weifuwu 0.25.2 → 0.27.1

package/core/cookie.ts

@@ -0,0 +1,114 @@
+/** Options for setting a cookie. All fields map to standard Set-Cookie attributes. */
+export interface CookieOptions {
+  domain?: string
+  path?: string
+  maxAge?: number
+  expires?: Date
+  httpOnly?: boolean
+  secure?: boolean
+  sameSite?: 'strict' | 'lax' | 'none'
+}
+
+/** Parse cookies from a Request's `Cookie` header.
+ *
+ * @example
+ * ```ts
+ * const cookies = getCookies(req)
+ * console.log(cookies.session_id) // value or undefined
+ * ``` */
+export function getCookies(req: Request): Record<string, string> {
+  const header = req.headers.get('cookie')
+  if (!header) return {}
+
+  const cookies: Record<string, string> = {}
+  for (const pair of header.split(';')) {
+    const idx = pair.indexOf('=')
+    if (idx === -1) continue
+    let name = pair.slice(0, idx).trim()
+    let value = pair.slice(idx + 1).trim()
+    if (!name) continue
+    // Decode cookie name (consistent with value)
+    try {
+      name = decodeURIComponent(name)
+    } catch {}
+    // Strip surrounding quotes from value (RFC 6265)
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1)
+    }
+    try {
+      cookies[name] = decodeURIComponent(value)
+    } catch {
+      cookies[name] = value
+    }
+  }
+  return cookies
+}
+
+function serializeCookie(name: string, value: string, options?: CookieOptions): string {
+  // Reject control characters and special chars per RFC 6265
+  // eslint-disable-next-line no-control-regex
+  if (/[\x00-\x1F\x7F-\x9F;,]/.test(name) || /[\x00-\x1F\x7F-\x9F;,]/.test(value)) {
+    throw new Error(`Invalid cookie name or value: contains control characters or special chars`)
+  }
+  const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`]
+  if (options?.maxAge != null) parts.push(`Max-Age=${options.maxAge}`)
+  if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`)
+  if (options?.domain) parts.push(`Domain=${options.domain}`)
+  if (options?.path) parts.push(`Path=${options.path}`)
+  if (options?.httpOnly) parts.push('HttpOnly')
+  if (options?.secure) parts.push('Secure')
+  if (options?.sameSite) parts.push(`SameSite=${options.sameSite}`)
+  return parts.join('; ')
+}
+
+/** Set a cookie on a Response.
+ *
+ * Appends a `Set-Cookie` header to the existing response headers.
+ * Returns a new Response with the added header.
+ *
+ * @example
+ * ```ts
+ * const res = new Response('ok')
+ * return setCookie(res, 'session', token, { httpOnly: true, path: '/' })
+ * ``` */
+export function setCookie(
+  res: Response,
+  name: string,
+  value: string,
+  options?: CookieOptions,
+): Response {
+  const headers = new Headers(res.headers)
+  headers.append('Set-Cookie', serializeCookie(name, value, options))
+  return new Response(res.body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers,
+  })
+}
+
+/** Delete a cookie by setting `Max-Age=0`.
+ *
+ * @example
+ * ```ts
+ * return deleteCookie(res, 'session')
+ * ``` */
+export function deleteCookie(
+  res: Response,
+  name: string,
+  options?: Omit<CookieOptions, 'maxAge'>,
+): Response {
+  const headers = new Headers(res.headers)
+  headers.append(
+    'Set-Cookie',
+    serializeCookie(name, '', {
+      ...options,
+      maxAge: 0,
+      expires: new Date(0),
+    }),
+  )
+  return new Response(res.body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers,
+  })
+}

