turbo-express-js 1.0.11 → 1.0.12

package/changelog.md

@@ -17,4 +17,8 @@
 
 # 1.0.9 - 1.0.10
   1. [25/4/2025] update clusters, 0 argument mean no clusters.
-  2. [25/4/2025] first typescript support
+  2. [25/4/2025] first typescript support
+
+# 1.0.12
+  1. cors middleware
+  2. formdata service fixing default get data

package/index.test.js

@@ -6,6 +6,9 @@ const app = new TurboExpress();
 
 // console.log("testing development...")
 
-app.get("asd", ()=>{  })
+app.get("/", ()=>{  })
+app.post("/test", TurboExpress.Cors({ origins: ["*"] }), async (req, res) => {
+    res.json({ query: req.queriesObj(), params: req.paramsObj(), body: await req.body() })
+})
 
-app.listen(3001, () => console.log("Service is running"));
+app.listen(3000, () => console.log("Service is running"));

package/lib/middlewares/cors_middleware.js

@@ -4,7 +4,7 @@
  * @PerfecTEvolutioN
  * @project - TurboExpress
  * @name TurboExpress
- * @namespace TurboExpress::middlewares::static_middleware
+ * @namespace TurboExpress::middlewares::cors_middleware
  * @license - MIT
  * @author - Mike Karypidis
  * @version - 1.0.0
@@ -23,14 +23,34 @@ const ResponseInterface = require("../types/ResponseInterface");
 * @param {ResponseInterface} res 
 * @param {*} next 
 */
-module.exports = function cors_middleware (req, res, next) 
+module.exports = function cors_middleware(req, res, next)
 {
-  const { origins, methods, credentials, headers } = this;
+  const config = this || {};
+  const origins = Array.isArray(config.origins) && config.origins.length ? config.origins : ["*"];
+  const methods = Array.isArray(config.methods) && config.methods.length ? config.methods : ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE", "OPTIONS"];
+  const headers = Array.isArray(config.headers) ? config.headers : [];
+  const credentials = config.credentials === true;
+  const maxAge = Number.isSafeInteger(config.maxAge) ? config.maxAge : 3600;
+
+  const requestHeaders = req.headers();
+  const requestOrigin = requestHeaders.origin;
+  const requestedHeaders = requestHeaders["access-control-request-headers"];
+  const requestMethod = String(req.IncomingMessage?.method || "GET").toUpperCase();
+  const wildcard = origins.includes("*");
+
+  if(requestOrigin && !wildcard && !origins.includes(requestOrigin)) return next();
+
+  if(wildcard && !credentials) {
+    res.header("Access-Control-Allow-Origin", "*");
+  } else if(requestOrigin) {
+    res.header("Access-Control-Allow-Origin", requestOrigin);
+    res.header("Vary", "Origin");
+  }
+
+  if(credentials) res.header("Access-Control-Allow-Credentials", "true");
 
-  res.header("Access-Control-Allow-Origin", origins.join(","));
-  res.header("Access-Control-Allow-Credentials", credentials);
   res.header("Access-Control-Allow-Methods", methods.join(","));
-  res.header("Access-Control-Max-Age", 3600);
+  res.header("Access-Control-Max-Age", String(maxAge));
 
   let allowedHeaders = "";
   const headers_req = req.headers();
@@ -45,6 +65,10 @@ module.exports = function cors_middleware (req, res, next)
     0, (allowedHeaders + headers.join(",")).length - 1
   ));
 
-  next();
+  if(requestMethod === "OPTIONS") {
+    res.status(204);
+    return res.send("");
+  }
 
+  return next();
 }

package/lib/services/FormDataService.js

@@ -19,6 +19,10 @@
 const multiparty = require("multiparty")
 const FileType = require("../types/FileType");
 
+const INTEGER_PATTERN = /^-?(?:0|[1-9]\d*)$/;
+const DECIMAL_PATTERN = /^-?(?:0|[1-9]\d*)\.\d+(?:[eE][+-]?\d+)?$/;
+const SCIENTIFIC_PATTERN = /^-?(?:0|[1-9]\d*)(?:\.\d+)?[eE][+-]?\d+$/;
+const MAX_JSON_FIELD_LENGTH = 1024 * 1024; // 1 MB
 
 module.exports = class FormDataService
 {
@@ -71,16 +75,110 @@ module.exports = class FormDataService
   }
 
 
-  #getValueByType (value)
+  #getValueByType(value)
   {
-    if(typeof value !== "string") return null
-    if(value.toLowerCase() === "true") return true;
-    if(value.toLowerCase() === "false") return false;
-    if(value.toLowerCase() === "nil" || value.toLowerCase() === "null") return null;
-    if(!isNaN(Number(value))) return Number(value);
+    // Multiparty normally returns strings, but do not destroy
+    // unexpected values if its behavior changes in the future.
+    if (typeof value !== "string") {
+      return value;
+    }
+
+    // Preserve empty strings and whitespace exactly.
+    if (value === "" || value.trim() === "") {
+      return value;
+    }
+
+    // Do not trim before conversion. Whitespace may be meaningful.
+    if (value !== value.trim()) {
+      return value;
+    }
+
+    const normalized = value.toLowerCase();
+
+    switch (normalized) {
+      case "true":
+        return true;
+
+      case "false":
+        return false;
+
+      case "null":
+      case "nil":
+        return null;
+
+      default:
+        break;
+    }
+
+    // Strict integer conversion.
+    if (INTEGER_PATTERN.test(value)) {
+      const parsed = Number(value);
+
+      // Prevent database identifiers and large integers from being corrupted.
+      if (!Number.isSafeInteger(parsed)) {
+        return value;
+      }
+
+      // "-0" has special behavior in JavaScript; preserve it as entered.
+      if (Object.is(parsed, -0)) {
+        return value;
+      }
+
+      return parsed;
+    }
+
+    // Strict decimal and scientific-notation conversion.
+    if (
+      DECIMAL_PATTERN.test(value) ||
+      SCIENTIFIC_PATTERN.test(value)
+    ) {
+      const parsed = Number(value);
+
+      if (!Number.isFinite(parsed)) {
+        return value;
+      }
+
+      // Avoid converting high-precision decimal values that Number
+      // cannot represent reliably.
+      if (this.#countSignificantDigits(value) > 15) {
+        return value;
+      }
+
+      return parsed;
+    }
+
+    // Parse explicitly structured JSON values.
+    if (
+      value.length <= MAX_JSON_FIELD_LENGTH &&
+      (
+        (value.startsWith("{") && value.endsWith("}")) ||
+        (value.startsWith("[") && value.endsWith("]"))
+      )
+    ) {
+      try {
+        return JSON.parse(value);
+      } catch {
+        // Invalid JSON remains the original string.
+        return value;
+      }
+    }
+
+    // Dates, UUIDs, AFMs, phone numbers, postal codes,
+    // hexadecimal values and ordinary text remain strings.
     return value;
   }
 
+  #countSignificantDigits(value)
+  {
+    const coefficient = value
+      .replace(/^[+-]/, "")
+      .split(/[eE]/, 1)[0]
+      .replace(".", "")
+      .replace(/^0+/, "");
+
+    return coefficient.length;
+  }
+
 }
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turbo-express-js",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "description": "Turbo Express JS - Performance, Security, Easy-to-use Web Server Framework",
   "main": "index.js",
   "directories": {