web_plsql 0.18.0 → 1.2.0

package/src/handler/plsql/procedureNamed.js

@@ -21,7 +21,7 @@ import {toTable, warningMessage} from '../../util/trace.js';
  * @typedef {import('../../types.js').BindParameterConfig} BindParameterConfig
  * @typedef {import('../../types.js').BindParameter} BindParameter
  * @typedef {Record<string, string>} argsType
- * @typedef {{hitCount: number, args: argsType}} cacheEntryType
+ * @typedef {import('../../util/cache.js').Cache<argsType>} ArgumentCache
  */
 
 const SQL_GET_ARGUMENT = [
@@ -60,11 +60,6 @@ const DATA_TYPES = Object.freeze({
 	//	REF CURSOR
 });
 
-// NOTE: Consider using a separate cache for each database pool to avoid possible conflicts.
-/** @type {Map<string, cacheEntryType>} */
-const ARGS_CACHE = new Map();
-const ARGS_CACHE_MAX_COUNT = 10000;
-
 /**
  *	Retrieve the argument types for a given procedure to be executed.
  *	This is important because if the procedure is defined to take a PL/SQL indexed table,
@@ -88,22 +83,28 @@ const loadArguments = async (procedure, databaseConnection) => {
 	try {
 		result = await databaseConnection.execute(SQL_GET_ARGUMENT, bind);
 	} catch (err) {
+		/* v8 ignore start */
 		debug('result', result);
+		/* v8 ignore stop */
+
 		const message = `Error when retrieving arguments\n${SQL_GET_ARGUMENT}\n${errorToString(err)}`;
 		throw new RequestError(message);
 	}
 
-	/** @type {{names: string[], types: string[]}} */
+	/** @type {{names: (string | null)[], types: (string | null)[]}} */
 	let data;
 	try {
 		data = z
 			.object({
-				names: z.array(z.string()),
-				types: z.array(z.string()),
+				names: z.array(z.string().nullable()),
+				types: z.array(z.string().nullable()),
 			})
 			.parse(result.outBinds);
 	} catch (err) {
+		/* v8 ignore start */
 		debug('result.outBinds', result.outBinds);
+		/* v8 ignore stop */
+
 		const message = `Error when decoding arguments\n${SQL_GET_ARGUMENT}\n${errorToString(err)}`;
 		throw new RequestError(message);
 	}
@@ -115,71 +116,52 @@ const loadArguments = async (procedure, databaseConnection) => {
 	/** @type {Record<string, string>} */
 	const argTypes = {};
 	for (let i = 0; i < data.names.length; i++) {
-		argTypes[data.names[i].toLowerCase()] = data.types[i];
+		const name = data.names[i];
+		const type = data.types[i];
+		if (name && type) {
+			argTypes[name.toLowerCase()] = type;
+		}
 	}
 
 	return argTypes;
 };
 
-/**
- *	Remove the cache entries with the lowest hitCount.
- *	@param {number} count - Number of entries to remove
- *	@returns {void}
- */
-const removeLowestHitCountEntries = (count) => {
-	// Convert cache entries to an array
-	const entries = Array.from(ARGS_CACHE.entries());
-
-	// Sort entries by hitCount in ascending order
-	entries.sort((a, b) => a[1].hitCount - b[1].hitCount);
-
-	// Get the keys of the `count` entries with the lowest hitCount
-	const keysToRemove = entries.slice(0, count).map(([key]) => key);
-
-	// Remove these entries from the cache
-	for (const key of keysToRemove) {
-		ARGS_CACHE.delete(key);
-	}
-};
-
 /**
  *	Find the argument types for a given procedure to be executed.
  *	As the arguments are cached, we first look up the cache and only if not yet available we load them.
  *	@param {string} procedure - The procedure
  *	@param {Connection} databaseConnection - The database connection
+ *	@param {ArgumentCache} argumentCache - The argument cache.
  *	@returns {Promise<argsType>} - The argument types
  */
-const findArguments = async (procedure, databaseConnection) => {
+const findArguments = async (procedure, databaseConnection, argumentCache) => {
 	const key = procedure.toUpperCase();
 
 	// lookup in the cache
-	const cacheEntry = ARGS_CACHE.get(key);
+	const cachedArgs = argumentCache.get(key);
 
-	// if we fount the procedure in the cache, we increase the hit cound and return
-	if (cacheEntry) {
-		cacheEntry.hitCount++;
+	// if we found the procedure in the cache, we return it
+	if (cachedArgs) {
+		/* v8 ignore start */
 		if (debug.enabled) {
-			debug(`findArguments: procedure "${procedure}" found in cache with "${cacheEntry.hitCount}" hits`);
+			debug(`findArguments: procedure "${procedure}" found in cache`);
 		}
-		return cacheEntry.args;
-	}
+		/* v8 ignore stop */
 
-	// if the cache is full, we remove the 1000 least used cache entries
-	if (ARGS_CACHE.size > ARGS_CACHE_MAX_COUNT) {
-		if (debug.enabled) {
-			debug(`findArguments: cache is full. size=${ARGS_CACHE.size} max=${ARGS_CACHE_MAX_COUNT}`);
-		}
-		removeLowestHitCountEntries(1000);
+		return cachedArgs;
 	}
 
 	// load from database
+	/* v8 ignore start */
 	if (debug.enabled) {
 		debug(`findArguments: procedure "${procedure}" not found in cache and must be loaded`);
 	}
+	/* v8 ignore stop */
+
 	const args = await loadArguments(procedure, databaseConnection);
 
 	// add to the cache
-	ARGS_CACHE.set(key, {hitCount: 0, args});
+	argumentCache.set(key, args);
 
 	return args;
 };
@@ -238,7 +220,7 @@ export const getBinding = (argName, argValue, argType) => {
  */
 const inspectBindings = (argObj, argTypes) => {
 	const rows = Object.entries(argObj).map(([key, value]) => {
-		return [key, value.toString(), typeof value, argTypes[key.toLowerCase()]];
+		return [key, value.toString(), typeof value, argTypes[key.toLowerCase()] ?? 'unknown'];
 	});
 
 	const {text} = toTable(['id', 'value', 'value type', 'argument type'], rows);
@@ -252,13 +234,14 @@ const inspectBindings = (argObj, argTypes) => {
  *	@param {string} procName - The procedure to execute
  *	@param {argObjType} argObj - The arguments to pass to the procedure
  *	@param {Connection} databaseConnection - The database connection
+ *	@param {ArgumentCache} argumentCache - The argument cache.
  *	@returns {Promise<{sql: string; bind: BindParameterConfig}>} - The SQL statement and bindings for the procedure to execute
  */
-export const getProcedureNamed = async (req, procName, argObj, databaseConnection) => {
+export const getProcedureNamed = async (req, procName, argObj, databaseConnection, argumentCache) => {
 	debug(`getProcedureNamed: ${procName} arguments=`, argObj);
 
 	// get the types of the arguments
-	const argTypes = await findArguments(procName, databaseConnection);
+	const argTypes = await findArguments(procName, databaseConnection, argumentCache);
 
 	/** @type {string[]} */
 	const sqlParameter = [];
@@ -288,10 +271,12 @@ export const getProcedureNamed = async (req, procName, argObj, databaseConnectio
 	// select statement
 	const sql = `${procName}(${sqlParameter.join(', ')})`;
 
+	/* v8 ignore start */
 	if (debug.enabled) {
 		debug(sql);
 		debug(inspectBindings(argObj, argTypes));
 	}
+	/* v8 ignore stop */
 
 	return {sql, bind: bindings};
 };

package/src/handler/plsql/procedureSanitize.js

@@ -16,17 +16,93 @@ import {errorToString} from '../../util/errorToString.js';
  * @typedef {import('../../types.js').environmentType} environmentType
  * @typedef {import('../../types.js').configPlSqlHandlerType} configPlSqlHandlerType
  * @typedef {import('../../types.js').BindParameterConfig} BindParameterConfig
+ * @typedef {import('../../util/cache.js').Cache<string>} ProcedureNameCache
  */
 
 const DEFAULT_EXCLUSION_LIST = ['sys.', 'dbms_', 'utl_', 'owa_', 'htp.', 'htf.', 'wpg_docload.', 'ctxsys.', 'mdsys.'];
 
