weifuwu 0.27.2 → 0.27.3

package/middleware/cors.ts

@@ -1,81 +0,0 @@
-import type { Middleware, Context } from '../types.ts'
-
-/** Options for {@link cors}. */
-export interface CORSOptions {
-  /** Allowed origin(s). Default `'*'`. If `credentials: true`, reflects the request origin. */
-  origin?: string | string[] | ((origin: string) => string | boolean | undefined)
-  /** Allowed HTTP methods. Default: `GET, HEAD, PUT, PATCH, POST, DELETE`. */
-  methods?: string[]
-  /** Allowed request headers. Default: `Content-Type, Authorization`. */
-  allowedHeaders?: string[]
-  /** Exposed response headers. */
-  exposedHeaders?: string[]
-  /** Whether to expose `Access-Control-Allow-Credentials`. */
-  credentials?: boolean
-  /** `Access-Control-Max-Age` in seconds. */
-  maxAge?: number
-}
-
-/**
- * CORS middleware.
- *
- * ```ts
- * import { cors } from 'weifuwu'
- * app.use(cors({ origin: 'https://myapp.com', credentials: true }))
- * ```
- */
-export function cors(options?: CORSOptions): Middleware<Context, Context> {
-  const opts: Required<Pick<CORSOptions, 'origin' | 'methods' | 'allowedHeaders'>> & CORSOptions = {
-    origin: '*',
-    methods: ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE'],
-    allowedHeaders: ['Content-Type', 'Authorization'],
-    ...options,
-  }
-
-  function resolveOrigin(requestOrigin: string): string {
-    if (typeof opts.origin === 'string') {
-      if (opts.origin === '*') {
-        return opts.credentials ? requestOrigin : '*'
-      }
-      return opts.origin
-    }
-    if (Array.isArray(opts.origin)) {
-      return opts.origin.includes(requestOrigin) ? requestOrigin : ''
-    }
-    const result = opts.origin(requestOrigin)
-    if (typeof result === 'boolean') return result ? requestOrigin : ''
-    if (typeof result === 'string') return result
-    return ''
-  }
-
-  function setCORSHeaders(res: Response, acao: string): Response {
-    if (!acao) return res
-    const headers = new Headers(res.headers)
-    headers.set('Access-Control-Allow-Origin', acao)
-    if (opts.credentials) headers.set('Access-Control-Allow-Credentials', 'true')
-    if (opts.exposedHeaders?.length)
-      headers.set('Access-Control-Expose-Headers', opts.exposedHeaders.join(', '))
-    if (acao !== '*') headers.set('Vary', 'Origin')
-    return new Response(res.body, { status: res.status, statusText: res.statusText, headers })
-  }
-
-  return (req, ctx, next) => {
-    const requestOrigin = req.headers.get('origin') ?? ''
-    const acao = resolveOrigin(requestOrigin)
-
-    if (req.method === 'OPTIONS' && acao) {
-      const headers = new Headers()
-      headers.set('Access-Control-Allow-Origin', acao)
-      headers.set('Access-Control-Allow-Methods', opts.methods.join(', '))
-      headers.set('Access-Control-Allow-Headers', opts.allowedHeaders.join(', '))
-      if (opts.credentials) headers.set('Access-Control-Allow-Credentials', 'true')
-      if (opts.maxAge != null) headers.set('Access-Control-Max-Age', String(opts.maxAge))
-      if (acao !== '*') headers.set('Vary', 'Origin')
-      return new Response(null, { status: 204, headers })
-    }
-
-    if (!acao) return next(req, ctx)
-
-    return Promise.resolve(next(req, ctx)).then((res) => setCORSHeaders(res, acao))
-  }
-}

