json-rest-api 1.0.29 → 2.1.0

package/plugins/core/connectors/fastify-plugin.js

@@ -1,9 +1,13 @@
 import { createContext } from './lib/request-helpers.js'
-import { createEnhancedLogger } from '../../../lib/enhanced-logger.js'
-import { buildTransportRouteSchema } from './lib/transport-route-schemas.js'
+import { buildTransportRouteSchema, getTransportRouteContract } from './lib/transport-route-schemas.js'
+import { validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
 import {
   isWriteMethod,
   isAllowedWriteContentType,
+  mergeResponseHeaders,
+  acceptsJsonApi,
+  getNotAcceptableErrorBody,
+  getNotFoundErrorBody,
   getUnsupportedMediaTypeErrorBody
 } from './lib/transport-http-helpers.js'
 import {
@@ -11,59 +15,55 @@ import {
   buildTransportRequestData,
   createConnectorContext,
   runTransportRequestLifecycle,
+  applyTransportResponseLifecycle,
+  addWriteOutcomeToHttpErrors,
   buildTransportRejectionBody,
   executeConnectorRoute,
+  logHttpRequestError,
   handleConnectorError
 } from './lib/connector-core.js'
 
 function applyHeaders (reply, headers = {}) {
-  for (const [headerName, headerValue] of Object.entries(headers)) {
+  const merged = mergeResponseHeaders({ vary: reply.getHeader('vary') }, headers, { vary: 'Accept' })
+  for (const [headerName, headerValue] of Object.entries(merged)) {
     reply.header(headerName, headerValue)
   }
 }
 
-function registerVendorJsonParser (app) {
-  if (typeof app?.addContentTypeParser !== 'function') return
-  if (typeof app?.hasContentTypeParser === 'function' && app.hasContentTypeParser('application/vnd.api+json')) {
-    return
-  }
-
-  app.addContentTypeParser(
-    'application/vnd.api+json',
-    { parseAs: 'string' },
-    (request, body, done) => {
-      if (body === '' || body === undefined || body === null) {
-        done(null, {})
-        return
-      }
+async function setJsonApiResponseType (request, reply, payload) {
+  // Fastify adds a charset during serialization; normalize after that step.
+  reply.header('Content-Type', 'application/vnd.api+json')
+  return payload
+}
 
-      try {
-        done(null, JSON.parse(body))
-      } catch (error) {
-        error.statusCode = 400
-        done(error)
-      }
+function registerJsonParsers (app) {
+  const parse = (request, body, done) => {
+    try { done(null, body === '' ? {} : JSON.parse(body)) } catch (error) {
+      error.statusCode = 400
+      error.type = 'entity.parse.failed'
+      done(error)
     }
-  )
+  }
+  for (const contentType of ['application/json', 'application/vnd.api+json']) {
+    if (app.hasContentTypeParser(contentType)) app.removeContentTypeParser(contentType)
+    app.addContentTypeParser(contentType, { parseAs: 'string' }, parse)
+  }
 }
 
 export const FastifyPlugin = {
   name: 'fastify',
   dependencies: ['rest-api'],
 
-  async install ({ vars, helpers, pluginOptions, log, api, runHooks, addHook }) {
+  async install ({ vars, helpers, pluginOptions, log, api, scopes, runHooks, addHook }) {
     const fastifyOptions = pluginOptions || {}
+    const httpValidators = fastifyOptions.httpValidators ?? false
+    if (typeof httpValidators !== 'boolean') throw new TypeError('httpValidators must be a boolean')
     const app = fastifyOptions.app
 
     if (!app || typeof app.route !== 'function') {
       throw new Error('FastifyPlugin requires a Fastify instance in pluginOptions.app.')
     }
 
-    const enhancedLog = createEnhancedLogger(log, {
-      logFullErrors: true,
-      includeStack: true
-    })
-
     if (!api.http) {
       api.http = {}
     }
@@ -80,19 +80,50 @@ export const FastifyPlugin = {
       publicBaseUrl
     }
 
-    registerVendorJsonParser(app)
+    const ensureContext = (request, reply) => {
+      if (!request.jsonRestContext) {
+        const requestData = buildTransportRequestData({
+          method: request.method,
+          url: request.url,
+          path: request.url,
+          headers: request.headers,
+          body: request.body,
+          params: request.params,
+          query: request.query
+        })
+        const { context } = createConnectorContext({
+          request, reply, source: 'fastify', mountPath, publicBaseUrl, requestData, createContext
+        })
+        request.jsonRestContext = context
+      }
+      return request.jsonRestContext
+    }
+    const sendResponse = async (request, reply, status, body) => {
+      const context = ensureContext(request, reply)
+      body = addWriteOutcomeToHttpErrors(body, context)
+      const headers = await applyTransportResponseLifecycle({ context, transportData: context.transport, status, body, runHooks })
+      applyHeaders(reply, headers)
+      return reply.code(status).type('application/vnd.api+json').send(body)
+    }
 
