inertjs-conduit 1.0.0-beta.0

package/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "inertjs-conduit",
+  "version": "1.0.0-beta.0",
+  "type": "module",
+  "dependencies": {},
+  "engines": {
+    "node": ">=22.0.0"
+  }
+}

package/src/index.js

@@ -0,0 +1,62 @@
+import { Worker } from 'node:worker_threads';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+let worker;
+let idCounter = 0;
+const pending = new Map();
+
+function getWorker() {
+  if (!worker) {
+    worker = new Worker(path.join(__dirname, 'worker.js'));
+    worker.on('message', (msg) => {
+      const p = pending.get(msg.id);
+      if (!p) return;
+      pending.delete(msg.id);
+      
+      if (msg.error) {
+        p.reject(new Error(msg.error));
+      } else {
+        const textData = Buffer.from(msg.data).toString('utf8');
+        p.resolve({
+          status: msg.status,
+          headers: msg.headers,
+          data: msg.data,
+          text: () => Promise.resolve(textData),
+          json: () => Promise.resolve(JSON.parse(textData))
+        });
+      }
+    });
+    worker.on('error', (err) => {
+      for (const p of pending.values()) p.reject(err);
+      pending.clear();
+      worker = null;
+    });
+    worker.on('exit', () => {
+      for (const p of pending.values()) p.reject(new Error('Conduit worker exited unexpectedly'));
+      pending.clear();
+      worker = null;
+    });
+  }
+  return worker;
+}
+
+/**
+ * Securely fetch data in a background thread, preventing Event Loop blocking.
+ * Sensitive headers (authorization, cookies) are automatically stripped from the response.
+ * 
+ * @param {string} url 
+ * @param {RequestInit} options 
+ */
+export async function fetchSecure(url, options = {}) {
+  const w = getWorker();
+  const id = ++idCounter;
+  
+  return new Promise((resolve, reject) => {
+    pending.set(id, { resolve, reject });
+    w.postMessage({ id, url, options });
+  });
+}

package/src/worker.js

@@ -0,0 +1,31 @@
+import { parentPort } from 'node:worker_threads';
+
+const FORBIDDEN_HEADERS = ['authorization', 'cookie', 'set-cookie'];
+
+parentPort.on('message', async ({ id, url, options }) => {
+  try {
+    const res = await fetch(url, options);
+    const headers = {};
+    for (const [key, value] of res.headers.entries()) {
+      if (!FORBIDDEN_HEADERS.includes(key.toLowerCase())) {
+        headers[key] = value;
+      }
+    }
+    
+    const arrayBuffer = await res.arrayBuffer();
+    // Use Uint8Array which is efficiently clonable to the main thread
+    const data = new Uint8Array(arrayBuffer);
+
+    parentPort.postMessage({
+      id,
+      status: res.status,
+      headers,
+      data
+    });
+  } catch (err) {
+    parentPort.postMessage({
+      id,
+      error: err.message
+    });
+  }
+});

package/test/conduit.test.js

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert';
+import http from 'node:http';
+import { fetchSecure } from '../src/index.js';
+
+test('Conduit secure fetch subsystem', async (t) => {
+  // Create a local HTTP server to test against
+  const server = http.createServer((req, res) => {
+    res.setHeader('Set-Cookie', 'secret=123');
+    res.setHeader('Authorization', 'Bearer token');
+    res.setHeader('Content-Type', 'application/json');
+    res.setHeader('X-Safe-Header', 'hello');
+    res.end(JSON.stringify({ message: 'Hello from Conduit' }));
+  });
+
+  await new Promise(resolve => server.listen(0, resolve));
+  const port = server.address().port;
+
+  try {
+    const res = await fetchSecure(`http://127.0.0.1:${port}/test`);
+    
+    assert.strictEqual(res.status, 200);
+    assert.strictEqual(res.headers['x-safe-header'], 'hello');
+    assert.strictEqual(res.headers['set-cookie'], undefined, 'Cookie header should be stripped');
+    assert.strictEqual(res.headers['authorization'], undefined, 'Auth header should be stripped');
+    
+    const data = await res.json();
+    assert.deepStrictEqual(data, { message: 'Hello from Conduit' });
+  } finally {
+    server.close();
+  }
+});