+
-### Web and services application framework
+# @hapi/hapi
-
+#### The Simple, Secure Framework Developers Trust
-Lead Maintainer: [Eran Hammer](https://github.com/hueniverse)
+Build powerful, scalable applications, with minimal overhead and full out-of-the-box functionality - your code, your way.
-**hapi** is sponsored by [Sideway](https://sideway.com).
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
-**hapi** is a simple to use configuration-centric framework with built-in support for input validation, caching,
-authentication, and other essential facilities for building web and services applications. **hapi** enables
-developers to focus on writing reusable application logic in a highly modular and prescriptive approach.
+## Useful resources
-Development version: **10.0.x** ([release notes](https://github.com/hapijs/hapi/issues?labels=release+notes&page=1&state=closed))
-[](http://travis-ci.org/hapijs/hapi)
+- [Documentation and API](https://hapi.dev/)
+- [Version status](https://hapi.dev/resources/status/#hapi) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/resources/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Support](https://hapi.dev/support/)
-For the latest updates, [change log](http://hapijs.com/updates), and release information visit [hapijs.com](http://hapijs.com) and follow [@hapijs](https://twitter.com/hapijs) on twitter. If you have questions, please open an issue in the
-[discussion forum](https://github.com/hapijs/discuss).
+## Technical Steering Committee (TSC) Members
+
+ - Devin Ivy ([@devinivy](https://github.com/devinivy))
+ - Lloyd Benson ([@lloydbenson](https://github.com/lloydbenson))
+ - Nathan LaFreniere ([@nlf](https://github.com/nlf))
+ - Wyatt Lyon Preul ([@geek](https://github.com/geek))
+ - Nicolas Morel ([@marsup](https://github.com/marsup))
+ - Jonathan Samines ([@jonathansamines](https://github.com/jonathansamines))
diff --git a/SPONSORS.md b/SPONSORS.md
new file mode 100755
index 000000000..3a1841fdf
--- /dev/null
+++ b/SPONSORS.md
@@ -0,0 +1,15 @@
+We'd like to thank our sponsors as well as the legacy sponsors who have supported hapi throughout the years. Thanks so much for your support!
+
+> Below are hapi's top recurring sponsors, but there are many more to thank. For the complete list, see [hapi.dev/policies/sponsors](https://hapi.dev/policies/sponsors/) or [hapijs/.github/SPONSORS.md](https://github.com/hapijs/.github/blob/master/SPONSORS.md).
+
+# Staff Sponsors
+
+- [Big Room Studios](https://www.bigroomstudios.com/)
+- [Dixeed](https://dixeed.com/)
+
+# Top Sponsors
+
+- Fabian Gündel / [DataWrapper.de](https://www.datawrapper.de/)
+- Devin Stewart
+- [Raider.IO](https://raider.io/)
+- [Florence Healthcare](https://florencehc.com/)
diff --git a/images/hapi.png b/images/hapi.png
deleted file mode 100755
index 92938ede7..000000000
Binary files a/images/hapi.png and /dev/null differ
diff --git a/lib/auth.js b/lib/auth.js
index 5c8fa84b4..e3de0fc7f 100755
--- a/lib/auth.js
+++ b/lib/auth.js
@@ -1,414 +1,571 @@
-// Load modules
+'use strict';
-var Boom = require('boom');
-var Hoek = require('hoek');
-var Schema = require('./schema');
+const Boom = require('@hapi/boom');
+const Bounce = require('@hapi/bounce');
+const Hoek = require('@hapi/hoek');
+const Config = require('./config');
+const Request = require('./request');
-// Declare internals
-var internals = {};
+const internals = {
+ missing: Symbol('missing')
+};
+
+exports = module.exports = internals.Auth = class {
-exports = module.exports = internals.Auth = function (connection) {
+ #core = null;
+ #schemes = {};
+ #strategies = {};
- this.connection = connection;
- this._schemes = {};
- this._strategies = {};
- this.settings = {
+ api = {}; // Do not reassign api or settings, as they are referenced in public()
+ settings = {
default: null // Strategy used as default if route has no auth settings
};
-};
+ constructor(core) {
-internals.Auth.prototype.scheme = function (name, scheme) {
+ this.#core = core;
+ }
- Hoek.assert(name, 'Authentication scheme must have a name');
- Hoek.assert(!this._schemes[name], 'Authentication scheme name already exists:', name);
- Hoek.assert(typeof scheme === 'function', 'scheme must be a function:', name);
+ public(server) {
+
+ return {
+ api: this.api,
+ settings: this.settings,
+ scheme: this.scheme.bind(this),
+ strategy: this._strategy.bind(this, server),
+ default: this.default.bind(this),
+ test: this.test.bind(this),
+ verify: this.verify.bind(this),
+ lookup: this.lookup.bind(this)
+ };
+ }
- this._schemes[name] = scheme;
-};
+ scheme(name, scheme) {
+ Hoek.assert(name, 'Authentication scheme must have a name');
+ Hoek.assert(!this.#schemes[name], 'Authentication scheme name already exists:', name);
+ Hoek.assert(typeof scheme === 'function', 'scheme must be a function:', name);
-internals.Auth.prototype.strategy = function (name, scheme /*, mode, options */) {
+ this.#schemes[name] = scheme;
+ }
- var hasMode = (typeof arguments[2] === 'string' || typeof arguments[2] === 'boolean');
- var mode = (hasMode ? arguments[2] : false);
- var options = (hasMode ? arguments[3] : arguments[2]) || null;
+ _strategy(server, name, scheme, options = {}) {
- Hoek.assert(name, 'Authentication strategy must have a name');
- Hoek.assert(name !== 'bypass', 'Cannot use reserved strategy name: bypass');
- Hoek.assert(!this._strategies[name], 'Authentication strategy name already exists');
- Hoek.assert(scheme, 'Authentication strategy', name, 'missing scheme');
- Hoek.assert(this._schemes[scheme], 'Authentication strategy', name, 'uses unknown scheme:', scheme);
+ Hoek.assert(name, 'Authentication strategy must have a name');
+ Hoek.assert(typeof options === 'object', 'options must be an object');
+ Hoek.assert(!this.#strategies[name], 'Authentication strategy name already exists');
+ Hoek.assert(scheme, 'Authentication strategy', name, 'missing scheme');
+ Hoek.assert(this.#schemes[scheme], 'Authentication strategy', name, 'uses unknown scheme:', scheme);
- var server = this.connection.server._clone([this.connection], '');
- var strategy = this._schemes[scheme](server, options);
+ server = server._clone();
+ const strategy = this.#schemes[scheme](server, options);
- Hoek.assert(strategy.authenticate, 'Invalid scheme:', name, 'missing authenticate() method');
- Hoek.assert(typeof strategy.authenticate === 'function', 'Invalid scheme:', name, 'invalid authenticate() method');
- Hoek.assert(!strategy.payload || typeof strategy.payload === 'function', 'Invalid scheme:', name, 'invalid payload() method');
- Hoek.assert(!strategy.response || typeof strategy.response === 'function', 'Invalid scheme:', name, 'invalid response() method');
- strategy.options = strategy.options || {};
- Hoek.assert(strategy.payload || !strategy.options.payload, 'Cannot require payload validation without a payload method');
+ Hoek.assert(strategy.authenticate, 'Invalid scheme:', name, 'missing authenticate() method');
+ Hoek.assert(typeof strategy.authenticate === 'function', 'Invalid scheme:', name, 'invalid authenticate() method');
+ Hoek.assert(!strategy.payload || typeof strategy.payload === 'function', 'Invalid scheme:', name, 'invalid payload() method');
+ Hoek.assert(!strategy.response || typeof strategy.response === 'function', 'Invalid scheme:', name, 'invalid response() method');
+ strategy.options = strategy.options ?? {};
+ Hoek.assert(strategy.payload || !strategy.options.payload, 'Cannot require payload validation without a payload method');
- this._strategies[name] = {
- methods: strategy,
- realm: server.realm
- };
+ this.#strategies[name] = {
+ methods: strategy,
+ realm: server.realm
+ };
- if (mode) {
- this.default({ strategies: [name], mode: mode === true ? 'required' : mode });
+ if (strategy.api) {