     const buildFastifyHandler = ({ method, path, handler, routeMeta }) => {
       const routeSchema = buildTransportRouteSchema({ routeMeta, api })
 
       const fastifyErrorHandler = async (error, request, reply) => {
-        enhancedLog.logError('Fastify request error', error, {
+        const context = ensureContext(request, reply)
+        await logHttpRequestError({
+          error,
+          context,
+          log,
+          scopes,
+          routeMeta,
+          api,
           method: request.method,
-          path: request.url
+          path,
+          message: 'Fastify request error'
         })
 
-        const context = request.jsonRestContext || null
-        const transportData = context?.transport || null
+        const transportData = context.transport
         const { status, body, headers } = await handleConnectorError({
           error,
           context,
@@ -107,65 +138,54 @@ export const FastifyPlugin = {
       }
 
       const preValidation = async (request, reply) => {
-        if (!strictContentType || !isWriteMethod(method)) {
-          return
+        const context = ensureContext(request, reply)
+        const { rejected, handled } = await runTransportRequestLifecycle({ context, runHooks })
+        if (rejected) {
+          return sendResponse(request, reply, context.rejection.status || 500, buildTransportRejectionBody(context))
         }
+        if (handled) return
 
-        const contentType = request.headers?.['content-type'] || ''
-        if (isAllowedWriteContentType(contentType)) {
-          return
+        applyHeaders(reply)
+        if (!acceptsJsonApi(request.headers?.accept)) {
+          return sendResponse(request, reply, 406, getNotAcceptableErrorBody())
         }
+      }
 
-        reply.code(415)
-        reply.type('application/vnd.api+json')
-        return reply.send(getUnsupportedMediaTypeErrorBody())
+      const preParsing = async (request, reply, payload) => {
+        if (strictContentType && isWriteMethod(request.method) && !isAllowedWriteContentType(request.headers?.['content-type'])) {
+          await sendResponse(request, reply, 415, getUnsupportedMediaTypeErrorBody())
+          return
+        }
+        return payload
       }
 
       return {
         method,
         url: path,
-        ...(routeSchema ? { schema: routeSchema } : {}),
+        ...(routeSchema
+          ? {
+              schema: routeSchema,
+              // Use the existing request contract without Ajv's field removal or coercion.
+              validatorCompiler: () => (payload) => {
+                try {
+                  const contract = getTransportRouteContract({ routeMeta, api })
+                  return { value: validateRequestContractOrThrow(contract, payload) }
+                } catch (error) { return { error } }
+              }
+            }
+          : {}),
         errorHandler: fastifyErrorHandler,
+        onSend: setJsonApiResponseType,
+        preParsing,
         preValidation,
         handler: async (request, reply) => {
-          const requestData = buildTransportRequestData({
-            method: request.method,
-            url: request.url,
-            path: request.url,
-            headers: request.headers,
-            body: request.body,
-            params: request.params,
-            query: request.query
-          })
-          const { context, transportData } = createConnectorContext({
-            request,
-            reply,
-            source: 'fastify',
-            mountPath,
-            publicBaseUrl,
-            requestData,
-            createContext
-          })
-          request.jsonRestContext = context
-
-          const { rejected, handled } = await runTransportRequestLifecycle({
-            context,
-            runHooks
-          })
-
-          if (rejected) {
-            const rejectionBody = buildTransportRejectionBody(context)
-            applyHeaders(reply, transportData.response.headers)
-            reply.code(context.rejection.status || 500)
-            reply.type('application/vnd.api+json')
-            return reply.send(rejectionBody)
-          }
-
-          if (handled) {
-            return
-          }
+          const context = request.jsonRestContext
+          if (context.handled) return
+          const transportData = context.transport
 
           const outcome = await executeConnectorRoute({
+            api,
+            httpValidators,
             method,
             handler,
             queryString: extractQueryString(request?.raw?.url || request?.url || ''),
@@ -199,9 +219,32 @@ export const FastifyPlugin = {
       }
     }
 