-// NOTE: Consider using a separate cache for each database pool to avoid possible conflicts.
+import {Cache} from '../../util/cache.js';
+/** @type {Cache<{valid: boolean}>} */
+const validationFunctionCache = new Cache();
+
 /**
- * @typedef {{hitCount: number, valid: boolean}} cacheEntryType
+ * Resolve the procedure name using dbms_utility.name_resolve.
+ *
+ * @param {string} procName - The procedure name to resolve.
+ * @param {Connection} databaseConnection - The database connection.
+ * @param {ProcedureNameCache} procedureNameCache - The procedure name cache.
+ * @returns {Promise<string>} - The resolved canonical procedure name (SCHEMA.NAME).
  */
-/** @type {Map<string, cacheEntryType>} */
-const REQUEST_VALIDATION_FUNCTION_CACHE = new Map();
-const REQUEST_VALIDATION_FUNCTION_CACHE_MAX_COUNT = 10000;
+const resolveProcedureName = async (procName, databaseConnection, procedureNameCache) => {
+	// Check cache
+	const cachedName = procedureNameCache.get(procName);
+	if (cachedName) {
+		debug(`resolveProcedureName: Cache hit for "${procName}" -> "${cachedName}"`);
+		return cachedName;
+	}
+
+	debug(`resolveProcedureName: Cache miss for "${procName}". Resolving in DB...`);
+
+	const sql = `
+		DECLARE
+			l_schema VARCHAR2(128);
+			l_part1  VARCHAR2(128);
+			l_part2  VARCHAR2(128);
+			l_dblink VARCHAR2(128);
+			l_part1_type NUMBER;
+			l_object_number NUMBER;
+		BEGIN
+			dbms_utility.name_resolve(
+				name => :name,
+				context => 1,
+				schema => l_schema,
+				part1 => l_part1,
+				part2 => l_part2,
+				dblink => l_dblink,
+				part1_type => l_part1_type,
+				object_number => l_object_number
+			);
+			
+			-- Reconstruct the canonical name
+			-- If it's a package procedure: schema.package.procedure
+			-- If it's a standalone procedure: schema.procedure
+			
+			IF l_part1 IS NOT NULL THEN
+				:resolved := l_schema || '.' || l_part1 || '.' || l_part2;
+			ELSE
+				:resolved := l_schema || '.' || l_part2;
+			END IF;
+		END;
+	`;
+
+	const bind = {
+		name: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: procName},
+		resolved: {dir: oracledb.BIND_OUT, type: oracledb.STRING, maxSize: 400},
+	};
+
+	try {
+		const result = await databaseConnection.execute(sql, bind);
+		const {resolved} = z.object({resolved: z.string()}).parse(result.outBinds);
+
+		if (!resolved) {
+			throw new RequestError(`Could not resolve procedure name "${procName}"`);
+		}
+
+		debug(`resolveProcedureName: Resolved "${procName}" -> "${resolved}"`);
+
+		// Update cache
+		procedureNameCache.set(procName, resolved);
+
+		return resolved;
+	} catch (err) {
+		/* v8 ignore start */
+		debug(`resolveProcedureName: Error resolving "${procName}"`, err);
+		/* v8 ignore stop */
+
+		// Rethrow as RequestError to indicate 404/403
+		throw new RequestError(`Procedure "${procName}" not found or not accessible.\n${errorToString(err)}`);
+	}
+};
 
 /**
  * Sanitize the procedure name.
@@ -34,22 +110,26 @@ const REQUEST_VALIDATION_FUNCTION_CACHE_MAX_COUNT = 10000;
  * @param {string} procName - The procedure name.
  * @param {Connection} databaseConnection - The database connection
  * @param {configPlSqlHandlerType} options - the options for the middleware.
+ * @param {ProcedureNameCache} procedureNameCache - The procedure name cache.
  * @returns {Promise<string>} Promise resolving to final procedure name.
  */
-export const sanitizeProcName = async (procName, databaseConnection, options) => {
+export const sanitizeProcName = async (procName, databaseConnection, options, procedureNameCache) => {
 	debug('sanitizeProcName', procName);
 