package/middleware/csrf.ts

@@ -1,112 +0,0 @@
-/* eslint-disable @typescript-eslint/no-explicit-any, @typescript-eslint/no-unused-vars */
-import type { Context, Middleware } from '../types.ts'
-import { getCookies, setCookie } from '../core/cookie.ts'
-
-// Augment Context with csrf property
-declare module '../types.ts' {
-  interface Context {
-    csrf: CsrfInjected
-  }
-}
-
-export interface CsrfInjected {
-  token: string
-}
-
-/** Options for {@link csrf}. */
-/** CSRF protection module — a {@link Middleware} that injects `ctx.csrf`. */
-export type CsrfModule = Middleware<Context, Context & CsrfInjected>
-
-export interface CsrfOptions {
-  /** Cookie name for CSRF token (default: `'_csrf'`). */
-  cookie?: string
-  /** Request header name for CSRF token (default: `'x-csrf-token'`). */
-  header?: string
-  /** Form body key for CSRF token (default: `'_csrf'`). */
-  key?: string
-  /** HTTP methods to exclude from CSRF protection (default: `['GET', 'HEAD', 'OPTIONS']`). */
-  excludeMethods?: string[]
-}
-
-/**
- * CSRF protection middleware.
- *
- * On excluded methods (GET, HEAD, OPTIONS), generates a token and stores it
- * in a cookie. On other methods, validates the token from header or body
- * against the cookie.
- *
- * Injects `ctx.csrf.token` for use in forms.
- *
- * ```ts
- * import { csrf } from 'weifuwu'
- * app.use(csrf())
- *
- * // In a form:
- * app.get('/form', (req, ctx) => {
- *   return new Response(`
- *     <form method="POST">
- *       <input type="hidden" name="_csrf" value="${ctx.csrf.token}" />
- *       <input type="submit" />
- *     </form>
- *   `, { headers: { 'content-type': 'text/html' } })
- * })
- * ```
- */
-export function csrf(options?: CsrfOptions): Middleware<Context, Context & CsrfInjected> {
-  const cookieName = options?.cookie ?? '_csrf'
-  const headerName = options?.header ?? 'x-csrf-token'
-  const bodyKey = options?.key ?? '_csrf'
-  const excluded = new Set(options?.excludeMethods ?? ['GET', 'HEAD', 'OPTIONS'])
-
-  const mw: Middleware<Context, Context & CsrfInjected> = async (req, ctx, next) => {
-    const method = req.method.toUpperCase()
-
-    if (excluded.has(method)) {
-      let token = getCookies(req)[cookieName]
-      if (!token) {
-        token = crypto.randomUUID()
-        ;(ctx as any).csrf = { token }
-      } else {
-        ;(ctx as any).csrf = { token }
-      }
-
-      const res = await next(req, ctx as Context & CsrfInjected)
-      const tokenToSet = (ctx as any).csrf?.token
-      if (tokenToSet && !getCookies(req)[cookieName]) {
-        return setCookie(res, cookieName, tokenToSet, {
-          httpOnly: true,
-          sameSite: 'strict',
-          path: '/',
-        })
-      }
-      return res
-    }
-
-    const cookieToken = getCookies(req)[cookieName]
-
-    let headerToken = req.headers.get(headerName) ?? ''
-    // Fallback: try to extract from request body
-    if (
-      !headerToken &&
-      (req.method === 'POST' ||
-        req.method === 'PUT' ||
-        req.method === 'PATCH' ||
-        req.method === 'DELETE')
-    ) {
-      try {
-        const body = await req.clone().json()
-        headerToken = body[bodyKey] ?? ''
-      } catch (e) {
-        return new Response('Invalid request body', { status: 400 })
-      }
-    }
-
-    if (!cookieToken || !headerToken || cookieToken !== headerToken) {
-      return new Response('CSRF token mismatch', { status: 403 })
-    }
-
-    return next(req, ctx as Context & CsrfInjected)
-  }
-  mw.__meta = { injects: ['csrf'], depends: [] }
-  return mw
-}

