![](\"https://raw.githubusercontent.com/hapijs/assets/master/images/hapi.png\")
\n\n# @hapi/hapi\n\n#### The Simple, Secure Framework Developers Trust\n\nBuild powerful, scalable applications, with minimal overhead and full out-of-the-box functionality - your code, your way.\n\n### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support\n\n## Useful resources\n\n- [Documentation and API](https://hapi.dev/)\n- [Version status](https://hapi.dev/resources/status/#hapi) (builds, dependencies, node versions, licenses, eol)\n- [Changelog](https://hapi.dev/resources/changelog/)\n- [Project policies](https://hapi.dev/policies/)\n- [Support](https://hapi.dev/support/)\n\n## Technical Steering Committee (TSC) Members\n\n - Devin Ivy ([@devinivy](https://github.com/devinivy))\n - Lloyd Benson ([@lloydbenson](https://github.com/lloydbenson))\n - Nathan LaFreniere ([@nlf](https://github.com/nlf))\n - Wyatt Lyon Preul ([@geek](https://github.com/geek))\n - Nicolas Morel ([@marsup](https://github.com/marsup))\n - Jonathan Samines ([@jonathansamines](https://github.com/jonathansamines))\n"
},
{
"path": "SPONSORS.md",
"content": "We'd like to thank our sponsors as well as the legacy sponsors who have supported hapi throughout the years. Thanks so much for your support!\n\n> Below are hapi's top recurring sponsors, but there are many more to thank. For the complete list, see [hapi.dev/policies/sponsors](https://hapi.dev/policies/sponsors/) or [hapijs/.github/SPONSORS.md](https://github.com/hapijs/.github/blob/master/SPONSORS.md).\n\n# Staff Sponsors\n\n- [Big Room Studios](https://www.bigroomstudios.com/)\n- [Dixeed](https://dixeed.com/)\n\n# Top Sponsors\n\n- Fabian Gündel / [DataWrapper.de](https://www.datawrapper.de/)\n- Devin Stewart\n- [Raider.IO](https://raider.io/)\n- [Florence Healthcare](https://florencehc.com/)\n"
},
{
"path": "lib/auth.js",
"content": "'use strict';\n\nconst Boom = require('@hapi/boom');\nconst Bounce = require('@hapi/bounce');\nconst Hoek = require('@hapi/hoek');\n\nconst Config = require('./config');\nconst Request = require('./request');\n\n\nconst internals = {\n missing: Symbol('missing')\n};\n\n\nexports = module.exports = internals.Auth = class {\n\n #core = null;\n #schemes = {};\n #strategies = {};\n\n api = {}; // Do not reassign api or settings, as they are referenced in public()\n settings = {\n default: null // Strategy used as default if route has no auth settings\n };\n\n constructor(core) {\n\n this.#core = core;\n }\n\n public(server) {\n\n return {\n api: this.api,\n settings: this.settings,\n scheme: this.scheme.bind(this),\n strategy: this._strategy.bind(this, server),\n default: this.default.bind(this),\n test: this.test.bind(this),\n verify: this.verify.bind(this),\n lookup: this.lookup.bind(this)\n };\n }\n\n scheme(name, scheme) {\n\n Hoek.assert(name, 'Authentication scheme must have a name');\n Hoek.assert(!this.#schemes[name], 'Authentication scheme name already exists:', name);\n Hoek.assert(typeof scheme === 'function', 'scheme must be a function:', name);\n\n this.#schemes[name] = scheme;\n }\n\n _strategy(server, name, scheme, options = {}) {\n\n Hoek.assert(name, 'Authentication strategy must have a name');\n Hoek.assert(typeof options === 'object', 'options must be an object');\n Hoek.assert(!this.#strategies[name], 'Authentication strategy name already exists');\n Hoek.assert(scheme, 'Authentication strategy', name, 'missing scheme');\n Hoek.assert(this.#schemes[scheme], 'Authentication strategy', name, 'uses unknown scheme:', scheme);\n\n server = server._clone();\n const strategy = this.#schemes[scheme](server, options);\n\n Hoek.assert(strategy.authenticate, 'Invalid scheme:', name, 'missing authenticate() method');\n Hoek.assert(typeof strategy.authenticate === 'function', 'Invalid scheme:', name, 'invalid authenticate() method');\n Hoek.assert(!strategy.payload || typeof strategy.payload === 'function', 'Invalid scheme:', name, 'invalid payload() method');\n Hoek.assert(!strategy.response || typeof strategy.response === 'function', 'Invalid scheme:', name, 'invalid response() method');\n strategy.options = strategy.options ?? {};\n Hoek.assert(strategy.payload || !strategy.options.payload, 'Cannot require payload validation without a payload method');\n\n this.#strategies[name] = {\n methods: strategy,\n realm: server.realm\n };\n\n if (strategy.api) {\n this.api[name] = strategy.api;\n }\n }\n\n default(options) {\n\n Hoek.assert(!this.settings.default, 'Cannot set default strategy more than once');\n options = Config.apply('auth', options, 'default strategy');\n\n this.settings.default = this._setupRoute(Hoek.clone(options)); // Prevent changes to options\n\n const routes = this.#core.router.table();\n for (const route of routes) {\n route.rebuild();\n }\n }\n\n async test(name, request) {\n\n Hoek.assert(name, 'Missing authentication strategy name');\n const strategy = this.