node-fastify 5.8.3

package/test/async_hooks.test.js

@@ -0,0 +1,52 @@
+'use strict'
+
+const { createHook } = require('node:async_hooks')
+const { test } = require('node:test')
+const Fastify = require('..')
+
+const remainingIds = new Set()
+
+createHook({
+  init (asyncId, type, triggerAsyncId, resource) {
+    if (type === 'content-type-parser:run') {
+      remainingIds.add(asyncId)
+    }
+  },
+  destroy (asyncId) {
+    remainingIds.delete(asyncId)
+  }
+})
+
+const app = Fastify({ logger: false })
+
+test('test async hooks', async (t) => {
+  app.get('/', function (request, reply) {
+    reply.send({ id: 42 })
+  })
+
+  app.post('/', function (request, reply) {
+    reply.send({ id: 42 })
+  })
+
+  t.after(() => app.close())
+
+  const fastifyServer = await app.listen({ port: 0 })
+
+  const result1 = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ hello: 'world' })
+  })
+  t.assert.strictEqual(result1.status, 200)
+
+  const result2 = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ hello: 'world' })
+  })
+  t.assert.strictEqual(result2.status, 200)
+
+  const result3 = await fetch(fastifyServer)
+  t.assert.strictEqual(result3.status, 200)
+  t.assert.strictEqual(remainingIds.size, 0)
+})

