qhttpx 1.8.0

package/tests/scheduler.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, it, vi } from 'vitest';
+import { Scheduler } from '../src/core/scheduler';
+
+describe('Scheduler', () => {
+  it('runs tasks within concurrency limit', async () => {
+    const scheduler = new Scheduler({ maxConcurrency: 4 });
+    const order: number[] = [];
+
+    await Promise.all([
+      scheduler.run(
+        async () => {
+          order.push(1);
+        },
+        {},
+      ),
+      scheduler.run(
+        async () => {
+          order.push(2);
+        },
+        {},
+      ),
+    ]);
+
+    expect(order.sort()).toEqual([1, 2]);
+    expect(scheduler.getCurrentInFlight()).toBe(0);
+  });
+
+  it('calls onOverloaded when limit is reached', async () => {
+    const scheduler = new Scheduler({ maxConcurrency: 1 });
+    const overloaded = vi.fn();
+
+    let resolveFirst: (() => void) | undefined;
+    const firstTask = scheduler.run(
+      () =>
+        new Promise<void>((resolve) => {
+          resolveFirst = resolve;
+        }),
+      {},
+    );
+
+    await scheduler.run(async () => {}, { onOverloaded: overloaded });
+
+    expect(overloaded).toHaveBeenCalledTimes(1);
+    expect(scheduler.getCurrentInFlight()).toBe(1);
+
+    resolveFirst?.();
+    await firstTask;
+
+    expect(scheduler.getCurrentInFlight()).toBe(0);
+  });
+
+  it('invokes timeout callback when task exceeds timeout', async () => {
+    const scheduler = new Scheduler({ maxConcurrency: 1 });
+    const onTimeout = vi.fn();
+
+    await scheduler.run(
+      () =>
+        new Promise<void>((resolve) => {
+          setTimeout(resolve, 50);
+        }),
+      {
+        timeoutMs: 10,
+        onTimeout,
+      },
+    );
+
+    expect(onTimeout).toHaveBeenCalledTimes(1);
+    expect(scheduler.getCurrentInFlight()).toBe(0);
+  });
+});
+

package/tests/schema-routes.test.ts

@@ -0,0 +1,89 @@
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { QHTTPX } from '../src/index';
+
+describe('Schema-based Routes', () => {
+  let app: QHTTPX;
+  let port: number;
+
+  beforeAll(async () => {
+    app = new QHTTPX({
+        performanceMode: 'ultra'
+    });
+
+    const UserSchema = {
+      type: 'object',
+      properties: {
+        id: { type: 'integer' },
+        name: { type: 'string' },
+        email: { type: 'string' }
+      },
+      required: ['id', 'name']
+    };
+
+    app.get('/user', {
+      schema: UserSchema,
+      handler(ctx) {
+        ctx.json({
+          id: 1,
+          name: 'John Doe',
+          email: 'john@example.com',
+          extra: 'should be ignored'
+        });
+      }
+    });
+
+    app.get('/no-schema', (ctx) => {
+        ctx.json({ foo: 'bar', run: ctx.state.middlewareRun });
+    });
+
+    app.use(async (ctx, next) => {
+        ctx.state.middlewareRun = true;
+        await next();
+    });
+
+    app.get('/middleware-check', (ctx) => {
+        ctx.json({ run: ctx.state.middlewareRun });
+    });
+
+    const result = await app.listen(0);
+    port = result.port;
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('should serialize using the provided schema', async () => {
+    const response = await fetch(`http://localhost:${port}/user`);
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    
+    expect(body).toEqual({
+      id: 1,
+      name: 'John Doe',
+      email: 'john@example.com'
+    });
+    // 'extra' should be missing
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect((body as any).extra).toBeUndefined();
+  });
+
+  it('should work without schema', async () => {
+      const response = await fetch(`http://localhost:${port}/no-schema`);
+      expect(response.status).toBe(200);
+      const body = await response.json();
+      expect(body).toEqual({ foo: 'bar' });
+      // Middleware was added AFTER this route, so it should NOT run
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      expect((body as any).run).toBeUndefined();
+  });
+
+  it('should run middlewares', async () => {
+      const response = await fetch(`http://localhost:${port}/middleware-check`);
+      expect(response.status).toBe(200);
+      const body = await response.json();
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      expect((body as any).run).toBe(true);
+  });
+});