#strategies[name];\n Hoek.assert(strategy, 'Unknown authentication strategy:', name);\n\n const bind = strategy.methods;\n const realm = strategy.realm;\n const response = await request._core.toolkit.execute(strategy.methods.authenticate, request, { bind, realm, auth: true });\n\n if (!response.isAuth) {\n throw response;\n }\n\n if (response.error) {\n throw response.error;\n }\n\n return response.data;\n }\n\n async verify(request) {\n\n const auth = request.auth;\n\n if (auth.error) {\n throw auth.error;\n }\n\n if (!auth.isAuthenticated) {\n return;\n }\n\n const strategy = this.#strategies[auth.strategy];\n Hoek.assert(strategy, 'Unknown authentication strategy:', auth.strategy);\n\n if (!strategy.methods.verify) {\n return;\n }\n\n const bind = strategy.methods;\n await strategy.methods.verify.call(bind, auth);\n }\n\n static testAccess(request, route) {\n\n const auth = request._core.auth;\n\n try {\n return auth._access(request, route);\n }\n catch (err) {\n Bounce.rethrow(err, 'system');\n return false;\n }\n }\n\n _setupRoute(options, path) {\n\n if (!options) {\n return options; // Preserve the difference between undefined and false\n }\n\n if (typeof options === 'string') {\n options = { strategies: [options] };\n }\n else if (options.strategy) {\n options.strategies = [options.strategy];\n delete options.strategy;\n }\n\n if (path &&\n !options.strategies) {\n\n Hoek.assert(this.settings.default, 'Route missing authentication strategy and no default defined:', path);\n options = Hoek.applyToDefaults(this.settings.default, options);\n }\n\n path = path ?? 'default strategy';\n Hoek.assert(options.strategies?.length, 'Missing authentication strategy:', path);\n\n options.mode = options.mode ?? 'required';\n\n if (options.entity !== undefined || // Backwards compatibility with <= 11.x.x\n options.scope !== undefined) {\n\n options.access = [{ entity: options.entity, scope: options.scope }];\n delete options.entity;\n delete options.scope;\n }\n\n if (options.access) {\n for (const access of options.access) {\n access.scope = internals.setupScope(access);\n }\n }\n\n if (options.payload === true) {\n options.payload = 'required';\n }\n\n let hasAuthenticatePayload = false;\n for (const name of options.strategies) {\n const strategy = this.#strategies[name];\n Hoek.assert(strategy, 'Unknown authentication strategy', name, 'in', path);\n\n Hoek.assert(strategy.methods.payload || options.payload !== 'required', 'Payload validation can only be required when all strategies support it in', path);\n hasAuthenticatePayload = hasAuthenticatePayload || strategy.methods.payload;\n Hoek.assert(!strategy.methods.options.payload || options.payload === undefined || options.payload === 'required', 'Cannot set authentication payload to', options.payload, 'when a strategy requires payload validation in', path);\n }\n\n Hoek.assert(!options.payload || hasAuthenticatePayload, 'Payload authentication requires at least one strategy with payload support in', path);\n\n return options;\n }\n\n lookup(route) {\n\n if (route.settings.auth === false) {\n return false;\n }\n\n return route.settings.auth || this.settings.default;\n }\n\n _enabled(route, type) {\n\n const config = this.lookup(route);\n if (!config) {\n return false;\n }\n\n if (type === 'authenticate') {\n return true;\n }\n\n if (type === 'access') {\n return !!config.access;\n }\n\n for (const name of config.strategies) {\n const strategy = this.#strategies[name];\n if (strategy.methods[type]) {\n return true;\n }\n }\n\n return false;\n }\n\n static authenticate(request) {\n\n const auth = request._core.auth;\n return auth._authenticate(request);\n }\n\n async _authenticate(request) {\n\n const config = this.lookup(request.route);\n\n const errors = [];\n request.auth.mode = config.mode;\n\n // Injection bypass\n\n if (request.auth.credentials) {\n internals.validate(null, { credentials: request.auth.credentials, artifacts: request.auth.artifacts }, request.auth.strategy, config, request, errors);\n return;\n }\n\n // Try each strategy\n\n for (const name of config.strategies) {\n const strategy = this.#strategies[name];\n\n const bind = strategy.methods;\n const realm = strategy.realm;\n const response = await request._core.toolkit.execute(strategy.methods.authenticate, request, { bind, realm, auth: true });\n\n const message = (response.isAuth ? internals.validate(response.error, response.data, name, config, request, errors) : internals.validate(response, null, name, config, request, errors));\n if (!message) {\n return;\n }\n\n if (message !