package/middleware/flash.ts

@@ -1,144 +0,0 @@
-/**
- * Flash message middleware.
- *
- * Provides a cookie-based flash message system:
- * - Read: `ctx.flash.value` parses the incoming flash cookie
- * - Write: `ctx.flash.set(data, location)` sets a new flash and redirects
- * - Auto-clear: after reading, the flash cookie is cleared from the response
- *
- * ```ts
- * import { flash } from 'weifuwu'
- *
- * app.use(flash())
- *
- * // Read flash
- * app.get('/', (req, ctx) => {
- *   const msg = ctx.flash.value  // e.g. { type: 'success', text: 'Saved!' }
- * })
- *
- * // Set flash + redirect
- * app.post('/save', async (req, ctx) => {
- *   await save()
- *   return ctx.flash.set({ type: 'success', text: 'Saved!' }, '/articles')
- * })
- * ```
- */
-import type { Context, Middleware } from '../types.ts'
-import { getCookies } from '../core/cookie.ts'
-
-// Augment Context with flash property
-declare module '../types.ts' {
-  interface Context {
-    flash: FlashInjected
-  }
-}
-
-/** Flash message module — a {@link Middleware} that injects `ctx.flash`. */
-export type FlashModule = Middleware<Context, Context & FlashInjected>
-
-/** Options for {@link flash}. */
-export interface FlashOptions {
-  /**
-   * Cookie name to store the flash message.
-   * @default 'flash'
-   */
-  name?: string
-}
-
-/**
- * Flash message object injected into `ctx.flash`.
- *
- * Access the current flash with `.value`, or set a new flash with `.set()`.
- * The `.value` is automatically cleared after being read.
- */
-export interface FlashInjected {
-  /**
-   * The flash value read from the incoming cookie.
-   * `undefined` if no flash cookie is present.
-   * Automatically cleared after the response is sent.
-   */
-  value: unknown
-  /**
-   * Set a flash message and return a 302 redirect response.
-   *
-   * @param data - Any JSON-serializable value to store as the flash message.
-   * @param location - Redirect location (defaults to the `Referer` header).
-   * @returns A 302 Response with a `Set-Cookie` header.
-   *
-   * ```ts
-   * return ctx.flash.set({ type: 'success', text: 'Saved!' }, '/articles')
-   * ```
-   */
-  set: (data: unknown, location?: string) => Response
-}
-
-function makeSetFlash(name: string, location: string) {
-  return (data: unknown, loc?: string) => {
-    const finalLoc = loc ?? location
-    const value = encodeURIComponent(JSON.stringify(data))
-    return new Response(null, {
-      status: 302,
-      headers: {
-        Location: finalLoc,
-        'Set-Cookie': `${name}=${value}; Path=/; SameSite=Lax`,
-      },
-    })
-  }
-}
-
-/**
- * Flash message middleware — injects `ctx.flash`.
- *
- * @param options - Cookie name configuration.
- * @returns Middleware that injects `ctx.flash` (`FlashInjected`).
- *
- * ```ts
- * app.use(flash())
- *
- * // Read
- * app.get('/', (req, ctx) => {
- *   const msg = ctx.flash.value
- * })
- *
- * // Write + redirect
- * app.post('/save', async (req, ctx) => {
- *   return ctx.flash.set({ type: 'success', text: 'Saved!' }, '/articles')
- * })
- * ```
- */
-export function flash(
-  options?: FlashOptions,
-): Middleware<Context, Context & { flash: FlashInjected }> {
-  const name = options?.name ?? 'flash'
-
-  const mw: Middleware<Context, Context & { flash: FlashInjected }> = async (req, ctx, next) => {
-    const raw = getCookies(req)[name] ?? null
-    const referer = req.headers.get('referer') || '/'
-
-    let value: unknown = undefined
-    if (raw) {
-      try {
-        value = JSON.parse(decodeURIComponent(raw))
-      } catch {
-        value = raw
-      }
-    }
-
-    ctx.flash = {
-      value,
-      set: makeSetFlash(name, referer),
-    } as FlashInjected
-
-    const res = await next(req, ctx as Context & { flash: FlashInjected })
-
-    if (raw) {
-      const headers = new Headers(res.headers)
-      headers.append('Set-Cookie', `${name}=; Path=/; Max-Age=0`)
-      return new Response(res.body, { status: res.status, statusText: res.statusText, headers })
-    }
-
-    return res
-  }
-  mw.__meta = { injects: ['flash'], depends: [] }
-  return mw
-}