+    const pendingRoutes = []
+    let registerRoute = route => pendingRoutes.push(route)
+    app.register(async (instance) => {
+      registerJsonParsers(instance)
+      registerRoute = route => instance.route(route)
+      for (const route of pendingRoutes.splice(0)) registerRoute(route)
+
+      if (fastifyOptions.handle404 !== false) {
+        instance.register(async (fallback) => {
+          const route = buildFastifyHandler({
+            method: 'GET',
+            handler: async ({ context }) => ({
+              statusCode: 404,
+              body: getNotFoundErrorBody(context.transport.request.method, context.transport.request.path.split('?')[0])
+            })
+          })
+          fallback.setErrorHandler(route.errorHandler)
+          fallback.addHook('onSend', setJsonApiResponseType)
+          fallback.addHook('preParsing', route.preParsing)
+          fallback.setNotFoundHandler({ preValidation: route.preValidation }, route.handler)
+        }, { prefix: mountPath })
+      }
+    })
+
     addHook('addRoute', 'fastifyRouteCreator', {}, async ({ context }) => {
-      const route = buildFastifyHandler(context)
-      app.route(route)
+      registerRoute(buildFastifyHandler(context))
       log.trace(`Fastify route created: ${context.method} ${context.path}`)
     })
 

package/plugins/core/connectors/lib/busboy-detector.js

@@ -1,174 +1,92 @@
-/**
- * Busboy File Detector for HTTP Multipart Uploads
- *
- * This detector handles multipart/form-data uploads using the busboy library.
- * It's suitable for both HTTP and Express connectors.
- *
- * Features:
- * - Streaming parser (memory efficient)
- * - Configurable file size limits
- * - Automatic field parsing
- * - No temporary files by default (keeps in memory)
- *
- * Usage:
- * ```javascript
- * import { createBusboyDetector } from 'jsonrestapi/plugins/core/lib/busboy-detector.js';
- *
- * api.use(HttpPlugin, {
- *   fileParser: 'busboy',
- *   fileParserOptions: {
- *     limits: { fileSize: 10 * 1024 * 1024 } // 10MB
- *   }
- * });
- * ```
- */
-
-import { requirePackage } from 'hooked-api'
-import { Readable } from 'stream'
-
-let Busboy
-try {
-  Busboy = (await import('busboy')).default
-} catch (e) {
-  requirePackage('busboy', 'express/http-connector',
-    'Busboy is required for multipart/form-data file uploads. This is a peer dependency.')
+import { throwMissingPackage } from '../../../../lib/missing-package.js'
+import { RestApiPayloadError } from '../../../../lib/rest-api-errors.js'
+import { isMultipartContentType } from './transport-http-helpers.js'
+import { addMultipartField, multipartLimits } from './multipart-helpers.js'
+
+let busboyFactory
+try { busboyFactory = (await import('busboy')).default } catch {
+  throwMissingPackage('busboy', 'express-connector', 'Busboy is required for multipart uploads. Install the optional busboy peer.')
 }
 