== internals.missing) {\n return message;\n }\n }\n\n // No more strategies\n\n const err = Boom.unauthorized('Missing authentication', errors);\n if (config.mode === 'required') {\n throw err;\n }\n\n request.auth.isAuthenticated = false;\n request.auth.credentials = null;\n request.auth.error = err;\n request._log(['auth', 'unauthenticated']);\n }\n\n static access(request) {\n\n const auth = request._core.auth;\n request.auth.isAuthorized = auth._access(request);\n }\n\n _access(request, route) {\n\n const config = this.lookup(route || request.route);\n if (!config?.access) {\n return true;\n }\n\n const credentials = request.auth.credentials;\n if (!credentials) {\n if (config.mode !== 'required') {\n return false;\n }\n\n throw Boom.forbidden('Request is unauthenticated');\n }\n\n const requestEntity = (credentials.user ? 'user' : 'app');\n\n const scopeErrors = [];\n for (const access of config.access) {\n\n // Check entity\n\n const entity = access.entity;\n if (entity &&\n entity !== 'any' &&\n entity !== requestEntity) {\n\n continue;\n }\n\n // Check scope\n\n let scope = access.scope;\n if (scope) {\n if (!credentials.scope) {\n scopeErrors.push(scope);\n continue;\n }\n\n scope = internals.expandScope(request, scope);\n if (!internals.validateScope(credentials, scope, 'required') ||\n !internals.validateScope(credentials, scope, 'selection') ||\n !internals.validateScope(credentials, scope, 'forbidden')) {\n\n scopeErrors.push(scope);\n continue;\n }\n }\n\n return true;\n }\n\n // Scope error\n\n if (scopeErrors.length) {\n request._log(['auth', 'scope', 'error']);\n throw Boom.forbidden('Insufficient scope', { got: credentials.scope, need: scopeErrors });\n }\n\n // Entity error\n\n if (requestEntity === 'app') {\n request._log(['auth', 'entity', 'user', 'error']);\n throw Boom.forbidden('Application credentials cannot be used on a user endpoint');\n }\n\n request._log(['auth', 'entity', 'app', 'error']);\n throw Boom.forbidden('User credentials cannot be used on an application endpoint');\n }\n\n static async payload(request) {\n\n if (!request.auth.isAuthenticated || !request.auth[Request.symbols.authPayload]) {\n return;\n }\n\n const auth = request._core.auth;\n const strategy = auth.#strategies[request.auth.strategy];\n Hoek.assert(strategy, 'Unknown authentication strategy:', request.auth.strategy);\n\n if (!strategy.methods.payload) {\n return;\n }\n\n const config = auth.lookup(request.route);\n const setting = config.payload ?? (strategy.methods.options.payload ? 'required' : false);\n if (!setting) {\n return;\n }\n\n const bind = strategy.methods;\n const realm = strategy.realm;\n const response = await request._core.toolkit.execute(strategy.methods.payload, request, { bind, realm });\n\n if (response.isBoom &&\n response.isMissing) {\n\n return setting === 'optional' ? undefined : Boom.unauthorized('Missing payload authentication');\n }\n\n return response;\n }\n\n static async response(response) {\n\n const request = response.request;\n const auth = request._core.auth;\n if (!request.auth.isAuthenticated) {\n return;\n }\n\n const strategy = auth.#strategies[request.auth.strategy];\n Hoek.assert(strategy, 'Unknown authentication strategy:', request.auth.strategy);\n\n if (!strategy.methods.response) {\n return;\n }\n\n const bind = strategy.methods;\n const realm = strategy.realm;\n const error = await request._core.toolkit.execute(strategy.methods.response, request, { bind, realm, continue: 'undefined' });\n if (error) {\n throw error;\n }\n }\n};\n\n\ninternals.setupScope = function (access) {\n\n // No scopes\n\n if (!access.scope) {\n return false;\n }\n\n // Already setup\n\n if (!Array.isArray(access.scope)) {\n return access.scope;\n }\n\n const scope = {};\n for (const value of access.scope) {\n const prefix = value[0];\n const type = prefix === '+' ? 'required' : (prefix === '!' ? 'forbidden' : 'selection');\n const clean = type === 'selection' ? value : value.slice(1);\n scope[type] = scope[type] ?? [];\n scope[type].push(clean);\n\n if ((!scope._hasParameters?.[type]) &&\n /{([^}]+)}/.test(clean)) {\n\n scope._hasParameters = scope._hasParameters ?? {};\n scope._hasParameters[type] = true;\n }\n }\n\n return scope;\n};\n\n\ninternals.validate = function (err, result, name, config, request, errors) { // err can be Boom, Error, or a valid response object\n\n result = result ?? {};\n request.auth.isAuthenticated = !err;\n\n if (err) {\n\n // Non-error response\n\n if (err instanceof Error === false) {\n request._log(['auth', 'unauthenticated', 'response', name], { statusCode: err.statusCode });\n return err;\n }\n\n // Missing authenticated\n\n if (err.isMissing) {\n request._log(['auth', 'unauthenticated', 'missing', name], err);\n errors.push(err.output.headers['WWW-Authenticate']);\n return internals.missing;\n }\n }\n\n request.auth.strategy = name;\n request.auth.credentials = result.credentials;\n request.auth.artifacts = result.artifacts;\n\n // Authenticated\n\n if (!err) {\n return;\n }\n\n // Unauthenticated\n\n request.auth.error = err;\n\n if (config.mode === 'try') {\n request._log(['auth', 'unauthenticated', 'try', name], err);\n return;\n }\n\n request._log(['auth', 'unauthenticated', 'error', name], err);\n throw err;\n};\n\n\ninternals.expandScope = function (request, scope) {\n\n if (!scope._hasParameters) {\n return scope;\n }\n\n const expanded = {\n required: internals.expandScopeType(request, scope, 'required'),\n selection: internals.expandScopeType(request, scope, 'selection'),\n forbidden: internals.expandScopeType(request, scope, 'forbidden')\n };\n\n return expanded;\n};\n\n\ninternals.expandScopeType = function (request, scope, type) {\n\n if (!scope._hasParameters[type]) {\n return scope[type];\n }\n\n const expanded = [];\n const context = {\n params: request.params,\n query: request.query,\n payload: request.payload,\n credentials: request.auth.credentials\n };\n\n for (const template of scope[type]) {\n expanded.push(Hoek.reachTemplate(context, template));\n }\n\n return expanded;\n};\n\n\ninternals.validateScope = function (credentials, scope, type) {\n\n if (!scope[type]) {\n return true;\n }\n\n const count = typeof credentials.scope === 'string' ?\n scope[type].indexOf(credentials.scope) !== -1 ? 1 : 0 :\n Hoek.intersect(scope[type], credentials.scope).length;\n\n if (type === 'forbidden') {\n return count === 0;\n }\n\n if (type === 'required') {\n return count === scope.required.length;\n }\n\n return !!count;\n};\n"
},
{
"path": "lib/compression.js",
"content": "'use strict';\n\nconst Zlib = require('zlib');\n\nconst Accept = require('@hapi/accept');\nconst Bounce = require('@hapi/bounce');\nconst Hoek = require('@hapi/hoek');\n\n\nconst internals = {\n common: ['gzip, deflate', 'deflate, gzip', 'gzip', 'deflate', 'gzip, deflate, br']\n};\n\n\nexports = module.exports = internals.Compression = class {\n\n decoders = {\n gzip: (options) => Zlib.createGunzip(options),\n deflate: (options) => Zlib.createInflate(options)\n };\n\n encodings = ['identity', 'gzip', 'deflate'];\n\n encoders = {\n identity: null,\n gzip: (options) => Zlib.createGzip(options),\n deflate: (options) => Zlib.createDeflate(options)\n };\n\n #common = null;\n\n constructor() {\n\n this._updateCommons();\n }\n\n _updateCommons() {\n\n this.#common = new Map();\n\n for (const header of internals.common) {\n this.#common.set(header, Accept.encoding(header, this.encodings));\n }\n }\n\n addEncoder(encoding, encoder) {\n\n Hoek.assert(this.encoders[encoding] === undefined, `Cannot override existing encoder for ${encoding}`);\n Hoek.assert(typeof encoder === 'function', `Invalid encoder function for ${encoding}`);\n this.encoders[encoding] = encoder;\n this.encodings.unshift(encoding);\n this._updateCommons();\n }\n\n addDecoder(encoding, decoder) {\n\n Hoek.assert(this.decoders[encoding] === undefined, `Cannot override existing decoder for ${encoding}`);\n Hoek.assert(typeof decoder === 'function', `Invalid decoder function for ${encoding}`);\n this.decoders[encoding] = decoder;\n }\n\n accept(request) {\n\n const header = request.headers['accept-encoding'];\n if (!header) {\n return 'identity';\n }\n\n const common = this.#common.get(header);\n if (common) {\n return common;\n }\n\n try {\n return Accept.encoding(header, this.encodings);\n }\n catch (err) {\n Bounce.rethrow(err, 'system');\n err.header = header;\n request._log(['accept-encoding', 'error'], err);\n return 'identity';\n }\n }\n\n encoding(response, length) {\n\n if (response.settings.compressed) {\n response.headers['content-encoding'] = response.settings.compressed;\n return null;\n }\n\n const request = response.request;\n if (!request._core.settings.compression ||\n length !== null && length < request._core.settings.compression.minBytes) {\n\n return null;\n }\n\n const mime = request._core.mime.type(response.headers['content-type'] || 'application/octet-stream');\n if (!mime.compressible) {\n return null;\n }\n\n response.vary('accept-encoding');\n\n if (response.headers['content-encoding']) {\n return null;\n }\n\n return request.info.acceptEncoding === 'identity' ? null : request.info.acceptEncoding;\n }\n\n encoder(request, encoding) {\n\n const encoder = this.encoders[encoding];\n Hoek.assert(encoder !== undefined, `Unknown encoding ${encoding}`);\n return encoder(request.route.settings.compression[encoding]);\n }\n};\n"
},
{
"path": "lib/config.js",
