node-fastify 5.8.3

package/lib/validation.js

@@ -0,0 +1,280 @@
+'use strict'
+
+const {
+  kSchemaHeaders: headersSchema,
+  kSchemaParams: paramsSchema,
+  kSchemaQuerystring: querystringSchema,
+  kSchemaBody: bodySchema,
+  kSchemaResponse: responseSchema
+} = require('./symbols')
+const scChecker = /^[1-5](?:\d{2}|xx)$|^default$/
+
+const {
+  FST_ERR_SCH_RESPONSE_SCHEMA_NOT_NESTED_2XX
+} = require('./errors')
+
+const { FSTWRN001 } = require('./warnings')
+
+function compileSchemasForSerialization (context, compile) {
+  if (!context.schema || !context.schema.response) {
+    return
+  }
+  const { method, url } = context.config || {}
+  context[responseSchema] = Object.keys(context.schema.response)
+    .reduce(function (acc, statusCode) {
+      const schema = context.schema.response[statusCode]
+      statusCode = statusCode.toLowerCase()
+      if (!scChecker.test(statusCode)) {
+        throw new FST_ERR_SCH_RESPONSE_SCHEMA_NOT_NESTED_2XX()
+      }
+
+      if (schema.content) {
+        const contentTypesSchemas = {}
+        for (const mediaName of Object.keys(schema.content)) {
+          const contentSchema = schema.content[mediaName].schema
+          contentTypesSchemas[mediaName] = compile({
+            schema: contentSchema,
+            url,
+            method,
+            httpStatus: statusCode,
+            contentType: mediaName
+          })
+        }
+        acc[statusCode] = contentTypesSchemas
+      } else {
+        acc[statusCode] = compile({
+          schema,
+          url,
+          method,
+          httpStatus: statusCode
+        })
+      }
+
+      return acc
+    }, {})
+}
+
+function compileSchemasForValidation (context, compile, isCustom) {
+  const { schema } = context
+  if (!schema) {
+    return
+  }
+
+  const { method, url } = context.config || {}
+
+  const headers = schema.headers
+  // the or part is used for backward compatibility
+  if (headers && (isCustom || Object.getPrototypeOf(headers) !== Object.prototype)) {
+    // do not mess with schema when custom validator applied, e.g. Joi, Typebox
+    context[headersSchema] = compile({ schema: headers, method, url, httpPart: 'headers' })
+  } else if (headers) {
+    // The header keys are case insensitive
+    //  https://datatracker.ietf.org/doc/html/rfc2616#section-4.2
+    const headersSchemaLowerCase = {}
+    Object.keys(headers).forEach(k => { headersSchemaLowerCase[k] = headers[k] })
+    if (headersSchemaLowerCase.required instanceof Array) {
+      headersSchemaLowerCase.required = headersSchemaLowerCase.required.map(h => h.toLowerCase())
+    }
+    if (headers.properties) {
+      headersSchemaLowerCase.properties = {}
+      Object.keys(headers.properties).forEach(k => {
+        headersSchemaLowerCase.properties[k.toLowerCase()] = headers.properties[k]
+      })
+    }
+    context[headersSchema] = compile({ schema: headersSchemaLowerCase, method, url, httpPart: 'headers' })
+  } else if (Object.hasOwn(schema, 'headers')) {
+    FSTWRN001('headers', method, url)
+  }
+
+  if (schema.body) {
+    const contentProperty = schema.body.content
+    if (contentProperty) {
+      const contentTypeSchemas = {}
+      for (const contentType of Object.keys(contentProperty)) {
+        const contentSchema = contentProperty[contentType].schema
+        contentTypeSchemas[contentType] = compile({ schema: contentSchema, method, url, httpPart: 'body', contentType })
+      }
+      context[bodySchema] = contentTypeSchemas
+    } else {
+      context[bodySchema] = compile({ schema: schema.body, method, url, httpPart: 'body' })
+    }
+  } else if (Object.hasOwn(schema, 'body')) {
+    FSTWRN001('body', method, url)
+  }
+
+  if (schema.querystring) {
+    context[querystringSchema] = compile({ schema: schema.querystring, method, url, httpPart: 'querystring' })
+  } else if (Object.hasOwn(schema, 'querystring')) {
+    FSTWRN001('querystring', method, url)
+  }
+
+  if (schema.params) {
+    context[paramsSchema] = compile({ schema: schema.params, method, url, httpPart: 'params' })