 	// make lowercase and trim
 	let finalProcName = procName.toLowerCase().trim();
 
-	// remove special characters
+	// remove special characters (basic sanity check before DB call)
 	finalProcName = removeSpecialCharacters(finalProcName);
 
 	// check for default exclusions
 	for (const i of DEFAULT_EXCLUSION_LIST) {
 		if (finalProcName.startsWith(i)) {
 			const error = `Procedure name "${procName}" is in default exclusion list "${DEFAULT_EXCLUSION_LIST.join(',')}"`;
+			/* v8 ignore start */
 			debug(error);
+			/* v8 ignore stop */
+
 			throw new RequestError(error);
 		}
 	}
@@ -59,7 +139,10 @@ export const sanitizeProcName = async (procName, databaseConnection, options) =>
 		for (const i of options.exclusionList) {
 			if (finalProcName.startsWith(i)) {
 				const error = `Procedure name "${procName}" is in custom exclusion list "${options.exclusionList.join(',')}"`;
+				/* v8 ignore start */
 				debug(error);
+				/* v8 ignore stop */
+
 				throw new RequestError(error);
 			}
 		}
@@ -67,15 +150,26 @@ export const sanitizeProcName = async (procName, databaseConnection, options) =>
 
 	// Check request validation function
 	if (options.requestValidationFunction && options.requestValidationFunction.length > 0) {
+		// Note: We might want to scope this cache too, but for now let's focus on the procedure name cache.
+		// The original code used a global cache for this.
+		// For strict correctness, we should probably verify the *resolved* name,
+		// but legacy behavior checks the input name.
 		const valid = await requestValidationFunction(finalProcName, options.requestValidationFunction, databaseConnection);
 		if (!valid) {
 			const error = `Procedure name "${procName}" is not valid according to the request validation function "${options.requestValidationFunction}"`;
+			/* v8 ignore start */
 			debug(error);
+			/* v8 ignore stop */
+
 			throw new RequestError(error);
 		}
 	}
 
-	return finalProcName;
+	// NEW: Resolve the procedure name against the database
+	// This prevents SQL injection and ensures the procedure exists
+	const resolvedName = await resolveProcedureName(finalProcName, databaseConnection, procedureNameCache);
+
+	return resolvedName;
 };
 
 /**
@@ -127,7 +221,10 @@ const loadRequestValid = async (procName, requestValidationFunction, databaseCon
 	try {
 		result = await databaseConnection.execute(SQL, bind);
 	} catch (err) {
+		/* v8 ignore start */
 		debug('result', result);
+		/* v8 ignore stop */
+
 		const message = `Error when validating procedure name "${procName}"\n${SQL}\n${errorToString(err)}`;
 		throw new RequestError(message);
 	}
@@ -136,33 +233,15 @@ const loadRequestValid = async (procName, requestValidationFunction, databaseCon
 		const data = z.strictObject({valid: z.number()}).parse(result.outBinds);
 		return data.valid === 1;
 	} catch (err) {
+		/* v8 ignore start */
 		debug('result', result.outBinds);
+		/* v8 ignore stop */
+
 		const message = `Internal error when parsing ${result.outBinds}\n${errorToString(err)}`;
 		throw new Error(message);
 	}
 };
 
-/**
- *	Remove the cache entries with the lowest hitCount.
- *	@param {number} count - Number of entries to remove
- *	@returns {void}
- */
-const removeLowestHitCountEntries = (count) => {
-	// Convert cache entries to an array
-	const entries = Array.from(REQUEST_VALIDATION_FUNCTION_CACHE.entries());
-
-	// Sort entries by hitCount in ascending order
-	entries.sort((a, b) => a[1].hitCount - b[1].hitCount);
-
-	// Get the keys of the `count` entries with the lowest hitCount
-	const keysToRemove = entries.slice(0, count).map(([key]) => key);
-
-	// Remove these entries from the cache
-	for (const key of keysToRemove) {
-		REQUEST_VALIDATION_FUNCTION_CACHE.delete(key);
-	}
-};
-
 /**
  * Request validation function.
  *
@@ -175,37 +254,33 @@ const requestValidationFunction = async (procName, requestValidationFunction, da
 	debug('requestValidationFunction', procName, requestValidationFunction);
 