+ this.api[name] = strategy.api;
+ }
}
-};
-
-internals.Auth.prototype.default = function (options) {
+ default(options) {
- Schema.assert('auth', options, 'default strategy');
- Hoek.assert(!this.settings.default, 'Cannot set default strategy more than once');
+ Hoek.assert(!this.settings.default, 'Cannot set default strategy more than once');
+ options = Config.apply('auth', options, 'default strategy');
- var settings = Hoek.clone(options); // options can be reused
+ this.settings.default = this._setupRoute(Hoek.clone(options)); // Prevent changes to options
- if (typeof settings === 'string') {
- settings = {
- strategies: [settings],
- mode: 'required'
- };
- }
- else if (settings.strategy) {
- settings.strategies = [settings.strategy];
- delete settings.strategy;
+ const routes = this.#core.router.table();
+ for (const route of routes) {
+ route.rebuild();
+ }
}
- Hoek.assert(settings.strategies && settings.strategies.length, 'Default authentication strategy missing strategy name');
+ async test(name, request) {
- this.settings.default = settings;
-};
+ Hoek.assert(name, 'Missing authentication strategy name');
+ const strategy = this.#strategies[name];
+ Hoek.assert(strategy, 'Unknown authentication strategy:', name);
+ const bind = strategy.methods;
+ const realm = strategy.realm;
+ const response = await request._core.toolkit.execute(strategy.methods.authenticate, request, { bind, realm, auth: true });
-internals.Auth.prototype.test = function (name, request, next) {
+ if (!response.isAuth) {
+ throw response;
+ }
- Hoek.assert(name, 'Missing authentication strategy name');
- var strategy = this._strategies[name];
- Hoek.assert(strategy, 'Unknown authentication strategy:', name);
+ if (response.error) {
+ throw response.error;
+ }
- var transfer = function (response, data) {
+ return response.data;
+ }
- return next(response, data && data.credentials);
- };
+ async verify(request) {
- var reply = request.server._replier.interface(request, strategy.realm, transfer);
- strategy.methods.authenticate(request, reply);
-};
+ const auth = request.auth;
+ if (auth.error) {
+ throw auth.error;
+ }
-internals.Auth.prototype._setupRoute = function (options, path) {
+ if (!auth.isAuthenticated) {
+ return;
+ }
- var self = this;
+ const strategy = this.#strategies[auth.strategy];
+ Hoek.assert(strategy, 'Unknown authentication strategy:', auth.strategy);
- if (!options) {
- return options; // Preseve the difference between undefined and false
- }
+ if (!strategy.methods.verify) {
+ return;
+ }
- if (typeof options === 'string') {
- options = { strategies: [options] };
- }
- else if (options.strategy) {
- options.strategies = [options.strategy];
- delete options.strategy;
+ const bind = strategy.methods;
+ await strategy.methods.verify.call(bind, auth);
}
- if (!options.strategies) {
- Hoek.assert(this.settings.default, 'Route missing authentication strategy and no default defined:', path);
- options = Hoek.applyToDefaults(this.settings.default, options);
+ static testAccess(request, route) {
+
+ const auth = request._core.auth;
+
+ try {
+ return auth._access(request, route);
+ }
+ catch (err) {
+ Bounce.rethrow(err, 'system');
+ return false;
+ }
}
- if (options.scope) {
- if (typeof options.scope === 'string') {
- options.scope = [options.scope];
+ _setupRoute(options, path) {
+
+ if (!options) {
+ return options; // Preserve the difference between undefined and false
}
- for (var i = 0, il = options.scope.length; i < il; ++i) {
- if (/{([^}]+)}/.test(options.scope[i])) {
- options.hasScopeParameters = true;
- break;
- }
+ if (typeof options === 'string') {
+ options = { strategies: [options] };
+ }
+ else if (options.strategy) {
+ options.strategies = [options.strategy];
+ delete options.strategy;
}
- }
- Hoek.assert(options.strategies.length, 'Route missing authentication strategy:', path);
+ if (path &&
+ !options.strategies) {
- options.mode = options.mode || 'required';
- if (options.payload === true) {
- options.payload = 'required';
- }
+ Hoek.assert(this.settings.default, 'Route missing authentication strategy and no default defined:', path);
+ options = Hoek.applyToDefaults(this.settings.default, options);
+ }
- var hasAuthenticatePayload = false;
- options.strategies.forEach(function (name) {
+ path = path ?? 'default strategy';
+ Hoek.assert(options.strategies?.length, 'Missing authentication strategy:', path);
- var strategy = self._strategies[name];
- Hoek.assert(strategy, 'Unknown authentication strategy:', name, 'in path:', path);
- Hoek.assert(strategy.methods.payload || options.payload !== 'required', 'Payload validation can only be required when all strategies support it in path:', path);
- hasAuthenticatePayload = hasAuthenticatePayload || strategy.methods.payload;
- Hoek.assert(!strategy.methods.options.payload || options.payload === undefined || options.payload === 'required', 'Cannot set authentication payload to', options.payload, 'when a strategy requires payload validation', path);
- });
+ options.mode = options.mode ?? 'required';
- Hoek.assert(!options.payload || hasAuthenticatePayload, 'Payload authentication requires at least one strategy with payload support in path:', path);
+ if (options.entity !== undefined || // Backwards compatibility with <= 11.x.x
+ options.scope !== undefined) {
- return options;
-};
+ options.access = [{ entity: options.entity, scope: options.scope }];
+ delete options.entity;
+ delete options.scope;
+ }
+ if (options.access) {
+ for (const access of options.access) {
+ access.scope = internals.setupScope(access);
+ }
+ }
-internals.Auth.prototype.lookup = function (route) {
+ if (options.payload === true) {
+ options.payload = 'required';
+ }
- if (route.settings.auth === false) {
- return false;
+ let hasAuthenticatePayload = false;
+ for (const name of options.strategies) {
+ const strategy = this.#strategies[name];
+ Hoek.assert(strategy, 'Unknown authentication strategy', name, 'in', path);
+
+ Hoek.assert(strategy.methods.payload || options.payload !== 'required', 'Payload validation can only be required when all strategies support it in', path);
+ hasAuthenticatePayload = hasAuthenticatePayload || strategy.methods.payload;
+ Hoek.assert(!strategy.methods.options.payload || options.payload === undefined || options.payload === 'required', 'Cannot set authentication payload to', options.payload, 'when a strategy requires payload validation in', path);
+ }
+
+ Hoek.assert(!options.payload || hasAuthenticatePayload, 'Payload authentication requires at least one strategy with payload support in', path);
+
+ return options;
}
- return route.settings.auth || this.settings.default;
-};
+ lookup(route) {
+ if (route.settings.auth === false) {
+ return false;
+ }
-internals.Auth.authenticate = function (request, next) {
+ return route.settings.auth || this.settings.default;
+ }
- var auth = request.connection.auth;
- return auth._authenticate(request, next);
-};
+ _enabled(route, type) {
+ const config = this.lookup(route);
+ if (!config) {
+ return false;
+ }
-internals.Auth.prototype._authenticate = function (request, next) {
+ if (type === 'authenticate') {
+ return true;
+ }
- var self = this;
+ if (type === 'access') {
+ return !!config.access;
+ }
- var config = this.lookup(request.route);
- if (!config) {
- return next();
- }
+ for (const name of config.strategies) {
+ const strategy = this.#strategies[name];
+ if (strategy.methods[type]) {
+ return true;
+ }
+ }
- request.auth.mode = config.mode;
+ return false;
+ }
- var authErrors = [];
- var strategyPos = 0;
+ static authenticate(request) {
- var authenticate = function () {
+ const auth = request._core.auth;
+ return auth._authenticate(request);
+ }
- // Find next strategy
+ async _authenticate(request) {
