mizchi/sol/middleware - mooncakes.io

README
U
ActionRegistry
U
ApiHandler
U
ApiResponse
U
CacheStrategy
U
PageHandler
U
PageProps
U
RawHandler
U
RouteManifestEntry
U
RouteManifestMatchKind
U
RouteManifestMethod
U
RouteManifestOwner
U
RouteOwnershipManifest
U
RouterConfig
U
SolRoutes
- ::newBundleConfig::new
- ::with_formatBundleConfig::with_format
- ::with_minifyBundleConfig::with_minify
- ::with_sourcemapBundleConfig::with_sourcemap
T
BundleResult
- ::newIslandConfig::new
- ::with_contentIslandConfig::with_content
- ::with_ssr_htmlIslandConfig::with_ssr_html
- ::with_stateIslandConfig::with_state
- ::with_state_refIslandConfig::with_state_ref
- ::with_state_urlIslandConfig::with_state_url
- ::with_triggerIslandConfig::with_trigger
T
IslandManifest
T
IslandManifestEntry
- ::to_stringOutputFormat::to_string
- ::as_anyRolldownChunk::as_any
- ::codeRolldownChunk::code
- ::file_nameRolldownChunk::file_name
- ::is_entryRolldownChunk::is_entry
- ::as_anyRolldownOutput::as_any
- ::outputRolldownOutput::output
- ::newStaticDirServeConfig::new
- ::defaultStaticFileConfig::default
- ::devStaticFileConfig::dev
- ::with_mappingStaticFileConfig::with_mapping
V
api_delete
V
api_get
V
api_patch
V
api_post
V
api_put
V
assets
V
bad_request
V
build
V
build_from_manifest
V
build_from_manifest_file
V
bundle_islands
V
bundle_islands_prod
V
bundle_islands_result
V
create_app
V
default_loader_url
V
default_wc_loader_url
V
error_response
V
forbidden
V
generate_island_manifest
V
generate_state_script
V
island
V
island_page
V
island_raw
V
island_with
V
island_with_raw
V
json_array_to_any
V
json_obj
V
json_to_any
V
nodes
V
not_found_response
V
ok
V
optional
V
optional_query
V
page
V
parse_island_manifest
V
raw_delete
V
raw_get
V
raw_patch
V
raw_post
V
raw_put
V
redirect_permanent_to
V
redirect_to
V
render_fragment
V
render_island
V
render_island_page
V
render_island_with_state_script
V
render_node
V
render_page
V
render_page_with_preloads
V
render_streaming_page
V
render_with_island_preloads
V
require
V
require_int
V
require_query
V
route
V
route_ownership_manifest
V
run
V
run_app
V
serve_default_favicon
V
serve_sol_assets
V
serve_static
V
serve_static_dir
V
server_island
V
server_island_typed
V
server_nodes
V
streaming_page
V
unauthorized
V
wc_island_raw
V
wc_island_with_raw
V
wc_page
V
with_assets
V
with_mw
V
with_script
V
with_style
V
wrap

mizchi/sol/middleware does not have a README file

Ctx

using @mizchi/mars { type Context as Ctx }

Mars context type alias

CorsConfig

source

pub struct CorsConfig {
  origin : CorsOrigin
  methods : Array[String]
  allowed_headers : Array[String]
  exposed_headers : Array[String]
  credentials : Bool
  max_age : Int?
}

CORS configuration

CorsConfig::default

source

fn CorsConfig::default() -> CorsConfig

Default CORS configuration (permissive)

CorsConfig::strict

source

fn CorsConfig::strict() -> CorsConfig

Strict CORS configuration (same origin only)

CorsConfig::with_allowed_headers

source

fn CorsConfig::with_allowed_headers(self : CorsConfig, headers : Array[String]) -> CorsConfig

Set allowed headers

CorsConfig::with_credentials

source

fn CorsConfig::with_credentials(self : CorsConfig) -> CorsConfig

Enable credentials

CorsConfig::with_exposed_headers

source

fn CorsConfig::with_exposed_headers(self : CorsConfig, headers : Array[String]) -> CorsConfig

Set exposed headers

CorsConfig::with_max_age

source

fn CorsConfig::with_max_age(self : CorsConfig, max_age : Int) -> CorsConfig

Set max age

CorsConfig::with_methods

source

fn CorsConfig::with_methods(self : CorsConfig, methods : Array[String]) -> CorsConfig

Set allowed methods

CorsConfig::with_origin

source

fn CorsConfig::with_origin(self : CorsConfig, origin : CorsOrigin) -> CorsConfig

Set allowed origin

CorsConfig::with_origin_single

source

fn CorsConfig::with_origin_single(self : CorsConfig, origin : String) -> CorsConfig

