Error loading file from typescript package in bin folder due to IIS restriction (404s)

[wforney]

This issue came to light while trying to use this plugin for SystemJS... I filed an issue there and they suggested I also make one over here.

frankwallis/plugin-typescript#22 (comment)

The bin folder is blocked in IIS out of box so when installing your typescript plugin I got 404s when it attempted to download the typescript.js file from the bin folder of the typescript package... I'm not sure who publishes that or if you can work around it but it is a blocker for using this on IIS. Whoever maintains the typescript package you use should add a web.config allowing browsing of the bin folder or rename the bin folder something else that isn't blocked (preferred).

web.config contents to fix it below:

<configuration>
  <system.webServer>
   <security>
     <requestFiltering>
        <hiddenSegments applyToWebDAV="false">
           <remove segment="Bin" />
        </hiddenSegments>
     </requestFiltering>
   </security>
  </system.webServer>
</configuration>

[mhegazy]

One option is to rename bin to dist; but this is undesirable as bin is part of the npm conventions, and we have had that since TypeScript was first released, and we do not know who would be broken by this.

I will check with IIS/ASP.net folks to see if there are other workarounds.

[guybedford]

@wforney are you saying here that a file web.config located in the base-level of the TypeScript folder with those contents would make this work in IIS?

[vladima]

yes, removing bin from the set of hidden segments will make it work however ASP.NET guys have not recommended to use this approach as it might result in a security hole (i.e. if some sensitive data is stored somewhere in folder named bin )

[vladima]

Here is what we can do with TypeScript npm package to unblock this scenario

• rename bin to dist and change main to be dist/typescript.js
• add a postinstall script to package.json that will create bin folder and fill it with links to files in dist.

var fs = require('fs');
var path = require('path');

var currentDirectory = process.cwd();
var distFolder = path.join(currentDirectory, "dist");
var files = fs.readdirSync(distFolder);

var binFolder = path.join(currentDirectory, "bin");
if (!fs.existsSync(binFolder)) {
    fs.mkdirSync(binFolder);
}

files.forEach(function(f) {
    var sourcePath = path.join(distFolder, f);
    var targetPath = path.join(binFolder, f);
    fs.linkSync(sourcePath, targetPath); // creating symlinks on Windows requires elevated permissions, in our case hardlinks will also work
});

This way we can be both backwards compatible in scenarios when somebody references typescript.js by relative path that has bin in it, use standard npm/jspm machinery to locate modules and don't bloat the size of the package.

@mhegazy does this solution work for you?

[mhegazy]

fine by me. @billti any concerns/ideas?

[mhegazy]

do we have to change main in package.json? i thought we can configure JSPM to find the right file without updating package.json?

[vladima]

@mhegazy if using overrides to specify different entry point does not put restrictions on some jspm scenarios we can do the other way around, keep everything in bin and create dist folder with links as a postinstall step. @guybedford can you please clarify if this solution is ok from the jspm perspective?

[billti]

A canonical pattern for NPM modules is to have the command line in './bin' (i.e. the file we have at https://github.com/Microsoft/TypeScript/blob/master/bin/tsc ), and have the remainder of the content in a './lib' folder. We could leave the current files referenced by 'bin' entries in packageon.json there (i.e. tsc and tsserver) and move the other files to a lib folder, and the only package.json updates needed would be to point the main property to ./lib/typescript.js.

I'm not a fan of running post install scripts to create folders or putting files for orthogonal technologies (i.e. ASP.NET) in our NPM package. How big do we expect the impact of the move will be without doing these?