- if (strategyPos >= config.strategies.length) {
- var err = Boom.unauthorized('Missing authentication', authErrors);
+ const config = this.lookup(request.route);
- if (config.mode === 'optional' ||
- config.mode === 'try') {
+ const errors = [];
+ request.auth.mode = config.mode;
- request.auth.isAuthenticated = false;
- request.auth.credentials = null;
- request.auth.error = err;
- request._log(['auth', 'unauthenticated']);
- return next();
- }
+ // Injection bypass
- return next(err);
+ if (request.auth.credentials) {
+ internals.validate(null, { credentials: request.auth.credentials, artifacts: request.auth.artifacts }, request.auth.strategy, config, request, errors);
+ return;
}
- var name = config.strategies[strategyPos];
- ++strategyPos;
+ // Try each strategy
- request._protect.run('auth:request:' + name, validate, function (exit) {
+ for (const name of config.strategies) {
+ const strategy = this.#strategies[name];
- var transfer = function (response, data) {
+ const bind = strategy.methods;
+ const realm = strategy.realm;
+ const response = await request._core.toolkit.execute(strategy.methods.authenticate, request, { bind, realm, auth: true });
- exit(response, name, data);
- };
+ const message = (response.isAuth ? internals.validate(response.error, response.data, name, config, request, errors) : internals.validate(response, null, name, config, request, errors));
+ if (!message) {
+ return;
+ }
- var strategy = self._strategies[name];
- var reply = request.server._replier.interface(request, strategy.realm, transfer);
- strategy.methods.authenticate(request, reply);
- });
- };
+ if (message !== internals.missing) {
+ return message;
+ }
+ }
- var validate = function (err, name, result) { // err can be Boom, Error, or a valid response object
+ // No more strategies
- if (!name) {
- return next(err);
+ const err = Boom.unauthorized('Missing authentication', errors);
+ if (config.mode === 'required') {
+ throw err;
}
- result = result || {};
+ request.auth.isAuthenticated = false;
+ request.auth.credentials = null;
+ request.auth.error = err;
+ request._log(['auth', 'unauthenticated']);
+ }
- // Unauthenticated
+ static access(request) {
- if (!err &&
- !result.credentials) {
+ const auth = request._core.auth;
+ request.auth.isAuthorized = auth._access(request);
+ }
+
+ _access(request, route) {
- return next(Boom.badImplementation('Authentication response missing both error and credentials'));
+ const config = this.lookup(route || request.route);
+ if (!config?.access) {
+ return true;
}
- if (err) {
- if (err instanceof Error === false) {
- request._log(['auth', 'unauthenticated', 'response', name], err.statusCode);
- return next(err);
+ const credentials = request.auth.credentials;
+ if (!credentials) {
+ if (config.mode !== 'required') {
+ return false;
}
- if (err.isMissing) {
+ throw Boom.forbidden('Request is unauthenticated');
+ }
+
+ const requestEntity = (credentials.user ? 'user' : 'app');
+
+ const scopeErrors = [];
+ for (const access of config.access) {
- // Try next name
+ // Check entity
- request._log(['auth', 'unauthenticated', 'missing', name], err);
- authErrors.push(err.output.headers['WWW-Authenticate']);
- return authenticate();
+ const entity = access.entity;
+ if (entity &&
+ entity !== 'any' &&
+ entity !== requestEntity) {
+
+ continue;
}
- if (config.mode === 'try') {
- request.auth.isAuthenticated = false;
- request.auth.strategy = name;
- request.auth.credentials = result.credentials;
- request.auth.artifacts = result.artifacts;
- request.auth.error = err;
- request._log(['auth', 'unauthenticated', 'try', name], err);
- return next();
+ // Check scope
+
+ let scope = access.scope;
+ if (scope) {
+ if (!credentials.scope) {
+ scopeErrors.push(scope);
+ continue;
+ }
+
+ scope = internals.expandScope(request, scope);
+ if (!internals.validateScope(credentials, scope, 'required') ||
+ !internals.validateScope(credentials, scope, 'selection') ||
+ !internals.validateScope(credentials, scope, 'forbidden')) {
+
+ scopeErrors.push(scope);
+ continue;
+ }
}
- request._log(['auth', 'unauthenticated', 'error', name], err);
- return next(err);
+ return true;
}
- // Authenticated
+ // Scope error
- var credentials = result.credentials;
- request.auth.strategy = name;
- request.auth.credentials = credentials;
- request.auth.artifacts = result.artifacts;
+ if (scopeErrors.length) {
+ request._log(['auth', 'scope', 'error']);
+ throw Boom.forbidden('Insufficient scope', { got: credentials.scope, need: scopeErrors });
+ }
- // Check scope
+ // Entity error
- if (config.scope) {
- var scopes = config.scope;
- if (config.hasScopeParameters) {
- scopes = [];
- var context = { params: request.params, query: request.query };
- for (var i = 0, il = config.scope.length; i < il; ++i) {
- scopes[i] = Hoek.reachTemplate(context, config.scope[i]);
- }
- }
+ if (requestEntity === 'app') {
+ request._log(['auth', 'entity', 'user', 'error']);
+ throw Boom.forbidden('Application credentials cannot be used on a user endpoint');
+ }
- if (!credentials.scope ||
- (typeof credentials.scope === 'string' ? scopes.indexOf(credentials.scope) === -1 : !Hoek.intersect(scopes, credentials.scope).length)) {
+ request._log(['auth', 'entity', 'app', 'error']);
+ throw Boom.forbidden('User credentials cannot be used on an application endpoint');
+ }
- request._log(['auth', 'scope', 'error', name], { got: credentials.scope, need: scopes });
- return next(Boom.forbidden('Insufficient scope, expected any of: ' + scopes));
- }
+ static async payload(request) {
+
+ if (!request.auth.isAuthenticated || !request.auth[Request.symbols.authPayload]) {
+ return;
+ }
+
+ const auth = request._core.auth;
+ const strategy = auth.#strategies[request.auth.strategy];
+ Hoek.assert(strategy, 'Unknown authentication strategy:', request.auth.strategy);
+
+ if (!strategy.methods.payload) {
+ return;
}
- // Check entity
+ const config = auth.lookup(request.route);
+ const setting = config.payload ?? (strategy.methods.options.payload ? 'required' : false);
+ if (!setting) {
+ return;
+ }
- var entity = config.entity || 'any';
+ const bind = strategy.methods;
+ const realm = strategy.realm;
+ const response = await request._core.toolkit.execute(strategy.methods.payload, request, { bind, realm });
- // Entity: 'any'
+ if (response.isBoom &&
+ response.isMissing) {
- if (entity === 'any') {
- request._log(['auth', name]);
- request.auth.isAuthenticated = true;
- return next();
+ return setting === 'optional' ? undefined : Boom.unauthorized('Missing payload authentication');
}
- // Entity: 'user'
+ return response;
+ }
- if (entity === 'user') {
- if (!credentials.user) {
- request._log(['auth', 'entity', 'user', 'error', name]);
- return next(Boom.forbidden('Application credentials cannot be used on a user endpoint'));
- }
+ static async response(response) {
- request._log(['auth', name]);
- request.auth.isAuthenticated = true;
- return next();
+ const request = response.request;
+ const auth = request._core.auth;
+ if (!request.auth.isAuthenticated) {
+ return;
}
- // Entity: 'app'
+ const strategy = auth.#strategies[request.auth.strategy];
+ Hoek.assert(strategy, 'Unknown authentication strategy:', request.auth.strategy);
- if (credentials.user) {
- request._log(['auth', 'entity', 'app', 'error', name]);
- return next(Boom.forbidden('User credentials cannot be used on an application endpoint'));
+ if (!strategy.methods.response) {
+ return;
}
- request._log(['auth', name]);
- request.auth.isAuthenticated = true;
- return next();
- };
+ const bind = strategy.methods;
+ const realm = strategy.realm;
+ const error = await request._core.toolkit.execute(strategy.methods.response, request, { bind, realm, continue: 'undefined' });
+ if (error) {