-/**
- * Creates a busboy-based file detector
- *
- * @param {Object} options - Busboy configuration options
- * @param {Object} options.limits - Size limits
- * @param {number} options.limits.fileSize - Max file size in bytes
- * @param {number} options.limits.files - Max number of files
- * @param {number} options.limits.fields - Max number of fields
- * @returns {Object} Detector object with detect() and parse() methods
- */
+/** Parse a streamed multipart request into buffered files and text fields. */
 export function createBusboyDetector (options = {}) {
+  const limits = { ...multipartLimits, ...options.limits }
   return {
     name: 'busboy-multipart',
-
-    /**
-     * Check if this detector can handle the request
-     * @param {Object} params - Request parameters
-     * @returns {boolean} True if this is a multipart request
-     */
-    detect: (params) => {
-      const req = params._httpReq || params._expressReq
-      if (!req || !req.headers) return false
-
-      const contentType = req.headers['content-type'] || ''
-      return contentType.includes('multipart/form-data')
-    },
-
-    /**
-     * Parse multipart data from the request
-     * @param {Object} params - Request parameters
-     * @returns {Promise<{fields: Object, files: Object}>} Parsed data
-     */
+    detect: params => isMultipartContentType((params._httpReq || params._expressReq)?.headers?.['content-type']),
     parse: async (params) => {
       const req = params._httpReq || params._expressReq
-
+      if (!req?.pipe || req.aborted) throw new RestApiPayloadError('Multipart request is unavailable or aborted')
       return new Promise((resolve, reject) => {
-        const busboy = new Busboy({
-          headers: req.headers,
-          ...options
+        let parser
+        const fields = new Map()
+        const files = new Map()
+        const fileNames = new Set()
+        let failure
+        const cleanup = () => {
+          req.removeListener('aborted', onAborted)
+          req.removeListener('error', onError)
+        }
+        const fail = error => {
+          if (failure) return
+          failure = error
+          fields.clear()
+          files.clear()
+          req.unpipe(parser)
+          req.resume()
+          cleanup()
+          // A limit event can run inside Busboy's current write; destroy afterwards.
+          queueMicrotask(() => parser?.destroy())
+          reject(error)
+        }
+        const onError = cause => fail(new RestApiPayloadError('Malformed multipart request', { cause }))
+        const onAborted = () => fail(new RestApiPayloadError('Multipart request aborted'))
+        const limitError = field => new RestApiPayloadError(`Multipart limit exceeded: ${field}`, { path: field, statusCode: 413 })
+        try {
+          parser = busboyFactory({
+            defParamCharset: 'utf8',
+            ...options,
+            headers: req.headers,
+            // Busboy reports truncation when a limit is reached, including exact size.
+            limits: { ...limits, fileSize: limits.fileSize + 1, fieldSize: limits.fieldSize + 1, parts: limits.parts + 1 }
+          })
+        } catch (cause) { reject(new RestApiPayloadError('Invalid multipart headers or boundary', { cause })); return }
+        req.once('aborted', onAborted)
+        req.once('error', onError)
+        parser.on('field', (name, value, info) => {
+          if (failure) return
+          if (info.valueTruncated || info.nameTruncated || Buffer.byteLength(value) > limits.fieldSize) return fail(limitError(name))
+          try { addMultipartField(fields, name, value) } catch (error) { fail(error) }
         })
-
-        const fields = {}
-        const files = {}
-        const filePromises = []
-
-        // Handle fields
-        busboy.on('field', (fieldname, val) => {
-          // Handle array notation (field[] or field[0])
-          const arrayMatch = fieldname.match(/^(.+)\[\d*\]$/)
-          if (arrayMatch) {
-            const baseName = arrayMatch[1]
-            if (!fields[baseName]) {
-              fields[baseName] = []
-            }
-            if (Array.isArray(fields[baseName])) {
-              fields[baseName].push(val)
-            }
-          } else {
-            fields[fieldname] = val
+        parser.on('file', (name, stream, { filename, encoding, mimeType }) => {
+          stream.on('error', onError)
+          if (failure) { stream.resume(); return }
+          if (fileNames.has(name)) {
+            stream.resume()
+            fail(new RestApiPayloadError(`Multiple files for field '${name}' are not supported`, { path: name }))
+            return
           }
-        })
-
-        // Handle files
-        busboy.on('file', (fieldname, file, filename, encoding, mimetype) => {
+          fileNames.add(name)
           const chunks = []
           let size = 0
-
-          const filePromise = new Promise((resolve, reject) => {
-            file.on('data', (chunk) => {
-              chunks.push(chunk)
-              size += chunk.length
-            })
-
-            file.on('limit', () => {
-              reject(new Error(`File size limit exceeded for field '${fieldname}'`))
-            })
-
-            file.on('end', () => {
-              files[fieldname] = {
-                filename,
-                mimetype,
-                encoding,
-                size,
-                data: Buffer.concat(chunks)
-              }
-              resolve()
-            })
-
-            file.on('error', reject)
+          stream.on('data', chunk => {
+            if (failure) return
+            size += chunk.length
+            if (size > limits.fileSize) { fail(limitError(name)); return }
+            chunks.push(chunk)
+          })
+          stream.on('limit', () => fail(limitError(name)))
+          stream.on('end', () => {
+            if (!failure) files.set(name, { filename, encoding, mimetype: mimeType, size, data: Buffer.concat(chunks) })
           })
-
-          filePromises.push(filePromise)
-        })
-
-        // Handle completion
-        busboy.on('finish', async () => {
-          try {
-            // Wait for all files to be fully read
-            await Promise.all(filePromises)
-            resolve({ fields, files })
-          } catch (error) {
-            reject(error)
-          }
-        })
-
-        // Handle errors
-        busboy.on('error', (error) => {
-          reject(error)
-        })
-
-        // Handle limit errors
-        busboy.on('partsLimit', () => {
-          reject(new Error('Parts limit exceeded'))
-        })
-
-        busboy.on('filesLimit', () => {
-          reject(new Error('Files limit exceeded'))
         })
-
-        busboy.on('fieldsLimit', () => {
-          reject(new Error('Fields limit exceeded'))
+        for (const event of ['partsLimit', 'filesLimit', 'fieldsLimit']) parser.on(event, () => fail(limitError(event)))
+        parser.on('error', onError)
+        parser.on('close', () => {
+          cleanup()
+          if (!failure) resolve({ fields: Object.fromEntries(fields), files: Object.fromEntries(files) })
         })
-
-        // Pipe request to busboy
-        if (req.pipe) {
-          req.pipe(busboy)
-        } else if (req.on) {
-          // For already buffered requests
-          const stream = new Readable()
-          stream.push(req.body || req)
-          stream.push(null)
-          stream.pipe(busboy)
-        } else {
-          reject(new Error('Request object is not a stream'))
-        }
+        req.pipe(parser)
       })
     }
   }