🥮 mooncakes.io
    Sign in

    mizchi/sol/middleware does not have a README file

    Ctx

    source
    using @mizchi/mars { type Context as Ctx }

    Mars context type alias

    CorsConfig

    source
    pub struct CorsConfig {
      origin : CorsOrigin
      methods : Array[String]
      allowed_headers : Array[String]
      exposed_headers : Array[String]
      credentials : Bool
      max_age : Int?
    }

    CORS configuration

    CorsConfig::default

    source
    fn CorsConfig::default() -> CorsConfig

    Default CORS configuration (permissive)

    CorsConfig::strict

    source
    fn CorsConfig::strict() -> CorsConfig

    Strict CORS configuration (same origin only)

    CorsConfig::with_allowed_headers

    source
    fn CorsConfig::with_allowed_headers(self : CorsConfig, headers : Array[String]) -> CorsConfig

    Set allowed headers

    CorsConfig::with_credentials

    source
    fn CorsConfig::with_credentials(self : CorsConfig) -> CorsConfig

    Enable credentials

    CorsConfig::with_exposed_headers

    source
    fn CorsConfig::with_exposed_headers(self : CorsConfig, headers : Array[String]) -> CorsConfig

    Set exposed headers

    CorsConfig::with_max_age

    source
    fn CorsConfig::with_max_age(self : CorsConfig, max_age : Int) -> CorsConfig

    Set max age

    CorsConfig::with_methods

    source
    fn CorsConfig::with_methods(self : CorsConfig, methods : Array[String]) -> CorsConfig

    Set allowed methods

    CorsConfig::with_origin

    source
    fn CorsConfig::with_origin(self : CorsConfig, origin : CorsOrigin) -> CorsConfig

    Set allowed origin

    CorsConfig::with_origin_single

    source
    fn CorsConfig::with_origin_single(self : CorsConfig, origin : String) -> CorsConfig

    Set single origin

    CorsOrigin

    source
    pub enum CorsOrigin {
      All
      Single(String)
      List(Array[String])
      Dynamic((String) -> Bool)
    }

    Origin configuration

    CsrfConfig

    source
    pub struct CsrfConfig {
      allowed_origins : Array[String]
      check_fetch_metadata : Bool
      expected_content_type : String?
      allow_no_origin : Bool
      error_message : String
    }

    CSRF protection configuration

    CsrfConfig::default

    source
    fn CsrfConfig::default() -> CsrfConfig

    Default CSRF configuration (strict)

    CsrfConfig::for_origin

    source
    fn CsrfConfig::for_origin(origin : String) -> CsrfConfig

    Create config for single origin

    CsrfConfig::for_origins

    source
    fn CsrfConfig::for_origins(origins : Array[String]) -> CsrfConfig

    Create config for multiple origins

    CsrfConfig::require_json

    source
    fn CsrfConfig::require_json(self : CsrfConfig) -> CsrfConfig

    Set JSON Content-Type requirement

    CsrfConfig::with_content_type

    source
    fn CsrfConfig::with_content_type(self : CsrfConfig, content_type : String) -> CsrfConfig

    Set expected Content-Type

    CsrfConfig::with_error_message

    source
    fn CsrfConfig::with_error_message(self : CsrfConfig, message : String) -> CsrfConfig

    Set custom error message

    CsrfConfig::with_fetch_metadata

    source
    fn CsrfConfig::with_fetch_metadata(self : CsrfConfig, enabled : Bool) -> CsrfConfig

    Enable/disable Fetch Metadata check

    CsrfConfig::with_origin

    source
    fn CsrfConfig::with_origin(self : CsrfConfig, origin : String) -> CsrfConfig

    Add single allowed origin

    CsrfConfig::with_origins

    source
    fn CsrfConfig::with_origins(self : CsrfConfig, origins : Array[String]) -> CsrfConfig

    Set allowed origins

    CsrfError

    source
    pub enum CsrfError {
      MissingOrigin
      InvalidOrigin(String)
      CrossSiteFetch
      UnsafeFetchMode
      InvalidContentType(String)
    }

