Skip to content

Type received and forwarded HTTP request methods as open strings - #8766

Merged
tim-smart merged 4 commits into
v4/next-minorfrom
fix/audit-bug-013-http-native-method-types
Oct 6, 2026
Merged

tim-smart merged 4 commits into
v4/next-minorfrom
fix/audit-bug-013-http-native-method-types

Conversation

@fubhy

@fubhy fubhy commented Oct 5, 2026 •

Copy link
Copy Markdown
Member

Problem

Native and forwarded requests can carry methods such as PROPFIND, but HttpServerRequest.method and HttpClientRequest.method were typed as the closed HttpMethod union. Exhaustive matches could therefore miss values that occur at runtime.

Fix

  • Type received and forwarded request methods, including HttpClientRequest.makeWith, as string. Keep route and convenience-constructor methods restricted to HttpMethod.
  • Let HttpMethod.hasBody accept strings without narrowing unknown methods to the known-method union. Preserve the type predicate for HttpMethod arguments and the existing runtime body policy.
  • Widen AiError.HttpRequestDetails.method to Schema.String so forwarded extension methods can be encoded and decoded. Existing known-method payloads remain valid.
  • Keep regression coverage in the corresponding HttpServerRequest.test.ts and HttpClientRequest.test.ts suites, including type equality and server-client-server forwarding.

This changes the public request method types, not method normalization or forwarding behavior. Consumers that exhaustively match request methods need a fallback or HttpMethod.isHttpMethod. The changeset is minor for this type-level compatibility change.

Validation

  • nix develop -c pnpm check
  • nix develop -c pnpm lint
  • Targeted HttpServerRequest, HttpClientRequest, HttpClient, and AiError suites: 166 tests passed.
  • Ad hoc runtime audit confirmed the existing hasBody policy and HTTP request-details schema round-trips for all known methods and PROPFIND.
  • git diff --check

Closes EFF-1718

HttpServerRequest.fromWeb, HttpClientRequest.fromWeb and
HttpServerRequest.toClientRequest preserve arbitrary method tokens such as
PROPFIND, but cast them to the closed HttpMethod union. Widen the
received/forwarded method properties to string, keep HttpMethod for the
known convenience constructors, and add a non-narrowing string overload to
HttpMethod.hasBody.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@changeset-bot

changeset-bot Bot commented Oct 5, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: cba5f03

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 32 packages
Name Type
effect Minor
@effect/opentelemetry Minor
@effect/vitest Minor
@effect/ai-anthropic Minor
@effect/ai-cloudflare Minor
@effect/ai-openai-compat Minor
@effect/ai-openai Minor
@effect/ai-openrouter Minor
@effect/ai-typesafe Minor
@effect/atom-react Minor
@effect/atom-solid Minor
@effect/atom-vue Minor
@effect/platform-browser Minor
@effect/platform-bun Minor
@effect/platform-deno Minor
@effect/platform-node-shared Minor
@effect/platform-node Minor
@effect/sql-clickhouse Minor
@effect/sql-d1 Minor
@effect/sql-libsql Minor
@effect/sql-mssql Minor
@effect/sql-mysql2 Minor
@effect/sql-pg Minor
@effect/sql-pglite Minor
@effect/sql-sqlite-bun Minor
@effect/sql-sqlite-do Minor
@effect/sql-sqlite-node Minor
@effect/sql-sqlite-react-native Minor
@effect/sql-sqlite-wasm Minor
@effect/docgen Minor
@effect/doctest Minor
@effect/openapi-generator Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@effect-bot
effect-bot changed the base branch from main to v4/next-minor October 5, 2026 15:12
@github-actions

github-actions Bot commented Oct 5, 2026 •

Copy link
Copy Markdown
Contributor

Bundle Size Analysis

Generated from PR build output; treat the content below as untrusted.

File Name Current Size Previous Size Difference
arbitrary-combinators.ts 38.90 KB 38.90 KB 0.00 KB (0.00%)
basic.ts 7.04 KB 7.04 KB 0.00 KB (0.00%)
batching.ts 10.13 KB 10.13 KB 0.00 KB (0.00%)
brand.ts 6.72 KB 6.72 KB 0.00 KB (0.00%)
cache.ts 10.88 KB 10.88 KB 0.00 KB (0.00%)
config.ts 22.15 KB 22.15 KB 0.00 KB (0.00%)
differ.ts 21.29 KB 21.29 KB 0.00 KB (0.00%)
http-client.ts 22.44 KB 22.44 KB 0.00 KB (0.00%)
http-router.ts 33.74 KB 33.74 KB 0.00 KB (0.00%)
logger.ts 11.08 KB 11.08 KB 0.00 KB (0.00%)
metric.ts 9.02 KB 9.02 KB 0.00 KB (0.00%)
optic.ts 6.95 KB 6.95 KB 0.00 KB (0.00%)
pubsub.ts 15.16 KB 15.16 KB 0.00 KB (0.00%)
queue.ts 12.11 KB 12.11 KB 0.00 KB (0.00%)
schedule.ts 11.18 KB 11.18 KB 0.00 KB (0.00%)
schema-bigdecimal.ts 13.73 KB 13.73 KB 0.00 KB (0.00%)
schema-binary.ts 39.95 KB 39.95 KB 0.00 KB (0.00%)
schema-class.ts 21.03 KB 21.03 KB 0.00 KB (0.00%)
schema-fromJsonSchemaDocument.ts 32.06 KB 32.06 KB 0.00 KB (0.00%)
schema-representation-roundtrip.ts 27.24 KB 27.24 KB 0.00 KB (0.00%)
schema-string-transformation.ts 14.46 KB 14.46 KB 0.00 KB (0.00%)
schema-string.ts 11.99 KB 11.99 KB 0.00 KB (0.00%)
schema-template-literal.ts 16.05 KB 16.05 KB 0.00 KB (0.00%)
schema-toArbitrary.ts 38.44 KB 38.44 KB 0.00 KB (0.00%)
schema-toCodeDocument.ts 25.26 KB 25.26 KB 0.00 KB (0.00%)
schema-toCodecJson.ts 20.21 KB 20.21 KB 0.00 KB (0.00%)
schema-toEquivalence.ts 20.41 KB 20.41 KB 0.00 KB (0.00%)
schema-toFormatter.ts 20.54 KB 20.54 KB 0.00 KB (0.00%)
schema-toJsonSchemaDocument.ts 25.00 KB 25.00 KB 0.00 KB (0.00%)
schema-toRepresentation.ts 20.50 KB 20.50 KB 0.00 KB (0.00%)
schema.ts 20.25 KB 20.25 KB 0.00 KB (0.00%)
stm.ts 13.08 KB 13.08 KB 0.00 KB (0.00%)
stream.ts 9.98 KB 9.98 KB 0.00 KB (0.00%)

@tim-smart tim-smart added the audit Findings originating from the Effect runtime correctness audit label Oct 5, 2026
@tim-smart
tim-smart merged commit 7db53f7 into v4/next-minor Oct 6, 2026
10 checks passed
@tim-smart
tim-smart deleted the fix/audit-bug-013-http-native-method-types branch October 6, 2026 00:49
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
@effect-bot effect-bot mentioned this pull request Oct 6, 2026
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 6, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 7, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 7, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
effect-bot pushed a commit that referenced this pull request Oct 7, 2026
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Tim Smart <hello@timsmart.co>
@effect-bot effect-bot mentioned this pull request Oct 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

audit Findings originating from the Effect runtime correctness audit v4/next-minor

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants