4.9.3

fixes #2361
fixes #2362

.gitignore

@@ -1 +1,16 @@
+coverage/
 .DS_Store
+*.seed
+*.log
+*.csv
+*.dat
+*.out
+*.pid
+*.swp
+*.swo
+benchmarks/graphs
+testing
+node_modules/
+testing
+test.js
+.idea

.gitmodules

@@ -1,12 +0,0 @@
-[submodule "spec/support/libxmljs"]
-	path = spec/support/libxmljs
-	url = git://github.com/sprsquish/libxmljs.git
-[submodule "lib/support/haml"]
-	path = lib/support/haml
-	url = git://github.com/creationix/haml-js.git
-[submodule "lib/support/js-oo"]
-	path = lib/support/js-oo
-	url = git://github.com/visionmedia/js-oo.git
-[submodule "lib/support/sass"]
-	path = lib/support/sass
-	url = git://github.com/visionmedia/sass.js.git

.npmignore

@@ -0,0 +1,11 @@
+.git*
+benchmarks/
+coverage/
+docs/
+examples/
+support/
+test/
+testing.js
+.DS_Store
+.travis.yml
+Contributing.md

.travis.yml

@@ -0,0 +1,10 @@
+language: node_js
+node_js:
+  - "0.10"
+  - "0.11"
+matrix:
+  allow_failures:
+    - node_js: "0.11"
+  fast_finish: true
+script: "npm run-script test-travis"
+after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"

Contributing.md

@@ -0,0 +1,25 @@
+
+## Website Issues
+
+Issues for the expressjs.com website go here https://github.com/strongloop/expressjs.com
+
+## PRs and Code contributions
+
+* Tests must pass.
+* Follow existing coding style.
+* If you fix a bug, add a test.
+
+
+## Issues which are questions
+
+We will typically close any vague issues or questions that are specific to some app you are writing. Please double check the docs and other references before being trigger happy with posting a question issue.
+
+Things that will help get your question issue looked at:
+
+* Full and runnable JS code.
+* Clear description of the problem or unexpected behavior.
+* Clear description of the expected result.
+* Steps you have taken to debug it yourself.
+
+If you post a question and do not outline the above items or make it easy for us to understand and reproduce your issue, it will be closed.
+

LICENSE

@@ -0,0 +1,22 @@
+(The MIT License)
+
+Copyright (c) 2009-2014 TJ Holowaychuk <tj@vision-media.ca>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Makefile

@@ -1,33 +0,0 @@
-
-NODE = node
-
-all: test
-
-init:
-	@git submodule init && git submodule update
-
-test: init spec/support/libxmljs/libxmljs.node
-	@$(NODE) spec/node.js all
-	
-test-independant: init
-	@$(NODE) spec/node.js independant
-	
-test-dependant: init spec/support/libxmljs/libxmljs.node
-	@$(NODE) spec/node.js dependant
-	
-app: app-chat
-	
-app-chat:
-	@$(NODE) examples/chat/app.js
-	
-app-upload:
-	@$(NODE) examples/upload/app.js
-	
-benchmark:
-	@$(NODE) benchmarks/collection.js
-	@$(NODE) benchmarks/views.js
-	
-spec/support/libxmljs/libxmljs.node:
-	@scons -C spec/support/libxmljs libxmljs.node
-	
-.PHONY: init test benchmark app

Readme.md

@@ -1,145 +1,128 @@
+[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/)
 
-# Express
-      
-  Insanely fast (and small) server-side JavaScript web development framework
-  built on **node.js** and the **V8 JavaScript engine**.
+  Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  * Visit the [Wiki](http://wiki.github.com/visionmedia/express) for documentation
-  * Visit the [Google Group](http://groups.google.com/group/express-js) for discussion
+  [![NPM Version](https://img.shields.io/npm/v/express.svg?style=flat)](https://www.npmjs.org/package/express)
+  [![Build Status](https://img.shields.io/travis/strongloop/express.svg?style=flat)](https://travis-ci.org/strongloop/express)
+  [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg?style=flat)](https://coveralls.io/r/strongloop/express)
+  [![Gittip](https://img.shields.io/gittip/dougwilson.svg?style=flat)](https://www.gittip.com/dougwilson/)
 
