feat(middleware): implement middleware chain with CORS support

add new Middleware type and refactor middleware execution to support chaining
introduce CORS middleware with preflight request handling
update example to demonstrate middleware usage

Author: oboard

src/cors/cors.mbt

@@ -0,0 +1,82 @@
+///|
+pub fn is_preflight_request(event : @mocket.HttpEvent) -> Bool {
+  let origin = event.req.headers.get("origin")
+  let access_control_request_method = event.req.headers.get(
+    "access-control-request-method",
+  )
+  return event.req.http_method == "OPTIONS" &&
+    origin != None &&
+    access_control_request_method != None
+}
+
+///|
+pub fn append_cors_preflight_headers(
+  event : @mocket.HttpEvent,
+  origin? : String = "*",
+  methods? : String = "*",
+  allow_headers? : String = "*",
+  credentials? : Bool = false,
+  max_age? : Int = 86400,
+) -> Unit noraise {
+  let headers = event.res.headers
+  headers["Access-Control-Allow-Origin"] = origin
+  if credentials {
+    headers["Access-Control-Allow-Credentials"] = "true"
+  }
+  headers["Access-Control-Allow-Methods"] = methods
+  headers["Access-Control-Allow-Headers"] = allow_headers
+  headers["Access-Control-Max-Age"] = max_age.to_string()
+}
+
+///|
+pub fn append_cors_headers(
+  event : @mocket.HttpEvent,
+  origin? : String = "*",
+  methods? : String = "*",
+  allow_headers? : String = "*",
+  expose_headers? : String = "*",
+  credentials? : Bool = false,
+) -> Unit noraise {
+  let headers = event.res.headers
+  headers["Access-Control-Allow-Origin"] = origin
+  headers["Access-Control-Allow-Methods"] = methods
+  headers["Access-Control-Allow-Headers"] = allow_headers
+  headers["Access-Control-Expose-Headers"] = expose_headers
+  if credentials {
+    headers["Access-Control-Allow-Credentials"] = "true"
+  }
+}
+
+///|
+pub fn handle_cors(
+  origin? : String = "*",
+  methods? : String = "*",
+  allow_headers? : String = "*",
+  expose_headers? : String = "*",
+  credentials? : Bool = false,
+  max_age? : Int = 86400,
+) -> @mocket.Middleware {
+  (event, next) => if is_preflight_request(event) {
+    append_cors_preflight_headers(
+      event,
+      origin~,
+      methods~,
+      allow_headers~,
+      credentials~,
+      max_age~,
+    )
+    // 对于预检请求，直接返回空响应，不调用next()
+    @mocket.Empty
+  } else {
+    append_cors_headers(
+      event,
+      origin~,
+      methods~,
+      allow_headers~,
+      expose_headers~,
+      credentials~,
+    )
+    // 对于普通请求，继续执行后续中间件和处理器
+    next()
+  }
+}

src/cors/moon.pkg.json

@@ -0,0 +1,5 @@
+{
+  "import": [
+    "oboard/mocket"
+  ]
+}

src/example/main.mbt

@@ -4,9 +4,11 @@ fn main {
 
   // Register global middleware
   app
-  ..use_middleware(event => println(
-    "📝 Request: \{event.req.http_method} \{event.req.url}",
-  ))
+  ..use_middleware((event, next) => {
+    println("📝 Request: \{event.req.http_method} \{event.req.url}")
+    next()
+  })
+  ..use_middleware(@cors.handle_cors())
 
   // Text Response
   ..get("/", _event => Text("⚡️ Tadaa!"))
@@ -15,9 +17,12 @@ fn main {
   ..on("GET", "/hello", _ => Text("Hello world!"))
   ..group("/api", group => {
     // 添加组级中间件
-    group.use_middleware(event => println(
-      "🔒 API Group Middleware: \{event.req.http_method} \{event.req.url}",
-    ))
+    group.use_middleware((event, next) => {
+      println(
+        "🔒 API Group Middleware: \{event.req.http_method} \{event.req.url}",
+      )
+      next()
+    })
     group.get("/hello", _ => Text("Hello world!"))
     group.get("/json", _ => Json({
       "name": "John Doe",

