fulmine.js 5.15.0 → 5.16.0

package/src/request.js

@@ -229,6 +229,13 @@ function endsWithChunked(value) {
  * @returns {boolean}
  */
 function saysClose(value) {
+    // what clients actually send, almost always: two interned compares answer before the scan
+    if (value === "keep-alive") {
+        return false;
+    }
+    if (value === "close") {
+        return true;
+    }
     const length = value.length;
     let at = 0;
     while (at < length) {
@@ -662,6 +669,19 @@ module.exports = class Request extends LazyReadable {
      */
     noEtag;
 
+    /**
+     * The decoded pairs of the first default-parser parse of req.query, flat key,value; false
+     * when it saw a repeated key, which a flat replay cannot reproduce. See `get query`.
+     * @type {string[]|false|undefined}
+     */
+    _querySnap;
+
+    /**
+     * The raw string _querySnap came from: a url rewrite replaces _rawQuery.
+     * @type {string|undefined}
+     */
+    _querySnapRaw;
+
     /**
      * Built for every request, which is why so little happens here. The headers are copied out
      * because uWS only lends them for this call, everything derived from them waits until something
@@ -681,23 +701,24 @@ module.exports = class Request extends LazyReadable {
         super();
         this._res = res;
         this._req = req;
-        // the plain field behind the `readable` accessor, written rather than set so a request that
-        // never streams never builds a stream
-        this._readableFlag = true;
         if (skipHolder !== undefined && skipHolder.skipHeaders) {
             // The chain behind this registration provably never reads a header, so instead of
-            // copying them all out of uWS the constructor asks for the four that steer the
-            // framework itself: body framing, keep-alive, and accept for the error page a
-            // throw could still need. A GET that does declare a body is the rare case, and
-            // the parsers and the stream want the whole picture, so it takes the full copy.
+            // copying them all out of uWS the constructor asks for the ones that steer the
+            // framework itself: body framing, keep-alive, and the conditional pair. A GET that
+            // does declare a body is the rare case, and the parsers and the stream want the
+            // whole picture, so it takes the full copy.
             //
-            // Seven named reads against one forEach looks like it should lose, and does not: the
-            // seven are flat at 0.75us however many headers are on the wire, since each one is a
-            // napi crossing and the scan behind it is nothing, while the copy pays a hop back into
-            // JS per header and grows, 1.16us at four headers, 1.61 at eight, 2.90 at sixteen. They
-            // do not cross, and the gap widens exactly where real traffic lives, since a browser
-            // sends a dozen or more. The body case pays two of the seven and then copies anyway,
-            // which is 0.2us on a request that is about to read a body.
+            // A handful of named reads against one forEach looks like it should lose, and does
+            // not: measured at seven reads they were flat at 0.75us however many headers are on
+            // the wire, since each one is a napi crossing and the scan behind it is nothing,
+            // while the copy pays a hop back into JS per header and grows, 1.16us at four
+            // headers, 1.61 at eight, 2.90 at sixteen. They do not cross, and the gap widens
+            // exactly where real traffic lives, since a browser sends a dozen or more. The body
+            // case pays two reads and then copies anyway, which is 0.2us on a request that is
+            // about to read a body.
+            //
+            // accept is not read: nothing on a granted chain consumes it, the error and 404
+            // pages are fixed HTML that never negotiate.
             const length = req.getHeader("content-length");
             const transferEncoding = req.getHeader("transfer-encoding");
             // A content-length of "0" declares no body and used to stay on the cheap side, but
@@ -724,12 +745,8 @@ module.exports = class Request extends LazyReadable {
                         this._connectionClose = true;
                     }
                 }
-                const accept = req.getHeader("accept");
-                if (accept !== "") {
-                    entries.push("accept", accept);
-                }
                 // send consults freshness whatever the etag setting: if-none-match can be "*"
-                // and a handler may set a validator by hand, so the conditional trio has to be
+                // and a handler may set a validator by hand, so the conditional pair has to be
                 // really absent rather than merely uncopied
                 const ifNoneMatch = req.getHeader("if-none-match");
                 if (ifNoneMatch !== "") {
@@ -739,9 +756,13 @@ module.exports = class Request extends LazyReadable {
                 if (ifModifiedSince !== "") {
                     entries.push("if-modified-since", ifModifiedSince);
                 }
-                const cacheControl = req.getHeader("cache-control");
-                if (cacheControl !== "") {
-                    entries.push("cache-control", cacheControl);
+                // fresh() answers false before it reads cache-control unless a conditional
+                // arrived, so the read only pays on the requests that can use it
+                if (ifNoneMatch !== "" || ifModifiedSince !== "") {
+                    const cacheControl = req.getHeader("cache-control");
+                    if (cacheControl !== "") {
+                        entries.push("cache-control", cacheControl);
+                    }
                 }
             }
         } else {
@@ -802,18 +823,26 @@ module.exports = class Request extends LazyReadable {
             this._opPath = this._path;
             this._originalPath = this._path;
             const rawMethod = req.getCaseSensitiveMethod();
-            this.method = rawMethod.toUpperCase();
-            // node's parser knows a fixed set and refuses everything else; µWS takes the token as
-            // it finds it, so a request line is anything with a space in it. Compared before the
-            // uppercasing on purpose: a method is case sensitive, node refuses "post", and µWS
-            // folds it to POST and serves it. Only asked of a method the framework cannot route
-            // anyway, since a route can only be registered for one of these, see the loop that
-            // builds the verb methods at the end of router.js
-            if (!KNOWN_METHODS.has(rawMethod)) {
-                this._mustRefuse = true;
+            if (skipHolder !== undefined && rawMethod === skipHolder.method) {
+                // the registration's constant, byte for byte; any other spelling, "get" that µWS
+                // folded here included, takes the full check below
+                this.method = rawMethod;
+                this._isOptions = skipHolder.isOptions;
+                this._isHead = skipHolder.isHead;
+            } else {
+                this.method = rawMethod.toUpperCase();
+                // node's parser knows a fixed set and refuses everything else; µWS takes the token
+                // as it finds it, so a request line is anything with a space in it. Compared before
+                // the uppercasing on purpose: a method is case sensitive, node refuses "post", and
+                // µWS folds it to POST and serves it. Only asked of a method the framework cannot
+                // route anyway, since a route can only be registered for one of these, see the loop
+                // that builds the verb methods at the end of router.js
+                if (!KNOWN_METHODS.has(rawMethod)) {
+                    this._mustRefuse = true;
+                }
+                this._isOptions = this.method === "OPTIONS";
+                this._isHead = this.method === "HEAD";
             }
-            this._isOptions = this.method === "OPTIONS";
-            this._isHead = this.method === "HEAD";
         }
         // what the router last saw as the method. A middleware assigning another one is a rewrite,
         // which express honours because it reads req.method at every layer, and dispatch compares
@@ -839,9 +868,6 @@ module.exports = class Request extends LazyReadable {
         // null for the same reason as the two above: a request that never enters a mount never
         // needs either array, and the push sites materialize them
         this._stack = null;
-        // how many characters of _originalPath the mounts entered so far have taken, which is
-        // where baseUrl ends and the path below them begins
-        this._consumed = 0;
         // whether one of them took a trailing slash, which only a RegExp mount can: see baseUrl
         this._mountSlash = false;
         this._paramStack = null;
@@ -925,6 +951,35 @@ module.exports = class Request extends LazyReadable {
         return undefined;
     }
 