-## Features (so far)
+```js
+var express = require('express')
+var app = express()
 
-  * Sexy DSL with robust sinatra-like routing
-  * High performance
-  * Session support
-  * Mime helpers
-  * Redirection helpers
-  * Nested parameter parsing
-  * Full test coverage
-  * Extremely readable specs
-  * Test helpers (mock requests etc)
-  * Environment based configuration
-  * Light-weight JavaScript class implementation via js-oo
-  * Collections and chainable iterators
-  * ElementCollections / markup parsing via libxmljs and css selector traversal support via css2xpath
-  * View support (ejs, haml, sass, etc)
-  
-## Installation
+app.get('/', function (req, res) {
+  res.send('Hello World')
+})
 
-Currently Express must be cloned (or downloaded), you can use the following command to
-get rolling and initialize the submodule dependencies:
+app.listen(3000)
+```
 
-    $ git clone git://github.com/visionmedia/express.git && cd express && git submodule update --init && make app
-    
-Or with the [gh](http://github.com/visionmedia/gh) utility:
+  **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/strongloop/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/strongloop/express/wiki/New-features-in-4.x).
 
-    $ gh clone visionmedia express && cd express && git submodule update --init && make app
+### Installation
 
-## Performance
+```bash
+$ npm install express
+```
 
-  Extensive benchmarking will wait until a development version
-  has been released. 
-  
-  Currently Express can chew through a request with a two Haml views (*page and layout*) 
-  requested **2000** times with concurrency of **80** in **2.4** seconds and **814**
-  requests per second. With no caching involved.
-  
-  An identical Sinatra application was served with the **Thin** HTTP server
-  and scored **8.3** seconds and **238** requests per second. In this situation
-  Express is currently **3.5** times faster than Sinatra.
+## Quick Start
 
-## Examples
+  The quickest way to get started with express is to utilize the executable [`express(1)`](https://github.com/expressjs/generator) to generate an application as shown below:
 
-Below is a minimal app example when express is already within your load path.
+  Install the executable. The executable's major version will match Express's:
 
-    require('express')
-    require('express/plugins')
-    
-    configure(function(){
-      use(MethodOverride)
-      use(ContentLength)
-      set('root', __dirname)
-    })
-    
-    get('/hello', function(){
-      this.contentType('html')
-      return '<h1>World<h1>'
-    })
-    
-    get('/user/:id?', function(id) {
-      this.render('user.haml.html', {
-        locals: {
-          name: id ? 'User ' + id : 'You' 
-        }
-      })
-    })
-    
-    run()
-  
-## Running Tests
+```bash
+$ npm install -g express-generator@4
+```
 
-Express uses the [JSpec](http://jspec.info) BDD JavaScript testing
-framework to write and run elegant spec suites. JSpec is frozen 
-to spec/lib and does not require separate installation.
+  Create the app:
 
-To run all specifications run the following command. This will ensure
-git submodules are initialized and updated, as well as building test
-related dependencies such as libxmljs.
+```bash
+$ express /tmp/foo && cd /tmp/foo
+```
 
-    $ make test
-    
-To run independent specs (which do not require building of external apis etc) use:
+  Install dependencies:
 
-    $ make test-independant
-    
-To run dependent specs (which require building of external apis etc) use:
+```bash
+$ npm install
+```
 
-    $ make test-dependant
-    
-Run individual suites:
+  Start the server:
+
+```bash
+$ npm start
+```
+
+## Features
+
+  * Robust routing
+  * HTTP helpers (redirection, caching, etc)
+  * View system supporting 14+ template engines
+  * Content negotiation
+  * Focus on high performance
+  * Executable for generating applications quickly
+  * High test coverage
+
+## Philosophy
+
+  The Express philosophy is to provide small, robust tooling for HTTP servers, making
+  it a great solution for single page applications, web sites, hybrids, or public
+  HTTP APIs.
+
+  Express does not force you to use any specific ORM or template engine. With support for over
+  14 template engines via [Consolidate.js](https://github.com/visionmedia/consolidate.js),
+  you can quickly craft your perfect framework.
 
