🥮 mooncakes.io

    moonbitstack/moonapi/ctx does not have a README file

    Form

    source

    A parsed form: its text fields and its files.

    Limits

    source

    What a body is allowed to be.

    A body arrives from whoever sent it, so both bounds are needed: a million empty parts and one enormous part are different ways of asking a server to allocate more than it has.

    Upload

    source

    A file from a multipart/form-data body.

    The content is held whole. Streaming a part to disk instead of into memory is what limits exists to make unnecessary until it is built.

    BackgroundTasks

    source
    pub struct BackgroundTasks {
      // private fields
    }

    A queue of deferred tasks. A handler adds to ctx.background; the app runs the queue in the order tasks were added, after the response is sent and within the same request.

    BackgroundTasks::add_task

    source
    fn BackgroundTasks::add_task(self : BackgroundTasks, task : async () -> Unit) -> Unit

    Enqueue a task to run after the response is sent (← BackgroundTasks.add_task).

    BackgroundTasks::length

    source
    fn BackgroundTasks::length(self : BackgroundTasks) -> Int

    How many tasks are queued.

    BackgroundTasks::new

    source

    An empty task queue.

    BackgroundTasks::run

    source
    async fn BackgroundTasks::run(self : BackgroundTasks) -> Unit

    Run every queued task in order, each after the previous returns, then clear the queue. A task that raises stops the ones after it and the error goes to the caller, as in Starlette.

    Context

    source
    pub(all) struct Context {
      request : 
    Request
      params : Map[String, String]
      scope : 
    HttpScope
      background : BackgroundTasks
    }

    The per-request context handed to a handler: the request with its body read, the path parameters the matched route extracted (its {name} pieces), the ASGI scope it arrived on (root_path, the peer, the lifespan state, the extensions), and the request's background tasks.
    fn Context::api_key_cookie(self : Context, name : String) -> String?

    The API key carried in the cookie name (← FastAPI's APIKeyCookie), or None.

    Context::api_key_header

    source
    fn Context::api_key_header(self : Context, name : String) -> String?

    The API key carried in the request header name (← FastAPI's APIKeyHeader), or None. Header names are matched against the request's lower-cased headers.

    Context::api_key_query

    source
    fn Context::api_key_query(self : Context, name : String) -> String?

    The API key carried in the query parameter name (← FastAPI's APIKeyQuery), or None.

    Context::bearer_token

    source
    fn Context::bearer_token(self : Context) -> String?

    Pull the bearer token out of the Authorization: Bearer <token> header, None if the header is absent or isn't a bearer credential. The scheme name is matched case-insensitively, as RFC 6750 requires.

    Context::body

    source

    Deserialise the JSON request body into a user type T, None when the body is absent, is not valid JSON, or does not shape-match T. This is the unchecked, best-effort extractor — the total counterpart of writing item: Item on a FastAPI handler when you don't want the framework's 422. T describes itself with derive(@json.FromJson); the deserialisation is core's, so it stays faithful to the JSON shape without any reflection.

    Context::body_json

    source
    fn Context::body_json(self : Context) -> Json?

    Parse the request body as JSON, returning None for an empty body or one that does not parse — the total counterpart of FastAPI reading a JSON body.

    test {
      let request : @moonasgi.Request = {
        http_method: "POST",
        path: "/login",
        query_string: b"",
        headers: [],
        body: b"{\"user\":\"ada\"}",
      }
      assert_eq(@ctx.Context::new(request).body_json(), Some({ "user": "ada" }))
      assert_eq(
        @ctx.Context::new({ ..request, body: b"not json", }).body_json(),
        None,
      )
    }

    Context::body_validated

    source

    The validated typed-body extractor — the faithful equivalent of FastAPI declaring a pydantic model parameter: the body is checked against the endpoint's descriptor schema (the same tree that emits the OpenAPI body schema), and only if it conforms is it deserialised into T. On failure it yields the FastAPI-shaped ValidationError list (located under ["body",...]), ready for unprocessable; on success it yields the built T.

    Reusing validate_schema here is the point of the descriptor tree: schema emission, request validation, and typed deserialisation are all driven off one source of truth, exactly as pydantic derives all three from one model. Because validation runs first, @json.from_json is reached only for a shape-conforming value; the final catch keeps the extractor total for the residual cases a scalar schema cannot express (e.g. an out-of-range integer).

    Context::cookie

    source
    fn Context::cookie(self : Context, name : String) -> String?

    Look up a cookie by name from the request Cookie header, which is a ; -separated list of key=value pairs. Spaces around a name or a value are the separators'; None if there is no Cookie header or the name is absent.

    Context::digest_credentials

    source
    fn Context::digest_credentials(self : Context) -> String?

    The credential of an Authorization: Digest <parameters> header — the comma-separated parameter list, verbatim (← FastAPI's HTTPDigest). None when the header is absent or names another scheme; the scheme name is matched case-insensitively, as RFC 7235 requires.

    Context::form

    source

    The posted form — FastAPI's Form(...) and File(...) parameters.

    Reading the body is moonhttp/form's job; what belongs here is knowing that a request has a Content-Type and handing it over. None means the form broke its bounds and was refused whole: a handler given the first thousand parts of a larger form would be answering a request nobody sent. An empty form is the other answer, and means the request carried none.