package/tests/security.test.ts

@@ -0,0 +1,128 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import {
+  QHTTPX,
+  createRateLimitMiddleware,
+  createSecureDefaults,
+  createSecurityHeadersMiddleware,
+} from '../src';
+
+describe('Security and rate limiting middleware', () => {
+  let app: QHTTPX | undefined;
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+  });
+
+  it('applies default security headers', async () => {
+    app = new QHTTPX();
+
+    app.use(createSecurityHeadersMiddleware());
+
+    app.get('/ping', (ctx) => {
+      ctx.send('pong');
+    });
+
+    const { port } = await app.listen(0, '127.0.0.1');
+
+    const response = await fetch(`http://127.0.0.1:${port}/ping`);
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe('pong');
+
+    expect(response.headers.get('content-security-policy')).toBe(
+      "default-src 'self'",
+    );
+    expect(response.headers.get('referrer-policy')).toBe('no-referrer');
+    expect(response.headers.get('x-frame-options')).toBe('SAMEORIGIN');
+    expect(response.headers.get('x-content-type-options')).toBe('nosniff');
+    expect(response.headers.get('x-xss-protection')).toBe('1; mode=block');
+  });
+
+  it('allows overriding and disabling specific headers', async () => {
+    app = new QHTTPX();
+
+    app.use(
+      createSecurityHeadersMiddleware({
+        contentSecurityPolicy: "default-src 'self' https://cdn.example.com",
+        referrerPolicy: 'strict-origin-when-cross-origin',
+        xFrameOptions: null,
+        strictTransportSecurity: 'max-age=31536000; includeSubDomains',
+      }),
+    );
+
+    app.get('/ping', (ctx) => {
+      ctx.send('pong');
+    });
+
+    const { port } = await app.listen(0, '127.0.0.1');
+
+    const response = await fetch(`http://127.0.0.1:${port}/ping`);
+
+    expect(response.status).toBe(200);
+
+    expect(response.headers.get('content-security-policy')).toBe(
+      "default-src 'self' https://cdn.example.com",
+    );
+    expect(response.headers.get('referrer-policy')).toBe(
+      'strict-origin-when-cross-origin',
+    );
+    expect(response.headers.get('x-frame-options')).toBeNull();
+    expect(response.headers.get('strict-transport-security')).toBe(
+      'max-age=31536000; includeSubDomains',
+    );
+  });
+
+  it('provides secure defaults preset combining CORS and headers', async () => {
+    app = new QHTTPX();
+
+    const middlewares = createSecureDefaults();
+    for (const mw of middlewares) {
+      app.use(mw);
+    }
+
+    app.get('/ping', (ctx) => {
+      ctx.send('pong');
+    });
+
+    const { port } = await app.listen(0, '127.0.0.1');
+
+    const response = await fetch(`http://127.0.0.1:${port}/ping`, {
+      method: 'GET',
+      headers: {
+        origin: 'http://example.com',
+      },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('access-control-allow-origin')).toBe('*');
+    expect(response.headers.get('content-security-policy')).toBe(
+      "default-src 'self'",
+    );
+  });
+
+  it('applies in-memory rate limiting per remote address', async () => {
+    app = new QHTTPX();
+
+    app.use(
+      createRateLimitMiddleware({
+        maxRequests: 1,
+        windowMs: 1000,
+      }),
+    );
+
+    app.get('/ping', (ctx) => {
+      ctx.send('pong');
+    });
+
+    const { port } = await app.listen(0, '127.0.0.1');
+
+    const first = await fetch(`http://127.0.0.1:${port}/ping`);
+    const second = await fetch(`http://127.0.0.1:${port}/ping`);
+
+    expect(first.status).toBe(200);
+    expect(second.status).toBe(429);
+  });
+});