+ throw error;
+ }
+ }
+};
- // Injection bypass
- if (request.auth.credentials) {
- return validate(null, 'bypass', { credentials: request.auth.credentials, artifacts: request.auth.artifacts });
+internals.setupScope = function (access) {
+
+ // No scopes
+
+ if (!access.scope) {
+ return false;
}
- // Authenticate
+ // Already setup
- authenticate();
+ if (!Array.isArray(access.scope)) {
+ return access.scope;
+ }
+
+ const scope = {};
+ for (const value of access.scope) {
+ const prefix = value[0];
+ const type = prefix === '+' ? 'required' : (prefix === '!' ? 'forbidden' : 'selection');
+ const clean = type === 'selection' ? value : value.slice(1);
+ scope[type] = scope[type] ?? [];
+ scope[type].push(clean);
+
+ if ((!scope._hasParameters?.[type]) &&
+ /{([^}]+)}/.test(clean)) {
+
+ scope._hasParameters = scope._hasParameters ?? {};
+ scope._hasParameters[type] = true;
+ }
+ }
+
+ return scope;
};
-internals.Auth.payload = function (request, next) {
+internals.validate = function (err, result, name, config, request, errors) { // err can be Boom, Error, or a valid response object
+
+ result = result ?? {};
+ request.auth.isAuthenticated = !err;
+
+ if (err) {
+
+ // Non-error response
+
+ if (err instanceof Error === false) {
+ request._log(['auth', 'unauthenticated', 'response', name], { statusCode: err.statusCode });
+ return err;
+ }
+
+ // Missing authenticated
+
+ if (err.isMissing) {
+ request._log(['auth', 'unauthenticated', 'missing', name], err);
+ errors.push(err.output.headers['WWW-Authenticate']);
+ return internals.missing;
+ }
+ }
+
+ request.auth.strategy = name;
+ request.auth.credentials = result.credentials;
+ request.auth.artifacts = result.artifacts;
- if (!request.auth.isAuthenticated ||
- request.auth.strategy === 'bypass') {
+ // Authenticated
- return next();
+ if (!err) {
+ return;
}
- var auth = request.connection.auth;
- var strategy = auth._strategies[request.auth.strategy];
+ // Unauthenticated
- if (!strategy.methods.payload) {
- return next();
+ request.auth.error = err;
+
+ if (config.mode === 'try') {
+ request._log(['auth', 'unauthenticated', 'try', name], err);
+ return;
}
- var config = auth.lookup(request.route);
- var setting = config.payload || (strategy.methods.options.payload ? 'required' : false);
- if (!setting) {
- return next();
+ request._log(['auth', 'unauthenticated', 'error', name], err);
+ throw err;
+};
+
+
+internals.expandScope = function (request, scope) {
+
+ if (!scope._hasParameters) {
+ return scope;
}
- var finalize = function (response) {
+ const expanded = {
+ required: internals.expandScopeType(request, scope, 'required'),
+ selection: internals.expandScopeType(request, scope, 'selection'),
+ forbidden: internals.expandScopeType(request, scope, 'forbidden')
+ };
- if (response &&
- response.isBoom &&
- response.isMissing) {
+ return expanded;
+};
- return next(setting === 'optional' ? null : Boom.unauthorized('Missing payload authentication'));
- }
- return next(response);
+internals.expandScopeType = function (request, scope, type) {
+
+ if (!scope._hasParameters[type]) {
+ return scope[type];
+ }
+
+ const expanded = [];
+ const context = {
+ params: request.params,
+ query: request.query,
+ payload: request.payload,
+ credentials: request.auth.credentials
};
- request._protect.run('auth:payload:' + request.auth.strategy, finalize, function (exit) {
+ for (const template of scope[type]) {
+ expanded.push(Hoek.reachTemplate(context, template));
+ }
- var reply = request.server._replier.interface(request, strategy.realm, exit);
- strategy.methods.payload(request, reply);
- });
+ return expanded;
};
-internals.Auth.response = function (request, next) {
-
- var auth = request.connection.auth;
- var config = auth.lookup(request.route);
- if (!config ||
- !request.auth.isAuthenticated ||
- request.auth.strategy === 'bypass') {
+internals.validateScope = function (credentials, scope, type) {
- return next();
+ if (!scope[type]) {
+ return true;
}
- var strategy = auth._strategies[request.auth.strategy];
- if (!strategy.methods.response) {
- return next();
+ const count = typeof credentials.scope === 'string' ?
+ scope[type].indexOf(credentials.scope) !== -1 ? 1 : 0 :
+ Hoek.intersect(scope[type], credentials.scope).length;
+
+ if (type === 'forbidden') {
+ return count === 0;
}
- request._protect.run('auth:response:' + request.auth.strategy, next, function (exit) {
+ if (type === 'required') {
+ return count === scope.required.length;
+ }
- var reply = request.server._replier.interface(request, strategy.realm, exit);
- strategy.methods.response(request, reply);
- });
+ return !!count;
};
diff --git a/lib/compression.js b/lib/compression.js
new file mode 100755
index 000000000..3e4c692e4
--- /dev/null
+++ b/lib/compression.js
@@ -0,0 +1,119 @@
+'use strict';
+
+const Zlib = require('zlib');
+
+const Accept = require('@hapi/accept');
+const Bounce = require('@hapi/bounce');
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {
+ common: ['gzip, deflate', 'deflate, gzip', 'gzip', 'deflate', 'gzip, deflate, br']
+};
+
+
+exports = module.exports = internals.Compression = class {
+
+ decoders = {
+ gzip: (options) => Zlib.createGunzip(options),
+ deflate: (options) => Zlib.createInflate(options)
+ };
+
+ encodings = ['identity', 'gzip', 'deflate'];
+
+ encoders = {
+ identity: null,
+ gzip: (options) => Zlib.createGzip(options),
+ deflate: (options) => Zlib.createDeflate(options)
+ };
+
+ #common = null;
+
+ constructor() {
+
+ this._updateCommons();
+ }
+
+ _updateCommons() {
+
+ this.#common = new Map();
+
+ for (const header of internals.common) {
+ this.#common.set(header, Accept.encoding(header, this.encodings));
+ }
+ }
+
+ addEncoder(encoding, encoder) {
+
+ Hoek.assert(this.encoders[encoding] === undefined, `Cannot override existing encoder for ${encoding}`);
+ Hoek.assert(typeof encoder === 'function', `Invalid encoder function for ${encoding}`);
+ this.encoders[encoding] = encoder;
+ this.encodings.unshift(encoding);
+ this._updateCommons();
+ }
+
+ addDecoder(encoding, decoder) {
+
+ Hoek.assert(this.decoders[encoding] === undefined, `Cannot override existing decoder for ${encoding}`);
+ Hoek.assert(typeof decoder === 'function', `Invalid decoder function for ${encoding}`);
+ this.decoders[encoding] = decoder;
+ }
+
+ accept(request) {
+
+ const header = request.headers['accept-encoding'];
+ if (!header) {
+ return 'identity';
+ }
+
+ const common = this.#common.get(header);
+ if (common) {
+ return common;
+ }
+
+ try {
+ return Accept.encoding(header, this.encodings);
+ }
+ catch (err) {
+ Bounce.rethrow(err, 'system');
+ err.header = header;
+ request._log(['accept-encoding', 'error'], err);
+ return 'identity';
+ }
+ }
+
+ encoding(response, length) {
+
+ if (response.settings.compressed) {
+ response.headers['content-encoding'] = response.settings.compressed;
+ return null;
+ }
+
+ const request = response.request;
+ if (!request._core.settings.compression ||
+ length !== null && length < request._core.settings.compression.minBytes) {
+
+ return null;
+ }
+
+ const mime = request._core.mime.type(response.headers['content-type'] || 'application/octet-stream');
+ if (!mime.compressible) {
+ return null;
+ }
+
+ response.vary('accept-encoding');
+
+ if (response.headers['content-encoding']) {
+ return null;
+ }
+
+ return request.info.acceptEncoding === 'identity' ? null : request.info.acceptEncoding;
+ }
+
+ encoder(request, encoding) {
+
+ const encoder = this.encoders[encoding];
+ Hoek.assert(encoder !== undefined, `Unknown encoding ${encoding}`);
+ return encoder(request.route.settings.compression[encoding]);
+ }
+};
diff --git a/lib/config.js b/lib/config.js
new file mode 100755
index 000000000..2b668f97d
--- /dev/null
+++ b/lib/config.js
@@ -0,0 +1,446 @@
