inherited', 'warn'])
+})

package/test/close-disposable.test.js

@@ -0,0 +1,154 @@
+'use strict'
+
+const { test } = require('node:test')
+const Fastify = require('../fastify')
+
+test('addHook onClose supports AsyncDisposable objects', async t => {
+  const app = Fastify()
+  let disposed = false
+
+  const resource = {
+    async [Symbol.asyncDispose] () {
+      disposed = true
+    }
+  }
+
+  app.addHook('onClose', resource)
+  await app.ready()
+  t.assert.equal(disposed, false)
+
+  await app.close()
+  t.assert.equal(disposed, true)
+})
+
+test('addHook onClose supports synchronous Disposable objects', async t => {
+  const app = Fastify()
+  let disposed = false
+
+  const resource = {
+    [Symbol.dispose] () {
+      disposed = true
+    }
+  }
+
+  app.addHook('onClose', resource)
+  await app.ready()
+  t.assert.equal(disposed, false)
+
+  await app.close()
+  t.assert.equal(disposed, true)
+})
+
+test('addHook onClose prefers Symbol.asyncDispose over Symbol.dispose when both are present', async t => {
+  const app = Fastify()
+  let asyncDisposed = false
+  let syncDisposed = false
+
+  const resource = {
+    async [Symbol.asyncDispose] () {
+      asyncDisposed = true
+    },
+    [Symbol.dispose] () {
+      syncDisposed = true
+    }
+  }
+
+  app.addHook('onClose', resource)
+  await app.ready()
+  await app.close()
+
+  t.assert.equal(asyncDisposed, true)
+  t.assert.equal(syncDisposed, false)
+})
+
+test('addHook onClose propagates rejection from Symbol.asyncDispose', async t => {
+  const app = Fastify()
+  const customError = new Error('dispose async failed')
+
+  const resource = {
+    async [Symbol.asyncDispose] () {
+      throw customError
+    }
+  }
+
+  app.addHook('onClose', resource)
+  await app.ready()
+
+  await t.assert.rejects(app.close(), {
+    message: 'dispose async failed'
+  })
+})
+
+test('addHook onClose ignores fulfillment value from Symbol.asyncDispose', async t => {
+  const app = Fastify()
+
+  const resource = {
+    async [Symbol.asyncDispose] () {
+      return 'OK'
+    }
+  }
+
+  app.addHook('onClose', resource)
+  await app.ready()
+
+  await t.assert.doesNotReject(app.close())
+})
+
+test('addHook onClose propagates thrown error from Symbol.dispose', async t => {
+  const app = Fastify()
+  const customError = new Error('dispose sync failed')
+
+  const resource = {
+    [Symbol.dispose] () {
+      throw customError
+    }
+  }
+
+  app.addHook('onClose', resource)
+  await app.ready()
+
+  await t.assert.rejects(app.close(), {
+    message: 'dispose sync failed'
+  })
+})
+
+test('addHook onClose respects plugin execution order for disposables', async t => {
+  const app = Fastify()
+  const order = []
+
+  app.register(function childPlugin (instance, opts, done) {
+    instance.addHook('onClose', {
+      async [Symbol.asyncDispose] () {
+        order.push('child')
+      }
+    })
+    done()
+  })
+
+  app.addHook('onClose', {
+    async [Symbol.asyncDispose] () {
+      order.push('parent')
+    }
+  })
+
+  await app.ready()
+  await app.close()
+
+  t.assert.deepStrictEqual(order, ['child', 'parent'])
+})
+
+test('addHook onClose throws FST_ERR_HOOK_INVALID_HANDLER when non-function non-disposable is passed', t => {
+  const app = Fastify()
+
+  t.assert.throws(() => {
+    app.addHook('onClose', 'not-a-function-or-disposable')
+  }, {
+    code: 'FST_ERR_HOOK_INVALID_HANDLER'
+  })
+
+  t.assert.throws(() => {
+    app.addHook('onClose', { someProp: 123 })
+  }, {
+    code: 'FST_ERR_HOOK_INVALID_HANDLER'
+  })
+})

package/test/constrained-routes.test.js

@@ -607,7 +607,7 @@ test('Should allow registering constrained routes in a prefixed plugin', (t, don
 })
 