src/example/moon.pkg.json

@@ -1,6 +1,7 @@
 {
   "is-main": true,
   "import": [
-    "oboard/mocket"
+    "oboard/mocket",
+    "oboard/mocket/cors"
   ]
 }

src/index.mbt

@@ -11,7 +11,7 @@ pub(all) enum HttpBody {
 pub(all) struct Mocket {
   base_path : String
   mappings : Map[(String, String), async (HttpEvent) -> HttpBody noraise]
-  middlewares : Array[(String, async (HttpEvent) -> Unit noraise)]
+  middlewares : Array[(String, Middleware)]
   // 添加静态路由缓存（精确匹配的路由）
   static_routes : Map[
     String,

src/middleware.mbt

@@ -1,8 +1,12 @@
+///|
+// 中间件类型：接受 HttpEvent 和 next 函数，返回 HttpBody
+pub type Middleware = async (HttpEvent, async () -> HttpBody noraise) -> HttpBody noraise
+
 ///|
 // 注册中间件，支持路径匹配
 pub fn Mocket::use_middleware(
   self : Mocket,
-  middleware : async (HttpEvent) -> Unit noraise,
+  middleware : Middleware,
   base_path? : String,
 ) -> Unit {
   let base_path = base_path.unwrap_or(self.base_path)
@@ -11,20 +15,44 @@ pub fn Mocket::use_middleware(
 }
 
 ///|
-// 执行中间件链，支持路径匹配
-fn execute_middlewares(
-  middlewares : Array[(String, async (HttpEvent) -> Unit noraise)],
+// 执行中间件链，支持路径匹配和洋葱模型
+pub async fn execute_middlewares(
+  middlewares : Array[(String, Middleware)],
   event : HttpEvent,
-) -> Unit {
-  // 优化：使用迭代而不是递归，避免栈溢出
-  let mut i = 0
-  while i < middlewares.length() {
+  final_handler : async (HttpEvent) -> HttpBody noraise,
+) -> HttpBody noraise {
+  // 过滤出匹配路径的中间件
+  let matched_middlewares = []
+  for i = 0; i < middlewares.length(); i = i + 1 {
     let (base_path, middleware) = middlewares[i]
     // 如果 base_path 为空字符串，则为全局中间件
     // 否则检查请求路径是否匹配 base_path
     if base_path == "" || event.req.url.has_prefix(base_path) {
-      run(fn() { middleware(event) })
+      matched_middlewares.push(middleware)
+    }
+  }
+
+  // 递归构建中间件链（洋葱模型）
+  execute_middleware_chain(matched_middlewares, 0, event, final_handler)
+}
+
+///|
+// 递归执行中间件链
+async fn execute_middleware_chain(
+  middlewares : Array[Middleware],
+  index : Int,
+  event : HttpEvent,
+  final_handler : async (HttpEvent) -> HttpBody noraise,
+) -> HttpBody noraise {
+  if index >= middlewares.length() {
+    // 所有中间件都执行完毕，调用最终处理器
+    final_handler(event)
+  } else {
+    // 执行当前中间件
+    let current_middleware = middlewares[index]
+    let next = async fn() noraise {
+      execute_middleware_chain(middlewares, index + 1, event, final_handler)
     }
-    i = i + 1
+    current_middleware(event, next)
   }
 }

src/mocket.js.mbt

@@ -112,9 +112,8 @@ pub fn serve_ffi(mocket : Mocket, port~ : Int) -> Unit {
           }
         }
 
-        // 执行中间件链
-        execute_middlewares(mocket.middlewares, event)
-        let body = handler(event)
+        // 执行中间件链和处理器
+        let body = execute_middlewares(mocket.middlewares, event, handler)
         if not(body is Empty) {
           event.res.headers.set(
             "Content-Type",

src/mocket.native.mbt

@@ -171,10 +171,9 @@ fn handle_request_native(
     }
     event.req.body = body
   }
-  run(() => {
-    // 执行中间件链
-    execute_middlewares(mocket.middlewares, event)
-    let body = handler(event)
+  run(async fn() noraise {
+    // 执行中间件链和处理器
+    let body = execute_middlewares(mocket.middlewares, event, handler)
     if not(body is Empty) {
       event.res.headers.set(
         "Content-Type",