fulmine.js 5.12.2 → 5.13.0

package/src/router.js

@@ -354,6 +354,13 @@ class Walk {
     runRoute(continueRoute) {
         const req = this.req;
         const route = this.route;
+        // A compiled chain walks into a mount rather than entering it, so the rule above needs
+        // saying here as well: everything after this marker is inside the mount, and a mount is
+        // stepped over while an error is in flight. Leaving the chain is what running out of it
+        // already means, and ordinary routing takes over after the mount.
+        if (route.keepMount === true && req._error) {
+            return this.dispatch(this.routes.length);
+        }
         if (route.use) {
             if (route.mountApp) {
                 // optimized chain: normal dispatch swaps req.app when it enters a mounted
@@ -484,7 +491,12 @@ class Walk {
         if (!this.skipCheck && this.skipUntil && this.skipUntil.routeKey >= route.routeKey) {
             return this.step(undefined);
         }
-        if (kind === CALLBACK_ROUTER) {
+        // A mounted router or application is stepped over while an error is in flight. Its handle
+        // takes three arguments, so express's Layer#handleError hands the error straight on without
+        // entering it: what a mount catches is what it raised itself. Entering it ran the error
+        // handlers written inside the mount, and left req.app pointing at a mounted application,
+        // whose settings then answered. A 500 carried an ETag under app.set("etag", false).
+        if (kind === CALLBACK_ROUTER && !req._error) {
             if (callback._isApplication) {
                 rememberApp(this, route, req);
                 useApp(req, callback);
@@ -683,10 +695,18 @@ function setMountedPath(req) {
     req._opPath = req._consumed === 0 ? req._originalPath : req._originalPath.slice(req._consumed);
     req._opPathLower = null;
     req.url = req._opPath === "" ? "/" + req.urlQuery : req._opPath + req.urlQuery;
-    req.path = req._opPath === "" ? "/" : req._opPath;
+    req._path = req._opPath === "" ? "/" : req._opPath;
     req._lastUrl = req.url;
 }
 
+// req.path as the request class declares it, taken off the prototype rather than written out a
+// second time. A request the router adopts is a plain object and gets it defined on itself, see
+// adoptPlainRequest. Enumerable, as express's own is.
+const PATH_PROPERTY = {
+    .../** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(Request.prototype, "path")),
+    enumerable: true
+};
+
 const NO_PARAM_NAMES = [];
 
 /**
@@ -830,7 +850,10 @@ function adoptPlainRequest(req, router) {
     const path = queryIndex === -1 ? raw : raw.slice(0, queryIndex);
     req.urlQuery = queryIndex === -1 ? "" : raw.slice(queryIndex);
     req._rawQuery = req.urlQuery.slice(1);
-    req.path = path;
+    req._path = path;
+    // an adopted request is a plain object, so it carries no prototype of ours and reads its path
+    // off a property of its own. The class's getter itself, so there is one of it
+    Object.defineProperty(req, "path", PATH_PROPERTY);
     req.originalUrl = req.originalUrl ?? arrived;
     req._originalPath = path;
     req.endsWithSlash = path.charCodeAt(path.length - 1) === 0x2f;
@@ -1056,7 +1079,17 @@ function stepsOver(route, req) {
     if (route.bodyMethods === undefined) {
         route.bodyMethods = req.app.get("body methods") ?? null;
     }
-    return route.bodyMethods === null || !route.bodyMethods.includes(req.method);
+    if (route.bodyMethods !== null && route.bodyMethods.includes(req.method)) {
+        return false;
+    }
+    // The layer is not entered, so it leaves the one mark it would have left: the parser puts
+    // `body` on the request before it works out that there is nothing to read. A library asks
+    // `"body" in req` to tell "a parser has run" from "none has", and a skip that did not leave
+    // it would answer a GET differently from express. See the same seeding in middlewares.js
+    if (!("body" in req)) {
+        req.body = undefined;
+    }
+    return true;
 }
 
 /**
@@ -1848,6 +1881,16 @@ module.exports = class Router extends EventEmitter {
                 }
             }
 