 test('Should allow registering a constrained GET route after a constrained HEAD route', (t, done) => {
-  t.plan(3)
+  t.plan(4)
   const fastify = Fastify()
 
   fastify.route({
@@ -637,7 +637,9 @@ test('Should allow registering a constrained GET route after a constrained HEAD
     }
   }, (err, res) => {
     t.assert.ifError(err)
-    t.assert.deepStrictEqual(res.payload, 'custom HEAD response')
+    // A HEAD response has no body, so check the headers set by the custom HEAD handler
+    t.assert.strictEqual(res.headers['content-type'], 'text/plain')
+    t.assert.strictEqual(res.headers['content-length'], String(Buffer.byteLength('custom HEAD response')))
     t.assert.strictEqual(res.statusCode, 200)
     done()
   })

package/test/content-parser.test.js

@@ -2,6 +2,7 @@
 
 const { test } = require('node:test')
 const { spyWarning } = require('process-warning')
+const { Readable } = require('node:stream')
 const Fastify = require('..')
 const keys = require('../lib/symbols')
 const { FST_ERR_CTP_ALREADY_PRESENT, FST_ERR_CTP_INVALID_TYPE, FST_ERR_CTP_INVALID_MEDIA_TYPE } = require('../lib/errors')
@@ -767,3 +768,101 @@ test('content-type fail when not a valid type', async t => {
     t.assert.equal(error.message, 'The content type should be a string or a RegExp')
   }
 })
+
+test('string body keeps multi-byte characters split across chunks', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+  const encoded = Buffer.from(JSON.stringify({ hello: 'wörld ✓ 😀' }))
+
+  fastify.addHook('preParsing', async () => {
+    // Emit one byte per chunk so every multi-byte character is split
+    return Readable.from(Array.from(encoded, byte => Buffer.from([byte])), { objectMode: false })
+  })
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/json' },
+    payload: encoded
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.deepStrictEqual(res.json(), { hello: 'wörld ✓ 😀' })
+})
+
+test('string body accepts string chunks from a preParsing stream', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.addHook('preParsing', async (request, reply, payload) => {
+    payload.setEncoding('utf8')
+    return payload
+  })
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'text/plain' },
+    payload: 'hellö'
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.body, 'hellö')
+})
+
+test('string body with invalid UTF-8 is not treated as a content-length mismatch', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'text/plain' },
+    payload: Buffer.from([0x61, 0xff, 0x62])
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.body, 'a�b')
+})
+
+test('a synchronous throw in a custom parser is handled like a route error, not an uncaught exception', async t => {
+  await t.test('stream-mode parser', async t => {
+    t.plan(2)
+    const fastify = Fastify()
+    fastify.addContentTypeParser('application/json', function (req, payload, done) {
+      throw new Error('parser boom')
+    })
+    fastify.post('/', (req, reply) => reply.send('ok'))
+    const res = await fastify.inject({ method: 'POST', url: '/', headers: { 'content-type': 'application/json' }, payload: '{}' })
+    t.assert.strictEqual(res.statusCode, 500)
+    t.assert.strictEqual(res.json().message, 'parser boom')
+  })
+
+  await t.test('parseAs string parser', async t => {
+    t.plan(2)
+    const fastify = Fastify()
+    fastify.addContentTypeParser('application/json', { parseAs: 'string' }, function (req, body, done) {
+      throw new Error('parser boom')
+    })
+    fastify.post('/', (req, reply) => reply.send('ok'))
+    const res = await fastify.inject({ method: 'POST', url: '/', headers: { 'content-type': 'application/json' }, payload: '{}' })
+    t.assert.strictEqual(res.statusCode, 500)
+    t.assert.strictEqual(res.json().message, 'parser boom')
+  })
+
+  await t.test('a thrown error with a statusCode is preserved', async t => {
+    t.plan(1)
+    const fastify = Fastify()
+    fastify.addContentTypeParser('application/json', { parseAs: 'string' }, function (req, body, done) {
+      const err = new Error('too big')
+      err.statusCode = 413
+      throw err
+    })
+    fastify.post('/', (req, reply) => reply.send('ok'))
+    const res = await fastify.inject({ method: 'POST', url: '/', headers: { 'content-type': 'application/json' }, payload: '{}' })
+    t.assert.strictEqual(res.statusCode, 413)
+  })
+})