+    /**
+     * The same, with repeats folded exactly as the headers object folds them, so a reader of one
+     * name per request does not build the whole object to stay correct on a repeated header.
+     * Not for set-cookie, whose folded form is an array.
+     *
+     * @param {string} name lowercase
+     * @returns {string|undefined}
+     */
+    _foldedHeader(name) {
+        if (this.#cachedHeaders !== null) {
+            return this.#cachedHeaders[name];
+        }
+        const entries = this.#rawHeadersEntries;
+        let value;
+        for (let i = 0, len = entries.length; i < len; i += 2) {
+            if (entries[i] === name) {
+                if (value === undefined) {
+                    value = entries[i + 1];
+                } else {
+                    if (discardedDuplicates.has(name)) {
+                        continue;
+                    }
+                    value += (name === "cookie" ? "; " : ", ") + entries[i + 1];
+                }
+            }
+        }
+        return value;
+    }
+
     /**
      * Whether there is any point still reading the body: once the response is finished or the
      * connection is gone, uWS has nothing left to hand over.
@@ -1039,7 +1094,11 @@ module.exports = class Request extends LazyReadable {
         // slash, a registered path having had it removed, so almost every request answers above.
         let out = "";
         let at = 0;
-        for (const taken of this._stack) {
+        for (let taken of this._stack) {
+            // negative marks a mount that consumed the whole path, see the push in runRoute
+            if (taken < 0) {
+                taken = -taken;
+            }
             const piece = this._originalPath.slice(at, at + taken);
             at += taken;
             out += piece.charCodeAt(taken - 1) === 0x2f ? piece.slice(0, -1) : piece;
@@ -1199,18 +1258,30 @@ module.exports = class Request extends LazyReadable {
      * path, and req.query reflects the new query string. The assigned url is relative to the
      * mount the request is currently in, as it is in express, so the absolute path is rebuilt
      * from the piece the mounts had consumed.
+     *
+     * @param {boolean} [leavingMount] the caller is popping the mount the rewrite happened in
      */
-    _absorbUrlRewrite() {
-        const newUrl = String(this.url);
-        const queryIndex = newUrl.indexOf("?");
-        const newPath = queryIndex === -1 ? newUrl : newUrl.slice(0, queryIndex);
+    _absorbUrlRewrite(leavingMount) {
+        const assignedUrl = String(this.url);
+        let newUrl = assignedUrl;
         // the prefix the mounts consumed: everything of the absolute path the relative one was not
         const lastQueryIndex = this._lastUrl.indexOf("?");
         const oldPath = lastQueryIndex === -1 ? this._lastUrl : this._lastUrl.slice(0, lastQueryIndex);
-        const prefix =
-            oldPath === "/" && !this._originalPath.endsWith("/")
-                ? this._originalPath
-                : this._originalPath.slice(0, this._originalPath.length - oldPath.length);
+        let prefix;
+        if (oldPath === "/" && !this._originalPath.endsWith("/")) {
+            prefix = this._originalPath;
+            // express's slashAdded restore, applied where express applies it, on the way out of a
+            // mount that consumed the whole path: the "/" the middleware saw was invented, and the
+            // rejoin strips the first character of whatever was assigned ("/found" + "target" is
+            // "/foundtarget"). Inside the mount the assigned url routes as it is, as express does
+            if (leavingMount === true) {
+                newUrl = newUrl.slice(1);
+            }
+        } else {
+            prefix = this._originalPath.slice(0, this._originalPath.length - oldPath.length);
+        }
+        const queryIndex = newUrl.indexOf("?");
+        const newPath = queryIndex === -1 ? newUrl : newUrl.slice(0, queryIndex);
         this._rawQuery = queryIndex === -1 ? "" : newUrl.slice(queryIndex + 1);
         // a rewrite to "/a?" keeps its "?", as one arriving that way does
         this.urlQuery = queryIndex === -1 ? "" : "?" + this._rawQuery;
@@ -1220,7 +1291,9 @@ module.exports = class Request extends LazyReadable {
         this._opPath = newPath;
         this._opPathLower = null;
         this._mayFailDecode = null;
-        this._lastUrl = newUrl;
+        // the assigned string, not the mangled one: the compare against req.url must go quiet or
+        // the next hop absorbs the same rewrite again with a different prefix
+        this._lastUrl = assignedUrl;
     }
 