 	// calculate the key
-	//const key = `${databaseConnection.connectString}_${databaseConnection.user}_${procName.toLowerCase()}`;
 	const key = procName.toLowerCase();
 
 	// lookup in the cache
-	const cacheEntry = REQUEST_VALIDATION_FUNCTION_CACHE.get(key);
+	const cacheEntry = validationFunctionCache.get(key);
 
-	// if we fount the procedure in the cache, we increase the hit cound and return
-	if (cacheEntry) {
-		cacheEntry.hitCount++;
+	// if we found the procedure in the cache, we return it (hitCount already incremented by get)
+	if (cacheEntry !== undefined) {
+		/* v8 ignore start */
 		if (debug.enabled) {
-			debug(`findArguments: procedure "${procName}" found in cache with "${cacheEntry.hitCount}" hits`);
+			debug(`requestValidationFunction: procedure "${procName}" found in cache`);
 		}
-		return cacheEntry.valid;
-	}
+		/* v8 ignore stop */
 
-	// if the cache is full, we remove the 1000 least used cache entries
-	if (REQUEST_VALIDATION_FUNCTION_CACHE.size > REQUEST_VALIDATION_FUNCTION_CACHE_MAX_COUNT) {
-		if (debug.enabled) {
-			debug(`findArguments: cache is full. size=${REQUEST_VALIDATION_FUNCTION_CACHE.size} max=${REQUEST_VALIDATION_FUNCTION_CACHE_MAX_COUNT}`);
-		}
-		removeLowestHitCountEntries(1000);
+		return cacheEntry.valid;
 	}
 
 	// load from database
+	/* v8 ignore start */
 	if (debug.enabled) {
-		debug(`findArguments: procedure "${procName}" not found in cache and must be loaded`);
+		debug(`requestValidationFunction: procedure "${procName}" not found in cache and must be loaded`);
 	}
+	/* v8 ignore stop */
+
 	const valid = await loadRequestValid(procName, requestValidationFunction, databaseConnection);
 
 	// add to the cache
-	REQUEST_VALIDATION_FUNCTION_CACHE.set(key, {hitCount: 0, valid});
+	validationFunctionCache.set(key, {valid});
 
 	return valid;
 };

package/src/handler/plsql/procedureVariable.js

@@ -18,15 +18,17 @@ import oracledb from 'oracledb';
 
 /**
  *	Get the sql statement and bindings for the procedure to execute for a variable number of arguments
- *	@param {Request} req - The req object represents the HTTP request. (only used for debugging)
+ *	@param {Request} _req - The req object represents the HTTP request. (only used for debugging)
  *	@param {string} procName - The procedure to execute
  *	@param {argObjType} argObj - The arguments to pass to the procedure
  *	@returns {{sql: string; bind: BindParameterConfig}} - The SQL statement and bindings for the procedure to execute
  */
-export const getProcedureVariable = (req, procName, argObj) => {
+export const getProcedureVariable = (_req, procName, argObj) => {
+	/* v8 ignore start */
 	if (debug.enabled) {
 		debug(`getProcedureVariable: ${procName} arguments=`, argObj);
 	}
+	/* v8 ignore stop */
 
 	const names = [];
 	const values = [];

package/src/handler/plsql/request.js

@@ -19,6 +19,8 @@ import {isStringOrArrayOfString} from '../../util/type.js';
  * @typedef {import('oracledb').Connection} Connection
  * @typedef {import('../../types.js').argObjType} argObjType
  * @typedef {import('../../types.js').configPlSqlHandlerType} configPlSqlHandlerType
+ * @typedef {import('../../util/cache.js').Cache<string>} ProcedureNameCache
+ * @typedef {import('../../util/cache.js').Cache<import('./procedureNamed.js').argsType>} ArgumentCache
  */
 
