slicejs-web-framework 4.0.2 → 4.1.0

package/api/framework/express.js

@@ -1,3 +1,3 @@
-import express from 'express';
-
-export default express;
+import express from 'express';
+
+export default express;

package/api/framework/precompressedStatic.js

@@ -1,93 +1,102 @@
-// api/framework/precompressedStatic.js
-//
-// Serves a precompressed `.br`/`.gz` sibling (produced by `slice build --compress`)
-// when the client accepts that encoding and the file exists, instead of
-// compressing on every request. Falls through to the normal static handlers
-// when there is no precompressed variant or the client doesn't accept one.
-//
-// Mounted before the runtime `compression` middleware short-circuits it: the
-// response ends here with Content-Encoding already set, so compression never
-// re-compresses an already-encoded body.
-
-import fs from 'node:fs';
-import path from 'node:path';
-
-const ENCODING_EXTENSION = { br: '.br', gzip: '.gz' };
-
-// Only known text types are served pre-encoded; the Content-Type is taken from
-// the ORIGINAL extension (the browser must not see `.br` as the type).
-const CONTENT_TYPES = {
-  '.js': 'application/javascript; charset=utf-8',
-  '.mjs': 'application/javascript; charset=utf-8',
-  '.cjs': 'application/javascript; charset=utf-8',
-  '.css': 'text/css; charset=utf-8',
-  '.html': 'text/html; charset=utf-8',
-  '.htm': 'text/html; charset=utf-8',
-  '.json': 'application/json; charset=utf-8',
-  '.svg': 'image/svg+xml',
-  '.xml': 'application/xml; charset=utf-8',
-  '.txt': 'text/plain; charset=utf-8',
-  '.map': 'application/json; charset=utf-8',
-  '.webmanifest': 'application/manifest+json; charset=utf-8'
-};
-
-/** Encodings the client accepts, most-preferred first (brotli over gzip). */
-function preferredEncodings(acceptEncoding) {
-  const accepts = String(acceptEncoding || '').toLowerCase();
-  const list = [];
-  if (accepts.includes('br')) list.push('br');
-  if (accepts.includes('gzip')) list.push('gzip');
-  return list;
-}
-
-/**
- * @param {string[]} roots Absolute directories to resolve `req.path` against,
- *   in priority order (e.g. [dist/public, dist]).
- * @returns {import('express').RequestHandler}
- */
-export function createPrecompressedStatic(roots = []) {
-  const resolvedRoots = roots.filter(Boolean).map((r) => path.resolve(r));
-
-  return function precompressedStatic(req, res, next) {
-    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
-
-    const encodings = preferredEncodings(req.headers['accept-encoding']);
-    if (encodings.length === 0) return next();
-
-    let rel;
-    try {
-      rel = decodeURIComponent(req.path).replace(/^\/+/, '');
-    } catch {
-      return next();
-    }
-    if (!rel || rel.includes('\0')) return next();
-
-    const ext = path.extname(rel).toLowerCase();
-    const contentType = CONTENT_TYPES[ext];
-    if (!contentType) return next();
-
-    for (const root of resolvedRoots) {
-      const target = path.normalize(path.join(root, rel));
-      // Path traversal guard: the resolved file must stay under the root.
-      if (target !== root && !target.startsWith(root + path.sep)) continue;
-
-      for (const enc of encodings) {
-        const encodedPath = target + ENCODING_EXTENSION[enc];
-        try {
-          if (fs.existsSync(encodedPath) && fs.statSync(encodedPath).isFile()) {
-            res.setHeader('Content-Type', contentType);
-            res.setHeader('Content-Encoding', enc);
-            res.setHeader('Vary', 'Accept-Encoding');
-            return res.send(fs.readFileSync(encodedPath));
-          }
-        } catch {
-          // Unreadable candidate — try the next encoding/root.