package/test/body-limit.test.js

@@ -0,0 +1,224 @@
+'use strict'
+
+const Fastify = require('../fastify')
+const zlib = require('node:zlib')
+const { test } = require('node:test')
+
+test('bodyLimit', async t => {
+  t.plan(4)
+
+  try {
+    Fastify({ bodyLimit: 1.3 })
+    t.assert.fail('option must be an integer')
+  } catch (err) {
+    t.assert.ok(err)
+  }
+
+  try {
+    Fastify({ bodyLimit: [] })
+    t.assert.fail('option must be an integer')
+  } catch (err) {
+    t.assert.ok(err)
+  }
+
+  const fastify = Fastify({ bodyLimit: 1 })
+
+  fastify.post('/', (request, reply) => {
+    reply.send({ error: 'handler should not be called' })
+  })
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+  t.after(() => { fastify.close() })
+
+  const result = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify([])
+  })
+
+  t.assert.ok(!result.ok)
+  t.assert.strictEqual(result.status, 413)
+})
+
+test('bodyLimit is applied to decoded content', async (t) => {
+  t.plan(6)
+
+  const body = { x: 'x'.repeat(30000) }
+  const json = JSON.stringify(body)
+  const encoded = zlib.gzipSync(json)
+
+  const fastify = Fastify()
+
+  fastify.addHook('preParsing', async (req, reply, payload) => {
+    t.assert.strictEqual(req.headers['content-length'], `${encoded.length}`)
+    const unzip = zlib.createGunzip()
+    Object.defineProperty(unzip, 'receivedEncodedLength', {
+      get () {
+        return unzip.bytesWritten
+      }
+    })
+    payload.pipe(unzip)
+    return unzip
+  })
+
+  fastify.post('/body-limit-40k', {
+    bodyLimit: 40000,
+    onError: async (req, res, err) => {
+      t.fail('should not be called')
+    }
+  }, (request, reply) => {
+    reply.send({ x: request.body.x })
+  })
+
+  fastify.post('/body-limit-20k', {
+    bodyLimit: 20000,
+    onError: async (req, res, err) => {
+      t.assert.strictEqual(err.code, 'FST_ERR_CTP_BODY_TOO_LARGE')
+      t.assert.strictEqual(err.statusCode, 413)
+    }
+  }, (request, reply) => {
+    reply.send({ x: 'handler should not be called' })
+  })
+
+  await t.test('bodyLimit 40k', async (t) => {
+    const result = await fastify.inject({
+      method: 'POST',
+      url: '/body-limit-40k',
+      headers: {
+        'content-encoding': 'gzip',
+        'content-type': 'application/json'
+      },
+      payload: encoded
+    })
+    t.assert.strictEqual(result.statusCode, 200)
+    t.assert.deepStrictEqual(result.json(), body)
+  })
+
+  await t.test('bodyLimit 20k', async (t) => {
+    const result = await fastify.inject({
+      method: 'POST',
+      url: '/body-limit-20k',
+      headers: {
+        'content-encoding': 'gzip',
+        'content-type': 'application/json'
+      },
+      payload: encoded
+    })
+    t.assert.strictEqual(result.statusCode, 413)
+  })
+})
+
+test('default request.routeOptions.bodyLimit should be 1048576', async t => {
+  t.plan(3)
+  const fastify = Fastify()
+  fastify.post('/default-bodylimit', {
+    handler (request, reply) {
+      t.assert.strictEqual(1048576, request.routeOptions.bodyLimit)
+      reply.send({ })
+    }
+  })
+  const fastifyServer = await fastify.listen({ port: 0 })
+  t.after(() => { fastify.close() })
+
+  const result = await fetch(fastifyServer + '/default-bodylimit', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify([])
+  })
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
+})
+
+test('request.routeOptions.bodyLimit should be equal to route limit', async t => {
+  t.plan(3)
+  const fastify = Fastify({ bodyLimit: 1 })
+  fastify.post('/route-limit', {
+    bodyLimit: 1000,
+    handler (request, reply) {
+      t.assert.strictEqual(1000, request.routeOptions.bodyLimit)
+      reply.send({})
+    }
+  })
+  const fastifyServer = await fastify.listen({ port: 0 })
+  t.after(() => { fastify.close() })
+
+  const result = await fetch(fastifyServer + '/route-limit', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify([])
+  })
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
+})
+
+test('request.routeOptions.bodyLimit should be equal to server limit', async t => {
+  t.plan(3)
+  const fastify = Fastify({ bodyLimit: 100 })
+  fastify.post('/server-limit', {
+    handler (request, reply) {
+      t.assert.strictEqual(100, request.routeOptions.bodyLimit)
+      reply.send({})
+    }
+  })
+  const fastifyServer = await fastify.listen({ port: 0 })
+  t.after(() => { fastify.close() })
+
+  const result = await fetch(fastifyServer + '/server-limit', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify([])
+  })
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
+})
+
+test('bodyLimit should use byte length for UTF-8 strings, not character length', async t => {
+  t.plan(4)
+
+  // Create a string with multi-byte UTF-8 characters
+  // Use Japanese characters that are 3 bytes each in UTF-8
+  const multiByteString = 'あああ' // 3 characters, 9 bytes in UTF-8
+  t.assert.strictEqual(multiByteString.length, 3) // 3 characters
+  t.assert.strictEqual(Buffer.byteLength(multiByteString, 'utf8'), 9) // 9 bytes
+
+  const fastify = Fastify()
+
+  // Add a custom text parser that returns the string as-is
+  fastify.addContentTypeParser('text/plain', { parseAs: 'string' }, (req, body, done) => {
+    done(null, body)
+  })
+
+  // Set body limit to 7 bytes - this should reject the string (9 bytes)
+  // even though string.length (3) would be under any reasonable limit
+  fastify.post('/test-utf8', {
+    bodyLimit: 7
+  }, (request, reply) => {
+    reply.send({ body: request.body, length: request.body.length })
+  })
+
+  await t.test('should reject body when byte length exceeds limit', async (t) => {
+    const result = await fastify.inject({
+      method: 'POST',
+      url: '/test-utf8',
+      headers: { 'Content-Type': 'text/plain', 'Content-Length': null },
+      payload: multiByteString
+    })
+
+    t.assert.strictEqual(result.statusCode, 413)
+  })
+
+  await t.test('should accept body when byte length is within limit', async (t) => {
+    const smallString = 'あ' // 1 character, 3 bytes, under the 7 byte limit
+
+    const result = await fastify.inject({
+      method: 'POST',
+      url: '/test-utf8',
+      headers: { 'Content-Type': 'text/plain' },
+      payload: smallString
+    })
+
+    t.assert.strictEqual(result.statusCode, 200)
+    t.assert.strictEqual(result.json().body, smallString)
+    t.assert.strictEqual(result.json().length, 1) // 1 character
+  })
+})