"content": "'use strict';\n\nconst Os = require('os');\n\nconst Somever = require('@hapi/somever');\nconst Validate = require('@hapi/validate');\n\n\nconst internals = {};\n\n\nexports.symbol = Symbol('hapi-response');\n\n\nexports.apply = function (type, options, ...message) {\n\n const result = internals[type].validate(options);\n\n if (result.error) {\n throw new Error(`Invalid ${type} options ${message.length ? '(' + message.join(' ') + ')' : ''} ${result.error.annotate()}`);\n }\n\n return result.value;\n};\n\n\nexports.enable = function (options) {\n\n const settings = options ? Object.assign({}, options) : {}; // Shallow cloned\n\n if (settings.security === true) {\n settings.security = {};\n }\n\n if (settings.cors === true) {\n settings.cors = {};\n }\n\n return settings;\n};\n\nexports.versionMatch = (version, range) => Somever.match(version, range, { includePrerelease: true });\n\ninternals.access = Validate.object({\n entity: Validate.valid('user', 'app', 'any'),\n scope: [false, Validate.array().items(Validate.string()).single().min(1)]\n});\n\n\ninternals.auth = Validate.alternatives([\n Validate.string(),\n internals.access.keys({\n mode: Validate.valid('required', 'optional', 'try'),\n strategy: Validate.string(),\n strategies: Validate.array().items(Validate.string()).min(1),\n access: Validate.array().items(internals.access.min(1)).single().min(1),\n payload: [\n Validate.valid('required', 'optional'),\n Validate.boolean()\n ]\n })\n .without('strategy', 'strategies')\n .without('access', ['scope', 'entity'])\n]);\n\n\ninternals.event = Validate.object({\n method: Validate.array().items(Validate.function()).single(),\n options: Validate.object({\n before: Validate.array().items(Validate.string()).single(),\n after: Validate.array().items(Validate.string()).single(),\n bind: Validate.any(),\n sandbox: Validate.valid('server', 'plugin'),\n timeout: Validate.number().integer().min(1)\n })\n .default({})\n});\n\n\ninternals.exts = Validate.array()\n .items(internals.event.keys({ type: Validate.string().required() })).single();\n\n\ninternals.failAction = Validate.alternatives([\n Validate.valid('error', 'log', 'ignore'),\n Validate.function()\n])\n .default('error');\n\n\ninternals.routeBase = Validate.object({\n app: Validate.object().allow(null),\n auth: internals.auth.allow(false),\n bind: Validate.object().allow(null),\n cache: Validate.object({\n expiresIn: Validate.number(),\n expiresAt: Validate.string(),\n privacy: Validate.valid('default', 'public', 'private'),\n statuses: Validate.array().items(Validate.number().integer().min(200)).min(1).single().default([200, 204]),\n otherwise: Validate.string().default('no-cache')\n })\n .allow(false)\n .default(),\n compression: Validate.object()\n .pattern(/.+/, Validate.object())\n .default(),\n cors: Validate.object({\n origin: Validate.array().min(1).allow('ignore').default(['*']),\n maxAge: Validate.number().default(86400),\n headers: Validate.array().items(Validate.string()).default(['Accept', 'Authorization', 'Content-Type', 'If-None-Match']),\n additionalHeaders: Validate.array().items(Validate.string()).default([]),\n exposedHeaders: Validate.array().items(Validate.string()).default(['WWW-Authenticate', 'Server-Authorization']),\n additionalExposedHeaders: Validate.array().items(Validate.string()).default([]),\n credentials: Validate.boolean().when('origin', { is: 'ignore', then: false }).default(false),\n preflightStatusCode: Validate.valid(200, 204).default(200)\n })\n .allow(false, true)\n .default(false),\n ext: Validate.object({\n onPreAuth: Validate.array().items(internals.event).single(),\n onCredentials: Validate.array().items(internals.event).single(),\n onPostAuth: Validate.array().items(internals.event).single(),\n onPreHandler: Validate.array().items(internals.event).single(),\n onPostHandler: Validate.array().items(internals.event).single(),\n onPreResponse: Validate.array().items(internals.event).single(),\n onPostResponse: Validate.array().items(internals.event).single()\n })\n .default({}),\n files: Validate.object({\n relativeTo: Validate.string().pattern(/^([\\/\\.])|([A-Za-z]:\\\\)|(\\\\\\\\)/).default('.')\n })\n .default(),\n json: Validate.object({\n replacer: Validate.alternatives(Validate.function(), Validate.array()).allow(null).default(null),\n space: Validate.number().allow(null).default(null),\n suffix: Validate.string().allow(null).default(null),\n escape: Validate.boolean().default(false)\n })\n .default(),\n log: Validate.object({\n collect: Validate.boolean().default(false)\n })\n .default(),\n payload: Validate.object({\n output: Validate.valid('data', 'stream', 'file').default('data'),\n parse: Validate.boolean().allow('gunzip').default(true),\n multipart: Validate.object({\n output: Validate.valid('data', 'stream', 'file', 'annotated').required()\n })\n .default(false)\n .allow(true, false),\n allow: Validate.array().items(Validate.string()).single(),\n override: Validate.string(),\n protoAction: Validate.valid('error', 'remove', 'ignore').default('error'),\n maxBytes: Validate.number().integer().positive().default(1024 * 1024),\n maxParts: Validate.number().integer().positive().default(1000),\n uploads: Validate.string().default(Os.tmpdir()),\n failAction: internals.failAction,\n timeout: Validate.number().integer().positive().allow(false).default(10 * 1000),\n defaultContentType: Validate.string().default('application/json'),\n compression: Validate.object()\n .pattern(/.