 /**
@@ -28,9 +30,11 @@ import {isStringOrArrayOfString} from '../../util/type.js';
  * @param {Response} res - The res object represents the HTTP response that an Express app sends when it gets an HTTP request.
  * @param {configPlSqlHandlerType} options - the options for the middleware.
  * @param {Pool} connectionPool - The connection pool.
+ * @param {ProcedureNameCache} procedureNameCache - The procedure name cache.
+ * @param {ArgumentCache} argumentCache - The argument cache.
  * @returns {Promise<void>} - Promise resolving to th page
  */
-export const processRequest = async (req, res, options, connectionPool) => {
+export const processRequest = async (req, res, options, connectionPool, procedureNameCache, argumentCache) => {
 	debug('processRequest: ENTER');
 
 	//
@@ -65,7 +69,7 @@ export const processRequest = async (req, res, options, connectionPool) => {
 	debug('processRequest: argObj=', argObj);
 
 	// invoke the Oracle procedure and get the page contenst
-	await invokeProcedure(req, res, argObj, cgiObj, filesToUpload, options, connection);
+	await invokeProcedure(req, res, argObj, cgiObj, filesToUpload, options, connection, procedureNameCache, argumentCache);
 
 	// transaction mode
 	if (options.transactionMode === 'rollback') {
@@ -73,7 +77,8 @@ export const processRequest = async (req, res, options, connectionPool) => {
 		await connection.rollback();
 	} else if (typeof options.transactionMode === 'function') {
 		debug('transactionMode: callback');
-		const result = options.transactionMode(connection, Array.isArray(req.params.name) ? req.params.name[0] : req.params.name);
+		const procName = Array.isArray(req.params.name) ? req.params.name[0] : req.params.name;
+		const result = options.transactionMode(connection, procName ?? '');
 		debug('transactionMode: callback restult', result);
 		if (result && typeof result.then === 'function') {
 			await result;

package/src/handler/plsql/sendResponse.js

@@ -18,30 +18,34 @@ import {getBlock} from '../../util/trace.js';
 
 /**
  *	Send "default" response to the browser
- *	@param {Request} req - The req object represents the HTTP request.
+ *	@param {Request} _req - The req object represents the HTTP request.
  *	@param {Response} res - The res object represents the HTTP response that an Express app sends when it gets an HTTP request.
  *	@param {pageType} page - The page to send.
  *	@returns {Promise<void>}
  */
-export const sendResponse = async (req, res, page) => {
+export const sendResponse = async (_req, res, page) => {
 	/** @type {string[]} */
 	const debugText = [];
 
 	// Send the "cookies"
 	page.head.cookies.forEach((cookie) => {
+		/* v8 ignore start */
 		if (debug.enabled) {
 			debugText.push(`res.cookie: name="${cookie.name}" value="${cookie.value}" options=${JSON.stringify(cookie.options)}`);
 		}
+		/* v8 ignore stop */
 
 		res.cookie(cookie.name, cookie.value, cookie.options);
 	});
 
 	// If there is a "redirectLocation" header, we immediately redirect and return
 	if (typeof page.head.redirectLocation === 'string' && page.head.redirectLocation.length > 0) {
+		/* v8 ignore start */
 		if (debug.enabled) {
 			debugText.push(`res.redirect(302, "${page.head.redirectLocation}")`);
 			debug(getBlock('RESPONSE', debugText.join('\n')));
 		}
+		/* v8 ignore stop */
 
 		res.redirect(302, page.head.redirectLocation);
 		return;
@@ -49,9 +53,11 @@ export const sendResponse = async (req, res, page) => {
 
 	// Send all the "otherHeaders"
 	for (const key in page.head.otherHeaders) {
+		/* v8 ignore start */
 		if (debug.enabled) {
 			debugText.push(`res.set("${key}", "${page.head.otherHeaders[key]}")`);
 		}
+		/* v8 ignore stop */
 
 		res.set(key, page.head.otherHeaders[key]);
 	}
@@ -70,18 +76,23 @@ export const sendResponse = async (req, res, page) => {
 		}
 
 		if (Object.keys(headers).length > 0) {
+			/* v8 ignore start */
 			if (debug.enabled) {
 				debugText.push(`res.writeHead(200, ${JSON.stringify(headers)})`);
 			}
+			/* v8 ignore stop */
+
 			res.writeHead(200, headers);
 		}
 