+  } else if (Object.hasOwn(schema, 'params')) {
+    FSTWRN001('params', method, url)
+  }
+}
+
+function validateParam (validatorFunction, request, paramName) {
+  const isUndefined = request[paramName] === undefined
+  let ret
+
+  try {
+    ret = validatorFunction?.(isUndefined ? null : request[paramName])
+  } catch (err) {
+    // If validator throws synchronously, ensure it propagates as an internal error
+    err.statusCode = 500
+    return err
+  }
+
+  if (ret && typeof ret.then === 'function') {
+    return ret
+      .then((res) => { return answer(res) })
+      .catch(err => { return err }) // return as simple error (not throw)
+  }
+
+  return answer(ret)
+
+  function answer (ret) {
+    if (ret === false) return validatorFunction.errors
+    if (ret && ret.error) return ret.error
+    if (ret && ret.value) request[paramName] = ret.value
+    return false
+  }
+}
+
+function validate (context, request, execution) {
+  const runExecution = execution === undefined
+
+  if (runExecution || !execution.skipParams) {
+    const params = validateParam(context[paramsSchema], request, 'params')
+    if (params) {
+      if (typeof params.then !== 'function') {
+        return wrapValidationError(params, 'params', context.schemaErrorFormatter)
+      } else {
+        return validateAsyncParams(params, context, request)
+      }
+    }
+  }
+
+  if (runExecution || !execution.skipBody) {
+    let validatorFunction = null
+    if (typeof context[bodySchema] === 'function') {
+      validatorFunction = context[bodySchema]
+    } else if (context[bodySchema]) {
+      // TODO: add request.contentType and reuse it here
+      const contentType = getEssenceMediaType(request.headers['content-type'])
+      const contentSchema = context[bodySchema][contentType]
+      if (contentSchema) {
+        validatorFunction = contentSchema
+      }
+    }
+    const body = validateParam(validatorFunction, request, 'body')
+    if (body) {
+      if (typeof body.then !== 'function') {
+        return wrapValidationError(body, 'body', context.schemaErrorFormatter)
+      } else {
+        return validateAsyncBody(body, context, request)
+      }
+    }
+  }
+
+  if (runExecution || !execution.skipQuery) {
+    const query = validateParam(context[querystringSchema], request, 'query')
+    if (query) {
+      if (typeof query.then !== 'function') {
+        return wrapValidationError(query, 'querystring', context.schemaErrorFormatter)
+      } else {
+        return validateAsyncQuery(query, context, request)
+      }
+    }
+  }
+
+  const headers = validateParam(context[headersSchema], request, 'headers')
+  if (headers) {
+    if (typeof headers.then !== 'function') {
+      return wrapValidationError(headers, 'headers', context.schemaErrorFormatter)
+    } else {
+      return validateAsyncHeaders(headers, context, request)
+    }
+  }
+
+  return false
+}
+
+function validateAsyncParams (validatePromise, context, request) {
+  return validatePromise
+    .then((paramsResult) => {
+      if (paramsResult) {
+        return wrapValidationError(paramsResult, 'params', context.schemaErrorFormatter)
+      }
+
+      return validate(context, request, { skipParams: true })
+    })
+}
+
+function validateAsyncBody (validatePromise, context, request) {
+  return validatePromise
+    .then((bodyResult) => {
+      if (bodyResult) {
+        return wrapValidationError(bodyResult, 'body', context.schemaErrorFormatter)
+      }
+
+      return validate(context, request, { skipParams: true, skipBody: true })
+    })
+}
+
+function validateAsyncQuery (validatePromise, context, request) {
+  return validatePromise
+    .then((queryResult) => {
+      if (queryResult) {
+        return wrapValidationError(queryResult, 'querystring', context.schemaErrorFormatter)
+      }
+
+      return validate(context, request, { skipParams: true, skipBody: true, skipQuery: true })
+    })
+}
+
+function validateAsyncHeaders (validatePromise, context, request) {
+  return validatePromise