-        }
-      }
-    }
-
-    return next();
-  };
-}
-
-export default createPrecompressedStatic;
+// api/framework/precompressedStatic.js
+//
+// Serves a precompressed `.br`/`.gz` sibling (produced by `slice build --compress`)
+// when the client accepts that encoding and the file exists, instead of
+// compressing on every request. Falls through to the normal static handlers
+// when there is no precompressed variant or the client doesn't accept one.
+//
+// Mounted before the runtime `compression` middleware short-circuits it: the
+// response ends here with Content-Encoding already set, so compression never
+// re-compresses an already-encoded body.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+const ENCODING_EXTENSION = { br: '.br', gzip: '.gz' };
+
+// Only known text types are served pre-encoded; the Content-Type is taken from
+// the ORIGINAL extension (the browser must not see `.br` as the type).
+const CONTENT_TYPES = {
+  '.js': 'application/javascript; charset=utf-8',
+  '.mjs': 'application/javascript; charset=utf-8',
+  '.cjs': 'application/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.html': 'text/html; charset=utf-8',
+  '.htm': 'text/html; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.xml': 'application/xml; charset=utf-8',
+  '.txt': 'text/plain; charset=utf-8',
+  '.map': 'application/json; charset=utf-8',
+  '.webmanifest': 'application/manifest+json; charset=utf-8'
+};
+
+/** Encodings the client accepts, most-preferred first (brotli over gzip). */
+function preferredEncodings(acceptEncoding) {
+  const accepts = String(acceptEncoding || '').toLowerCase();
+  const list = [];
+  if (accepts.includes('br')) list.push('br');
+  if (accepts.includes('gzip')) list.push('gzip');
+  return list;
+}
+
+/**
+ * @param {string[]} roots Absolute directories to resolve `req.path` against,
+ *   in priority order (e.g. [dist/public, dist]).
+ * @param {{ noStorePrefixes?: string[] }} [options] Path prefixes that must not
+ *   be cached. Bundles are unversioned, so they keep the same no-store policy
+ *   the `/bundles/` handler applies when it serves them itself.
+ * @returns {import('express').RequestHandler}
+ */
+export function createPrecompressedStatic(roots = [], options = {}) {
+  const resolvedRoots = roots.filter(Boolean).map((r) => path.resolve(r));
+  const noStorePrefixes = options.noStorePrefixes || [];
+
+  return function precompressedStatic(req, res, next) {
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+
+    const encodings = preferredEncodings(req.headers['accept-encoding']);
+    if (encodings.length === 0) return next();
+
+    let rel;
+    try {
+      rel = decodeURIComponent(req.path).replace(/^\/+/, '');
+    } catch {
+      return next();
+    }
+    if (!rel || rel.includes('\0')) return next();
+
+    const ext = path.extname(rel).toLowerCase();
+    const contentType = CONTENT_TYPES[ext];
+    if (!contentType) return next();
+
+    for (const root of resolvedRoots) {
+      const target = path.normalize(path.join(root, rel));
+      // Path traversal guard: the resolved file must stay under the root.
+      if (target !== root && !target.startsWith(root + path.sep)) continue;
+
+      for (const enc of encodings) {
+        const encodedPath = target + ENCODING_EXTENSION[enc];
+        try {
+          if (fs.existsSync(encodedPath) && fs.statSync(encodedPath).isFile()) {
+            res.setHeader('Content-Type', contentType);
+            res.setHeader('Content-Encoding', enc);
+            res.setHeader('Vary', 'Accept-Encoding');
+            if (noStorePrefixes.some((prefix) => req.path.startsWith(prefix))) {
+              res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+              res.setHeader('Pragma', 'no-cache');
+              res.setHeader('Expires', '0');
+            }
+            return res.send(fs.readFileSync(encodedPath));
+          }
+        } catch {
+          // Unreadable candidate — try the next encoding/root.