Set single origin

CorsOrigin

source

pub enum CorsOrigin {
  All
  Single(String)
  List(Array[String])
  Dynamic((String) -> Bool)
}

Origin configuration

CsrfConfig

source

pub struct CsrfConfig {
  allowed_origins : Array[String]
  check_fetch_metadata : Bool
  expected_content_type : String?
  allow_no_origin : Bool
  error_message : String
}

CSRF protection configuration

CsrfConfig::default

source

fn CsrfConfig::default() -> CsrfConfig

Default CSRF configuration (strict)

CsrfConfig::for_origin

source

fn CsrfConfig::for_origin(origin : String) -> CsrfConfig

Create config for single origin

CsrfConfig::for_origins

source

fn CsrfConfig::for_origins(origins : Array[String]) -> CsrfConfig

Create config for multiple origins

CsrfConfig::require_json

source

fn CsrfConfig::require_json(self : CsrfConfig) -> CsrfConfig

Set JSON Content-Type requirement

CsrfConfig::with_content_type

source

fn CsrfConfig::with_content_type(self : CsrfConfig, content_type : String) -> CsrfConfig

Set expected Content-Type

CsrfConfig::with_error_message

source

fn CsrfConfig::with_error_message(self : CsrfConfig, message : String) -> CsrfConfig

Set custom error message

CsrfConfig::with_fetch_metadata

source

fn CsrfConfig::with_fetch_metadata(self : CsrfConfig, enabled : Bool) -> CsrfConfig

Enable/disable Fetch Metadata check

CsrfConfig::with_origin

source

fn CsrfConfig::with_origin(self : CsrfConfig, origin : String) -> CsrfConfig

Add single allowed origin

CsrfConfig::with_origins

source

fn CsrfConfig::with_origins(self : CsrfConfig, origins : Array[String]) -> CsrfConfig

Set allowed origins

CsrfError

source

pub enum CsrfError {
  MissingOrigin
  InvalidOrigin(String)
  CrossSiteFetch
  UnsafeFetchMode
  InvalidContentType(String)
}

CSRF validation error types

CsrfError::to_string

source

fn CsrfError::to_string(self : CsrfError) -> String

CsrfResult

source

pub enum CsrfResult {
  Valid
  ValidNoOrigin
  ValidOrigin(String)
  Invalid(CsrfError)
}

CSRF validation result

LogFormat

source

pub enum LogFormat {
  Dev
  Combined
  Json
}

Log output format

LoggerConfig

source

pub struct LoggerConfig {
  format : LogFormat
  skip_paths : Array[String]
  log_fn : (String) -> Unit?
}

Logger configuration

LoggerConfig::combined

source

fn LoggerConfig::combined() -> LoggerConfig

Create combined format config

LoggerConfig::default

source

fn LoggerConfig::default() -> LoggerConfig

Default logger configuration

LoggerConfig::dev

source

fn LoggerConfig::dev() -> LoggerConfig

Create dev format config

LoggerConfig::json

source

fn LoggerConfig::json() -> LoggerConfig

Create JSON format config

LoggerConfig::with_log_fn

source

fn LoggerConfig::with_log_fn(self : LoggerConfig, log_fn : (String) -> Unit) -> LoggerConfig

Set custom log function

LoggerConfig::with_skip_paths

source

fn LoggerConfig::with_skip_paths(self : LoggerConfig, paths : Array[String]) -> LoggerConfig

Set skip paths

Middleware

source

pub(all) struct Middleware(@mizchi/mars.Handler
Handler)

Middleware type - wraps Mars Handler To halt the pipeline, call ctx.text(), ctx.json(), etc. To continue, simply return without sending response.

Middleware::then

source

fn Middleware::then(self : Middleware, other : Middleware) -> Middleware

Method-style composition on Middleware type Usage: logger().Middleware::then(cors()) Note: Using explicit type to avoid needing mars import in consumer packages

SecurityHeadersConfig

source

pub struct SecurityHeadersConfig {
  frame_options : String
  content_type_options : String
  referrer_policy : String
  coop : String
  coep : String
  permissions_policy : String
  csp : String
  cache_control_html : String
  cache_control_static : String
}

Security headers configuration

SecurityHeadersConfig::default

source

fn SecurityHeadersConfig::default() -> SecurityHeadersConfig

Default security headers configuration (strict)

SecurityHeadersConfig::relaxed

source

fn SecurityHeadersConfig::relaxed() -> SecurityHeadersConfig

Relaxed configuration (for development or when strict CSP breaks things)