    CSRF validation error types

    CsrfError::to_string

    source
    fn CsrfError::to_string(self : CsrfError) -> String

    CsrfResult

    source
    pub enum CsrfResult {
      Valid
      ValidNoOrigin
      ValidOrigin(String)
      Invalid(CsrfError)
    }

    CSRF validation result

    LogFormat

    source
    pub enum LogFormat {
      Dev
      Combined
      Json
    }

    Log output format

    LoggerConfig

    source
    pub struct LoggerConfig {
      format : LogFormat
      skip_paths : Array[String]
      log_fn : (String) -> Unit?
    }

    Logger configuration

    LoggerConfig::combined

    source
    fn LoggerConfig::combined() -> LoggerConfig

    Create combined format config

    LoggerConfig::default

    source
    fn LoggerConfig::default() -> LoggerConfig

    Default logger configuration

    LoggerConfig::dev

    source

    Create dev format config

    LoggerConfig::json

    source

    Create JSON format config

    LoggerConfig::with_log_fn

    source
    fn LoggerConfig::with_log_fn(self : LoggerConfig, log_fn : (String) -> Unit) -> LoggerConfig

    Set custom log function

    LoggerConfig::with_skip_paths

    source
    fn LoggerConfig::with_skip_paths(self : LoggerConfig, paths : Array[String]) -> LoggerConfig

    Set skip paths

    Middleware

    source
    pub(all) struct Middleware(
    Handler    )

    Middleware type - wraps Mars Handler To halt the pipeline, call ctx.text(), ctx.json(), etc. To continue, simply return without sending response.

    Middleware::then

    source
    fn Middleware::then(self : Middleware, other : Middleware) -> Middleware

    Method-style composition on Middleware type Usage: logger().Middleware::then(cors()) Note: Using explicit type to avoid needing mars import in consumer packages

    SecurityHeadersConfig

    source
    pub struct SecurityHeadersConfig {
      frame_options : String
      content_type_options : String
      referrer_policy : String
      coop : String
      coep : String
      permissions_policy : String
      csp : String
      cache_control_html : String
      cache_control_static : String
    }

    Security headers configuration

    SecurityHeadersConfig::default

    source

    Default security headers configuration (strict)

    SecurityHeadersConfig::relaxed

    source

    Relaxed configuration (for development or when strict CSP breaks things)

    SecurityHeadersConfig::with_cache_control_html

    source
    fn SecurityHeadersConfig::with_cache_control_html(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

    Set Cache-Control for HTML

    SecurityHeadersConfig::with_cache_control_static

    source
    fn SecurityHeadersConfig::with_cache_control_static(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

    Set Cache-Control for static assets

    SecurityHeadersConfig::with_coep

    source
    fn SecurityHeadersConfig::with_coep(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

    Set Cross-Origin-Embedder-Policy

    SecurityHeadersConfig::with_coop

    source
    fn SecurityHeadersConfig::with_coop(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

    Set Cross-Origin-Opener-Policy

    SecurityHeadersConfig::with_csp

    source
    fn SecurityHeadersConfig::with_csp(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

    Set Content-Security-Policy

    SecurityHeadersConfig::with_frame_options

    source
    fn SecurityHeadersConfig::with_frame_options(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

    Set frame options

    SecurityHeadersConfig::with_permissions_policy

    source
    fn SecurityHeadersConfig::with_permissions_policy(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

    Set Permissions-Policy

    SecurityHeadersConfig::with_referrer_policy

    source
    fn SecurityHeadersConfig::with_referrer_policy(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

    Set referrer policy

    cache_control

    source
    fn cache_control(value : String) -> Middleware

    Add Cache-Control header

    cors

    source
    fn cors() -> Middleware

    Create CORS middleware with default config

    cors_with_config

    source
    fn cors_with_config(config : CorsConfig) -> Middleware

    Create CORS middleware with custom config

    csp

    source
    fn csp(policy : String) -> Middleware

    Add Content-Security-Policy header

    csrf

    source
    fn csrf() -> Middleware

    Create CSRF protection middleware with default config Note: You must configure allowed origins for this to work properly

    csrf_for_origin

    source
    fn csrf_for_origin(origin : String) -> Middleware

    Create CSRF protection middleware for single origin

    csrf_with_config

    source
    fn csrf_with_config(config : CsrfConfig) -> Middleware

    Create CSRF protection middleware with custom config

    extract_origin_from_url

    source
    fn extract_origin_from_url(url : String) -> String?