package/tests/server-db.test.ts

@@ -0,0 +1,72 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { QHTTPX } from '../src/core/server';
+import { DatabaseManager } from '../src/database/manager';
+import { MemoryAdapter } from '../src/database/adapters/memory';
+import http from 'http';
+
+describe('Server Database Integration', () => {
+  let app: QHTTPX;
+  let dbManager: DatabaseManager;
+
+  beforeEach(async () => {
+    DatabaseManager.registerAdapter('memory', MemoryAdapter);
+    dbManager = new DatabaseManager({
+      default: 'main',
+      connections: {
+        main: {
+          type: 'memory',
+          database: 'test_db'
+        }
+      }
+    });
+    await dbManager.connect();
+
+    app = new QHTTPX({
+      database: dbManager
+    });
+  });
+
+  afterEach(async () => {
+    await app.close();
+    await dbManager.disconnect();
+  });
+
+  it('should expose database manager in context', async () => {
+    return new Promise<void>(async (resolve, reject) => {
+      app.get('/db-test', (ctx) => {
+        try {
+          expect(ctx.db).toBeDefined();
+          expect(ctx.db).toBe(dbManager);
+          expect(ctx.db?.get('main').isConnected()).toBe(true);
+          ctx.json({ status: 'ok' });
+        } catch (error) {
+          // If expect fails, we need to make sure the test fails
+          // But throwing here might be caught by the server error handler
+          // So we set a flag or just let it fail naturally if vitest handles async exceptions
+          // For now, let's reject the promise
+          reject(error);
+        }
+      });
+
+      try {
+        const { port } = await app.listen(0);
+        
+        const req = http.get(`http://localhost:${port}/db-test`, (res) => {
+            if (res.statusCode !== 200) {
+                 reject(new Error(`Status code: ${res.statusCode}`));
+                 return;
+            }
+            res.on('data', () => {});
+            res.on('end', () => {
+                resolve();
+            });
+        });
+        req.on('error', (err) => {
+            reject(err);
+        });
+      } catch (err) {
+        reject(err);
+      }
+    });
+  });
+});

package/tests/smoke.test.ts

@@ -0,0 +1,9 @@
+import { describe, expect, it } from 'vitest';
+import { QHTTPX } from '../src/index';
+
+describe('qhttpx smoke', () => {
+  it('constructs a QHTTPX instance', () => {
+    const app = new QHTTPX();
+    expect(app).toBeInstanceOf(QHTTPX);
+  });
+});