+'use strict';
+
+const Os = require('os');
+
+const Somever = require('@hapi/somever');
+const Validate = require('@hapi/validate');
+
+
+const internals = {};
+
+
+exports.symbol = Symbol('hapi-response');
+
+
+exports.apply = function (type, options, ...message) {
+
+ const result = internals[type].validate(options);
+
+ if (result.error) {
+ throw new Error(`Invalid ${type} options ${message.length ? '(' + message.join(' ') + ')' : ''} ${result.error.annotate()}`);
+ }
+
+ return result.value;
+};
+
+
+exports.enable = function (options) {
+
+ const settings = options ? Object.assign({}, options) : {}; // Shallow cloned
+
+ if (settings.security === true) {
+ settings.security = {};
+ }
+
+ if (settings.cors === true) {
+ settings.cors = {};
+ }
+
+ return settings;
+};
+
+exports.versionMatch = (version, range) => Somever.match(version, range, { includePrerelease: true });
+
+internals.access = Validate.object({
+ entity: Validate.valid('user', 'app', 'any'),
+ scope: [false, Validate.array().items(Validate.string()).single().min(1)]
+});
+
+
+internals.auth = Validate.alternatives([
+ Validate.string(),
+ internals.access.keys({
+ mode: Validate.valid('required', 'optional', 'try'),
+ strategy: Validate.string(),
+ strategies: Validate.array().items(Validate.string()).min(1),
+ access: Validate.array().items(internals.access.min(1)).single().min(1),
+ payload: [
+ Validate.valid('required', 'optional'),
+ Validate.boolean()
+ ]
+ })
+ .without('strategy', 'strategies')
+ .without('access', ['scope', 'entity'])
+]);
+
+
+internals.event = Validate.object({
+ method: Validate.array().items(Validate.function()).single(),
+ options: Validate.object({
+ before: Validate.array().items(Validate.string()).single(),
+ after: Validate.array().items(Validate.string()).single(),
+ bind: Validate.any(),
+ sandbox: Validate.valid('server', 'plugin'),
+ timeout: Validate.number().integer().min(1)
+ })
+ .default({})
+});
+
+
+internals.exts = Validate.array()
+ .items(internals.event.keys({ type: Validate.string().required() })).single();
+
+
+internals.failAction = Validate.alternatives([
+ Validate.valid('error', 'log', 'ignore'),
+ Validate.function()
+])
+ .default('error');
+
+
+internals.routeBase = Validate.object({
+ app: Validate.object().allow(null),
+ auth: internals.auth.allow(false),
+ bind: Validate.object().allow(null),
+ cache: Validate.object({
+ expiresIn: Validate.number(),
+ expiresAt: Validate.string(),
+ privacy: Validate.valid('default', 'public', 'private'),
+ statuses: Validate.array().items(Validate.number().integer().min(200)).min(1).single().default([200, 204]),
+ otherwise: Validate.string().default('no-cache')
+ })
+ .allow(false)
+ .default(),
+ compression: Validate.object()
+ .pattern(/.+/, Validate.object())
+ .default(),
+ cors: Validate.object({
+ origin: Validate.array().min(1).allow('ignore').default(['*']),
+ maxAge: Validate.number().default(86400),
+ headers: Validate.array().items(Validate.string()).default(['Accept', 'Authorization', 'Content-Type', 'If-None-Match']),
+ additionalHeaders: Validate.array().items(Validate.string()).default([]),
+ exposedHeaders: Validate.array().items(Validate.string()).default(['WWW-Authenticate', 'Server-Authorization']),
+ additionalExposedHeaders: Validate.array().items(Validate.string()).default([]),
+ credentials: Validate.boolean().when('origin', { is: 'ignore', then: false }).default(false),
+ preflightStatusCode: Validate.valid(200, 204).default(200)
+ })
+ .allow(false, true)
+ .default(false),
+ ext: Validate.object({
+ onPreAuth: Validate.array().items(internals.event).single(),
+ onCredentials: Validate.array().items(internals.event).single(),
+ onPostAuth: Validate.array().items(internals.event).single(),
+ onPreHandler: Validate.array().items(internals.event).single(),
+ onPostHandler: Validate.array().items(internals.event).single(),
+ onPreResponse: Validate.array().items(internals.event).single(),
+ onPostResponse: Validate.array().items(internals.event).single()
+ })
+ .default({}),
+ files: Validate.object({
+ relativeTo: Validate.string().pattern(/^([\/\.])|([A-Za-z]:\\)|(\\\\)/).default('.')
+ })
+ .default(),
+ json: Validate.object({
+ replacer: Validate.alternatives(Validate.function(), Validate.array()).allow(null).default(null),
+ space: Validate.number().allow(null).default(null),
+ suffix: Validate.string().allow(null).default(null),
+ escape: Validate.boolean().default(false)
+ })
+ .default(),
+ log: Validate.object({
+ collect: Validate.boolean().default(false)
+ })
+ .default(),
+ payload: Validate.object({
+ output: Validate.valid('data', 'stream', 'file').default('data'),
+ parse: Validate.boolean().allow('gunzip').default(true),
+ multipart: Validate.object({
+ output: Validate.valid('data', 'stream', 'file', 'annotated').required()
+ })
+ .default(false)
+ .allow(true, false),
+ allow: Validate.array().items(Validate.string()).single(),
+ override: Validate.string(),
+ protoAction: Validate.valid('error', 'remove', 'ignore').default('error'),
+ maxBytes: Validate.number().integer().positive().default(1024 * 1024),
+ maxParts: Validate.number().integer().positive().default(1000),
+ uploads: Validate.string().default(Os.tmpdir()),
+ failAction: internals.failAction,
+ timeout: Validate.number().integer().positive().allow(false).default(10 * 1000),
+ defaultContentType: Validate.string().default('application/json'),
+ compression: Validate.object()
+ .pattern(/.+/, Validate.object())
+ .default()
+ })
+ .default(),
+ plugins: Validate.object(),
+ response: Validate.object({
+ disconnectStatusCode: Validate.number().integer().min(400).default(499),
+ emptyStatusCode: Validate.valid(200, 204).default(204),
+ failAction: internals.failAction,
+ modify: Validate.boolean(),
+ options: Validate.object(),
+ ranges: Validate.boolean().default(true),
+ sample: Validate.number().min(0).max(100).when('modify', { then: Validate.forbidden() }),
+ schema: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(true, false),
+ status: Validate.object().pattern(/\d\d\d/, Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(true, false))
+ })
+ .default(),
+ security: Validate.object({
+ hsts: Validate.alternatives([
+ Validate.object({
+ maxAge: Validate.number(),
+ includeSubdomains: Validate.boolean(),
+ includeSubDomains: Validate.boolean(),
+ preload: Validate.boolean()
+ }),
+ Validate.boolean(),
+ Validate.number()
+ ])
+ .default(15768000),
+ xframe: Validate.alternatives([
+ Validate.boolean(),
+ Validate.valid('sameorigin', 'deny'),
+ Validate.object({
+ rule: Validate.valid('sameorigin', 'deny', 'allow-from'),
+ source: Validate.string()
+ })
+ ])
+ .default('deny'),
+ xss: Validate.valid('enabled', 'disabled', false).default('disabled'),
+ noOpen: Validate.boolean().default(true),
+ noSniff: Validate.boolean().default(true),
+ referrer: Validate.alternatives([
+ Validate.boolean().valid(false),
+ Validate.valid('', 'no-referrer', 'no-referrer-when-downgrade',
+ 'unsafe-url', 'same-origin', 'origin', 'strict-origin',
+ 'origin-when-cross-origin', 'strict-origin-when-cross-origin')
+ ])
+ .default(false)
+ })
+ .allow(null, false, true)
+ .default(false),
+ state: Validate.object({
+ parse: Validate.boolean().default(true),
+ failAction: internals.failAction
+ })
+ .default(),
+ timeout: Validate.object({
+ socket: Validate.number().integer().positive().allow(false),
+ server: Validate.number().integer().positive().allow(false).default(false)
+ })
+ .default(),
+ validate: Validate.object({
+ headers: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, true),
+ params: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, true),
+ query: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),
+ payload: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),
