fulmine.js 5.21.2 → 5.21.4

package/src/usage.js

@@ -74,7 +74,7 @@ const verdicts = new WeakMap();
  * What one callback provably does, as a mask of the facts above. The default is UNKNOWN: any shape
  * this walk does not understand, and any alias of req, res or next, could do anything.
  *
- * @param {Function} fn
+ * @param {Function & {[kGetSafe]?: boolean}} fn
  * @returns {number}
  */
 function callbackUsage(fn) {
@@ -143,6 +143,20 @@ function analyze(fn) {
         if (mask & UNKNOWN) {
             return;
         }
+        // a member read off what a call returned: res.status(200).sendFile() is a sendFile on res,
+        // every chainable method returns res itself, so it is judged as one. Reading it off the
+        // call had let sendFile and redirect through, and a Range or an Accept then went unread
+        if (
+            node.type === "MemberExpression" &&
+            node.object.type === "CallExpression" &&
+            resName !== null &&
+            chainRoot(node.object) === resName
+        ) {
+            if (node.computed || !RES_OK.has(node.property.name)) {
+                mask |= UNKNOWN;
+            }
+            return;
+        }
         if (node.type === "MemberExpression" && !node.computed && node.object.type === "Identifier") {
             const owner = node.object.name;
             if (owner !== reqName) {
@@ -227,6 +241,25 @@ function analyze(fn) {
     return mask;
 }
 
+/**
+ * The identifier a chain of members and calls starts from: res for res.status(200).sendFile().
+ *
+ * @param {any} node
+ * @returns {string|null} null when the chain does not start from a plain identifier
+ */
+function chainRoot(node) {
+    while (node) {
+        if (node.type === "MemberExpression") {
+            node = node.object;
+        } else if (node.type === "CallExpression") {
+            node = node.callee;
+        } else {
+            return node.type === "Identifier" ? node.name : null;
+        }
+    }
+    return null;
+}
+
 /**
  * Walks every node by key, handing each its parent.
  *
@@ -275,12 +308,16 @@ function chainUsage(chain, allowTerminalNext) {
             return none;
         }
         const terminal = i === chain.length - 1;
-        for (const cb of callbacks) {
+        for (let j = 0; j < callbacks.length; j++) {
+            const cb = callbacks[j];
             if (typeof cb !== "function") {
                 return none;
             }
             const mask = callbackUsage(cb);
-            if (mask & UNKNOWN || (mask & NEXT_PLAIN && terminal && !allowTerminalNext)) {
+            // a bare next() leaves the chain only from the route's last callback: from one in
+            // front of it, the step lands on the next callback of the same route, judged here too
+            const last = terminal && j === callbacks.length - 1;
+            if (mask & UNKNOWN || (mask & NEXT_PLAIN && last && !allowTerminalNext)) {
                 return none;
             }
             if (mask & QUERY) {

package/src/utils.js

@@ -896,6 +896,8 @@ function negotiateEncoding(accept, allowed) {
     return best;
 }
 
+// a function here is called with the application at construction, see Application's constructor
+/** @type {Record<string, unknown>} */
 const defaultSettings = {
     "jsonp callback name": "callback",
     env: () => process.env.NODE_ENV ?? "development",
@@ -1501,6 +1503,7 @@ function headerIsWritable(name, value) {
 }
 
 // the status send picks for a failed stat; anything else is the server's 500
+/** @type {Record<string, number>} */
 const STAT_ERROR_STATUS = { ENAMETOOLONG: 404, ENOTDIR: 404, ENOENT: 404 };
 
 /**
@@ -1548,7 +1551,7 @@ function httpErrorName(status) {
  */
 function asStatError(err) {
     err.expose = false;
-    err.statusCode = STAT_ERROR_STATUS[err.code] ?? 500;
+    err.statusCode = STAT_ERROR_STATUS[/** @type {string} */ (err.code)] ?? 500;
     err.status = err.statusCode;
     return err;
 }

package/src/verify.js

@@ -36,6 +36,7 @@ const SWAP_IMAGE = `node:${MIN_NODE_MAJOR}-trixie-slim`;
 
 // What a project may carry that needs a different API here. Everything that just works is
 // `npx fulmine migrate`'s business.
+/** @type {Record<string, string>} */
 const NEEDS_A_LOOK = {
     "socket.io": "attach it with io.attachApp(app.uwsApp), not io.attach(server): there is no node socket to take over",
     ws: "the websocket server is µWS's own, through app.ws(path, behavior)",
@@ -191,6 +192,7 @@ function checkBinary(platform = process.platform, arch = process.arch, abi = pro
  * @returns {string}
  */
 function abiToNode(abi) {
+    /** @type {Record<string, string>} */
     const known = { 108: "18", 115: "20", 127: "22", 131: "23", 137: "24", 147: "26" };
     return known[abi] ?? `ABI ${abi}`;
 }

package/src/view.js

@@ -172,6 +172,7 @@ module.exports = class View {
         if (stat && stat.isFile()) {
             return _path;
         }
+        return undefined;
     }
 };
 

package/src/websocket.js

@@ -237,8 +237,9 @@ function checkBehavior(path, behavior) {
                 "parameters that are a whole segment, as in /room/:id."
         );
     }
+    const handlers = /** @type {Record<string, unknown>} */ (behavior);
     for (const name of [...SOCKET_HANDLERS, "upgrade"]) {
-        if (behavior[name] !== undefined && typeof behavior[name] !== "function") {
+        if (handlers[name] !== undefined && typeof handlers[name] !== "function") {
             throw new TypeError(`app.ws() behavior.${name} must be a function`);
         }
     }

package/src/work.js

@@ -61,6 +61,7 @@ function work(req, res) {
 }
 
 // The order both readers list them in, cheapest first, so a header and a failure message agree.
+/** @type {[keyof Work, string][]} */
 const NAMES = [
     ["headers", "headers"],
     ["query", "query"],