+/, Validate.object())\n .default()\n })\n .default(),\n plugins: Validate.object(),\n response: Validate.object({\n disconnectStatusCode: Validate.number().integer().min(400).default(499),\n emptyStatusCode: Validate.valid(200, 204).default(204),\n failAction: internals.failAction,\n modify: Validate.boolean(),\n options: Validate.object(),\n ranges: Validate.boolean().default(true),\n sample: Validate.number().min(0).max(100).when('modify', { then: Validate.forbidden() }),\n schema: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(true, false),\n status: Validate.object().pattern(/\\d\\d\\d/, Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(true, false))\n })\n .default(),\n security: Validate.object({\n hsts: Validate.alternatives([\n Validate.object({\n maxAge: Validate.number(),\n includeSubdomains: Validate.boolean(),\n includeSubDomains: Validate.boolean(),\n preload: Validate.boolean()\n }),\n Validate.boolean(),\n Validate.number()\n ])\n .default(15768000),\n xframe: Validate.alternatives([\n Validate.boolean(),\n Validate.valid('sameorigin', 'deny'),\n Validate.object({\n rule: Validate.valid('sameorigin', 'deny', 'allow-from'),\n source: Validate.string()\n })\n ])\n .default('deny'),\n xss: Validate.valid('enabled', 'disabled', false).default('disabled'),\n noOpen: Validate.boolean().default(true),\n noSniff: Validate.boolean().default(true),\n referrer: Validate.alternatives([\n Validate.boolean().valid(false),\n Validate.valid('', 'no-referrer', 'no-referrer-when-downgrade',\n 'unsafe-url', 'same-origin', 'origin', 'strict-origin',\n 'origin-when-cross-origin', 'strict-origin-when-cross-origin')\n ])\n .default(false)\n })\n .allow(null, false, true)\n .default(false),\n state: Validate.object({\n parse: Validate.boolean().default(true),\n failAction: internals.failAction\n })\n .default(),\n timeout: Validate.object({\n socket: Validate.number().integer().positive().allow(false),\n server: Validate.number().integer().positive().allow(false).default(false)\n })\n .default(),\n validate: Validate.object({\n headers: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, true),\n params: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, true),\n query: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),\n payload: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),\n state: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),\n failAction: internals.failAction,\n errorFields: Validate.object(),\n options: Validate.object().default(),\n validator: Validate.object()\n })\n .default()\n});\n\n\ninternals.server = Validate.object({\n address: Validate.string().hostname(),\n app: Validate.object().allow(null),\n autoListen: Validate.boolean(),\n cache: Validate.allow(null), // Validated elsewhere\n compression: Validate.object({\n minBytes: Validate.number().min(1).integer().default(1024)\n })\n .allow(false)\n .default(),\n debug: Validate.object({\n request: Validate.array().items(Validate.string()).single().allow(false).default(['implementation']),\n log: Validate.array().items(Validate.string()).single().allow(false)\n })\n .allow(false)\n .default(),\n host: Validate.string().hostname().allow(null),\n info: Validate.object({\n remote: Validate.boolean().default(false)\n })\n .default({}),\n listener: Validate.any(),\n load: Validate.object({\n sampleInterval: Validate.number().integer().min(0).default(0)\n })\n .unknown()\n .default(),\n mime: Validate.object().empty(null).default(),\n operations: Validate.object({\n cleanStop: Validate.boolean().default(true)\n })\n .default(),\n plugins: Validate.object(),\n port: Validate.alternatives([\n Validate.number().integer().min(0), // TCP port\n Validate.string().pattern(/\\//), // Unix domain socket\n Validate.string().pattern(/^\\\\\\\\\\.\\\\pipe\\\\/) // Windows named pipe\n ])\n .allow(null),\n query: Validate.object({\n parser: Validate.function()\n })\n .default(),\n router: Validate.object({\n isCaseSensitive: Validate.boolean().default(true),\n stripTrailingSlash: Validate.boolean().default(false)\n })\n .default(),\n routes: internals.routeBase.default(),\n state: Validate.object(), // Cookie defaults\n tls: Validate.alternatives([\n Validate.object().allow(null),\n Validate.boolean()\n ]),\n uri: Validate.string().pattern(/[^/]$/)\n});\n\n\ninternals.vhost = Validate.alternatives([\n Validate.string().hostname(),\n Validate.array().items(Validate.string().hostname()).min(1)\n]);\n\n\ninternals.handler = Validate.alternatives([\n Validate.function(),\n Validate.object().length(1)\n]);\n\n\ninternals.route = Validate.object({\n method: Validate.string().pattern(/^[a-zA-Z0-9!#\\$%&'\\*\\+\\-\\.