package/test/decorator.test.js

@@ -1328,3 +1328,32 @@ test('Request.setDecorator should update an existing decorator', (t, done) => {
     })
   })
 })
+
+test('getDecorator should evaluate a getter once', async t => {
+  const fastify = Fastify()
+  t.after(() => fastify.close())
+  let calls = 0
+  fastify.decorate('value', {
+    getter () {
+      return ++calls
+    }
+  })
+
+  t.assert.strictEqual(fastify.getDecorator('value'), 1)
+  t.assert.strictEqual(calls, 1)
+})
+
+test('getDecorator should bind the function returned by a getter once', async t => {
+  const fastify = Fastify()
+  t.after(() => fastify.close())
+  let calls = 0
+  fastify.decorate('method', {
+    getter () {
+      calls++
+      return function () { return this }
+    }
+  })
+
+  t.assert.strictEqual(fastify.getDecorator('method')(), fastify)
+  t.assert.strictEqual(calls, 1)
+})

package/test/diagnostics-channel/error-status.test.js

@@ -96,9 +96,12 @@ test('Error.status property support', (t, done) => {
   const err = new Error('winter is coming')
   err.status = 418
 
-  diagnostics.subscribe('tracing:fastify.request.handler:error', (msg) => {
+  const channel = diagnostics.channel('tracing:fastify.request.handler:error')
+  const handler = (msg) => {
     t.assert.strictEqual(msg.error.message, 'winter is coming')
-  })
+  }
+  channel.subscribe(handler)
+  t.after(() => channel.unsubscribe(handler))
 
   fastify.get('/', () => {
     return Promise.reject(err)
@@ -121,3 +124,33 @@ test('Error.status property support', (t, done) => {
     done()
   })
 })
+
+test('diagnostics channel error event should report 500 for error with statusCode >= 600', async (t) => {
+  t.plan(4)
+  const fastify = Fastify()
+  t.after(() => fastify.close())
+
+  let diagnosticsStatusCode
+  let diagnosticsError
+
+  const channel = diagnostics.channel('tracing:fastify.request.handler:error')
+  const handler = (msg) => {
+    diagnosticsStatusCode = msg.reply.statusCode
+    diagnosticsError = msg.error
+  }
+  channel.subscribe(handler)
+  t.after(() => channel.unsubscribe(handler))
+
+  fastify.get('/', async () => {
+    const err = new Error('custom invalid status')
+    err.statusCode = 600
+    throw err
+  })
+
+  const res = await fastify.inject('/')
+
+  t.assert.strictEqual(res.statusCode, 500)
+  t.assert.strictEqual(diagnosticsStatusCode, 500, 'diagnostics channel should report 500 when statusCode >= 600')
+  t.assert.strictEqual(diagnosticsStatusCode, res.statusCode, 'diagnostics status should match response status')
+  t.assert.strictEqual(diagnosticsError.message, 'custom invalid status')
+})

package/test/handler-timeout.test.js

@@ -2,6 +2,7 @@
 
 const { test } = require('node:test')
 const net = require('node:net')
+const http2 = require('node:http2')
 const Fastify = require('..')
 const { Readable } = require('node:stream')
 const { kTimeoutTimer, kOnAbort } = require('../lib/symbols')
@@ -201,6 +202,229 @@ test('streaming response: timer clears when response finishes', async t => {
   t.assert.strictEqual(res.status, 200)
 })
 
+// Regression test for GHSA-3qgw-9275-xf8w:
+// a streaming response that has already transmitted its headers must not
+// crash the server when handlerTimeout expires. Instead of trying to send
+// an error response (which would raise an uncaught ERR_HTTP_HEADERS_SENT),
+// the in-flight response is aborted and the server stays alive.
+test('streaming response exceeding handlerTimeout aborts instead of crashing', async t => {
+  t.plan(4)
+
+  const fastify = Fastify({ handlerTimeout: 100 })
+
+  // A logical gate (a deferred promise) keeps the stream open. The gateway
+  // is only released during teardown, so the stream never ends on its own
+  // and the handlerTimeout is what terminates the response. Relying on a
+  // wall-clock setTimeout to control the stream would be flaky (it can fire
+  // after the stream has already been destroyed).
+  let release
+  const gate = new Promise((resolve) => { release = resolve })
+
+  fastify.get('/stream', async (request, reply) => {
+    let started = false
+    const stream = new Readable({
+      read () {
+        if (started) return
+        started = true
+        // Emit one chunk so the response headers are transmitted before the
+        // handler timeout fires, then hold the stream open on the gate until
+        // the timeout aborts the response.
+        this.push('first')
+        gate.then(() => {
+          if (!this.destroyed) this.push(null)
+        })
+      }
+    })
+    reply.type('text/plain').send(stream)
+    return reply
+  })
+
+  fastify.get('/after', async () => ({ ok: true }))
+
+  await fastify.listen({ port: 0 })
+  t.after(async () => {
+    release()
+    await fastify.close()
+  })
+
+  const base = `http://127.0.0.1:${fastify.server.address().port}`
+
+  // Headers and the first chunk are transmitted before the timeout expires, so
+  // the client observes a 200, but the body is aborted when the timeout fires.
+  const res = await fetch(`${base}/stream`)
+  t.assert.strictEqual(res.status, 200)
+  t.assert.strictEqual(res.headers.get('content-type'), 'text/plain')
+  await t.assert.rejects(() => res.text())
+
+  // The server must not have crashed and must still serve other requests.
+  const after = await fetch(`${base}/after`)
+  t.assert.strictEqual(after.status, 200)
+})
+
+// Over HTTP/2, payloads larger than 64 KiB are written in chunks and the
+// response is ended only after the last one. A client that never reads the
+// body keeps the response open with its headers already sent.
+test('HTTP/2 payload still being written when handlerTimeout fires aborts instead of crashing', async t => {
+  t.plan(2)
+
+  const fastify = Fastify({ http2: true, handlerTimeout: 100 })
+  const big = Buffer.alloc(4 * 1024 * 1024, 'a')
+
+  fastify.get('/big', async (request, reply) => {
+    reply.type('text/plain')
+    return big
+  })
+
+  fastify.get('/after', async () => 'ok')
+
+  await fastify.listen({ port: 0 })
+
+  const client = http2.connect(`http://127.0.0.1:${fastify.server.address().port}`)
+  t.after(async () => {
+    client.destroy()
+    await fastify.close()
+  })
+
+  await new Promise((resolve) => {
+    const req = client.request({ ':path': '/big' })
+    req.on('response', (headers) => {
+      t.assert.strictEqual(headers[':status'], 200)
+      // Never read the body, so the flow-control window is never replenished.
+      req.pause()
+    })
+    req.on('error', () => {})
+    req.on('close', resolve)
+    req.end()
+  })
+
+  // The server must not have crashed and must still serve other requests.
+  const body = await new Promise((resolve, reject) => {
+    const req = client.request({ ':path': '/after' })
+    let data = ''
+    req.setEncoding('utf8')
+    req.on('data', (chunk) => { data += chunk })
+    req.on('end', () => resolve(data))
+    req.on('error', reject)
+    req.end()
+  })
+  t.assert.strictEqual(body, 'ok')
+})
+
+// Regression test for GHSA-3qgw-9275-xf8w:
+// aborting request.signal on timeout runs any application abort listener
+// synchronously. If that listener sends the response itself, the timeout path
+// must not then destroy it: doing so resets the keep-alive connection (and any
+// other in-flight requests on it). The connection must stay usable afterwards.
+test('handlerTimeout keeps the connection usable when an abort listener sends the response', async t => {
+  t.plan(2)
+
+  const fastify = Fastify({ handlerTimeout: 100 })
+