SecurityHeadersConfig::with_cache_control_html

source

fn SecurityHeadersConfig::with_cache_control_html(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

Set Cache-Control for HTML

SecurityHeadersConfig::with_cache_control_static

source

fn SecurityHeadersConfig::with_cache_control_static(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

Set Cache-Control for static assets

SecurityHeadersConfig::with_coep

source

fn SecurityHeadersConfig::with_coep(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

Set Cross-Origin-Embedder-Policy

SecurityHeadersConfig::with_coop

source

fn SecurityHeadersConfig::with_coop(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

Set Cross-Origin-Opener-Policy

SecurityHeadersConfig::with_csp

source

fn SecurityHeadersConfig::with_csp(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

Set Content-Security-Policy

SecurityHeadersConfig::with_frame_options

source

fn SecurityHeadersConfig::with_frame_options(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

Set frame options

SecurityHeadersConfig::with_permissions_policy

source

fn SecurityHeadersConfig::with_permissions_policy(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

Set Permissions-Policy

SecurityHeadersConfig::with_referrer_policy

source

fn SecurityHeadersConfig::with_referrer_policy(self : SecurityHeadersConfig, value : String) -> SecurityHeadersConfig

Set referrer policy

cache_control

source

fn cache_control(value : String) -> Middleware

Add Cache-Control header

cors

source

fn cors() -> Middleware

Create CORS middleware with default config

cors_with_config

source

fn cors_with_config(config : CorsConfig) -> Middleware

Create CORS middleware with custom config

csp

source

fn csp(policy : String) -> Middleware

Add Content-Security-Policy header

csrf

source

fn csrf() -> Middleware

Create CSRF protection middleware with default config Note: You must configure allowed origins for this to work properly

csrf_for_origin

source

fn csrf_for_origin(origin : String) -> Middleware

Create CSRF protection middleware for single origin

csrf_with_config

source

fn csrf_with_config(config : CsrfConfig) -> Middleware

Create CSRF protection middleware with custom config

extract_origin_from_url

source

fn extract_origin_from_url(url : String) -> String?

Extract origin (scheme://host[:port]) from a URL Returns None if URL is malformed

fetch_metadata

source

fn fetch_metadata() -> Middleware

Fetch Metadata validation middleware Blocks requests with Sec-Fetch-Site: cross-site

frame_options

source

fn frame_options(value : String) -> Middleware

Add X-Frame-Options header

get_header

source

fn get_header(ctx : @mizchi/mars.Context
Context, name : String) -> String?

Get header value from context (case-insensitive)

identity

source

fn identity() -> Middleware

Identity middleware - passes through unchanged

is_referer_allowed

source

fn is_referer_allowed(referer : String, allowed_origins : Array[String]) -> Bool

Check if Referer matches any allowed origin SECURITY: Extract origin from Referer URL and compare exactly (Previous implementation used has_prefix which was vulnerable to attacks like http://allowed-origin.attacker.com)

is_safe_method

source

fn is_safe_method(meth : String) -> Bool

Check if HTTP method is safe (no side effects)

logger

source

fn logger() -> Middleware

Create logger middleware with default config (dev format)

logger_with_config

source

fn logger_with_config(config : LoggerConfig) -> Middleware

Create logger middleware with custom config

nosniff

source

fn nosniff() -> Middleware

Add X-Content-Type-Options: nosniff header

pipeline

source

fn pipeline(middlewares : Array[Middleware]) -> Middleware

Compose array of middlewares into single middleware Runs handlers sequentially, stops if response is sent

referrer_policy

source

fn referrer_policy(value : String) -> Middleware

Add Referrer-Policy header

require_content_type

source

fn require_content_type(content_type : String) -> Middleware

Require specific Content-Type for mutations

require_json_content_type

source

fn require_json_content_type() -> Middleware

Require JSON Content-Type for mutations

run

source

async fn run(middleware : Middleware, ctx : @mizchi/mars.Context
Context) -> Bool

Execute middleware and check if it halted Returns true if middleware sent a response (halted)

run_or_500

source

async fn run_or_500(middleware : Middleware, ctx : @mizchi/mars.Context
Context, message_prefix? : String) -> Bool

Execute middleware and convert unexpected errors to 500 response. Returns true if middleware halted request handling.