    Context::http_basic

    source
    fn Context::http_basic(self : Context) -> HttpBasicCredentials?

    The HTTP Basic credentials on this request (← FastAPI's HTTPBasic dependency), or None.

    Context::json_field

    source
    fn Context::json_field(self : Context, name : String) -> Json?

    Pull a single field out of a JSON object body by name, None if the body is absent, not an object, or lacks the field.

    Context::last_event_id

    source
    fn Context::last_event_id(self : Context) -> String?

    The id of the last event the client received, from the Last-Event-ID header an event source sends when it reconnects, so a stream can resume after it. None on a first connection; an empty value is one too, since a client with no id sends no header.

    Context::new

    source

    A context for request. The scope defaults to the one a server would build for the request alone, which is what a test or a hand-built context needs.

    Context::oauth2_password_form

    source
    fn Context::oauth2_password_form(self : Context) -> OAuth2PasswordRequestForm?

    Read an OAuth2PasswordRequestForm off the request's urlencoded (or multipart) body. None when neither username nor password is present — the body isn't a password-grant form at all — and equally when the body is too large to be one, since a grant carries six fields and nothing that big is a login.

    Context::param

    source
    fn Context::param(self : Context, name : String) -> String?

    Look up a path parameter by name.

    test {
      let request : @moonasgi.Request = {
        http_method: "GET",
        path: "/users/42",
        query_string: b"",
        headers: [],
        body: b"",
      }
      let ctx = @ctx.Context::new(request, params=Map([("id", "42")]))
      assert_eq(ctx.param("id"), Some("42"))
      assert_eq(ctx.param("name"), None)
    }

    Context::query

    source
    fn Context::query(self : Context, name : String, limits? : 
    Limits    ) -> String?

    Look up a query-string parameter by name, e.g. ?limit=10&q=cat%20dog. Keys and values are percent/plus-decoded, so q above reads back as cat dog. When a key repeats, the first occurrence wins; use query_all to read every one.

    test {
      let request : @moonasgi.Request = {
        http_method: "GET",
        path: "/search",
        query_string: b"q=cat%20dog&q=fish",
        headers: [],
        body: b"",
      }
      let ctx = @ctx.Context::new(request)
      assert_eq(ctx.query("q"), Some("cat dog"))
      assert_eq(ctx.query_all("q"), ["cat dog", "fish"])
    }

    Context::query_all

    source
    fn Context::query_all(self : Context, name : String, limits? : 
    Limits    ) -> Array[String]

    Every value given for name, in the order they appear — ?tag=a&tag=b reads back as ["a", "b"]. Empty when the key is absent.

    Context::serve

    source
    fn Context::serve(self : Context, content : Bytes, filename? : String, media_type? : String, inline? : Bool, etag? : 
    Tag    , modified? : 
    Moment    , ranges? : Bool) -> 
    Response

    [file_response] with the request weighed first (RFC 9110 §13, §14):

    • 304 — the client's copy is current.
    • 412 — a precondition it stated does not hold.
    • 206 — it asked for part, one Content-Range or a multipart/byteranges.
    • 416 — it asked for what is not there.

    Everything turns on etag. Left out, one is hashed from the content, which costs a pass over the body; pass @conditional.stamp(length~, modified~) for one stat's worth instead, or any tag of your own.

    ranges=false withdraws the offer in Accept-Ranges.

    Context::state

    source
    fn Context::state(self : Context) -> Map[String, Json]

    The lifespan state: a shallow copy of what the startup hooks stored, so a handler reads the shared resources and anything it adds stays with this request.

    HttpBasicCredentials

    source
    pub(all) struct HttpBasicCredentials {
      username : String
      password : String
    }

    The credentials carried in an HTTP Basic Authorization header (← FastAPI's HTTPBasicCredentials): the username and password from base64(username:password).

    OAuth2PasswordRequestForm

    source
    pub(all) struct OAuth2PasswordRequestForm {
      grant_type : String
      username : String
      password : String
      scopes : Array[String]
      client_id : String?
      client_secret : String?
    } derive(Eq)

    The parsed OAuth2 password-grant form (← FastAPI's OAuth2PasswordRequestForm). The token endpoint reads username / password to authenticate and scopes (the space-delimited scope field, split into a list) to stamp into the issued token. grant_type is "password" for this flow; client_id / client_secret are optional confidential-client credentials.

    OAuth2PasswordRequestForm::equal

    source

    OAuth2PasswordRequestForm::not_equal

    source

    parse_basic_auth

    source
    fn parse_basic_auth(header : String) -> HttpBasicCredentials?

    Parse an HTTP Basic Authorization header value into credentials (← FastAPI's HTTPBasic), or None. Matches the Basic scheme case-insensitively (RFC 7617), base64-decodes the rest, and splits on the first colon so a password may itself contain colons.

    split_scopes

    source
    fn split_scopes(s : String) -> Array[String]

    Split a space-delimited scope string into its scopes, dropping empty runs — the OAuth2 scope form field is one string like "read write".

    Source Files

    Powered by MoonBit

    Site sourceReport issueModulesSkillsBuild queueStatistics

    © 2026 mooncakes.io