package/tests/sqlite-fusion.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { QHTTPX } from '../src/core/server';
+import { DatabaseManager } from '../src/database/manager';
+import { SQLiteAdapter } from '../src/database/adapters/sqlite';
+
+describe('SQLite Query Fusion', () => {
+  let app: QHTTPX;
+  let dbManager: DatabaseManager;
+
+  beforeEach(async () => {
+    // Register SQLite adapter
+    DatabaseManager.registerAdapter('sqlite', SQLiteAdapter);
+    
+    // Use in-memory SQLite DB
+    dbManager = new DatabaseManager({
+      default: 'main',
+      connections: {
+        main: { type: 'sqlite', database: ':memory:' }
+      }
+    });
+
+    await dbManager.connect();
+    
+    // Setup schema and data
+    const adapter = dbManager.get('main');
+    await adapter.query('CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT)');
+    await adapter.query("INSERT INTO users (id, name) VALUES (1, 'Alice')");
+    await adapter.query("INSERT INTO users (id, name) VALUES (2, 'Bob')");
+    await adapter.query("INSERT INTO users (id, name) VALUES (3, 'Charlie')");
+
+    app = new QHTTPX({ 
+      database: dbManager,
+      enableBatching: true 
+    });
+  });
+
+  afterEach(async () => {
+    if (app) await app.close();
+    if (dbManager) await dbManager.disconnect();
+  });
+
+  it('should fuse SELECT queries with SQLite', async () => {
+    // Wrap the adapter to spy on queries
+    const realAdapter = dbManager.get('main');
+    const originalQuery = realAdapter.query.bind(realAdapter);
+    
+    const queries: string[] = [];
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    realAdapter.query = async (sql: string, params?: any[]) => {
+        queries.push(sql);
+        return originalQuery(sql, params);
+    };
+
+    app.op('getUser', async (params, ctx) => {
+      // This matches the coalescer pattern: "SELECT ... WHERE id = ?"
+      if (!ctx.db) throw new Error('No DB');
+      const rows = await ctx.db.get().query('SELECT * FROM users WHERE id = ?', [params.id]);
+      return rows[0];
+    });
+
+    const { port } = await app.listen(0);
+
+    const batch = {
+      batch: [
+        { op: 'getUser', params: { id: 1 }, id: 1 },
+        { op: 'getUser', params: { id: 2 }, id: 2 },
+        { op: 'getUser', params: { id: 3 }, id: 3 }
+      ]
+    };
+
+    const response = await fetch(`http://localhost:${port}/qhttpx`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(batch)
+    });
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const data = await response.json() as any;
+    
+    // Verify results
+    expect(data.results).toHaveLength(3);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const r1 = data.results.find((r: any) => r.id === 1);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const r2 = data.results.find((r: any) => r.id === 2);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const r3 = data.results.find((r: any) => r.id === 3);
+
+    expect(r1.result).toEqual({ id: 1, name: 'Alice' });
+    expect(r2.result).toEqual({ id: 2, name: 'Bob' });
+    expect(r3.result).toEqual({ id: 3, name: 'Charlie' });
+
+    // Verify FUSION
+    const selectQueries = queries.filter(q => q.trim().toUpperCase().startsWith('SELECT'));
+    
+    // It should contain an IN clause
+    const fusedQuery = selectQueries.find(q => q.includes('IN ('));
+    expect(fusedQuery).toBeDefined();
+    
+    // Ensure we didn't run 3 individual queries
+    // The spy catches the FUSED query, but NOT the individual ones if they were fused.
+    // If fusion FAILED, we would see 3 queries with "= ?"
+    const individualQueries = selectQueries.filter(q => q.includes('= ?'));
+    expect(individualQueries).toHaveLength(0);
+  });
+});