package/middleware/health.ts

@@ -1,44 +0,0 @@
-import type { Handler } from '../types.ts'
-import { Router } from '../core/router.ts'
-
-/** Options for {@link health}. */
-export interface HealthOptions {
-  /** Health check endpoint path (default: `'/__health'`). */
-  path?: string
-  /** Async function that throws if the service is unhealthy. Called on each request. */
-  check?: () => Promise<void>
-}
-
-/**
- * Health check endpoint.
- *
- * Returns 200 with `'OK'` if the check passes, 503 if it fails.
- *
- * ```ts
- * import { health } from 'weifuwu'
- *
- * app.use(health({
- *   check: async () => {
- *     await db.query('SELECT 1')
- *   },
- * }))
- * ```
- */
-export function health(options?: HealthOptions): Router {
-  const path = options?.path ?? '/__health'
-  const r = new Router()
-
-  const handler: Handler = async () => {
-    try {
-      await options?.check?.()
-      return new Response('OK', { status: 200 })
-    } catch {
-      return new Response('Service Unavailable', { status: 503 })
-    }
-  }
-
-  r.get(path, handler)
-  r.head(path, handler)
-
-  return r
-}

package/middleware/helmet.ts

@@ -1,98 +0,0 @@
-import type { Middleware, Context } from '../types.ts'
-
-/** Options for {@link helmet}. Set any header to `false` to omit it. */
-export interface HelmetOptions {
-  /** `Content-Security-Policy` header value. */
-  contentSecurityPolicy?: string | false
-  /** `Cross-Origin-Embedder-Policy` header value. */
-  crossOriginEmbedderPolicy?: string | false
-  /** `Cross-Origin-Opener-Policy` header value. */
-  crossOriginOpenerPolicy?: string | false
-  /** `Cross-Origin-Resource-Policy` header value. */
-  crossOriginResourcePolicy?: string | false
-  /** `Origin-Agent-Cluster` header value. */
-  originAgentCluster?: string | false
-  /** `Referrer-Policy` header value. */
-  referrerPolicy?: string | false
-  /** `Strict-Transport-Security` header value. */
-  strictTransportSecurity?: string | false
-  /** `X-Content-Type-Options` header value. */
-  xContentTypeOptions?: string | false
-  /** `X-DNS-Prefetch-Control` header value. */
-  xDnsPrefetchControl?: string | false
-  /** `X-Download-Options` header value. */
-  xDownloadOptions?: string | false
-  /** `X-Frame-Options` header value. */
-  xFrameOptions?: string | false
-  /** `X-Permitted-Cross-Domain-Policies` header value. */
-  xPermittedCrossDomainPolicies?: string | false
-  /** `X-XSS-Protection` header value. */
-  xXssProtection?: string | false
-  /** `Permissions-Policy` header value. */
-  permissionsPolicy?: string | false
-}
-
-/**
- * Security headers middleware. Sets sensible defaults for all major security headers.
- *
- * ```ts
- * import { helmet } from 'weifuwu'
- * app.use(helmet())
- *
- * // Customize or disable specific headers
- * app.use(helmet({ contentSecurityPolicy: false, xFrameOptions: 'DENY' }))
- * ```
- */
-const HEADER_MAP: Record<string, keyof HelmetOptions> = {
-  'Content-Security-Policy': 'contentSecurityPolicy',
-  'Cross-Origin-Embedder-Policy': 'crossOriginEmbedderPolicy',
-  'Cross-Origin-Opener-Policy': 'crossOriginOpenerPolicy',
-  'Cross-Origin-Resource-Policy': 'crossOriginResourcePolicy',
-  'Origin-Agent-Cluster': 'originAgentCluster',
-  'Referrer-Policy': 'referrerPolicy',
-  'Strict-Transport-Security': 'strictTransportSecurity',
-  'X-Content-Type-Options': 'xContentTypeOptions',
-  'X-DNS-Prefetch-Control': 'xDnsPrefetchControl',
-  'X-Download-Options': 'xDownloadOptions',
-  'X-Frame-Options': 'xFrameOptions',
-  'X-Permitted-Cross-Domain-Policies': 'xPermittedCrossDomainPolicies',
-  'X-XSS-Protection': 'xXssProtection',
-  'Permissions-Policy': 'permissionsPolicy',
-}
-
-export function helmet(options?: HelmetOptions): Middleware<Context, Context> {
-  const opts = { ...DEFAULTS, ...options } as HelmetOptions
-
-  const headers = new Headers()
-  for (const [header, key] of Object.entries(HEADER_MAP)) {
-    const val = opts[key]
-    if (val !== false && val !== undefined) headers.set(header, val)
-  }
-
-  return async (req, ctx, next) => {
-    const res = await next(req, ctx)
-    const h = new Headers(res.headers)
-    for (const [k, v] of headers) {
-      if (!h.has(k)) h.set(k, v)
-    }
-    return new Response(res.body, { status: res.status, statusText: res.statusText, headers: h })
-  }
-}
-
-const DEFAULTS: HelmetOptions = {
-  contentSecurityPolicy:
-    "default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests",
-  crossOriginEmbedderPolicy: 'require-corp',
-  crossOriginOpenerPolicy: 'same-origin',
-  crossOriginResourcePolicy: 'same-origin',
-  originAgentCluster: '?1',
-  referrerPolicy: 'no-referrer',
-  strictTransportSecurity: 'max-age=15552000; includeSubDomains',
-  xContentTypeOptions: 'nosniff',
-  xDnsPrefetchControl: 'off',
-  xDownloadOptions: 'noopen',
-  xFrameOptions: 'SAMEORIGIN',
-  xPermittedCrossDomainPolicies: 'none',
-  xXssProtection: '0',
-  permissionsPolicy: 'camera=(),display-capture=(),fullscreen=(),geolocation=(),microphone=()',
-}

