rpc-express-toolkit 4.2.0 → 4.3.2

package/src/batch.js

@@ -2,6 +2,8 @@
  * @file BatchHandler Class
  * @description Handles JSON-RPC 2.0 batch requests processing multiple requests in a single call
  */
+const { addBatchIndex, hasOwn, validateEnvelope } = require('./protocol');
+
 class BatchHandler {
   constructor(endpoint) {
     this.endpoint = endpoint;
@@ -13,7 +15,7 @@ class BatchHandler {
    * @returns {boolean}
    */
   isBatchRequest(body) {
-    return Array.isArray(body) && body.length > 0;
+    return Array.isArray(body);
   }
 
   /**
@@ -42,22 +44,6 @@ class BatchHandler {
       };
     }
 
-    // Check for duplicate IDs in the batch
-    const ids = batch
-      .map((req) => req.id)
-      .filter((id) => id !== undefined && id !== null);
-    const uniqueIds = new Set(ids);
-
-    if (ids.length !== uniqueIds.size) {
-      return {
-        valid: false,
-        error: {
-          code: -32600,
-          message: 'Invalid Request: Duplicate IDs in batch',
-        },
-      };
-    }
-
     return { valid: true };
   }
 
@@ -72,13 +58,11 @@ class BatchHandler {
   async processBatch(batch, req, res, context) {
     const validation = this.validateBatch(batch);
     if (!validation.valid) {
-      return [
-        {
-          jsonrpc: '2.0',
-          id: null,
-          error: validation.error,
-        },
-      ];
+      return {
+        jsonrpc: '2.0',
+        id: null,
+        error: validation.error,
+      };
     }
 
     // Process all requests in parallel
@@ -88,11 +72,11 @@ class BatchHandler {
       } catch (error) {
         return {
           jsonrpc: '2.0',
-          id: request.id || null,
+          id: request && hasOwn(request, 'id') ? request.id : null,
           error: {
             code: error.code || -32603,
             message: error.message || 'Internal error',
-            data: { batchIndex: index },
+            data: addBatchIndex(error, index).data,
           },
         };
       }
@@ -113,38 +97,26 @@ class BatchHandler {
    * @returns {Promise<Object|null>}
    */
   async processSingleRequest(request, req, context, batchIndex) {
-    const { jsonrpc, method, params, id } = request;
+    const { method, params, id } = request || {};
+    const envelope = validateEnvelope(request);
 
-    // Validate JSON-RPC 2.0 request structure
-    if (jsonrpc !== '2.0') {
+    if (!envelope.valid) {
       return {
         jsonrpc: '2.0',
-        id: id || null,
-        error: {
-          code: -32600,
-          message: `Invalid Request: 'jsonrpc' must be '2.0'`,
-          data: { batchIndex },
-        },
+        id: envelope.responseId,
+        error: addBatchIndex(envelope.error, batchIndex),
       };
     }
 
-    if (typeof method !== 'string') {
-      return {
-        jsonrpc: '2.0',
-        id: id || null,
-        error: {
-          code: -32600,
-          message: `Invalid Request: 'method' must be a string`,
-          data: { batchIndex },
-        },
-      };
-    }
+    const methodConfig = this.endpoint.methods[method];
+    if (!methodConfig) {
+      if (envelope.isNotification) {
+        return null;
+      }
 
-    const handler = this.endpoint.methods[method];
-    if (!handler) {
       return {
         jsonrpc: '2.0',
-        id: id || null,
+        id,
         error: {
           code: -32601,
           message: `Method "${method}" not found`,
@@ -153,13 +125,47 @@ class BatchHandler {
       };
     }
 
+    // Extract handler (support both function and config object)
+    const handler =
+      typeof methodConfig === 'function' ? methodConfig : methodConfig.handler;
+    const schema =
+      typeof methodConfig === 'object' ? methodConfig.schema : null;
+
     // If no id is provided, this is a notification - don't return response
-    const isNotification = id === undefined || id === null;
+    const isNotification = !envelope.hasId;
 
