wurzel 0.0.15 → 0.0.16

package/dist/bin/wurzel.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 import express from "express";
-import { expressRouter as wurzel } from "../lib/index.js";
+import { expressRouter } from "../lib/index.js";
 import path from "node:path";
 
 const app = express();
 
 const rootFolder = path.resolve(".");
 
-app.use("/", wurzel({ express, baseFolder: rootFolder }));
+app.use("/", expressRouter({ express, baseFolder: rootFolder }));
 
 const port = 8080;
 

package/dist/lib/index.js

@@ -11,7 +11,7 @@ import {
 import { readFile } from "node:fs/promises";
 import { pathToFileURL, fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
-import { resolve as resolveImport } from "import-meta-resolve";
+import * as importMetaResolve from "import-meta-resolve";
 // @ts-expect-error missing types
 import { transpileCode } from "commentscript";
 import { LRUCache } from "lru-cache";
@@ -41,7 +41,7 @@ const defaultResolveImportPath/*: TResolveImportPathFunc*/ = async ({ importer,
   let resolvedUrl/*: string | undefined*/ = undefined;
 
   try {
-    resolvedUrl = resolveImport(specifier, parentUrl.toString());
+    resolvedUrl = importMetaResolve.resolve(specifier, parentUrl.toString());
   } catch (error) {
     return {
       error: error /*as Error*/
@@ -67,6 +67,40 @@ const defaultResolveImportPath/*: TResolveImportPathFunc*/ = async ({ importer,
   };
 };
 
+// es6-debug-server rejects uris containing "//" or "..", and a file path must not contain null bytes,
+// so such uris have to be answered before reaching es6-debug-server
+const isMalformedUri = ({ uri }/*: { uri: string }*/) => {
+  return uri.includes("//") || uri.split("/").includes("..") || uri.includes("\0");
+};
+
+const decodePath = ({ path }/*: { path: string }*/) => {
+  try {
+    return decodeURIComponent(path);
+  } catch (ex) {
+    const error/*: Error & { status?: number }*/ = Error(`failed to decode path "${path}"`, { cause: ex });
+    // express answers errors with their status
+    // eslint-disable-next-line immutable/no-mutation
+    error.status = 400;
+    throw error;
+  }
+};
+
+const encodePath = ({ path }/*: { path: string }*/) => {
+  return path.split("/").map((segment) => {
+    return encodeURIComponent(segment);
+  }).join("/");
+};
+
+const queryOf = ({ url }/*: { url: string }*/) => {
+  const queryStart = url.indexOf("?");
+  return queryStart < 0 ? "" : url.substring(queryStart);
+};
+
+// ENOTDIR means that a parent folder of the path is a file, so there is no such file either
+const isFileNotFoundError = ({ error }/*: { error: NodeJS.ErrnoException }*/) => {
+  return error.code === "ENOENT" || error.code === "ENOTDIR";
+};
+
 const defaultScriptFileEndings = [".js", ".ts", ".cjs", ".mjs", ".cts", ".mts"];
 
 const defaultDetermineFileTypeByPath = ({ filePath }/*: { filePath: string }*/)/*: TFileType*/ => {
@@ -99,7 +133,6 @@ const expressRouter = ({
   maxTranspileCacheSize?: number,
 
   analyzeCode?: TCodeAnalyzeFunc,
-  // eslint-disable-next-line no-unused-vars
   determineFileTypeByPath?: (args: { filePath: string }) => TFileType,
   resolveImportPath?: TResolveImportPathFunc
 // eslint-disable-next-line complexity
@@ -107,15 +140,19 @@ const expressRouter = ({
 
   const router = express.Router();
 
+  // eslint-disable-next-line k13-engineering/no-new
   const transpileCache = new LRUCache/*<string, string>*/({
     maxSize: maxTranspileCacheSize,
+    // eslint-disable-next-line k13-engineering/prefer-single-object-parameters
     sizeCalculation: (value, key) => {
       return key.length + value.length;
     }
   });
 
+  // eslint-disable-next-line k13-engineering/no-new
   const analyzeCache = new LRUCache/*<string, ICodeAnalyzeResult>*/({
     maxSize: maxAnalyzeCacheSize,
+    // eslint-disable-next-line k13-engineering/prefer-single-object-parameters
     sizeCalculation: (value, key) => {
       return key.length + JSON.stringify(value).length;
     }
@@ -177,7 +214,7 @@ const expressRouter = ({
       });
 
       if (readError !== undefined) {
-        if (readError.code === "ENOENT") {
+        if (isFileNotFoundError({ error: readError })) {
 
           return {
             error: createReadError({
@@ -244,45 +281,57 @@ const expressRouter = ({
     resolveImportPath
   });
 