package/middleware/i18n.ts

@@ -1,175 +0,0 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
-import { readFile, stat } from 'node:fs/promises'
-import { join, resolve } from 'node:path'
-import type { Context, Middleware } from '../types.ts'
-import { getCookies } from '../core/cookie.ts'
-import { Router } from '../core/router.ts'
-
-// Augment Context with i18n property
-declare module '../types.ts' {
-  interface Context {
-    i18n: I18nInjected
-  }
-}
-
-export interface I18nInjected {
-  locale: string
-  messages?: Record<string, unknown>
-  t: (key: string, params?: Record<string, string>, fallback?: string) => string
-  set?: (value: string, loc?: string) => Response
-}
-
-export interface I18nOptions {
-  /** Default locale (default: 'en'). */
-  default?: string
-  /** Directory containing `{locale}.json` translation files. */
-  dir?: string
-  /** Inline translation messages keyed by locale. */
-  messages?: Record<string, Record<string, unknown>>
-  /** Cookie name for locale (default: 'locale'). Set empty to disable. */
-  cookie?: string
-  /** Whether to detect locale from Accept-Language header (default: true). */
-  fromAcceptLanguage?: boolean
-}
-
-const DEFAULTS = {
-  default: 'en',
-  cookie: 'locale',
-  fromAcceptLanguage: true,
-}
-
-function translate(
-  msgs: Record<string, unknown>,
-  key: string,
-  params?: Record<string, string>,
-  fallback?: string,
-): string {
-  const msg = key.split('.').reduce((o: any, k: string) => o?.[k], msgs)
-  if (msg === undefined || msg === null) return fallback ?? key
-  if (!params) return String(msg)
-  let result = String(msg)
-  for (const [k, v] of Object.entries(params)) {
-    result = result.replace(`{${k}}`, v)
-  }
-  return result
-}
-
-/**
- * i18n module. Returns a Router with an attached `.middleware()` method.
- *
- * ```ts
- * const l = i18n({ dir: './locales' })
- * app.use(l.middleware())  // → ctx.i18n = { locale, t, set }
- * app.use('/', l)          // → GET /__lang/:locale (switch route)
- * ```
- */
-export interface I18nModule extends Router {
-  /** Middleware that injects `ctx.i18n = { locale, t, set }`. */
-  middleware: () => Middleware<Context, Context & I18nInjected>
-}
-
-export function i18n(options?: I18nOptions): I18nModule {
-  const opts = { ...DEFAULTS, ...options }
-  const dir = opts.dir ? resolve(opts.dir) : undefined
-  const cache = new Map<string, Record<string, unknown>>()
-
-  function validLocale(locale: string): boolean {
-    return /^[\w-]+$/.test(locale) && !locale.includes('..')
-  }
-
-  async function loadMessages(locale: string): Promise<Record<string, unknown>> {
-    // Check inline messages first
-    if (opts.messages?.[locale] && Object.keys(opts.messages[locale]).length > 0) {
-      cache.set(locale, opts.messages[locale])
-      return opts.messages[locale]
-    }
-    // Then check file system
-    if (!dir || !validLocale(locale)) return {}