+ state: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),
+ failAction: internals.failAction,
+ errorFields: Validate.object(),
+ options: Validate.object().default(),
+ validator: Validate.object()
+ })
+ .default()
+});
+
+
+internals.server = Validate.object({
+ address: Validate.string().hostname(),
+ app: Validate.object().allow(null),
+ autoListen: Validate.boolean(),
+ cache: Validate.allow(null), // Validated elsewhere
+ compression: Validate.object({
+ minBytes: Validate.number().min(1).integer().default(1024)
+ })
+ .allow(false)
+ .default(),
+ debug: Validate.object({
+ request: Validate.array().items(Validate.string()).single().allow(false).default(['implementation']),
+ log: Validate.array().items(Validate.string()).single().allow(false)
+ })
+ .allow(false)
+ .default(),
+ host: Validate.string().hostname().allow(null),
+ info: Validate.object({
+ remote: Validate.boolean().default(false)
+ })
+ .default({}),
+ listener: Validate.any(),
+ load: Validate.object({
+ sampleInterval: Validate.number().integer().min(0).default(0)
+ })
+ .unknown()
+ .default(),
+ mime: Validate.object().empty(null).default(),
+ operations: Validate.object({
+ cleanStop: Validate.boolean().default(true)
+ })
+ .default(),
+ plugins: Validate.object(),
+ port: Validate.alternatives([
+ Validate.number().integer().min(0), // TCP port
+ Validate.string().pattern(/\//), // Unix domain socket
+ Validate.string().pattern(/^\\\\\.\\pipe\\/) // Windows named pipe
+ ])
+ .allow(null),
+ query: Validate.object({
+ parser: Validate.function()
+ })
+ .default(),
+ router: Validate.object({
+ isCaseSensitive: Validate.boolean().default(true),
+ stripTrailingSlash: Validate.boolean().default(false)
+ })
+ .default(),
+ routes: internals.routeBase.default(),
+ state: Validate.object(), // Cookie defaults
+ tls: Validate.alternatives([
+ Validate.object().allow(null),
+ Validate.boolean()
+ ]),
+ uri: Validate.string().pattern(/[^/]$/)
+});
+
+
+internals.vhost = Validate.alternatives([
+ Validate.string().hostname(),
+ Validate.array().items(Validate.string().hostname()).min(1)
+]);
+
+
+internals.handler = Validate.alternatives([
+ Validate.function(),
+ Validate.object().length(1)
+]);
+
+
+internals.route = Validate.object({
+ method: Validate.string().pattern(/^[a-zA-Z0-9!#\$%&'\*\+\-\.^_`\|~]+$/).required(),
+ path: Validate.string().required(),
+ rules: Validate.object(),
+ vhost: internals.vhost,
+
+ // Validated in route construction
+
+ handler: Validate.any(),
+ options: Validate.any(),
+ config: Validate.any() // Backwards compatibility
+})
+ .without('config', 'options');
+
+
+internals.pre = [
+ Validate.function(),
+ Validate.object({
+ method: Validate.alternatives(Validate.string(), Validate.function()).required(),
+ assign: Validate.string(),
+ mode: Validate.valid('serial', 'parallel'),
+ failAction: internals.failAction
+ })
+];
+
+
+internals.routeConfig = internals.routeBase.keys({
+ description: Validate.string(),
+ id: Validate.string(),
+ isInternal: Validate.boolean(),
+ notes: [
+ Validate.string(),
+ Validate.array().items(Validate.string())
+ ],
+ pre: Validate.array().items(...internals.pre.concat(Validate.array().items(...internals.pre).min(1))),
+ tags: [
+ Validate.string(),
+ Validate.array().items(Validate.string())
+ ]
+});
+
+
+internals.cacheConfig = Validate.alternatives([
+ Validate.function(),
+ Validate.object({
+ name: Validate.string().invalid('_default'),
+ shared: Validate.boolean(),
+ provider: [
+ Validate.function(),
+ {
+ constructor: Validate.function().required(),
+ options: Validate.object({
+ partition: Validate.string().default('hapi-cache')
+ })
+ .unknown() // Catbox client validates other keys
+ .default({})
+ }
+ ],
+ engine: Validate.object()
+ })
+ .xor('provider', 'engine')
+]);
+
+
+internals.cache = Validate.array().items(internals.cacheConfig).min(1).single();
+
+
+internals.cachePolicy = Validate.object({
+ cache: Validate.string().allow(null).allow(''),
+ segment: Validate.string(),
+ shared: Validate.boolean()
+})
+ .unknown(); // Catbox policy validates other keys
+
+
+internals.method = Validate.object({
+ bind: Validate.object().allow(null),
+ generateKey: Validate.function(),
+ cache: internals.cachePolicy
+});
+
+
+internals.methodObject = Validate.object({
+ name: Validate.string().required(),
+ method: Validate.function().required(),
+ options: Validate.object()
+});
+
+
+internals.register = Validate.object({
+ once: true,
+ routes: Validate.object({
+ prefix: Validate.string().pattern(/^\/.+/),
+ vhost: internals.vhost
+ })
+ .default({})
+});
+
+
+internals.semver = Validate.string();
+
+
+internals.plugin = internals.register.keys({
+ options: Validate.any(),
+ plugin: Validate.object({
+ register: Validate.function().required(),
+ name: Validate.string().when('pkg.name', { is: Validate.exist(), otherwise: Validate.required() }),
+ version: Validate.string(),
+ multiple: Validate.boolean().default(false),
+ dependencies: [
+ Validate.array().items(Validate.string()).single(),
+ Validate.object().pattern(/.+/, internals.semver)
+ ],
+ once: true,
+ requirements: Validate.object({
+ hapi: Validate.string(),
+ node: Validate.string()
+ })
+ .default(),
+ pkg: Validate.object({
+ name: Validate.string(),
+ version: Validate.string().default('0.0.0')
+ })
+ .unknown()
+ .default({})
+ })
+ .unknown()
+})
+ .without('once', 'options')
+ .unknown();
+
+
+internals.rules = Validate.object({
+ validate: Validate.object({
+ schema: Validate.alternatives(Validate.object(), Validate.array()).required(),
+ options: Validate.object()
+ .default({ allowUnknown: true })
+ })
+});
diff --git a/lib/connection.js b/lib/connection.js
deleted file mode 100755
index d8b0304ab..000000000
--- a/lib/connection.js
+++ /dev/null
@@ -1,413 +0,0 @@
-// Load modules
-
-var Events = require('events');
-var Http = require('http');
-var Https = require('https');
-var Os = require('os');
-var Path = require('path');
-var Boom = require('boom');
-var Call = require('call');
-var Hoek = require('hoek');
-var Shot = require('shot');
-var Statehood = require('statehood');
-var Topo = require('topo');
-var Auth = require('./auth');
-var Route = require('./route');
-
-
-// Declare internals
-
-var internals = {
- counter: {
- min: 10000,
- max: 99999
- }
-};
-
-
-exports = module.exports = internals.Connection = function (server, options) {
-
- var self = this;
-
- var now = Date.now();
-
- Events.EventEmitter.call(this);
-
- this.settings = options; // options cloned in server.connection()
- this.server = server;
-
- // Normalize settings
-
- this.settings.labels = Hoek.unique(this.settings.labels || []); // Remove duplicates
- if (this.settings.port === undefined) {
- this.settings.port = 0;
- }
-
- this.type = (typeof this.settings.port === 'string' ? 'socket' : 'tcp');
- if (this.type === 'socket') {
- this.settings.port = (this.settings.port.indexOf('/') !== -1 ? Path.resolve(this.settings.port) : this.settings.port.toLowerCase());
- }
-
- if (this.settings.autoListen === undefined) {
- this.settings.autoListen = true;
- }
-
- Hoek.assert(this.settings.autoListen || !this.settings.port, 'Cannot specify port when autoListen is false');
- Hoek.assert(this.settings.autoListen || !this.settings.address, 'Cannot specify address when autoListen is false');
-
- this.settings.query = this.settings.query || {};
-
- // Connection facilities
-
- this._started = false;
- this._connections = {};
- this._onConnection = null; // Used to remove event listener on stop
- this._registrations = {}; // Tracks plugin for dependency validation
-
- this._extensions = {
- onRequest: null, // New request, before handing over to the router (allows changes to the request method, url, etc.)
- onPreAuth: null, // After cookie parse and before authentication (skipped if state error)
- onPostAuth: null, // After authentication (and payload processing) and before validation (skipped if auth or payload error)
- onPreHandler: null, // After validation and body parsing, before route handler (skipped if auth or validation error)
- onPostHandler: null, // After route handler returns, before sending response (skipped if onPreHandler not called)
- onPreResponse: null // Before response is sent (always called)
- };
-
- this._requestCounter = { value: internals.counter.min, min: internals.counter.min, max: internals.counter.max };
- this._load = server._heavy.policy(this.settings.load);
- this.states = new Statehood.Definitions(this.settings.state);
- this.auth = new Auth(this);
- this._router = new Call.Router(this.settings.router);
- this._defaultRoutes();
-
- this.plugins = {}; // Registered plugin APIs by plugin name
- this.app = {}; // Place for application-specific state without conflicts with hapi, should not be used by plugins
-
- // Create listener
-
- this.listener = this.settings.listener || (this.settings.tls ? Https.createServer(this.settings.tls) : Http.createServer());
- this.listener.on('request', this._dispatch());
- this._init();
-
- this.listener.on('clientError', function (err, socket) {
-
- self.server._log(['connection', 'client', 'error'], err);
- });
-
- // Connection information
-
- this.info = {
- created: now,
- started: 0,
- host: this.settings.host || Os.hostname() || 'localhost',
- port: this.settings.port,
- protocol: this.type === 'tcp' ? (this.settings.tls ? 'https' : 'http') : this.type,
- id: Os.hostname() + ':' + process.pid + ':' + now.toString(36)
- };
-
- this.info.uri = (this.settings.uri || (this.info.protocol + ':' + (this.type === 'tcp' ? '//' + this.info.host + (this.info.port ? ':' + this.info.port : '') : this.info.port)));
-};
-
-Hoek.inherits(internals.Connection, Events.EventEmitter);
-
-
-internals.Connection.prototype._init = function () {
-
- var self = this;
-
- // Setup listener
-
- this.listener.once('listening', function () {
-
- // Update the address, port, and uri with active values
-
- if (self.type === 'tcp') {
- var address = self.listener.address();
- self.info.address = address.address;
- self.info.port = address.port;
- self.info.uri = (self.settings.uri || (self.info.protocol + '://' + self.info.host + ':' + self.info.port));
- }
-
- self._onConnection = function (connection) {
-
- var key = connection.remoteAddress + ':' + connection.remotePort;
- self._connections[key] = connection;
-
- connection.once('close', function () {
-
- delete self._connections[key];
- });
- };
-
- self.listener.on('connection', self._onConnection);
- });
-};
-
-
-internals.Connection.prototype._start = function (callback) {
-
- var self = this;
-
- if (this._started) {
- return process.nextTick(callback);
- }
-
- this._started = true;
- this.info.started = Date.now();
-
- if (!this.settings.autoListen) {
- return process.nextTick(callback);
- }
-
- var onError = function (err) {
-
- self._started = false;
- return callback(err);
- };
-
- this.listener.once('error', onError);
-
- var finalize = function () {
-
- self.listener.removeListener('error', onError);
- callback();
- };
-
- if (this.type !== 'tcp') {
- this.listener.listen(this.settings.port, finalize);
- }
- else {
- var address = this.settings.address || this.settings.host || '0.0.0.0';
- this.listener.listen(this.settings.port, address, finalize);
- }
-};
-
-
-internals.Connection.prototype._stop = function (options, callback) {
-
- var self = this;
-
- if (!this._started) {
- return process.nextTick(callback);
- }
-
- this._started = false;
- this.info.started = 0;
-
- var timeoutId = setTimeout(function () {
-
- Object.keys(self._connections).forEach(function (key) {
-
- self._connections[key].destroy();
- });
-
-
- self._connections = {};
- }, options.timeout);
-
- this.listener.close(function () {
-
- self.listener.removeListener('connection', self._onConnection);
- clearTimeout(timeoutId);
-
- self._init();
- return callback();
- });
-};
-
-
-internals.Connection.prototype._dispatch = function (options) {
-
- var self = this;
-
- options = options || {};
-
- return function (req, res) {
-
- if (!self._started &&
- !Shot.isInjection(req)) {
-
- return req.connection.end();
- }
-
- // Create request
-
- var request = self.server._requestor.request(self, req, res, options);
-
- // Check load
-
- var overload = self._load.check();
- if (overload) {
- self.server._log(['load'], self.server.load);
- request._reply(overload);
- }
- else {
-
- // Execute request lifecycle
-
- request._protect.domain.run(function () {
-
- request._execute();
- });
- }
- };
-};
-
-
-internals.Connection.prototype.inject = function (options, callback) {
-
- var settings = options;
- if (settings.credentials ||
- settings.allowInternals !== undefined) { // Can be false
-
- settings = Hoek.shallow(options); // options can be reused
- delete settings.credentials;
- delete settings.artifacts; // Cannot appear without credentials
- delete settings.allowInternals;
- }
-
- var needle = this._dispatch({
- credentials: options.credentials,
- artifacts: options.artifacts,
- allowInternals: options.allowInternals
- });
-
- Shot.inject(needle, settings, function (res) {
-
- if (res.raw.res._hapi) {
- res.result = res.raw.res._hapi.result;
- res.request = res.raw.res._hapi.request;
- delete res.raw.res._hapi;
- }
-
- if (res.result === undefined) {
- res.result = res.payload;
- }
-
- return callback(res);
- });
-};
-
-
-internals.Connection.prototype.table = function (host) {
-
- return this._router.table(host);
-};
-
-
-internals.Connection.prototype.lookup = function (id) {
-
- Hoek.assert(id && typeof id === 'string', 'Invalid route id:', id);
-
- var record = this._router.ids[id];
- if (!record) {
- return null;
- }
-
- return record.route.public;
-};
-
-
-internals.Connection.prototype.match = function (method, path, host) {
-
- Hoek.assert(method && typeof method === 'string', 'Invalid method:', method);
- Hoek.assert(path && typeof path === 'string' && path[0] === '/', 'Invalid path:', path);
- Hoek.assert(!host || typeof host === 'string', 'Invalid host:', host);
-
- var match = this._router.route(method.toLowerCase(), path, host);
- if (match.route.method === 'notfound') {
- return null;
- }
-
- Hoek.assert(match.route.method !== 'badrequest', 'Invalid path:', path);
-
- return match.route.public;
-};
-
-
-internals.Connection.prototype._ext = function (event, nodes, options) {
-
- Hoek.assert(this._extensions[event] !== undefined, 'Unknown event type', event);
-
- this._extensions[event] = this._extensions[event] || new Topo();
- this._extensions[event].add(nodes, options);
-};
-
-
-internals.Connection.prototype._route = function (configs, realm) {
-
- configs = [].concat(configs);
- for (var i = 0, il = configs.length; i < il; ++i) {
- var config = configs[i];
-
- if (Array.isArray(config.method)) {
- for (var m = 0, ml = config.method.length; m < ml; ++m) {
- var method = config.method[m];
-
- var settings = Hoek.shallow(config);
- settings.method = method;
- this._addRoute(settings, realm);
- }
- }
- else {
- this._addRoute(config, realm);
- }
- }
-};
-
-
-internals.Connection.prototype._addRoute = function (config, realm) {
-
- var route = new Route(config, this, realm); // Do no use config beyond this point, use route members
- var vhosts = [].concat(route.settings.vhost || '*');
-
- for (var i = 0, il = vhosts.length; i < il; ++i) {
- var vhost = vhosts[i];
- var record = this._router.add({ method: route.method, path: route.path, vhost: vhost, analysis: route._analysis, id: route.settings.id }, route);
- route.fingerprint = record.fingerprint;
- route.params = record.params;
- }