+    .then((headersResult) => {
+      if (headersResult) {
+        return wrapValidationError(headersResult, 'headers', context.schemaErrorFormatter)
+      }
+
+      return false
+    })
+}
+
+function wrapValidationError (result, dataVar, schemaErrorFormatter) {
+  if (result instanceof Error) {
+    result.statusCode = result.statusCode || 400
+    result.code = result.code || 'FST_ERR_VALIDATION'
+    result.validationContext = result.validationContext || dataVar
+    return result
+  }
+
+  const error = schemaErrorFormatter(result, dataVar)
+  error.statusCode = error.statusCode || 400
+  error.code = error.code || 'FST_ERR_VALIDATION'
+  error.validation = result
+  error.validationContext = dataVar
+  return error
+}
+
+/**
+ * simple function to retrieve the essence media type
+ * @param {string} header
+ * @returns {string} Mimetype string.
+ */
+function getEssenceMediaType (header) {
+  if (!header) return ''
+  return header.split(/[ ;]/, 1)[0].trim().toLowerCase()
+}
+
+module.exports = {
+  symbols: { bodySchema, querystringSchema, responseSchema, paramsSchema, headersSchema },
+  compileSchemasForValidation,
+  compileSchemasForSerialization,
+  validate
+}

package/lib/warnings.js

@@ -0,0 +1,57 @@
+'use strict'
+
+const { createWarning } = require('process-warning')
+
+/**
+ * Deprecation codes:
+ *   - FSTWRN001
+ *   - FSTSEC001
+ *   - FSTDEP022
+ *
+ * Deprecation Codes FSTDEP001 - FSTDEP021 were used by v4 and MUST NOT not be reused.
+ *                             - FSTDEP022 is used by v5 and MUST NOT be reused.
+ * Warning Codes FSTWRN001 - FSTWRN002 were used by v4 and MUST NOT not be reused.
+ */
+
+const FSTWRN001 = createWarning({
+  name: 'FastifyWarning',
+  code: 'FSTWRN001',
+  message: 'The %s schema for %s: %s is missing. This may indicate the schema is not well specified.',
+  unlimited: true
+})
+
+const FSTWRN003 = createWarning({
+  name: 'FastifyWarning',
+  code: 'FSTWRN003',
+  message: 'The %s mixes async and callback styles that may lead to unhandled rejections. Please use only one of them.',
+  unlimited: true
+})
+
+const FSTWRN004 = createWarning({
+  name: 'FastifyWarning',
+  code: 'FSTWRN004',
+  message: 'It seems that you are overriding an errorHandler in the same scope, which can lead to subtle bugs.',
+  unlimited: true
+})
+
+const FSTSEC001 = createWarning({
+  name: 'FastifySecurity',
+  code: 'FSTSEC001',
+  message: 'You are using /%s/ Content-Type which may be vulnerable to CORS attack. Please make sure your RegExp start with "^" or include ";?" to proper detection of the essence MIME type.',
+  unlimited: true
+})
+
+const FSTDEP022 = createWarning({
+  name: 'FastifyWarning',
+  code: 'FSTDEP022',
+  message: 'The router options for %s property access is deprecated. Please use "options.routerOptions" instead for accessing router options. The router options will be removed in `fastify@6`.',
+  unlimited: true
+})
+
+module.exports = {
+  FSTWRN001,
+  FSTWRN003,
+  FSTWRN004,
+  FSTSEC001,
+  FSTDEP022
+}

package/lib/wrap-thenable.js

@@ -0,0 +1,84 @@
+'use strict'
+
+const {
+  kReplyIsError,
+  kReplyHijacked
+} = require('./symbols')
+const { setErrorStatusCode } = require('./error-status')
+
+const diagnostics = require('node:diagnostics_channel')
+const channels = diagnostics.tracingChannel('fastify.request.handler')
+
+function wrapThenable (thenable, reply, store) {
+  if (store) store.async = true
+  thenable.then(function (payload) {
+    if (reply[kReplyHijacked] === true) {
+      return
+    }
+
+    if (store) {
+      channels.asyncStart.publish(store)
+    }
+
+    try {
+      // this is for async functions that are using reply.send directly
+      //
+      // since wrap-thenable will be called when using reply.send directly
+      // without actual return. the response can be sent already or
+      // the request may be terminated during the reply. in this situation,
+      // it require an extra checking of request.aborted to see whether
+      // the request is killed by client.