+        }
+      }
+    }
+
+    return next();
+  };
+}
+
+export default createPrecompressedStatic;

package/api/framework/publicEnvResolver.js

@@ -1,123 +1,123 @@
-import { readFileSync, existsSync } from 'node:fs';
-
-const PUBLIC_PREFIX = 'SLICE_PUBLIC_';
-const SUSPICIOUS_TERMS = ['SECRET', 'TOKEN', 'PASSWORD', 'PRIVATE', 'API_KEY', 'ACCESS_KEY', 'CREDENTIAL'];
-
-function parseEnvFile(envFilePath) {
-   if (!envFilePath || !existsSync(envFilePath)) {
-      return {};
-   }
-
-   let fileContent;
-   try {
-      fileContent = readFileSync(envFilePath, 'utf8').replace(/^\uFEFF/, '');
-   } catch (error) {
-      console.error(`Error reading env file ${envFilePath}:`, error);
-      return {};
-   }
-   const parsed = {};
-   const lines = fileContent.split(/\r?\n/);
-
-   for (const rawLine of lines) {
-      const line = rawLine.trim();
-
-      if (!line || line.startsWith('#')) {
-         continue;
-      }
-
-      const equalsIndex = line.indexOf('=');
-      if (equalsIndex === -1) {
-         continue;
-      }
-
-      let key = line.slice(0, equalsIndex).trim();
-      if (!key) {
-         continue;
-      }
-
-      if (key.startsWith('export ')) {
-         key = key.slice('export '.length).trim();
-      }
-
-      let value = line.slice(equalsIndex + 1).trim();
-
-      const quotedWithOptionalCommentMatch = value.match(/^(["'])(.*?)\1(?:\s+#.*)?$/);
-
-      if (quotedWithOptionalCommentMatch) {
-         value = quotedWithOptionalCommentMatch[2];
-      } else {
-         value = value.replace(/\s+#.*$/, '').trimEnd();
-      }
-
-      parsed[key] = value;
-   }
-
-   return parsed;
-}
-
-function warnSuspiciousKey(key, logger, warnedKeys) {
-   const upperKey = key.toUpperCase();
-   const isSuspicious = SUSPICIOUS_TERMS.some((term) => upperKey.includes(term));
-
-   if (isSuspicious && !warnedKeys.has(key) && logger && typeof logger.warn === 'function') {
-      logger.warn(`[slice-env] Suspicious public environment key detected: ${key}`);
-      warnedKeys.add(key);
-   }
-}
-
-function buildPublicPayload({ envFromFile, processEnv, logger }) {
-   const env = {};
-   const warnedKeys = new Set();
-
-   for (const [key, value] of Object.entries(envFromFile)) {
-      if (key.startsWith(PUBLIC_PREFIX)) {
-         env[key] = String(value ?? '');
-         warnSuspiciousKey(key, logger, warnedKeys);
-      }
-   }
-
-   for (const [key, value] of Object.entries(processEnv || {})) {
-      if (key.startsWith(PUBLIC_PREFIX)) {
-         env[key] = String(value ?? '');
-         warnSuspiciousKey(key, logger, warnedKeys);
-      }
-   }
-
-   return env;
-}
-
-export function resolvePublicEnv({ mode, envFilePath, processEnv = process.env, logger = console }) {
-   const envFromFile = parseEnvFile(envFilePath);
-   const env = buildPublicPayload({
-      envFromFile,
-      processEnv,
-      logger,
-   });
-
-   return {
-      mode,
-      env,
-   };
-}
-
-export function createPublicEnvProvider({ mode, envFilePath, processEnv = process.env, logger = console }) {
-   if (mode === 'production') {
-      let cachedPayload;
-
-      return {
-         getPayload() {
-            if (!cachedPayload) {
-               cachedPayload = resolvePublicEnv({ mode, envFilePath, processEnv, logger });
-            }
-
-            return cachedPayload;
-         },
-      };
-   }
-
-   return {
-      getPayload() {