+            // The same rule as the one just above, which a route of another method reaches by
+            // another road. A mount's chain is inherited by every path under it, and a route that
+            // is not itself a mount answers the mount point rather than the subtree: in the chain
+            // it ran for the whole of it, so router.all("/:p1") answered the /posts/a-b that
+            // belongs to the router mounted at /posts. guardsInside is written for this: only
+            // layers with more segments than the mount path are asked about a leaf.
+            if (route.use && !r.use && typeof route.path === "string" && couldAnswer(r, route.path)) {
+                return false;
+            }
+
             // a RegExp mount runs only where its match starts the path and breaks on a separator,
             // which is decidable here against a literal path and not against one with a parameter
             if (r.regexMount) {
@@ -1874,13 +1917,9 @@ module.exports = class Router extends EventEmitter {
 
             // check if the paths match. A route with parameters is excluded from the text test:
             // its literal ":name" text would let an earlier regex in on requests it never matches.
-            // Both spellings of this route's path are tried, because without strict routing it
-            // answers "/x/" as well as "/x", and an earlier pattern that matches only the first is
-            // still an earlier pattern that answers a request this registration would take.
+            const regexCanMatch = r.pattern instanceof RegExp && (!withParams || r.use);
             if (
-                (r.pattern instanceof RegExp &&
-                    (!withParams || r.use) &&
-                    (r.pattern.test(route.path) || (!strictHere && r.pattern.test(route.path + "/")))) ||
+                (regexCanMatch && r.pattern.test(route.path)) ||
                 (typeof r.pattern === "string" &&
                     (r.pattern === route.path ||
                         (!caseSensitive && r.pattern.toLowerCase() === routePathFolded) ||
@@ -1892,6 +1931,15 @@ module.exports = class Router extends EventEmitter {
                 optimizedPath.push(r);
                 continue;
             }
+            // Without strict routing this registration answers "/x/" as well as "/x". An earlier
+            // pattern matching only the second answers part of what the registration takes and not
+            // the rest, which the chain has no way to say: it runs what is in it without matching
+            // again. Both spellings used to put the route in whole, so app.all("/:p0/{:o1}/{:o2}")
+            // answered a GET /list/Mixed that belonged to the route written after it. An ordinary
+            // pattern answers both spellings, so only an optional group or a wildcard reaches here.
+            if (regexCanMatch && !strictHere && r.pattern.test(route.path + "/")) {
+                return false;
+            }
             if (!withParams) {
                 continue;
             }
@@ -1951,6 +1999,13 @@ module.exports = class Router extends EventEmitter {
         if (!this.uwsApp) {
             return;
         }
+        // Everything below is what makes this framework fast, and every one of its decisions is a
+        // claim that µWS answering by itself is the same answer the chain would have given. Turned
+        // off, the claim is not made and the chain answers everything. Serving one application both
+        // ways and comparing the answers is what tests those claims: `npm run fuzz -- --self`.
+        if (this.get("native routes") === false) {
+            return;
+        }
 
         // pathPrefix/chainPrefix accumulate across nested sole-callback mounts, and outerGuards
         // carries what was written before them and answers only part of what is under them
@@ -2135,7 +2190,7 @@ module.exports = class Router extends EventEmitter {
      *
      * @param {any} response
      */
-    _refuseFraming(response) {
+    _refuseRequest(response) {
         response.finished = true;
         response._res.close();
         response.emit("close");
@@ -2247,8 +2302,8 @@ module.exports = class Router extends EventEmitter {
                 }
                 const request = this.handleRequest(res, req, preset, skipHolder);
                 const response = request.res;
-                if (request._badFraming === true) {
-                    return this._refuseFraming(response);
+                if (request._mustRefuse === true) {
+                    return this._refuseRequest(response);
                 }
                 if (optimizedParams) {
                     request.optimizedParams = new NullObject();
@@ -2347,6 +2402,10 @@ module.exports = class Router extends EventEmitter {
             route.callbacks.length === 1 && // must not have multiple callbacks
             typeof route.callbacks[0] === "function" && // must be a function
             route.paramCallbacks.size === 0 && // a param callback has to run, and this answers without running anything
+            // a captured value is decoded when the route runs, and one that cannot be decoded is a
+            // 400 in express and on the ordinary path here. Nothing runs to raise it on a
+            // declarative response, so GET /a-b%5Ec@d%e came back 200 from app.get("/:p12")
+            route.optimizedParams === undefined &&
             // a declarative response is answered by µWS itself, so no javascript runs and the case
             // guard could not: a route that needs one has to stay an ordinary handler
             caseGuards === null &&