-};
-
-
-internals.Connection.prototype._defaultRoutes = function () {
-
- this._router.special('notFound', new Route({
- method: 'notFound',
- path: '/{p*}',
- config: {
- auth: false, // Override any defaults
- handler: function (request, reply) {
-
- return reply(Boom.notFound());
- }
- }
- }, this, this.server.realm));
-
- this._router.special('badRequest', new Route({
- method: 'badRequest',
- path: '/{p*}',
- config: {
- auth: false, // Override any defaults
- handler: function (request, reply) {
-
- return reply(Boom.badRequest());
- }
- }
- }, this, this.server.realm));
-
- if (this.settings.routes.cors) {
- this._router.special('options', new Route({
- path: '/{p*}',
- method: 'options',
- config: {
- auth: false, // Override any defaults
- cors: this.settings.routes.cors,
- handler: function (request, reply) {
-
- return reply();
- }
- }
- }, this, this.server.realm));
- }
-};
diff --git a/lib/core.js b/lib/core.js
new file mode 100755
index 000000000..202f6dbe0
--- /dev/null
+++ b/lib/core.js
@@ -0,0 +1,718 @@
+'use strict';
+
+const Http = require('http');
+const Https = require('https');
+const Os = require('os');
+const Path = require('path');
+
+const Boom = require('@hapi/boom');
+const Bounce = require('@hapi/bounce');
+const Call = require('@hapi/call');
+const Catbox = require('@hapi/catbox');
+const { Engine: CatboxMemory } = require('@hapi/catbox-memory');
+const { Heavy } = require('@hapi/heavy');
+const Hoek = require('@hapi/hoek');
+const { Mimos } = require('@hapi/mimos');
+const Podium = require('@hapi/podium');
+const Statehood = require('@hapi/statehood');
+
+const Auth = require('./auth');
+const Compression = require('./compression');
+const Config = require('./config');
+const Cors = require('./cors');
+const Ext = require('./ext');
+const Methods = require('./methods');
+const Request = require('./request');
+const Response = require('./response');
+const Route = require('./route');
+const Toolkit = require('./toolkit');
+const Validation = require('./validation');
+
+
+const internals = {
+ counter: {
+ min: 10000,
+ max: 99999
+ },
+ events: [
+ { name: 'cachePolicy', spread: true },
+ { name: 'log', channels: ['app', 'internal'], tags: true },
+ { name: 'request', channels: ['app', 'internal', 'error'], tags: true, spread: true },
+ 'response',
+ 'route',
+ 'start',
+ 'closing',
+ 'stop'
+ ],
+ badRequestResponse: Buffer.from('HTTP/1.1 400 Bad Request\r\n\r\n', 'ascii')
+};
+
+
+exports = module.exports = internals.Core = class {
+
+ actives = new WeakMap(); // Active requests being processed
+ app = {};
+ auth = new Auth(this);
+ caches = new Map(); // Cache clients
+ compression = new Compression();
+ controlled = null; // Other servers linked to the phases of this server
+ dependencies = []; // Plugin dependencies
+ events = new Podium.Podium(internals.events);
+ heavy = null;
+ info = null;
+ instances = new Set();
+ listener = null;
+ methods = new Methods(this); // Server methods
+ mime = null;
+ onConnection = null; // Used to remove event listener on stop
+ phase = 'stopped'; // 'stopped', 'initializing', 'initialized', 'starting', 'started', 'stopping', 'invalid'
+ plugins = {}; // Exposed plugin properties by name
+ registrations = {}; // Tracks plugin for dependency validation { name -> { version } }
+ registring = 0; // > 0 while register() is waiting for plugin callbacks
+ Request = class extends Request { };
+ Response = class extends Response { };
+ requestCounter = { value: internals.counter.min, min: internals.counter.min, max: internals.counter.max };
+ root = null;
+ router = null;
+ settings = null;
+ sockets = null; // Track open sockets for graceful shutdown
+ started = false;
+ states = null;
+ toolkit = new Toolkit.Manager();
+ type = null;
+ validator = null;
+
+ extensionsSeq = 0; // Used to keep absolute order of extensions based on the order added across locations
+ extensions = {
+ server: {
+ onPreStart: new Ext('onPreStart', this),
+ onPostStart: new Ext('onPostStart', this),
+ onPreStop: new Ext('onPreStop', this),
+ onPostStop: new Ext('onPostStop', this)
+ },
+ route: {
+ onRequest: new Ext('onRequest', this),
+ onPreAuth: new Ext('onPreAuth', this),
+ onCredentials: new Ext('onCredentials', this),
+ onPostAuth: new Ext('onPostAuth', this),
+ onPreHandler: new Ext('onPreHandler', this),
+ onPostHandler: new Ext('onPostHandler', this),
+ onPreResponse: new Ext('onPreResponse', this),
+ onPostResponse: new Ext('onPostResponse', this)
+ }
+ };
+
+ decorations = {
+ handler: new Map(),
+ request: new Map(),
+ response: new Map(),
+ server: new Map(),
+ toolkit: new Map(),
+ requestApply: null,
+ public: { handler: [], request: [], response: [], server: [], toolkit: [] }
+ };
+
+ constructor(options) {
+
+ const { settings, type } = internals.setup(options);
+
+ this.settings = settings;
+ this.type = type;
+
+ this.heavy = new Heavy(this.settings.load);
+ this.mime = new Mimos(this.settings.mime);
+ this.router = new Call.Router(this.settings.router);
+ this.states = new Statehood.Definitions(this.settings.state);
+
+ this._debug();
+ this._initializeCache();
+
+ if (this.settings.routes.validate.validator) {
+ this.validator = Validation.validator(this.settings.routes.validate.validator);
+ }
+
+ this.listener = this._createListener();
+ this._initializeListener();
+ this.info = this._info();
+ }
+
+ _debug() {
+
+ const debug = this.settings.debug;
+ if (!debug) {
+ return;
+ }
+
+ // Subscribe to server log events
+
+ const method = (event) => {
+
+ const data = event.error ?? event.data;
+ console.error('Debug:', event.tags.join(', '), data ? '\n ' + (data.stack ?? (typeof data === 'object' ? Hoek.stringify(data) : data)) : '');
+ };
+
+ if (debug.log) {
+ const filter = debug.log.some((tag) => tag === '*') ? undefined : debug.log;
+ this.events.on({ name: 'log', filter }, method);
+ }
+
+ if (debug.request) {
+ const filter = debug.request.some((tag) => tag === '*') ? undefined : debug.request;
+ this.events.on({ name: 'request', filter }, (request, event) => method(event));
+ }
+ }
+
+ _initializeCache() {
+
+ if (this.settings.cache) {
+ this._createCache(this.settings.cache);
+ }
+
+ if (!this.caches.has('_default')) {
+ this._createCache([{ provider: CatboxMemory }]); // Defaults to memory-based
+ }
+ }
+
+ _info() {
+
+ const now = Date.now();
+ const protocol = this.type === 'tcp' ? (this.settings.tls ? 'https' : 'http') : this.type;
+ const host = this.settings.host || Os.hostname() || 'localhost';
+ const port = this.settings.port;
+
+ const info = {
+ created: now,
+ started: 0,
+ host,
+ port,
+ protocol,
+ id: Os.hostname() + ':' + process.pid + ':' + now.toString(36),
+ uri: this.settings.uri ?? (protocol + ':' + (this.type === 'tcp' ? '//' + host + (port ? ':' + port : '') : port))
+ };
+
+ return info;
+ }
+
+ _counter() {
+
+ const next = ++this.requestCounter.value;
+
+ if (this.requestCounter.value > this.requestCounter.max) {
+ this.requestCounter.value = this.requestCounter.min;
+ }
+
+ return next - 1;
+ }
+
+ _createCache(configs) {
+
+ Hoek.assert(this.phase !== 'initializing', 'Cannot provision server cache while server is initializing');
+
+ configs = Config.apply('cache', configs);
+
+ const added = [];
+ for (let config of configs) {
+
+ // (type: 'handler', property: P, method: HandlerDecorationMethod, options?: { apply?: boolean | undefined, extend?: never }): void; + + decorate
(type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'request', property: ExceptName (type: 'toolkit', property: ExceptName (type: 'toolkit', property: ExceptName (type: 'toolkit', property: ExceptName (type: 'toolkit', property: ExceptName (type: 'server', property: ExceptName (type: 'server', property: ExceptName (type: 'server', property: ExceptName (type: 'server', property: ExceptName