+      if (payload !== undefined || //
+        (reply.sent === false && //
+          reply.raw.headersSent === false &&
+          reply.request.raw.aborted === false &&
+          reply.request.socket &&
+          !reply.request.socket.destroyed
+        )
+      ) {
+        // we use a try-catch internally to avoid adding a catch to another
+        // promise, increase promise perf by 10%
+        try {
+          reply.send(payload)
+        } catch (err) {
+          reply[kReplyIsError] = true
+          reply.send(err)
+        }
+      }
+    } finally {
+      if (store) {
+        channels.asyncEnd.publish(store)
+      }
+    }
+  }, function (err) {
+    if (store) {
+      store.error = err
+      // Set status code before publishing so subscribers see the correct value
+      setErrorStatusCode(reply, err)
+      channels.error.publish(store) // note that error happens before asyncStart
+      channels.asyncStart.publish(store)
+    }
+
+    try {
+      if (reply.sent === true) {
+        reply.log.error({ err }, 'Promise errored, but reply.sent = true was set')
+        return
+      }
+
+      reply[kReplyIsError] = true
+
+      reply.send(err)
+      // The following should not happen
+      /* c8 ignore next 3 */
+    } catch (err) {
+      // try-catch allow to re-throw error in error handler for async handler
+      reply.send(err)
+    } finally {
+      if (store) {
+        channels.asyncEnd.publish(store)
+      }
+    }
+  })
+}
+
+module.exports = wrapThenable

package/package.json

@@ -0,0 +1,225 @@
+{
+  "name": "node-fastify",
+  "version": "5.8.3",
+  "description": "Fast and low overhead web framework, for Node.js",
+  "main": "fastify.js",
+  "type": "commonjs",
+  "types": "fastify.d.ts",
+  "scripts": {
+    "bench": "branchcmp -r 2 -g -s \"npm run benchmark\"",
+    "benchmark": "concurrently -k -s first \"node ./examples/benchmark/simple.js\" \"autocannon -c 100 -d 30 -p 10 localhost:3000/\"",
+    "benchmark:parser": "concurrently -k -s first \"node ./examples/benchmark/parser.js\" \"autocannon -c 100 -d 30 -p 10 -i ./examples/benchmark/body.json -H \"content-type:application/jsoff\" -m POST localhost:3000/\"",
+    "benchmark:parser:error": "concurrently -k -s first \"node ./examples/benchmark/parser.js\" \"autocannon -c 100 -d 30 -p 10 -i ./examples/benchmark/body.json -H \"content-type:application/jsoff\" -H \"content-length:123\" -m POST localhost:3000/\"",
+    "build:validation": "node build/build-error-serializer.js && node build/build-validation.js",
+    "build:sync-version": "node build/sync-version.js",
+    "coverage": "c8 --reporter html borp --reporter=@jsumners/line-reporter",
+    "coverage:ci-check-coverage": "borp --reporter=@jsumners/line-reporter --coverage --check-coverage --lines 100",
+    "lint": "npm run lint:eslint",
+    "lint:fix": "eslint --fix",
+    "lint:markdown": "markdownlint-cli2",
+    "lint:eslint": "eslint",