package/src/testing.js

@@ -171,6 +171,32 @@ function expectNative(app, patterns) {
     );
 }
 
+/**
+ * Why a route µWS already matches is still not compiled into a response.
+ *
+ * The handler is the last answer, not the first: three refusals come before it, and blaming the
+ * handler for one of those sends the reader to rewrite something that was already simple enough.
+ *
+ * @param {any} app
+ * @param {{path: string}} entry
+ * @returns {string}
+ */
+function whyNotCompiled(app, entry) {
+    if (!app.get("declarative responses")) {
+        return "answered by µWS, but declarative responses are turned off";
+    }
+    if (entry.path.includes(":")) {
+        return "answered by µWS, but the route captures, and nothing runs to decode the value";
+    }
+    if (app.get("etag")) {
+        return (
+            "answered by µWS, but a response carrying an ETag could never answer the conditional " +
+            'request it invites: app.set("etag", false) is what puts a route here'
+        );
+    }
+    return "answered by µWS, but the handler is not simple enough to compile";
+}
+
 /**
  * Throws unless every route named is answered from a response written at startup, which is the
  * step past native: µWS answers it without entering javascript at all.
@@ -189,9 +215,7 @@ function expectDeclarative(app, patterns) {
                 .map(
                     (entry) =>
                         `  ${entry.method} ${entry.path}\n    ` +
-                        (entry.native
-                            ? "answered by µWS, but the handler is no longer simple enough to compile"
-                            : entry.reason)
+                        (entry.native ? whyNotCompiled(app, entry) : entry.reason)
                 )
                 .join("\n") +
             `\n\nRun \`npx fulmine profile\` to see the whole picture.`

package/src/utils.js

@@ -409,8 +409,21 @@ function patternToRegex(pattern, isPrefix = false, caseSensitive = true, strict
             // splits /a.b.c against /:file{.:ext} as file=a.b, ext=c, which only works if ext
             // cannot contain a dot. After static text there is nothing to give ground, so the
             // parameter takes everything: /file{.:ext} against /file.tar.gz gives ext=tar.gz.
-            const separator = lastTokenWasParam && groupContent[0] && groupContent[0] !== ":" ? groupContent[0] : "";
-            const groupParamClass = `[^/${separator.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}]+`;
+            // The whole of it, not its first character: /:foo{abc:bar} against /123abcabc splits as
+            // foo=123 and bar=abc on express, and reading the separator as "a" left bar unable to
+            // match its own text, so the group never matched and foo took the segment whole. More
+            // than one character cannot go in a class, so it is written as a lookahead, and either
+            // way the parameter is still allowed to be exactly the separator, as path-to-regexp
+            // writes it.
+            const colon = groupContent.indexOf(":");
+            const separator = lastTokenWasParam && colon > 0 ? groupContent.slice(0, colon) : "";
+            const escapedSeparator = separator.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const groupParamClass =
+                separator === ""
+                    ? "[^/]+"
+                    : separator.length === 1
+                      ? `[^/${escapedSeparator}]+|${escapedSeparator}`
+                      : `(?:(?!${escapedSeparator})[^/])+|${escapedSeparator}`;
 
             let groupRegex = "";
             let gi = 0;
@@ -961,6 +974,13 @@ const defaultSettings = {
     // The native µWS router matches bytes, so the compiler in _compileOptimizedRoutes only hands
     // it routes whose earlier siblings it can prove agree under either case rule.
     "declarative responses": true,
+    // on. Off hands every request to the ordinary chain instead of letting µWS match what it can,
+    // which is slower and answers the same. Not a tuning knob: it exists so one application can be
+    // served both ways and the two sets of answers compared, which tests the optimizer against the
+    // rest of the framework without a second framework to compare with. See
+    // `npm run fuzz -- --self`. A compiled response needs a native registration to hang on, so this
+    // takes "declarative responses" with it.
+    "native routes": true,
     // off: with a window set, the size and mtime of a file served by sendFile are remembered for
     // it, which is one syscall less per request and a file that can be served as it was a moment
     // ago. "stat cache ms" is the window in milliseconds, compiled from it by set()