security_headers

source

fn security_headers() -> Middleware

Create security headers middleware with default configuration

security_headers_relaxed

source

fn security_headers_relaxed() -> Middleware

Create security headers middleware with relaxed configuration

security_headers_with_config

source

fn security_headers_with_config(config : SecurityHeadersConfig) -> Middleware

Create security headers middleware with custom configuration

then

source

fn then(m1 : Middleware, m2 : Middleware) -> Middleware

Method-style composition: then(m1, m2)

then_

source

fn then_(m1 : Middleware, m2 : Middleware) -> Middleware

Sequential composition: run m1, then m2 if m1 didn't send response Usage: m1 |> then_(m2)

validate_origin_middleware

source

fn validate_origin_middleware(allowed_origins : Array[String]) -> Middleware

Simple Origin-only validation middleware Use this for simpler use cases where Fetch Metadata isn't needed

Source Files

Site source Report issue Packages Build queue Skills Statistics

#Ctx

#CorsConfig

#CorsConfig::default

#CorsConfig::strict

#CorsConfig::with_allowed_headers

#CorsConfig::with_credentials

#CorsConfig::with_exposed_headers

#CorsConfig::with_max_age

#CorsConfig::with_methods

#CorsConfig::with_origin

#CorsConfig::with_origin_single

#CorsOrigin

#CsrfConfig

#CsrfConfig::default

#CsrfConfig::for_origin

#CsrfConfig::for_origins

#CsrfConfig::require_json

#CsrfConfig::with_content_type

#CsrfConfig::with_error_message

#CsrfConfig::with_fetch_metadata

#CsrfConfig::with_origin

#CsrfConfig::with_origins

#CsrfError

#CsrfError::to_string

#CsrfResult

#LogFormat

#LoggerConfig

#LoggerConfig::combined

#LoggerConfig::default

#LoggerConfig::dev

#LoggerConfig::json

#LoggerConfig::with_log_fn

#LoggerConfig::with_skip_paths

#Middleware

#Middleware::then

#SecurityHeadersConfig

#SecurityHeadersConfig::default

#SecurityHeadersConfig::relaxed

#SecurityHeadersConfig::with_cache_control_html

#SecurityHeadersConfig::with_cache_control_static

#SecurityHeadersConfig::with_coep

#SecurityHeadersConfig::with_coop

#SecurityHeadersConfig::with_csp

#SecurityHeadersConfig::with_frame_options

#SecurityHeadersConfig::with_permissions_policy

#SecurityHeadersConfig::with_referrer_policy

#cache_control

#cors

#cors_with_config

#csp

#csrf

#csrf_for_origin

#csrf_with_config

#extract_origin_from_url

#fetch_metadata

#frame_options

#get_header

#identity

#is_referer_allowed

#is_safe_method

#logger

#logger_with_config

#nosniff

#pipeline

#referrer_policy

#require_content_type

#require_json_content_type

#run

#run_or_500

#security_headers

#security_headers_relaxed

#security_headers_with_config

#then

#then_

#validate_origin_middleware

Source Files

Ctx

CorsConfig

CorsConfig::default

CorsConfig::strict

CorsConfig::with_allowed_headers

CorsConfig::with_credentials

CorsConfig::with_exposed_headers

CorsConfig::with_max_age

CorsConfig::with_methods

CorsConfig::with_origin

CorsConfig::with_origin_single

CorsOrigin

CsrfConfig

CsrfConfig::default

CsrfConfig::for_origin

CsrfConfig::for_origins

CsrfConfig::require_json

CsrfConfig::with_content_type

CsrfConfig::with_error_message

CsrfConfig::with_fetch_metadata

CsrfConfig::with_origin

CsrfConfig::with_origins

CsrfError

CsrfError::to_string

CsrfResult

LogFormat

LoggerConfig

LoggerConfig::combined

LoggerConfig::default

LoggerConfig::dev

LoggerConfig::json

LoggerConfig::with_log_fn

LoggerConfig::with_skip_paths

Middleware

Middleware::then

SecurityHeadersConfig

SecurityHeadersConfig::default

SecurityHeadersConfig::relaxed

SecurityHeadersConfig::with_cache_control_html

SecurityHeadersConfig::with_cache_control_static

SecurityHeadersConfig::with_coep

SecurityHeadersConfig::with_coop

SecurityHeadersConfig::with_csp

SecurityHeadersConfig::with_frame_options

SecurityHeadersConfig::with_permissions_policy

SecurityHeadersConfig::with_referrer_policy

cache_control

cors

cors_with_config

csp

csrf

csrf_for_origin

csrf_with_config

extract_origin_from_url

fetch_metadata

frame_options

get_header

identity

is_referer_allowed

is_safe_method

logger

logger_with_config

nosniff

pipeline

referrer_policy

require_content_type

require_json_content_type

run

run_or_500

security_headers

security_headers_relaxed

security_headers_with_config

then

then_

validate_origin_middleware