     /**
@@ -1251,15 +1324,16 @@ module.exports = class Request extends LazyReadable {
      * the parse cached and handed out as itself, the sanitised value leaked into req.query here and
      * a handler written against express read a trimmed value where express gives it the raw one.
      *
-     * And that is why there is no cache: the fresh object comes from parsing the raw string again,
-     * not from copying a kept parse. As first shipped this was parse-once-copy-per-read, and the
-     * copy was the expensive half: Object.assign between null-prototype objects, which live in
-     * V8's dictionary mode, measured 638ns for a two-parameter query where parsing the same string
-     * measures 119ns, and on a benchmark whose every request carries such a query it cost +1.5us
-     * of CPU per request, which a public arena saw as -8% on its query-carrying rows. A handler
-     * that reads req.query once per request now pays exactly what it paid when the parse was
-     * cached, one parse, and a handler that reads it N times pays N parses, which is express's
-     * own cost shape.
+     * And that is why there is no cache of the object: the fresh object comes from the raw
+     * string, not from copying a kept parse. As first shipped this was parse-once-copy-per-read,
+     * and the copy was the expensive half: Object.assign between null-prototype objects, which
+     * live in V8's dictionary mode, measured 638ns for a two-parameter query where parsing the
+     * same string measures 119ns, and on a benchmark whose every request carries such a query it
+     * cost +1.5us of CPU per request, which a public arena saw as -8% on its query-carrying rows.
+     *
+     * The default parser does keep the decoded pairs of its first parse, and a later read of the
+     * same raw string replays the stores into a fresh null-prototype object: identical output,
+     * still nothing shared between reads. A repeated key cannot be replayed and re-parses.
      *
      * @returns {Record<string, any>}
      */
@@ -1277,7 +1351,25 @@ module.exports = class Request extends LazyReadable {
             return Object.create(null);
         }
         if (qp === parseQuery) {
-            return parseQuery(this._rawQuery);
+            const raw = this._rawQuery;
+            if (this._querySnapRaw === raw) {
+                const snap = this._querySnap;
+                if (snap === false) {
+                    return parseQuery(raw);
+                }
+                const out = Object.create(null);
+                const pairs = /** @type {string[]} */ (snap);
+                for (let i = 0, len = pairs.length; i < len; i += 2) {
+                    out[pairs[i]] = pairs[i + 1];
+                }
+                return out;
+            }
+            /** @type {string[] & {invalid?: boolean}} */
+            const capture = [];
+            const out = parseQuery(raw, capture);
+            this._querySnapRaw = raw;
+            this._querySnap = capture.invalid === true ? false : capture;
+            return out;
         }
         if (qp === fastQueryParse) {
             return Object.assign(Object.create(null), fastQueryParse(this._rawQuery));
@@ -1686,7 +1778,9 @@ module.exports = class Request extends LazyReadable {
             const value = entries[index + 1];
             // lowercase by the entries' contract, see the field declaration
             const key = entries[index];
-            if (Object.hasOwn(headers, key)) {
+            // own values are never undefined, so the read answers "absent" without the hasOwn
+            // call; a prototype-named header reads truthy and still takes the hasOwn check
+            if (headers[key] !== undefined && Object.hasOwn(headers, key)) {
                 if (discardedDuplicates.has(key)) {
                     continue;
                 }