     // Determine client safe mode from headers and deserialize params accordingly
     const clientSafeHeader = req.headers['x-rpc-safe-enabled'];
+    if (
+      this.endpoint.options.strictMode &&
+      this.endpoint.options.safeEnabled &&
+      !clientSafeHeader
+    ) {
+      if (isNotification) {
+        return null;
+      }
+
+      return {
+        jsonrpc: '2.0',
+        id,
+        error: {
+          code: -32600,
+          message:
+            'RPC Compatibility Error: Server requires safe serialization header but client did not provide it.',
+          data: {
+            serverSafeEnabled: this.endpoint.options.safeEnabled,
+            requiredHeader: 'X-RPC-Safe-Enabled',
+            strictMode: true,
+            solution:
+              'Update client to rpc-express-toolkit v4+ or disable server strict mode',
+            batchIndex,
+          },
+        },
+      };
+    }
+
     const clientSafeEnabled = clientSafeHeader === 'true';
-    const deserializedParams = params
+    const deserializedParams = hasOwn(request, 'params')
       ? this.endpoint.deserializeBigIntsAndDates(params, {
           safeEnabled: clientSafeEnabled,
         })
@@ -185,6 +191,41 @@ class BatchHandler {
         );
       }
 
+      if (schema) {
+        if (this.endpoint.middleware) {
+          middlewareContext = await this.endpoint.middleware.execute(
+            'beforeValidation',
+            middlewareContext
+          );
+        }
+
+        const validation = this.endpoint.validator.validate(
+          middlewareContext.params,
+          schema
+        );
+        if (!validation.valid) {
+          const error = new Error('Validation failed');
+          error.code = -32602;
+          error.data = {
+            validationErrors: validation.errors.map((err) => ({
+              field: err.instancePath || err.schemaPath,
+              message: err.message,
+              value: err.data,
+            })),
+          };
+          throw error;
+        }
+
+        middlewareContext.params = validation.data;
+
+        if (this.endpoint.middleware) {
+          middlewareContext = await this.endpoint.middleware.execute(
+            'afterValidation',
+            middlewareContext
+          );
+        }
+      }
+
       // Execute the handler
       const result = await Promise.resolve(
         handler(req, context, middlewareContext.params)
@@ -230,11 +271,11 @@ class BatchHandler {
 
       return {
         jsonrpc: '2.0',
-        id: id || null,
+        id,
         error: {
           code: error.code || -32603,
           message: error.message || 'Internal error',
-          data: { batchIndex },
+          data: addBatchIndex(error, batchIndex).data,
         },
       };
     }
@@ -246,9 +287,7 @@ class BatchHandler {
    * @returns {Object}
    */
   getBatchStats(batch) {
-    const notifications = batch.filter(
-      (req) => req.id === undefined || req.id === null
-    ).length;
+    const notifications = batch.filter((req) => !hasOwn(req, 'id')).length;
     const requests = batch.length - notifications;
     const methods = [...new Set(batch.map((req) => req.method))];
 

package/src/index.d.ts

@@ -1,6 +1,16 @@
 // Type definitions for rpc-express-toolkit
 
 import type { Router, Request, Response } from 'express';
+import {
+  RpcClient as SharedRpcClient,
+  RpcError as SharedRpcError,
+  RpcHttpError as SharedRpcHttpError,
+  RpcSafeClient as SharedRpcSafeClient
+} from 'rpc-toolkit-js-client';
+import type {
+  RpcBatchRequest as SharedRpcBatchRequest,
+  RpcClientOptions as SharedRpcClientOptions
+} from 'rpc-toolkit-js-client';
 
 /**
  * JSON-RPC handler function type
@@ -73,12 +83,9 @@ interface RateLimitConfig {
 }
 