 		// Check if fileBlob is a stream
 		if (page.file.fileBlob instanceof stream.Readable) {
+			/* v8 ignore start */
 			if (debug.enabled) {
 				debugText.push(`res.pipe("${page.file.fileType}") - streaming`);
 				debug(getBlock('RESPONSE', debugText.join('\n')));
 			}
+			/* v8 ignore stop */
 
 			/** @type {Promise<void>} */
 			const streamComplete = new Promise((resolve, reject) => {
@@ -96,10 +107,12 @@ export const sendResponse = async (req, res, page) => {
 			});
 			await streamComplete;
 		} else {
+			/* v8 ignore start */
 			if (debug.enabled) {
 				debugText.push(`res.end("${page.file.fileType}") - buffer`);
 				debug(getBlock('RESPONSE', debugText.join('\n')));
 			}
+			/* v8 ignore stop */
 
 			res.end(page.file.fileBlob, 'binary');
 		}
@@ -108,29 +121,54 @@ export const sendResponse = async (req, res, page) => {
 
 	// Is the a "contentType" header
 	if (typeof page.head.contentType === 'string' && page.head.contentType.length > 0) {
+		/* v8 ignore start */
 		if (debug.enabled) {
 			debugText.push(`res.set("Content-Type", "${page.head.contentType}")`);
 		}
+		/* v8 ignore stop */
 
 		res.set('Content-Type', page.head.contentType);
 	}
 
 	// If we have a "Status" header, we send the header and then return.
 	if (typeof page.head.statusCode === 'number') {
+		/* v8 ignore start */
 		if (debug.enabled) {
 			debugText.push(`res.status(page.head.statusCode).send("${page.head.statusDescription}")`);
 			debug(getBlock('RESPONSE', debugText.join('\n')));
 		}
+		/* v8 ignore stop */
 
 		res.status(page.head.statusCode).send(page.head.statusDescription);
 		return;
 	}
 
 	// Send the body
+	/* v8 ignore start */
 	if (debug.enabled) {
-		debugText.push(`${'-'.repeat(60)}\n${page.body}`);
+		if (page.body instanceof stream.Readable) {
+			debugText.push(`${'-'.repeat(60)}\n[Stream Body]`);
+		} else {
+			debugText.push(`${'-'.repeat(60)}\n${page.body}`);
+		}
 		debug(getBlock('RESPONSE', debugText.join('\n')));
 	}
-
-	res.send(page.body);
+	/* v8 ignore stop */
+
+	if (page.body instanceof stream.Readable) {
+		/** @type {Promise<void>} */
+		const streamComplete = new Promise((resolve, reject) => {
+			if (page.body instanceof stream.Readable) {
+				page.body.pipe(res);
+				page.body.on('end', () => resolve());
+				/* v8 ignore next - error handler */
+				page.body.on('error', (/** @type {Error} */ err) => reject(err));
+				/* v8 ignore next - error handler */
+				res.on('close', () => resolve());
+			}
+		});
+		await streamComplete;
+	} else {
+		res.send(page.body);
+	}
 };

package/src/index.js

@@ -11,7 +11,6 @@ export * from './util/shutdown.js';
 export {handlerWebPlSql} from './handler/plsql/handlerPlSql.js';
 export {handlerLogger} from './handler/handlerLogger.js';
 export {handlerUpload} from './handler/handlerUpload.js';
-export {handlerMetrics} from './handler/handlerMetrics.js';
 
 // oracle
 export * from './util/oracle.js';

package/src/server/adminContext.js

@@ -0,0 +1,23 @@
+import {StatsManager} from '../util/statsManager.js';
+
+/**
+ * @typedef {import('oracledb').Pool} Pool
+ * @typedef {import('../types.js').configType} configType
+ * @typedef {import('../handler/plsql/procedureNamed.js').argsType} argsType
+ * @typedef {import('../util/cache.js').Cache<unknown>} Cache
+ */
+
+/**
+ * Global Admin Context
+ */
+export const AdminContext = {
+	startTime: new Date(),
+	/** @type {configType | null} */
+	config: null,
+	/** @type {Pool[]} */
+	pools: [],
+	/** @type {Array<{poolName: string, procedureNameCache: Cache, argumentCache: Cache}>} */
+	caches: [],
+	paused: false,
+	statsManager: new StatsManager(),
+};