package/test/buffer.test.js

@@ -0,0 +1,74 @@
+'use strict'
+
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('Buffer test', async t => {
+  const fastify = Fastify()
+  fastify.addContentTypeParser('application/json', { parseAs: 'buffer' }, fastify.getDefaultJsonParser('error', 'ignore'))
+
+  fastify.delete('/', async (request) => {
+    return request.body
+  })
+
+  await test('should return 200 if the body is not empty', async t => {
+    t.plan(3)
+
+    const response = await fastify.inject({
+      method: 'DELETE',
+      url: '/',
+      payload: Buffer.from('{"hello":"world"}'),
+      headers: {
+        'content-type': 'application/json'
+      }
+    })
+
+    t.assert.ifError(response.error)
+    t.assert.strictEqual(response.statusCode, 200)
+    t.assert.deepStrictEqual(response.payload.toString(), '{"hello":"world"}')
+  })
+
+  await test('should return 400 if the body is empty', async t => {
+    t.plan(3)
+
+    const response = await fastify.inject({
+      method: 'DELETE',
+      url: '/',
+      payload: Buffer.alloc(0),
+      headers: {
+        'content-type': 'application/json'
+      }
+    })
+
+    t.assert.ifError(response.error)
+    t.assert.strictEqual(response.statusCode, 400)
+    t.assert.deepStrictEqual(JSON.parse(response.payload.toString()), {
+      error: 'Bad Request',
+      code: 'FST_ERR_CTP_EMPTY_JSON_BODY',
+      message: 'Body cannot be empty when content-type is set to \'application/json\'',
+      statusCode: 400
+    })
+  })
+
+  await test('should return 400 if the body is invalid json', async t => {
+    t.plan(3)
+
+    const response = await fastify.inject({
+      method: 'DELETE',
+      url: '/',
+      payload: Buffer.from(']'),
+      headers: {
+        'content-type': 'application/json'
+      }
+    })
+
+    t.assert.ifError(response.error)
+    t.assert.strictEqual(response.statusCode, 400)
+    t.assert.deepStrictEqual(JSON.parse(response.payload.toString()), {
+      error: 'Bad Request',
+      code: 'FST_ERR_CTP_INVALID_JSON_BODY',
+      message: 'Body is not valid JSON but content-type is set to \'application/json\'',
+      statusCode: 400
+    })
+  })
+})

package/test/build/error-serializer.test.js

@@ -0,0 +1,36 @@
+'use strict'
+
+const { test } = require('node:test')
+const fs = require('node:fs')
+const path = require('node:path')
+const { loadESLint } = require('eslint')
+
+const { code } = require('../../build/build-error-serializer')
+
+function unifyLineBreak (str) {
+  return str.toString().replace(/\r\n/g, '\n')
+}
+
+test('check generated code syntax', async (t) => {
+  t.plan(1)
+
+  // standard is a esm, we import it like this
+  const Eslint = await loadESLint({ useFlatConfig: true })
+  const eslint = new Eslint()
+  const result = await eslint.lintText(code)
+
+  // if there are any invalid syntax
+  // fatal count will be greater than 0
+  t.assert.strictEqual(result[0].fatalErrorCount, 0)
+})
+
+const isPrepublish = !!process.env.PREPUBLISH
+
+test('ensure the current error serializer is latest', { skip: !isPrepublish }, async (t) => {
+  t.plan(1)
+
+  const current = await fs.promises.readFile(path.resolve('lib/error-serializer.js'))
+
+  // line break should not be a problem depends on system
+  t.assert.strictEqual(unifyLineBreak(current), unifyLineBreak(code))
+})

package/test/build/version.test.js

@@ -0,0 +1,14 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+const { test } = require('node:test')
+const fastify = require('../../fastify')()
+
+test('should be the same as package.json', t => {
+  t.plan(1)
+
+  const json = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json')).toString('utf8'))
+
+  t.assert.strictEqual(fastify.version, json.version)
+})