 /**
- * Authentication configuration
+ * Authentication verifier. Return a truthy value to allow the call.
  */
-interface AuthConfig {
-  required?: boolean;
-  verify?: (req: Request) => boolean | Promise<boolean>;
-}
+type AuthConfig = (req: Request) => boolean | Promise<boolean>;
 
 /**
  * Schema validation configuration
@@ -106,6 +113,8 @@ interface RpcEndpointOptions {
   logging?: LoggingConfig;
   warnOnUnsafe?: boolean;
   strictMode?: boolean;
+  maxSerializationDepth?: number;
+  maxDeserializationDepth?: number;
   autoJsonMiddleware?: boolean;
   jsonOptions?: {
     limit?: string;
@@ -123,10 +132,17 @@ interface RpcEndpointOptions {
 /**
  * RPC client configuration options
  */
-interface RpcClientOptions {
-  safeEnabled?: boolean;
-  warnOnUnsafe?: boolean;
-}
+type RpcClientOptions = SharedRpcClientOptions;
+type RpcBatchRequest = SharedRpcBatchRequest;
+type RpcClient = SharedRpcClient;
+type RpcError = SharedRpcError;
+type RpcHttpError = SharedRpcHttpError;
+type RpcSafeClient = SharedRpcSafeClient;
+
+declare const RpcClient: typeof SharedRpcClient;
+declare const RpcError: typeof SharedRpcError;
+declare const RpcHttpError: typeof SharedRpcHttpError;
+declare const RpcSafeClient: typeof SharedRpcSafeClient;
 
 /**
  * Deserialization options for safe prefixes
@@ -224,59 +240,6 @@ declare class RpcEndpoint<C = any> {
   deserializeBigIntsAndDates(value: any, options?: DeserializationOptions): any;
 }
 
-/**
- * JSON-RPC 2.0 Client for Node.js environments.
- */
-declare class RpcClient {
-  /**
-   * Client constructor.
-   */
-  constructor(endpoint: string, options?: RpcClientOptions);
-  constructor(endpoint: string, defaultHeaders?: Record<string, string>, options?: RpcClientOptions);
-
-  /**
-   * Make a JSON-RPC call to the server.
-   */
-  call<T = any>(
-    method: string,
-    params?: any,
-    id?: string | number | null,
-    overrideHeaders?: Record<string, string>
-  ): Promise<T>;
-
-  /**
-   * Make a JSON-RPC notification (no response expected).
-   */
-  notify(
-    method: string,
-    params?: any,
-    overrideHeaders?: Record<string, string>
-  ): Promise<void>;
-
-  /**
-   * Make a batch JSON-RPC call.
-   */
-  batch<T = any>(
-    requests: Array<{
-      method: string;
-      params?: any;
-      id?: string | number | null;
-      notification?: boolean;
-    }>,
-    overrideHeaders?: Record<string, string>
-  ): Promise<T[]>;
-
-  /**
-   * Recursively serialize BigInt and Date to JSON-safe string formats.
-   */
-  serializeBigIntsAndDates(value: any): any;
-
-  /**
-   * Recursively deserialize strings representing BigInt and Date.
-   */
-  deserializeBigIntsAndDates(value: any, options?: DeserializationOptions): any;
-}
-
 /**
  * Export types for external use
  */
@@ -292,9 +255,13 @@ export {
   ValidationConfig,
   RpcEndpointOptions,
   RpcClientOptions,
+  RpcBatchRequest,
   DeserializationOptions,
   RpcEndpoint,
-  RpcClient
+  RpcClient,
+  RpcError,
+  RpcHttpError,
+  RpcSafeClient
 };
 
 /**
@@ -308,6 +275,9 @@ declare const Main: {
   serveScripts(router: Router, url?: string): void;
   RpcEndpoint: typeof RpcEndpoint;
   RpcClient: typeof RpcClient;
+  RpcError: typeof RpcError;
+  RpcHttpError: typeof RpcHttpError;
+  RpcSafeClient: typeof RpcSafeClient;
   Logger: any;
   MiddlewareManager: any;
   builtInMiddlewares: any;