package/tests/static.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it, beforeAll, afterAll } from 'vitest';
+import path from 'path';
+import fs from 'fs';
+// import http from 'http';
+import { QHTTPX } from '../src/core/server';
+import { createStaticMiddleware } from '../src/middleware/static';
+
+const TEST_DIR = path.join(__dirname, 'fixtures');
+const TEST_FILE = path.join(TEST_DIR, 'test.txt');
+const TEST_CONTENT = 'Hello World! This is a test file for QHTTPX static middleware.';
+
+describe('static middleware', () => {
+  let app: QHTTPX;
+  let serverUrl: string;
+
+  beforeAll(async () => {
+    // Create fixtures
+    if (!fs.existsSync(TEST_DIR)) fs.mkdirSync(TEST_DIR);
+    fs.writeFileSync(TEST_FILE, TEST_CONTENT);
+
+    app = new QHTTPX();
+    app.use(createStaticMiddleware({ root: TEST_DIR }));
+    
+    const { port } = await app.listen(0, '127.0.0.1');
+    serverUrl = `http://127.0.0.1:${port}`;
+  });
+
+  afterAll(async () => {
+    await app.close();
+    // Cleanup
+    if (fs.existsSync(TEST_FILE)) fs.unlinkSync(TEST_FILE);
+    if (fs.existsSync(TEST_DIR)) fs.rmdirSync(TEST_DIR);
+  });
+
+  it('should serve a static file', async () => {
+    const response = await fetch(`${serverUrl}/test.txt`);
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-type')).toContain('text/plain');
+    const text = await response.text();
+    expect(text).toBe(TEST_CONTENT);
+  });
+
+  it('should support HEAD requests', async () => {
+    const response = await fetch(`${serverUrl}/test.txt`, { method: 'HEAD' });
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-type')).toContain('text/plain');
+    expect(response.headers.get('content-length')).toBe(TEST_CONTENT.length.toString());
+    const text = await response.text();
+    expect(text).toBe('');
+  });
+
+  it('should support Range requests (first byte)', async () => {
+    const response = await fetch(`${serverUrl}/test.txt`, {
+      headers: { Range: 'bytes=0-0' }
+    });
+    expect(response.status).toBe(206);
+    expect(response.headers.get('content-range')).toBe(`bytes 0-0/${TEST_CONTENT.length}`);
+    expect(response.headers.get('content-length')).toBe('1');
+    const text = await response.text();
+    expect(text).toBe('H');
+  });
+
+  it('should support Range requests (partial)', async () => {
+    const response = await fetch(`${serverUrl}/test.txt`, {
+      headers: { Range: 'bytes=0-4' }
+    });
+    expect(response.status).toBe(206);
+    expect(response.headers.get('content-range')).toBe(`bytes 0-4/${TEST_CONTENT.length}`);
+    expect(response.headers.get('content-length')).toBe('5');
+    const text = await response.text();
+    expect(text).toBe('Hello');
+  });
+
+  it('should return 416 for invalid Range', async () => {
+    const response = await fetch(`${serverUrl}/test.txt`, {
+      headers: { Range: 'bytes=1000-2000' }
+    });
+    expect(response.status).toBe(416);
+    expect(response.headers.get('content-range')).toBe(`bytes */${TEST_CONTENT.length}`);
+  });
+
+  it('should support ETag caching (304 Not Modified)', async () => {
+    const response1 = await fetch(`${serverUrl}/test.txt`);
+    const etag = response1.headers.get('etag');
+    expect(etag).toBeTruthy();
+
+    const response2 = await fetch(`${serverUrl}/test.txt`, {
+      headers: { 'If-None-Match': etag! }
+    });
+    expect(response2.status).toBe(304);
+    const text = await response2.text();
+    expect(text).toBe('');
+  });
+
+  it('should support Last-Modified caching (304 Not Modified)', async () => {
+    const response1 = await fetch(`${serverUrl}/test.txt`);
+    const lastModified = response1.headers.get('last-modified');
+    expect(lastModified).toBeTruthy();
+
+    const response2 = await fetch(`${serverUrl}/test.txt`, {
+      headers: { 'If-Modified-Since': lastModified! }
+    });
+    expect(response2.status).toBe(304);
+  });
+
+  it('should return 404 for non-existent file', async () => {
+    const response = await fetch(`${serverUrl}/does-not-exist.txt`);
+    expect(response.status).toBe(404);
+  });
+});
+

package/tests/stream.test.ts

@@ -0,0 +1,58 @@
+import { Readable } from 'stream';
+import { afterEach, describe, expect, it } from 'vitest';
+import { QHTTPX, createSseStream, sendStream } from '../src';
+
+describe('Streaming helpers', () => {
+  let app: QHTTPX | undefined;
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+  });
+
+  it('sends a simple SSE event', async () => {
+    app = new QHTTPX({ requestTimeoutMs: 5000 });
+
+    app.get('/sse', (ctx) => {
+      const sse = createSseStream(ctx);
+      sse.send({ message: 'hello' });
+      sse.close();
+    });
+
+    const { port } = await app.listen(0, '127.0.0.1');
+
+    const response = await fetch(`http://127.0.0.1:${port}/sse`);
+
+    expect(response.status).toBe(200);
+    expect(
+      response.headers.get('content-type'),
+    ).toContain('text/event-stream');
+
+    const text = await response.text();
+    expect(text.trim()).toBe('data: {"message":"hello"}');
+  });
+
+  it('streams data from a readable', async () => {
+    app = new QHTTPX();
+
+    app.get('/stream', async (ctx) => {
+      const readable = Readable.from(['hello', ' ', 'world']);
+      await sendStream(ctx, readable, {
+        contentType: 'text/plain; charset=utf-8',
+        status: 200,
+      });
+    });
+
+    const { port } = await app.listen(0, '127.0.0.1');
+
+    const response = await fetch(`http://127.0.0.1:${port}/stream`);
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-type')).toContain('text/plain');
+    const text = await response.text();
+    expect(text).toBe('hello world');
+  });
+});
+