    Extract origin (scheme://host[:port]) from a URL Returns None if URL is malformed

    fetch_metadata

    source
    fn fetch_metadata() -> Middleware

    Fetch Metadata validation middleware Blocks requests with Sec-Fetch-Site: cross-site

    frame_options

    source
    fn frame_options(value : String) -> Middleware

    Add X-Frame-Options header

    get_header

    source
    fn get_header(ctx : 
    Context    , name : String) -> String?

    Get header value from context (case-insensitive)

    identity

    source
    fn identity() -> Middleware

    Identity middleware - passes through unchanged

    is_referer_allowed

    source
    fn is_referer_allowed(referer : String, allowed_origins : Array[String]) -> Bool

    Check if Referer matches any allowed origin SECURITY: Extract origin from Referer URL and compare exactly (Previous implementation used has_prefix which was vulnerable to attacks like http://allowed-origin.attacker.com)

    is_safe_method

    source
    fn is_safe_method(meth : String) -> Bool

    Check if HTTP method is safe (no side effects)

    logger

    source
    fn logger() -> Middleware

    Create logger middleware with default config (dev format)

    logger_with_config

    source
    fn logger_with_config(config : LoggerConfig) -> Middleware

    Create logger middleware with custom config

    nosniff

    source
    fn nosniff() -> Middleware

    Add X-Content-Type-Options: nosniff header

    pipeline

    source
    fn pipeline(middlewares : Array[Middleware]) -> Middleware

    Compose array of middlewares into single middleware Runs handlers sequentially, stops if response is sent

    referrer_policy

    source
    fn referrer_policy(value : String) -> Middleware

    Add Referrer-Policy header

    require_content_type

    source
    fn require_content_type(content_type : String) -> Middleware

    Require specific Content-Type for mutations

    require_json_content_type

    source
    fn require_json_content_type() -> Middleware

    Require JSON Content-Type for mutations

    run

    source
    async fn run(middleware : Middleware, ctx : 
    Context    ) -> Bool

    Execute middleware and check if it halted Returns true if middleware sent a response (halted)

    run_or_500

    source
    async fn run_or_500(middleware : Middleware, ctx : 
    Context    , message_prefix? : String) -> Bool

    Execute middleware and convert unexpected errors to 500 response. Returns true if middleware halted request handling.

    security_headers

    source
    fn security_headers() -> Middleware

    Create security headers middleware with default configuration

    security_headers_relaxed

    source
    fn security_headers_relaxed() -> Middleware

    Create security headers middleware with relaxed configuration

    security_headers_with_config

    source
    fn security_headers_with_config(config : SecurityHeadersConfig) -> Middleware

    Create security headers middleware with custom configuration

    then

    source
    fn then(m1 : Middleware, m2 : Middleware) -> Middleware

    Method-style composition: then(m1, m2)

    then_

    source
    fn then_(m1 : Middleware, m2 : Middleware) -> Middleware

    Sequential composition: run m1, then m2 if m1 didn't send response Usage: m1 |> then_(m2)

    validate_origin_middleware

    source
    fn validate_origin_middleware(allowed_origins : Array[String]) -> Middleware

    Simple Origin-only validation middleware Use this for simpler use cases where Fetch Metadata isn't needed

    Source Files

    Powered by MoonBit

    Site sourceReport issuePackagesBuild queueSkillsStatistics

    © 2026 mooncakes.io