package/core/env.ts

@@ -0,0 +1,142 @@
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import type { Context, Middleware } from '../types.ts'
+
+/** Build-time injection from esbuild --define. `true` in dist/index.js, undefined in TS source. */
+declare let __WFW_BUNDLED__: boolean | undefined
+
+const PUBLIC_PREFIX = 'WEIFUWU_PUBLIC_'
+
+/**
+ * Get all public environment variables (those prefixed with `WEIFUWU_PUBLIC_`),
+ * with the prefix stripped.
+ *
+ * ```ts
+ * const pub = getPublicEnv()
+ * // WEIFUWU_PUBLIC_API_URL=http://api.example.com → { API_URL: 'http://api.example.com' }
+ * ```
+ */
+export function getPublicEnv(): Record<string, string> {
+  const result: Record<string, string> = {}
+  for (const [key, value] of Object.entries(process.env)) {
+    if (key.startsWith(PUBLIC_PREFIX) && value !== undefined) {
+      result[key.slice(PUBLIC_PREFIX.length)] = value
+    }
+  }
+  return result
+}
+
+// Augment Context with env property
+declare module '../types.ts' {
+  interface Context {
+    env?: Record<string, string>
+  }
+}
+
+/**
+ * Whether this code is running from the compiled `dist/index.js` bundle.
+ * `false` when running TypeScript source directly (dev workflow in weifuwu repo).
+ *
+ * Used by modules that need to resolve package-internal files differently
+ * depending on whether they are compiled (published npm package) or raw TS.
+ */
+export function isBundled(): boolean {
+  return typeof __WFW_BUNDLED__ !== 'undefined' ? __WFW_BUNDLED__ : false
+}
+
+/**
+ * Whether `NODE_ENV` is explicitly set to `'development'`.
+ *
+ * Used for dev-only features: HMR, livereload, React `createRoot` (not hydrate).
+ * **Not** the opposite of {@link isProd} — when `NODE_ENV` is unset, both return `false`.
+ */
+export function isDev(): boolean {
+  const env = process.env.NODE_ENV
+  return env !== 'production' && env !== 'test'
+}
+
+/**
+ * Whether `NODE_ENV` is explicitly set to `'production'`.
+ *
+ * Used for production-only behavior: plain-text 404, suppressed warnings, minified output.
+ */
+export function isProd(): boolean {
+  return process.env.NODE_ENV === 'production'
+}
+
+/**
+ * Load environment variables from a `.env` file into `process.env`.
+ *
+ * Does **not** override existing `process.env` values.
+ * Supports quoted values and inline comments.
+ *
+ * @param path - Path to `.env` file (default: `'.env'` relative to cwd).
+ *
+ * ```ts
+ * import { loadEnv } from 'weifuwu'
+ * loadEnv()
+ * console.log(process.env.PORT)
+ * ```
+ */
+export function loadEnv(path?: string): void {
+  const filePath = resolve(process.cwd(), path ?? '.env')
+
+  let content: string
+  try {
+    content = readFileSync(filePath, 'utf-8')
+  } catch {
+    return
+  }
+
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim()
+    if (!trimmed || trimmed.startsWith('#')) continue
+
+    const eqIdx = trimmed.indexOf('=')
+    if (eqIdx === -1) continue
+
+    const key = trimmed.slice(0, eqIdx).trim()
+    if (!key) continue
+
+    if (process.env[key] !== undefined) continue
+
+    let value = trimmed.slice(eqIdx + 1).trim()
+
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1)
+    } else {
+      // Strip inline comments: space before #, or # at start of value
+      const commentIdx = value.search(/\s#/)
+      if (commentIdx !== -1) {
+        value = value.slice(0, commentIdx).trimEnd()
+      }
+    }
+
+    process.env[key] = value
+  }
+}
+
+/**
+ * Public env middleware.
+ *
+ * Injects `ctx.env` with all environment variables prefixed with `WEIFUWU_PUBLIC_`,
+ * with the prefix stripped. Safe to expose to the client.
+ *
+ * ```ts
+ * import { env } from 'weifuwu'
+ * app.use(env())
+ *
+ * // .env:  WEIFUWU_PUBLIC_API_URL=https://api.example.com
+ * // ctx:   ctx.env.API_URL === 'https://api.example.com'
+ * ```
+ */
+export function env(): Middleware<Context, Context & { env: Record<string, string> }> {
+  const entries = getPublicEnv()
+  return async (req, ctx, next) => {
+    ;(ctx as Context & { env: Record<string, string> }).env = entries
+    return next(req, ctx as Context & { env: Record<string, string> })
+  }
+}

package/core/logger.ts

@@ -0,0 +1,72 @@
+/* eslint-disable no-console */
+import type { Middleware, Context } from '../types.ts'
+import { currentTraceId } from './trace.ts'
+
+export interface LoggerOptions {
+  /** 'short' = method + path + status + ms, 'combined' = short + query string, 'json' = structured stderr JSON */
+  format?: 'short' | 'combined' | 'json'
+}
+
+export interface LogEvent {
+  level: 'info' | 'warn' | 'error'
+  message: string
+  method?: string
+  path?: string
+  status?: number
+  elapsed_ms?: number
+  traceId?: string
+  timestamp?: string
+}
+
+function emit(event: LogEvent): void {
+  event.traceId = event.traceId ?? currentTraceId()
+  event.timestamp = new Date().toISOString()
+  process.stderr.write(JSON.stringify(event) + '\n')
+}
+
+export function logger(options?: LoggerOptions): Middleware<Context, Context> {
+  const format = options?.format ?? 'short'
+
+  return async (req, ctx, next) => {
+    const start = Date.now()
+    const url = new URL(req.url)
+
+    try {
+      const res = await next(req, ctx)
+      const ms = Date.now() - start
+      const pathAndQuery = format === 'combined' ? url.pathname + url.search : url.pathname
+
+      if (format === 'json') {
+        emit({
+          level: 'info',
+          message: 'request',
+          method: req.method,
+          path: pathAndQuery,
+          status: res.status,
+          elapsed_ms: ms,
+        })
+      } else {
+        console.log(`${req.method} ${pathAndQuery} ${res.status} ${ms}ms`)
+      }
+
+      return res
+    } catch (err) {
+      const ms = Date.now() - start
+      const pathAndQuery = format === 'combined' ? url.pathname + url.search : url.pathname
+
+      if (format === 'json') {
+        emit({
+          level: 'error',
+          message: err instanceof Error ? err.message : String(err),
+          method: req.method,
+          path: pathAndQuery,
+          status: 500,
+          elapsed_ms: ms,
+        })
+      } else {
+        console.log(`${req.method} ${pathAndQuery} 500 ${ms}ms`)
+      }
+      throw err
+    }
+  }
+}