Kikobeats / router-http

98%

push

github

fix: match .use() mounts by decoded longest prefix (#35)

* fix: match .use() mounts by decoded longest prefix

Path middleware skipped multi-segment mounts, trailing-slash mounts, and
percent-encoded segments while routes still matched — an auth bypass.
Normalize mounts on register, match the longest decoded prefix, and strip
the raw URL prefix by segment count so nested handlers see the right path.

Co-authored-by: Cursor <cursoragent@cursor.com>

* perf: restore O(1) first-segment mount lookup

Index path mounts by decoded first segment with longest-first candidates,
skip decode when the URL has no escapes, avoid mountPath+'/' allocs, and
use the registered path for strip unless the request is percent-encoded.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: decode mounts with decodeURI to keep %2F inert

decodeURIComponent turned %2F into a path separator, so a multi-segment
mount could match while raw segment stripping cut the wrong span.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

113 of 118 branches covered (95.76%)

Branch coverage included in aggregate %.

82 of 86 new or added lines in 1 file covered. (95.35%)

323 of 327 relevant lines covered (98.78%)

81.94 hits per line