+  const serveScript = ({ filePath, req, res }/*: { filePath: string, req: Express.Request, res: Express.Response }*/) => {
+
+    if (isMalformedUri({ uri: filePath })) {
+      res.status(400).end("bad request");
+      return;
+    }
+
+    server.handleRequest({
+      uri: filePath,
+
+      // a relative redirect is resolved by the client against the url it requested, which keeps it below
+      // wherever the router is reachable, even below a path prefix of a reverse proxy the router cannot see
+      handleRedirect: ({ relativeUri }) => {
+        const redirectLocation = `${encodePath({ path: relativeUri })}${queryOf({ url: req.url })}`;
+        res.redirect(redirectLocation);
+      },
+
+      handleContent: ({ contentType, content }) => {
+        res.writeHead(200, {
+          "Content-Type": contentType
+        });
+        res.end(content);
+      },
+
+      handleFileNotFound: () => {
+        res.status(404).end("not found");
+      },
+
+      handleInternalError: ({ error }) => {
+        console.error(error);
+        res.status(500).end("internal server error");
+      }
+    });
+  };
+
+  // eslint-disable-next-line k13-engineering/prefer-single-object-parameters
   router.use((req, res, next) => {
 
     if (req.method === "HEAD") {
       throw Error("HEAD not supported yet");
     }
 
-    const fileType = determineFileTypeByPath({ filePath: req.url });
+    const filePath = decodePath({ path: req.path });
+    const fileType = determineFileTypeByPath({ filePath });
 
     if (fileType === "script-resource") {
       throw Error(`file type ${fileType} is not supported yet`);
     }
 
     if (fileType === "script") {
-
-      server.handleRequest({
-        uri: req.url,
-
-        handleRedirect: ({ uri }) => {
-          const redirectLocation = `${req.baseUrl}${uri}`;
-          res.redirect(redirectLocation);
-        },
-
-        handleContent: ({ contentType, content }) => {
-          res.writeHead(200, {
-            "Content-Type": contentType
-          });
-          res.end(content);
-        },
-
-        handleFileNotFound: () => {
-          res.status(404).end("not found");
-        },
-
-        handleInternalError: ({ error }) => {
-          console.error(error);
-          res.status(500).end("internal server error");
-        }
-      });
-
+      serveScript({ filePath, req, res });
       return;
     }
 

package/dist/samples/express/main.js

@@ -1,5 +1,5 @@
 import {
-  expressRouter as wurzelExpressRouter,
+  expressRouter,
   defaultResolveImportPath,
   /*type TResolveImportPathFunc
 */} from "../../lib/index.js";
@@ -27,7 +27,7 @@ const resolveImportPath/*: TResolveImportPathFunc*/ = async ({ importer, specifi
 
 const app = express();
 
-app.use("/", wurzelExpressRouter({
+app.use("/", expressRouter({
   express,
   baseFolder,
   resolveImportPath

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.0.15",
+  "version": "0.0.16",
   "name": "wurzel",
   "type": "module",
   "description": "A tool to serve script files from different directories",
@@ -9,20 +9,24 @@
   "main": "dist/lib/index.js",
   "dependencies": {
     "commentscript": "^0.0.10",
-    "es6-debug-server": "^0.0.13",
+    "es6-debug-server": "^0.0.14",
     "esm-resource": "^0.0.3",
     "import-meta-resolve": "^4.0.0",
     "lru-cache": "^10.2.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
+    "@k13engineering/eslint-rules": "^0.0.6",
     "@k13engineering/releasetool": "^0.0.5",
     "@types/express": "^4.17.21",
-    "@types/node": "^20.12.7",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^25.6.0",
+    "c8": "^11.0.0",
     "deno-node": "^0.0.12",
     "express": "^5.2.1",
+    "mocha": "^12.0.2",
     "npm-check-updates": "^20.0.2",
-    "typescript-eslint": "^8.58.2"
+    "typescript": "^6.0.3"
   },
   "bin": {
     "wurzel": "dist/bin/wurzel.js"
@@ -30,7 +34,7 @@
   "scripts": {
     "build": "rm -rf dist/ && deno-node-build --root . --out dist/ --entry lib/index.ts --entry bin/wurzel.ts --entry samples/express/main.ts && cp -r samples/express/frontend dist/samples/express/",
     "lint": "eslint .",
-    "test": "true",
+    "test": "c8 --reporter lcov --reporter html --reporter text --all --src lib/ --exclude 'lib/**/*.spec.ts' mocha 'lib/**/*.spec.ts'",
     "type-check": "tsc --noEmit",
     "update-deps": "npm-check-updates -u"
   },