-    const cached = cache.get(locale)
-    if (cached) return cached
-    const filePath = join(dir, `${locale}.json`)
-    try {
-      await stat(filePath)
-      const content = await readFile(filePath, 'utf-8')
-      const data = JSON.parse(content) as Record<string, unknown>
-      cache.set(locale, data)
-      return data
-    } catch {
-      /* file not found */
-    }
-    // Fallback: zh-CN → zh
-    const short = locale.split('-')[0]
-    if (short !== locale) {
-      const fallback = cache.get(short) || (await loadMessages(short))
-      if (fallback && Object.keys(fallback).length > 0) {
-        cache.set(locale, fallback)
-        return fallback
-      }
-    }
-    return {}
-  }
-
-  function detectLocale(req: Request): string {
-    if (opts.cookie) {
-      const fromCookie = getCookies(req)[opts.cookie]
-      if (fromCookie && validLocale(fromCookie)) return fromCookie
-    }
-    if (opts.fromAcceptLanguage) {
-      const fromHeader = req.headers.get('Accept-Language')?.split(',')[0]?.trim()
-      if (fromHeader && validLocale(fromHeader)) return fromHeader
-    }
-    return opts.default
-  }
-
-  const mw: Middleware<Context, Context & I18nInjected> = async (req, ctx, next) => {
-    const locale = detectLocale(req)
-    const msgs = await loadMessages(locale)
-
-    ;(ctx as Context & I18nInjected).i18n = {
-      locale,
-      messages: msgs,
-      t: (key: string, params?: Record<string, string>, fallback?: string) =>
-        translate(msgs, key, params, fallback),
-      set: (value: string, loc?: string) => {
-        const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`
-        const location = loc ?? (req.headers.get('referer') || '/')
-        return new Response(null, {
-          status: 302,
-          headers: { Location: location, 'Set-Cookie': cookie },
-        })
-      },
-    }
-
-    return next(req, ctx as Context & I18nInjected)
-  }
-  mw.__meta = { injects: ['i18n'], depends: [] }
-
-  class I18nRouter extends Router {
-    middleware() {
-      return mw
-    }
-  }
-
-  const router = new I18nRouter()
-  router.get('/__lang/:locale', async (req) => {
-    const url = new URL(req.url)
-    const value = url.pathname.split('/__lang/')[1] ?? ''
-    const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`
-    const messages = await loadMessages(value)
-    const accept = req.headers.get('accept') ?? ''
-    if (accept.includes('application/json')) {
-      return Response.json(
-        {
-          ok: true,
-          locale: value,
-          messages: Object.keys(messages).length > 0 ? messages : undefined,
-        },
-        { headers: { 'Set-Cookie': cookie } },
-      )
-    }
-    const referer = req.headers.get('referer') || '/'
-    return new Response(null, { status: 302, headers: { Location: referer, 'Set-Cookie': cookie } })
-  })
-
-  return router
-}