package/test/build-certificate.js

@@ -0,0 +1,109 @@
+'use strict'
+
+const os = require('node:os')
+const forge = require('node-forge')
+
+// from self-cert module
+function selfCert (opts) {
+  const options = opts || {}
+  const log = opts.logger || require('abstract-logging')
+  const now = new Date()
+
+  if (!options.attrs) options.attrs = {}
+  if (!options.expires) {
+    options.expires = new Date(
+      now.getFullYear() + 5, now.getMonth() + 1, now.getDate()
+    )
+  }
+
+  log.debug('generating key pair')
+  const keys = forge.pki.rsa.generateKeyPair(options.bits || 2048)
+  log.debug('key pair generated')
+
+  log.debug('generating self-signed certificate')
+  const cert = forge.pki.createCertificate()
+  cert.publicKey = keys.publicKey
+  cert.serialNumber = '01'
+  cert.validity.notBefore = now
+  cert.validity.notAfter = options.expires
+
+  const attrs = [
+    { name: 'commonName', value: options.attrs.commonName || os.hostname() },
+    { name: 'countryName', value: options.attrs.countryName || 'US' },
+    { name: 'stateOrProvinceName', value: options.attrs.stateName || 'Georgia' },
+    { name: 'localityName', value: options.attrs.locality || 'Atlanta' },
+    { name: 'organizationName', value: options.attrs.orgName || 'None' },
+    { shortName: 'OU', value: options.attrs.shortName || 'example' }
+  ]
+  cert.setSubject(attrs)
+  cert.setIssuer(attrs)
+
+  cert.setExtensions([
+    { name: 'basicConstraints', cA: true },
+    {
+      name: 'keyUsage',
+      keyCertSign: true,
+      digitalSignature: true,
+      nonRepudiation: true,
+      keyEncipherment: true,
+      dataEncipherment: true
+    },
+    {
+      name: 'extKeyUsage',
+      serverAuth: true,
+      clientAuth: true,
+      codeSigning: true,
+      emailProtection: true,
+      timeStamping: true
+    },
+    {
+      name: 'nsCertType',
+      client: true,
+      server: true,
+      email: true,
+      objsign: true,
+      sslCA: true,
+      emailCA: true,
+      objCA: true
+    },
+    { name: 'subjectKeyIdentifier' },
+    {
+      name: 'subjectAltName',
+      altNames: [{ type: 6 /* URI */, value: 'DNS: ' + attrs[0].value }].concat((function () {
+        const interfaces = os.networkInterfaces()
+
+        // fix citgm: skip invalid ips (aix72-ppc64)
+        const ips = Object.values(interfaces).flat()
+          .filter(i => !!forge.util.bytesFromIP(i.address))
+          .map(i => ({ type: 7 /* IP */, ip: i.address }))
+
+        return ips
+      }()))
+    }
+  ])
+
+  cert.sign(keys.privateKey)
+  log.debug('certificate generated')
+  return {
+    privateKey: forge.pki.privateKeyToPem(keys.privateKey),
+    publicKey: forge.pki.publicKeyToPem(keys.publicKey),
+    certificate: forge.pki.certificateToPem(cert)
+  }
+}
+
+function buildCertificate () {
+  // "global" is used in here because "t.context" is only supported by "t.beforeEach" and "t.afterEach"
+  // For the test case which execute this code which will be using `t.before` and it can reduce the
+  // number of times executing it.
+  if (!global.context || !global.context.cert || !global.context.key) {
+    const certs = selfCert({
+      expires: new Date(Date.now() + 86400000)
+    })
+    global.context = {
+      cert: certs.certificate,
+      key: certs.privateKey
+    }
+  }
+}
+
+module.exports = { buildCertificate }

package/test/bundler/README.md

@@ -0,0 +1,29 @@
+# Bundlers test stack
+
+In some cases, developers bundle their apps for several targets such as serverless applications.
+Even if it's not recommended by Fastify team; we need to ensure we do not break the build process.
+Please note this might result in features behaving differently, like the version handling check for plugins.
+
+## Test bundlers
+
+The bundler test stack has been defined separately from the rest of the Unit testing stack because it's not a
+part of the fastify lib itself. Note that the tests run in CI only on NodeJs LTS version.
+Developers do not need to install every bundler to run unit tests.
+
+To run the bundler tests you will need to install the repository dependencies followed by the bundler
+stack dependencies. See:
+
+```bash
+  # path: root of repository /fastify
+  npm i
+  cd test/bundler/webpack
+  npm i
+  npm run test # test command runs bundle before of starting the test
+```
+
+## Bundler test development
+
+To not break the fastify unit testing stack please name test files like this `*-test.js` and not `*.test.js`,
+otherwise it will be targeted by the regular expression used for unit tests for fastify.
+Tests need to ensure the build process works and the fastify application can be run,
+no need to go in deep testing unless an issue is raised.