+  // A deferred gate keeps the handler pending so the timeout is what ends the
+  // request, while the abort listener sends a complete 504 response.
+  let release
+  const gate = new Promise((resolve) => { release = resolve })
+
+  fastify.get('/timeout', async (request, reply) => {
+    request.signal.addEventListener('abort', () => {
+      reply.code(504).type('text/plain').send('handled by abort listener')
+    })
+    await gate
+  })
+  fastify.get('/after', async () => 'ok')
+
+  await fastify.listen({ port: 0 })
+  t.after(async () => {
+    release()
+    await fastify.close()
+  })
+
+  const socket = net.connect(fastify.server.address().port, '127.0.0.1')
+  t.after(() => socket.destroy())
+
+  const second = await new Promise((resolve, reject) => {
+    let buffer = ''
+    let reused = false
+    socket.setEncoding('utf8')
+    socket.on('connect', () => {
+      socket.write('GET /timeout HTTP/1.1\r\nHost: localhost\r\nConnection: keep-alive\r\n\r\n')
+    })
+    socket.on('data', (chunk) => {
+      buffer += chunk
+      if (!reused && buffer.includes('handled by abort listener')) {
+        // The abort listener's response arrived; reuse the same socket.
+        reused = true
+        buffer = ''
+        socket.write('GET /after HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n')
+      } else if (reused && buffer.includes('ok')) {
+        resolve(buffer)
+      }
+    })
+    socket.on('error', reject)
+    // Without the fix the server destroys the socket after the first response,
+    // so the follow-up request never completes.
+    socket.on('close', () => reject(new Error('connection was reset before the follow-up request completed')))
+  })
+
+  t.assert.strictEqual(second.startsWith('HTTP/1.1 200'), true)
+  t.assert.strictEqual(second.includes('ok'), true)
+})
+
+// A response can be ended (reply.sent === true) while its body is still being
+// flushed to a slow client, so 'finish' has not fired and the timer is still
+// pending. When it fires it must leave the response and request.signal alone.
+// 'finish' is held back explicitly so the test does not depend on how much
+// data the OS socket buffers absorb.
+test('handlerTimeout firing after the reply ended but before it finished is a no-op', async t => {
+  t.plan(4)
+
+  const fastify = Fastify({ handlerTimeout: 50 })
+
+  let signal
+  fastify.get('/', async (request, reply) => {
+    signal = request.signal
+    const res = reply.raw
+    const emit = res.emit
+    res.emit = function (event, ...args) {
+      if (event !== 'finish') return emit.call(this, event, ...args)
+      // Emit 'finish' only well after the handlerTimeout has fired.
+      setTimeout(() => {
+        t.assert.strictEqual(reply.sent, true)
+        t.assert.strictEqual(signal.aborted, false)
+        emit.call(this, event, ...args)
+      }, 200)
+      return true
+    }
+    return 'ok'
+  })
+
+  await fastify.listen({ port: 0 })
+  t.after(() => fastify.close())
+
+  // A raw keep-alive connection, so nothing but the timer can abort the
+  // request while 'finish' is pending.
+  const socket = net.connect(fastify.server.address().port, '127.0.0.1')
+  t.after(() => socket.destroy())
+
+  const response = await new Promise((resolve, reject) => {
+    let buffer = ''
+    socket.setEncoding('utf8')
+    socket.on('connect', () => {
+      socket.write('GET / HTTP/1.1\r\nHost: localhost\r\n\r\n')
+    })
+    socket.on('data', (chunk) => {
+      buffer += chunk
+      if (buffer.endsWith('ok')) resolve(buffer)
+    })
+    socket.on('error', reject)
+  })
+  t.assert.strictEqual(response.startsWith('HTTP/1.1 200'), true)
+
+  // Wait for the deferred 'finish', then the request must still not be aborted.
+  await new Promise((resolve) => setTimeout(resolve, 300))
+  t.assert.strictEqual(signal.aborted, false)
+})
+
 // --- SSE with reply.hijack() ---
 
 test('reply.hijack() clears timeout timer', async t => {

package/test/internals/all.test.js

@@ -33,6 +33,11 @@ test('fastify.all should add all the methods to the same url', async t => {
     }
 
     const res = await fastify.inject(options)
+    if (method === 'HEAD') {
+      // A HEAD response has no body, only the headers of the GET-like response
+      t.assert.strictEqual(res.headers['content-length'], String(Buffer.byteLength(JSON.stringify({ method }))))
+      return
+    }
     const payload = JSON.parse(res.payload)
     t.assert.deepStrictEqual(payload, { method })
   }