javier
cdded06ba3
This PR contains the work done to rename the _Web_ package as _Infrastructure_, to provide a clear naming and purpose to this particular package within the project. To provide further details about the work: * Infrastructure * Asset fingerprinting: an FNV-1a token derived from the static files directory, appended as ?v= to asset URLs so deploys bust caches; pre-rendered pages also revalidate via weak ETags. * New middlewares: fixed-window RateLimitMiddleware (per-client budgets keyed by trusted X-Forwarded-For or remote address) and VaryMiddleware (Accept-Encoding on every response); SecurityHeadersMiddleware now also stamps error responses. * Auto-generated HEAD endpoints, cache max-age configuration, and Docker build/Compose refinements. * Protocols and scaffolding: Asset/AssetExtension, the Page protocol (viewport, stylesheets, scripts, versioned URLs), and LocalizedRequestContext. * Rate limiter's counter store swapped from an actor to a Mutex (no executor hop per request) with amortized batch eviction instead of O(n²) scans under client floods. * FingerprintAssets reports unreadable files to a logger instead of silently producing a token that never busts their cache. Reviewed-on: rock-n-code/loud-amsterdam#25 Co-authored-by: Javier Cicchelli <javier@rock-n-code.com> Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>
72 lines
2.4 KiB
Swift
72 lines
2.4 KiB
Swift
import Foundation
|
|
import HTTPTypes
|
|
import Hummingbird
|
|
|
|
/// Appends header names to the `Vary` header of every response passing through.
|
|
///
|
|
/// Placed just above the response-compression middleware, it marks each response as varying on `Accept-Encoding`: the static files and pre-rendered
|
|
/// pages are served with `Cache-Control: public`, so without the signal a shared cache could store a compressed body and hand it to a client that
|
|
/// never advertised support for the encoding.
|
|
///
|
|
/// Names already present on a response's `Vary` header — such as the `Accept-Language` the localized pages carry — are kept, and duplicates are not
|
|
/// added.
|
|
public struct VaryMiddleware<Context: RequestContext>: Sendable {
|
|
|
|
// MARK: Properties
|
|
|
|
/// The header names appended to every response's `Vary` header.
|
|
private let names: [String]
|
|
|
|
// MARK: Initializers
|
|
|
|
/// Creates a vary middleware.
|
|
/// - Parameter fields: the header names appended to every response's `Vary` header. Defaults to `Accept-Encoding`, the request header
|
|
/// the response-compression middleware acts on.
|
|
public init(
|
|
fields: [HTTPField.Name] = [.acceptEncoding]
|
|
) {
|
|
self.names = fields.map(\.rawName)
|
|
}
|
|
|
|
}
|
|
|
|
// MARK: - RouterMiddleware
|
|
|
|
extension VaryMiddleware: RouterMiddleware {
|
|
|
|
// MARK: Functions
|
|
|
|
/// Passes the request down the chain and appends the configured names to the response's `Vary` header on the way back up.
|
|
/// - Parameters:
|
|
/// - request: the incoming request.
|
|
/// - context: the context the request is resolved against.
|
|
/// - next: the next responder in the middleware chain.
|
|
/// - Returns: the downstream response with the `Vary` names applied.
|
|
/// - Throws: any error thrown downstream.
|
|
public func handle(
|
|
_ request: Request,
|
|
context: Context,
|
|
next: (Request, Context) async throws -> Response
|
|
) async throws -> Response {
|
|
var response = try await next(
|
|
request,
|
|
context
|
|
)
|
|
|
|
var vary = response.headers[.vary]?
|
|
.split(separator: ",")
|
|
.map { $0.trimmingCharacters(in: .whitespaces) } ?? []
|
|
|
|
for name in names where !vary.contains(where: {
|
|
$0.caseInsensitiveCompare(name) == .orderedSame
|
|
}) {
|
|
vary.append(name)
|
|
}
|
|
|
|
response.headers[.vary] = vary.joined(separator: ", ")
|
|
|
|
return response
|
|
}
|
|
|
|
}
|