+    "prepublishOnly": "cross-env PREPUBLISH=true borp --reporter=@jsumners/line-reporter && npm run test:validator:integrity && npm run build:sync-version",
+    "test": "npm run lint && npm run unit && npm run test:typescript",
+    "test:ci": "npm run unit && npm run test:typescript",
+    "test:report": "npm run lint && npm run unit:report && npm run test:typescript",
+    "test:validator:integrity": "npm run build:validation && git diff --quiet --ignore-all-space --ignore-blank-lines --ignore-cr-at-eol lib/error-serializer.js && git diff --quiet --ignore-all-space --ignore-blank-lines --ignore-cr-at-eol lib/config-validator.js",
+    "test:typescript": "tsc test/types/import.ts --target es2022 --moduleResolution node16 --module node16 --noEmit && tsd",
+    "test:watch": "npm run unit -- --watch --coverage-report=none --reporter=terse",
+    "unit": "borp",
+    "unit:report": "c8 --reporter html borp --reporter=@jsumners/line-reporter",
+    "citgm": "borp --reporter=@jsumners/line-reporter --coverage --check-coverage --concurrency=1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fastify/fastify.git"
+  },
+  "keywords": [
+    "web",
+    "framework",
+    "json",
+    "schema",
+    "open",
+    "api"
+  ],
+  "author": "Matteo Collina <hello@matteocollina.com>",
+  "contributors": [
+    {
+      "name": "Tomas Della Vedova",
+      "url": "http://delved.org",
+      "author": true
+    },
+    {
+      "name": "Tommaso Allevi",
+      "email": "tomallevi@gmail.com"
+    },
+    {
+      "name": "Ethan Arrowood",
+      "url": "https://github.com/Ethan-Arrowood",
+      "email": "ethan.arrowood@gmail.com"
+    },
+    {
+      "name": "Dustin Deus",
+      "url": "http://starptech.de",
+      "email": "deusdustin@gmail.com"
+    },
+    {
+      "name": "Ayoub El Khattabi",
+      "url": "https://github.com/AyoubElk",
+      "email": "elkhattabi.ayoub@gmail.com"
+    },
+    {
+      "name": "Rafael Gonzaga",
+      "email": "rafael.nunu@hotmail.com",
+      "url": "https://github.com/rafaelgss"
+    },
+    {
+      "name": "Trivikram Kamat",
+      "url": "http://trivikr.github.io",
+      "email": "trivikr.dev@gmail.com"
+    },
+    {
+      "name": "Luciano Mammino",
+      "url": "https://loige.co"
+    },
+    {
+      "name": "Cemre Mengu",
+      "email": "cemremengu@gmail.com"
+    },
+    {
+      "name": "Evan Shortiss",
+      "email": "evanshortiss@gmail.com"
+    },
+    {
+      "name": "Maksim Sinik",
+      "url": "https://maksim.dev"
+    },
+    {
+      "name": "Manuel Spigolon",
+      "email": "behemoth89@gmail.com"
+    },
+    {
+      "name": "James Sumners",
+      "url": "https://james.sumners.info"
+    },
+    {
+      "name": "Denis Fäcke",
+      "url": "https://github.com/SerayaEryn"
+    },
+    {
+      "name": "Igor Savin",
+      "email": "kibertoad@gmail.com",
+      "url": "https://github.com/kibertoad"
+    },
+    {
+      "name": "Vincent Le Goff",