^_`\\|~]+$/).required(),\n path: Validate.string().required(),\n rules: Validate.object(),\n vhost: internals.vhost,\n\n // Validated in route construction\n\n handler: Validate.any(),\n options: Validate.any(),\n config: Validate.any() // Backwards compatibility\n})\n .without('config', 'options');\n\n\ninternals.pre = [\n Validate.function(),\n Validate.object({\n method: Validate.alternatives(Validate.string(), Validate.function()).required(),\n assign: Validate.string(),\n mode: Validate.valid('serial', 'parallel'),\n failAction: internals.failAction\n })\n];\n\n\ninternals.routeConfig = internals.routeBase.keys({\n description: Validate.string(),\n id: Validate.string(),\n isInternal: Validate.boolean(),\n notes: [\n Validate.string(),\n Validate.array().items(Validate.string())\n ],\n pre: Validate.array().items(...internals.pre.concat(Validate.array().items(...internals.pre).min(1))),\n tags: [\n Validate.string(),\n Validate.array().items(Validate.string())\n ]\n});\n\n\ninternals.cacheConfig = Validate.alternatives([\n Validate.function(),\n Validate.object({\n name: Validate.string().invalid('_default'),\n shared: Validate.boolean(),\n provider: [\n Validate.function(),\n {\n constructor: Validate.function().required(),\n options: Validate.object({\n partition: Validate.string().default('hapi-cache')\n })\n .unknown() // Catbox client validates other keys\n .default({})\n }\n ],\n engine: Validate.object()\n })\n .xor('provider', 'engine')\n]);\n\n\ninternals.cache = Validate.array().items(internals.cacheConfig).min(1).single();\n\n\ninternals.cachePolicy = Validate.object({\n cache: Validate.string().allow(null).allow(''),\n segment: Validate.string(),\n shared: Validate.boolean()\n})\n .unknown(); // Catbox policy validates other keys\n\n\ninternals.method = Validate.object({\n bind: Validate.object().allow(null),\n generateKey: Validate.function(),\n cache: internals.cachePolicy\n});\n\n\ninternals.methodObject = Validate.object({\n name: Validate.string().required(),\n method: Validate.function().required(),\n options: Validate.object()\n});\n\n\ninternals.register = Validate.object({\n once: true,\n routes: Validate.object({\n prefix: Validate.string().pattern(/^\\/.+/),\n vhost: internals.vhost\n })\n .default({})\n});\n\n\ninternals.semver = Validate.string();\n\n\ninternals.plugin = internals.register.keys({\n options: Validate.any(),\n plugin: Validate.object({\n register: Validate.function().required(),\n name: Validate.string().when('pkg.name', { is: Validate.exist(), otherwise: Validate.required() }),\n version: Validate.string(),\n multiple: Validate.boolean().default(false),\n dependencies: [\n Validate.array().items(Validate.string()).single(),\n Validate.object().pattern(/.+/, internals.semver)\n ],\n once: true,\n requirements: Validate.object({\n hapi: Validate.string(),\n node: Validate.string()\n })\n .default(),\n pkg: Validate.object({\n name: Validate.string(),\n version: Validate.string().default('0.0.0')\n })\n .unknown()\n .default({})\n })\n .unknown()\n})\n .without('once', 'options')\n .unknown();\n\n\ninternals.rules = Validate.object({\n validate: Validate.object({\n schema: Validate.alternatives(Validate.object(), Validate.array()).required(),\n options: Validate.object()\n .default({ allowUnknown: true })\n })\n});\n"
},
{
"path": "lib/core.js",
"content": "'use strict';\n\nconst Http = require('http');\nconst Https = require('https');\nconst Os = require('os');\nconst Path = require('path');\n\nconst Boom = require('@hapi/boom');\nconst Bounce = require('@hapi/bounce');\nconst Call = require('@hapi/call');\nconst Catbox = require('@hapi/catbox');\nconst { Engine: CatboxMemory } = require('@hapi/catbox-memory');\nconst { Heavy } = require('@hapi/heavy');\nconst Hoek = require('@hapi/hoek');\nconst { Mimos } = require('@hapi/mimos');\nconst Podium = require('@hapi/podium');\nconst Statehood = require('@hapi/statehood');\n\nconst Auth = require('./auth');\nconst Compression = require('./compression');\nconst Config = require('./config');\nconst Cors = require('./cors');\nconst Ext = require('./ext');\nconst Methods = require('./methods');\nconst Request = require('./request');\nconst Response = require('./response');\nconst Route = require('./route');\nconst Toolkit = require('./toolkit');\nconst Validation = require('./validation');\n\n\nconst internals = {\n counter: {\n min: 10000,\n max: 99999\n },\n events: [\n { name: 'cachePolicy', spread: true },\n { name: 'log', channels: ['app', 'internal'], tags: true },\n { name: 'request', channels: ['app', 'internal', 'error'], tags: true, spread: true },\n 'response',\n 'route',\n 'start',\n 'closing',\n 'stop'\n ],\n badRequestResponse: Buffer.from('HTTP/1.1 400 Bad Request\\r\\n\\r\\n', 'ascii')\n};\n\n\nexports = module.exports = internals.Core = class {\n\n actives = new WeakMap(); // Active requests being processed\n app = {};\n auth = new Auth(this);\n caches = new Map(); // Cache clients\n compression = new Compression();\n controlled = null; // Other servers linked to the phases of this server\n dependencies = []; // Plugin dependencies\n events = new Podium.Podium(internals.events);\n heavy = null;\n info = null;\n instances = new Set();\n listener = null;\n methods = new Methods(this); // Server methods\n mime = null;\n onConnection = null; // Used to remove event listener on stop\n phase = 'stopped'; // 'stopped', 'initializing', 'initialized', 'starting', 'started', 'stopping', 'invalid'\n plugins = {}; // Exposed plugin properties by name\n registrations = {}; // Tracks plugin for dependency validation { name -> { version } }\n registring = 0; // > 0 while register() is waiting for plugin callbacks\n Request = class extends Request { };\n Response = class extends Response { };\n requestCounter = { value: internals.counter.min, min: internals.counter.min, max: internals.counter.max };\n root = null;\n router = null;\n settings = null;\n sockets = null; // Track open sockets for graceful shutdown\n started = false;\n states = null;\n toolkit = new Toolkit.Manager();\n type = null;\n validator = null;\n\n extensionsSeq = 0; // Used to keep absolute order of extensions based on the order added across locations\n extensions = {\n server: {\n onPreStart: new Ext('onPreStart', this),\n onPostStart: new Ext('onPostStart', this),\n onPreStop: new Ext('onPreStop', this),\n onPostStop: new Ext('onPostStop', this)\n },\n route: {\n onRequest: new Ext('onRequest', this),\n onPreAuth: new Ext('onPreAuth', this),\n onCredentials: new Ext('onCredentials', this),\n onPostAuth: new Ext('onPostAuth', this),\n onPreHandler: new Ext('onPreHandler', this),\n onPostHandler: new Ext('onPostHandler', this),\n onPreResponse: new Ext('onPreResponse', this),\n onPostResponse: new Ext('onPostResponse', this)\n }\n };\n\n decorations = {\n handler: new Map(),\n request: new Map(),\n response: new Map(),\n server: new Map(),\n toolkit: new Map(),\n requestApply: null,\n public: { handler: [], request: [], response: [], server: [], toolkit: [] }\n };\n\n constructor(options) {\n\n const { settings, type } = internals.setup(options);\n\n this.settings = settings;\n this.type = type;\n\n this.heavy = new Heavy(this.settings.load);\n this.mime = new Mimos(this.settings.mime);\n this.router = new Call.Router(this.settings.router);\n this.states = new Statehood.Definitions(this.settings.state);\n\n this._debug();\n this._initializeCache();\n\n if (this.settings.routes.validate.validator) {\n this.validator = Validation.validator(this.settings.routes.validate.validator);\n }\n\n this.listener = this._createListener();\n this._initializeListener();\n this.info = this._info();\n }\n\n _debug() {\n\n const debug = this.settings.debug;\n if (!debug) {\n return;\n }\n\n // Subscribe to server log events\n\n const method = (event) => {\n\n const data = event.error ?? event.data;\n console.error('Debug:', event.tags.join(', '), data ? '\\n ' + (data.stack ?? (typeof data === 'object' ? Hoek.stringify(data) : data)) : '');\n };\n\n if (debug.log) {\n const filter = debug.log.some((tag) => tag === '*') ? undefined : debug.log;\n this.events.on({ name: 'log', filter }, method);\n }\n\n if (debug.request) {\n const filter = debug.request.some((tag) => tag === '*') ? undefined : debug.request;\n this.events.on({ name: 'request', filter }, (request, event) => method(event));\n }\n }\n\n _initializeCache() {\n\n if (this.settings.cache) {\n this._createCache(this.settings.cache);\n }\n\n if (!this.caches.has('_default')) {\n this._createCache([{ provider: CatboxMemory }]); // Defaults to memory-based\n }\n }\n\n _info() {\n\n const now = Date.now();\n const protocol = this.type === 'tcp' ? (this.settings.tls ? 'https' : 'http') : this.type;\n const host = this.settings.host || Os.hostname() || 'localhost';\n const port = this.settings.port;\n\n const info = {\n created: now,\n started: 0,\n host,\n port,\n protocol,\n id: Os.hostname() + ':' + process.pid + ':' + now.toString(36),\n uri: this.settings.uri ?? (protocol + ':' + (this.type === 'tcp' ? '//' + host + (port ? ':' + port : '') : port))\n };\n\n return info;\n }\n\n _counter() {\n\n const next = ++this.requestCounter.value;\n\n if (this.requestCounter.value > this.requestCounter.max) {\n this.requestCounter.value = this.requestCounter.min;\n }\n\n return next - 1;\n }\n\n _createCache(configs) {\n\n Hoek.assert(this.phase !== 'initializing', 'Cannot provision server cache while server is initializing');\n\n configs = Config.apply('cache', configs);\n\n const added = [];\n for (let config of configs) {\n\n // (type: 'handler', property: P, method: HandlerDecorationMethod, options?: { apply?: boolean | undefined, extend?: never }): void;\n\n decorate
(type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'toolkit', property: ExceptName (type: 'toolkit', property: ExceptName (type: 'toolkit', property: ExceptName (type: 'toolkit', property: ExceptName (type: 'server', property: ExceptName (type: 'server', property: ExceptName (type: 'server', property: ExceptName (type: 'server', property: ExceptName