package/src/response.js

@@ -72,15 +72,37 @@ const symbols = Object.getOwnPropertySymbols(outgoingMessage);
 // if a future node renames it, fall back to a private symbol rather than writing a property
 // literally named "undefined", which is what indexing with undefined would do
 const kOutHeaders = symbols.find((s) => s.toString() === "Symbol(kOutHeaders)") ?? Symbol("kOutHeaders");
+// node's emitters tombstone a removed listener's slot instead of deleting it when this flag is
+// set, which is what keeps _events in a stable shape. EventEmitter.init sets it, and never runs
+// for the lazily-materialized response, so it is set by hand; a future rename degrades to the
+// delete, not to an error
+const kShapeMode =
+    Object.getOwnPropertySymbols(new EventEmitter()).find((s) => s.toString() === "Symbol(shapeMode)") ??
+    Symbol("shapeMode");
+// names setHeader has validated and lowercased, so the constant names middleware writes per
+// request are one Map hit. Insert-only after validation, bounded; only setHeader may insert,
+// the never-throwing readers keep their plain toLowerCase
+const VALIDATED_HEADER_NAMES = new Map();
 const HIGH_WATERMARK = 128 * 1024;
-// Statuses whose message carries no body, so no Content-Length may describe one either. 1xx is
-// the third case and is checked by range rather than listed.
-const STATUSES_WITHOUT_BODY = new Set([204, 304]);
+// the exact string json() writes, so send() can skip recomputing the charset on it
+const JSON_UTF8 = "application/json; charset=utf-8";
 // send's ceiling for maxAge, one year in milliseconds. Anything larger is clamped to it rather
 // than written out, since a year is already longer than any cache will honour.
 const MAX_MAXAGE = 60 * 60 * 24 * 365 * 1000;
 
 class Socket extends EventEmitter {
+    /**
+     * The Socket's own error listener, shared across sockets: an error on the stand-in closes it,
+     * which is the close the connection trackers wait for. EventEmitter calls it with this = the
+     * emitter.
+     *
+     * @this {any}
+     * @param {any} err
+     */
+    static _onError(err) {
+        this.emit("close");
+    }
+
     /**
      * Enough of a node socket for the middleware that reaches for one. There is no socket object
      * in uWS to hand over, so this stands in and forwards what it can to the response.
@@ -90,10 +112,10 @@ class Socket extends EventEmitter {
     constructor(response) {
         super();
         this.response = response;
+        this[kShapeMode] = true;
 