+      "email": "vince.legoff@gmail.com",
+      "url": "https://github.com/zekth"
+    },
+    {
+      "name": "Luis Orbaiceta",
+      "email": "luisorbaiceta@gmail.com",
+      "url": "https://luisorbaiceta.com"
+    },
+    {
+      "name": "Carlos Fuentes",
+      "email": "me@metcoder.dev",
+      "url": "https://metcoder.dev"
+    },
+    {
+      "name": "Gürgün Dayıoğlu",
+      "email": "hey@gurgun.day",
+      "url": "https://heyhey.to/G"
+    },
+    {
+      "name": "Aras Abbasi",
+      "email": "aras.abbasi@gmail.com"
+    },
+    {
+      "name": "Frazer Smith",
+      "email": "frazer.dev@icloud.com",
+      "url": "https://github.com/fdawgs"
+    },
+    {
+      "name": "KaKa Ng",
+      "email": "kaka@kakang.dev",
+      "url": "https://github.com/climba03003"
+    },
+    {
+      "name": "Jean Michelet",
+      "email": "jean.antoine.michelet@gmail.com",
+      "url": "https://github.com/jean-michelet"
+    }
+  ],
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/fastify/fastify/issues"
+  },
+  "homepage": "https://fastify.dev/",
+  "funding": [
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/fastify"
+    },
+    {
+      "type": "opencollective",
+      "url": "https://opencollective.com/fastify"
+    }
+  ],
+  "devDependencies": {
+    "@jsumners/line-reporter": "^1.0.1",
+    "@sinonjs/fake-timers": "^11.2.2",
+    "@stylistic/eslint-plugin": "^5.1.0",
+    "@stylistic/eslint-plugin-js": "^4.1.0",
+    "@types/node": "^25.0.3",
+    "ajv": "^8.12.0",
+    "ajv-errors": "^3.0.0",
+    "ajv-formats": "^3.0.1",
+    "ajv-i18n": "^4.2.0",
+    "ajv-merge-patch": "^5.0.1",
+    "autocannon": "^8.0.0",
+    "borp": "^0.21.0",
+    "branch-comparer": "^1.1.0",
+    "concurrently": "^9.1.2",
+    "cross-env": "^10.0.0",
+    "eslint": "^9.0.0",
+    "fast-json-body": "^1.1.0",
+    "fastify-plugin": "^5.0.0",
+    "fluent-json-schema": "^6.0.0",
+    "h2url": "^0.2.0",
+    "http-errors": "^2.0.0",
+    "joi": "^18.0.1",
+    "json-schema-to-ts": "^3.0.1",
+    "JSONStream": "^1.3.5",
+    "markdownlint-cli2": "^0.21.0",
+    "neostandard": "^0.12.0",
+    "node-forge": "^1.3.1",
+    "proxyquire": "^2.1.3",
+    "split2": "^4.2.0",
+    "tsd": "^0.33.0",
+    "typebox": "^1.0.81",
+    "typescript": "~5.9.2",
+    "undici": "^7.11.0",
+    "vary": "^1.1.2",
+    "yup": "^1.4.0"
+  },
+  "dependencies": {
+    "@fastify/ajv-compiler": "^4.0.5",
+    "@fastify/error": "^4.0.0",
+    "@fastify/fast-json-stringify-compiler": "^5.0.0",
+    "@fastify/proxy-addr": "^5.0.0",
+    "abstract-logging": "^2.0.1",
+    "avvio": "^9.0.0",
+    "fast-json-stringify": "^6.0.0",
+    "find-my-way": "^9.0.0",
+    "light-my-request": "^6.0.0",
+    "pino": "^9.14.0 || ^10.1.0",
+    "process-warning": "^5.0.0",
+    "rfdc": "^1.3.1",
+    "secure-json-parse": "^4.0.0",
+    "semver": "^7.6.0",
+    "toad-cache": "^3.7.0"
+  },
+  "tsd": {
+    "directory": "test/types"
+  }
+}