package/test/bundler/esbuild/bundler-test.js

@@ -0,0 +1,32 @@
+'use strict'
+
+const { test } = require('node:test')
+const fastifySuccess = require('./dist/success')
+const fastifyFailPlugin = require('./dist/failPlugin')
+
+test('Bundled package should work', (t, done) => {
+  t.plan(4)
+  fastifySuccess.ready((err) => {
+    t.assert.ifError(err)
+    fastifySuccess.inject(
+      {
+        method: 'GET',
+        url: '/'
+      },
+      (error, res) => {
+        t.assert.ifError(error)
+        t.assert.strictEqual(res.statusCode, 200)
+        t.assert.deepStrictEqual(res.json(), { hello: 'world' })
+        done()
+      }
+    )
+  })
+})
+
+test('Bundled package should not work with bad plugin version', (t, done) => {
+  t.plan(1)
+  fastifyFailPlugin.ready((err) => {
+    t.assert.match(err.message, /expected '9.x' fastify version/i)
+    done()
+  })
+})

package/test/bundler/esbuild/package.json

@@ -0,0 +1,10 @@
+{
+  "version": "0.0.1",
+  "scripts": {
+    "bundle": "esbuild success=src/index.js failPlugin=src/fail-plugin-version.js --bundle  --outdir=dist --platform=node",
+    "test": "npm run bundle && node bundler-test.js"
+  },
+  "devDependencies": {
+    "esbuild": "^0.25.0"
+  }
+}

package/test/bundler/esbuild/src/fail-plugin-version.js

@@ -0,0 +1,14 @@
+'use strict'
+
+const fp = require('fastify-plugin')
+const fastify = require('../../../../')()
+
+fastify.get('/', function (request, reply) {
+  reply.send({ hello: 'world' })
+})
+
+fastify.register(fp((instance, opts, done) => {
+  done()
+}, { fastify: '9.x' }))
+
+module.exports = fastify

package/test/bundler/esbuild/src/index.js

@@ -0,0 +1,9 @@
+'use strict'
+
+const fastify = require('../../../../')()
+// Declare a route
+fastify.get('/', function (request, reply) {
+  reply.send({ hello: 'world' })
+})
+
+module.exports = fastify

package/test/bundler/webpack/bundler-test.js

@@ -0,0 +1,32 @@
+'use strict'
+
+const { test } = require('node:test')
+const fastifySuccess = require('./dist/success')
+const fastifyFailPlugin = require('./dist/failPlugin')
+
+test('Bundled package should work', (t, done) => {
+  t.plan(4)
+  fastifySuccess.ready((err) => {
+    t.assert.ifError(err)
+    fastifySuccess.inject(
+      {
+        method: 'GET',
+        url: '/'
+      },
+      (error, res) => {
+        t.assert.ifError(error)
+        t.assert.strictEqual(res.statusCode, 200)
+        t.assert.deepStrictEqual(res.json(), { hello: 'world' })
+        done()
+      }
+    )
+  })
+})
+
+test('Bundled package should not work with bad plugin version', (t, done) => {
+  t.plan(1)
+  fastifyFailPlugin.ready((err) => {
+    t.assert.match(err.message, /expected '9.x' fastify version/i)
+    done()
+  })
+})

package/test/bundler/webpack/package.json

@@ -0,0 +1,11 @@
+{
+  "version":"0.0.1",
+  "scripts": {
+    "bundle": "webpack",
+    "test": "npm run bundle && node bundler-test.js"
+  },
+  "devDependencies": {
+    "webpack": "^5.49.0",
+    "webpack-cli": "^4.7.2"
+  }
+}

package/test/bundler/webpack/src/fail-plugin-version.js

@@ -0,0 +1,14 @@
+'use strict'
+
+const fp = require('fastify-plugin')
+const fastify = require('../../../../')()
+
+fastify.get('/', function (request, reply) {
+  reply.send({ hello: 'world' })
+})
+
+fastify.register(fp((instance, opts, done) => {
+  done()
+}, { fastify: '9.x' }))
+
+module.exports = fastify

package/test/bundler/webpack/src/index.js

@@ -0,0 +1,9 @@
+'use strict'
+
+const fastify = require('../../../../')()
+// Declare a route
+fastify.get('/', function (request, reply) {
+  reply.send({ hello: 'world' })
+})
+
+module.exports = fastify