-         return resolvePublicEnv({ mode, envFilePath, processEnv, logger });
-      },
-   };
-}
+import { readFileSync, existsSync } from 'node:fs';
+
+const PUBLIC_PREFIX = 'SLICE_PUBLIC_';
+const SUSPICIOUS_TERMS = ['SECRET', 'TOKEN', 'PASSWORD', 'PRIVATE', 'API_KEY', 'ACCESS_KEY', 'CREDENTIAL'];
+
+function parseEnvFile(envFilePath) {
+   if (!envFilePath || !existsSync(envFilePath)) {
+      return {};
+   }
+
+   let fileContent;
+   try {
+      fileContent = readFileSync(envFilePath, 'utf8').replace(/^\uFEFF/, '');
+   } catch (error) {
+      console.error(`Error reading env file ${envFilePath}:`, error);
+      return {};
+   }
+   const parsed = {};
+   const lines = fileContent.split(/\r?\n/);
+
+   for (const rawLine of lines) {
+      const line = rawLine.trim();
+
+      if (!line || line.startsWith('#')) {
+         continue;
+      }
+
+      const equalsIndex = line.indexOf('=');
+      if (equalsIndex === -1) {
+         continue;
+      }
+
+      let key = line.slice(0, equalsIndex).trim();
+      if (!key) {
+         continue;
+      }
+
+      if (key.startsWith('export ')) {
+         key = key.slice('export '.length).trim();
+      }
+
+      let value = line.slice(equalsIndex + 1).trim();
+
+      const quotedWithOptionalCommentMatch = value.match(/^(["'])(.*?)\1(?:\s+#.*)?$/);
+
+      if (quotedWithOptionalCommentMatch) {
+         value = quotedWithOptionalCommentMatch[2];
+      } else {
+         value = value.replace(/\s+#.*$/, '').trimEnd();
+      }
+
+      parsed[key] = value;
+   }
+
+   return parsed;
+}
+
+function warnSuspiciousKey(key, logger, warnedKeys) {
+   const upperKey = key.toUpperCase();
+   const isSuspicious = SUSPICIOUS_TERMS.some((term) => upperKey.includes(term));
+
+   if (isSuspicious && !warnedKeys.has(key) && logger && typeof logger.warn === 'function') {
+      logger.warn(`[slice-env] Suspicious public environment key detected: ${key}`);
+      warnedKeys.add(key);
+   }
+}
+
+function buildPublicPayload({ envFromFile, processEnv, logger }) {
+   const env = {};
+   const warnedKeys = new Set();
+
+   for (const [key, value] of Object.entries(envFromFile)) {
+      if (key.startsWith(PUBLIC_PREFIX)) {
+         env[key] = String(value ?? '');
+         warnSuspiciousKey(key, logger, warnedKeys);
+      }
+   }
+
+   for (const [key, value] of Object.entries(processEnv || {})) {
+      if (key.startsWith(PUBLIC_PREFIX)) {
+         env[key] = String(value ?? '');
+         warnSuspiciousKey(key, logger, warnedKeys);
+      }
+   }
+
+   return env;
+}
+
+export function resolvePublicEnv({ mode, envFilePath, processEnv = process.env, logger = console }) {
+   const envFromFile = parseEnvFile(envFilePath);
+   const env = buildPublicPayload({
+      envFromFile,
+      processEnv,
+      logger,
+   });
+
+   return {
+      mode,
+      env,
+   };
+}
+
+export function createPublicEnvProvider({ mode, envFilePath, processEnv = process.env, logger = console }) {
+   if (mode === 'production') {
+      let cachedPayload;
+
+      return {
+         getPayload() {
+            if (!cachedPayload) {
+               cachedPayload = resolvePublicEnv({ mode, envFilePath, processEnv, logger });
+            }
+
+            return cachedPayload;
+         },
+      };
+   }
+
+   return {
+      getPayload() {
+         return resolvePublicEnv({ mode, envFilePath, processEnv, logger });
+      },
+   };
+}