-        this.on("error", (err) => {
-            this.emit("close");
-        });
+        // shared, not an arrow: one per process instead of one per materialized socket
+        this.on("error", Socket._onError);
     }
 
     /** Whether anything more can be written, which stops being true once the response is done. */
@@ -276,6 +298,11 @@ module.exports = class Response extends LazyWritable {
             drain: undefined
         };
         this._eventsCount = 0;
+        // tombstone removed listeners instead of deleting the key, as node's own streams do: the
+        // delete flipped this literal to dictionary mode on every on-finished cancel
+        this[kShapeMode] = true;
+        // on-finished stores its state here; declared so that store is not a shape change
+        this.__onFinished = null;
         this._req = req;
         // linked here rather than by the caller: the pair is built together, and a field the
         // constructor leaves unset is a shape change on whoever assigns it first
@@ -801,7 +828,9 @@ module.exports = class Response extends LazyWritable {
         // without one writes "Content-Length: 9223372036854775808" onto a 204. Those two paths keep
         // µWS's own rule, which closes for a bare "close" and not for a list.
         const closeConnection = this.req._connectionClose === true;
-        if (STATUSES_WITHOUT_BODY.has(this.statusCode) || this.statusCode < 200) {
+        // 204 and 304 carry no body, so no Content-Length may describe one either; 1xx is the
+        // third case, by range
+        if (this.statusCode === 204 || this.statusCode === 304 || this.statusCode < 200) {
             // no body and no length describing one, whatever the caller passed. node decides
             // this the same way, from the status alone, so res.status(304).end("x") sends the
             // status and nothing else on either.
@@ -905,9 +934,10 @@ module.exports = class Response extends LazyWritable {
                 if (!skipContentType) {
                     this.headers["content-type"] = "text/html; charset=utf-8";
                 }
-            } else if (typeof contentType === "string") {
+            } else if (typeof contentType === "string" && contentType !== JSON_UTF8) {
                 // replaced, not only added: the body goes out as utf-8, so a content-type saying
-                // iso-8859-1 would be describing bytes that are not there.
+                // iso-8859-1 would be describing bytes that are not there. The json() literal is
+                // already exactly that, so the common res.json answer skips the recomputation
                 this.headers["content-type"] = withUtf8Charset(contentType);
             }
         } else {
@@ -1374,7 +1404,16 @@ module.exports = class Response extends LazyWritable {
         if (this.headersSent) {
             throw new Error("Cannot set headers after they are sent to the client");
         }
-        validateHeaderName(field);
+        // one Map hit for a name already validated and lowercased: middleware writes the same
+        // constant names on every request. Insert-only after validation, so no bad name can enter
+        let key = VALIDATED_HEADER_NAMES.get(field);
+        if (key === undefined) {
+            validateHeaderName(field);
+            key = field.toLowerCase();
+            if (VALIDATED_HEADER_NAMES.size < 512) {
+                VALIDATED_HEADER_NAMES.set(field, key);
+            }
+        }
         if (value === undefined) {
             /** @type {NodeJS.ErrnoException} */
             const err = new TypeError(`Invalid value "undefined" for header "${field}"`);
@@ -1388,7 +1427,7 @@ module.exports = class Response extends LazyWritable {
         // catch it
         const out = Array.isArray(value) ? value.map(String) : String(value);
         validateHeaderValue(field, out);
-        this.headers[field.toLowerCase()] = out;
+        this.headers[key] = out;
         return this;
     }
 
@@ -1737,7 +1776,11 @@ module.exports = class Response extends LazyWritable {
      * @param {string} field
      */
     removeHeader(field) {
-        delete this.headers[field.toLowerCase()];
+        const key = field.toLowerCase();
+        // the delete is a runtime call, and helmet removes a header most responses never carry
+        if (key in this.headers) {
+            delete this.headers[key];
+        }
     }
 
     /**
@@ -1912,7 +1955,7 @@ module.exports = class Response extends LazyWritable {
      */
     json(body) {
         if (!this.headers["content-type"]) {
-            this.headers["content-type"] = "application/json; charset=utf-8";
+            this.headers["content-type"] = JSON_UTF8;
         }
         const hot = this.app._hot();
         return this.send(stringify(body, hot.jsonReplacer, hot.jsonSpaces, hot.jsonEscape));