-    $ node spec/node.js core
-    $ node spec/node.js mime
-    $ node spec/node.js routing
-    ...
-    
-Express is currently being developed with node --version:
-    v0.1.27
-    
 ## More Information
 
-  * [JavaScript Extensions &amp; Utilities](http://github.com/visionmedia/ext.js)
-  * [JavaScript Sass](http://github.com/visionmedia/sass.js)
-  * [Scons Build System](http://www.scons.org/) (some development dependencies rely on this, ex libxmljs)
-    
-## Contributors
+  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/strongloop/expressjs.com)]
+  * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
+  * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
+  * Visit the [Wiki](https://github.com/strongloop/express/wiki)
+  * [Google Group](https://groups.google.com/group/express-js) for discussion
+  * [Русскоязычная документация](http://jsman.ru/express/)
+  * [한국어 문서](http://expressjs.kr) - [[website repo](https://github.com/Hanul/expressjs.kr)]
+  * Run express examples [online](https://runnable.com/express)
 
-  * TJ Holowaychuk (visionmedia) &lt;tj@vision-media.ca&gt;
-  * Aaron Heckmann (aheckmann) &lt;aaron.heckmann+github@gmail.com&gt;
-  * Ciaran Jessup (ciaranj) &lt;ciaranj@gmail.com&gt;
-  * Gareth Jones (csausdev) &lt;gareth.jones@sensis.com.au&gt;
-    
-## License 
+## Viewing Examples
 
-(The MIT License)
+  Clone the Express repo, then install the dev dependencies to install all the example / test suite dependencies:
 
-Copyright (c) 2009 TJ Holowaychuk &lt;tj@vision-media.ca&gt;
+```bash
+$ git clone git://github.com/strongloop/express.git --depth 1
+$ cd express
+$ npm install
+```
 
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
+  Then run whichever example you want:
 
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
+    $ node examples/content-negotiation
 
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+  You can also view live examples here:
+
+  <a href="https://runnable.com/express" target="_blank"><img src="https://runnable.com/external/styles/assets/runnablebtn.png" style="width:67px;height:25px;"></a>
+
+## Running Tests
+
+  To run the test suite, first invoke the following command within the repo, installing the development dependencies:
+
+```bash
+$ npm install
+```
+
+  Then run the tests:
+
+```bash
+$ npm test
+```
+
+### Contributors
+
+ * Author: [TJ Holowaychuk](https://github.com/visionmedia)
+ * Lead Maintainer: [Douglas Christopher Wilson](https://github.com/dougwilson)
+ * [All Contributors](https://github.com/strongloop/express/graphs/contributors)
+
+### License
+
+  [MIT](LICENSE)

benchmarks/Makefile

@@ -0,0 +1,13 @@
+
+all:
+	@./run 1 middleware
+	@./run 5 middleware
+	@./run 10 middleware
+	@./run 15 middleware
+	@./run 20 middleware
+	@./run 30 middleware
+	@./run 50 middleware
+	@./run 100 middleware
+	@echo
+
+.PHONY: all

benchmarks/benchmark.js

@@ -1,83 +0,0 @@
-
-;(function(){
-	var currentSuite
-	
-	/**
-	 * Contents of _fn_. Strips function literal and signature.
-	 *
-	 * @param  {function} fn
-	 * @return {string}
-	 * @api private
-	 */
-	
-	function contentsOf(fn) {
-		return fn.toString().match(/^[^\{]*{((.*\n*)*)}/m)[1]
-	}
-	
-	/**
-	 * Pad _str_ to _len_.
-	 *
-	 * @param  {string} str
-	 * @param  {integer} len
-	 * @return {string}
-	 * @api private
-	 */
-	
-	function pad(str, len) {
-		return str + (new Array(len - str.length)).join(' ')
-	}
-	
-	/**
-	 * Time the execution of _fn_
-	 *
-	 * @param  {function} fn
-	 * @return {float}
-	 * @api private
-	 */
-	
-	function time(fn) {
-		var start = Number(new Date)
-		fn()
-		return (Number(new Date) - start) / 1000
-	}
-	
-	/**
-	 * Benchmark _fn_ with the given _label_.
-	 *
-	 * @param {string} label
-	 * @param {function} fn
-	 * @api public
-	 */
-	
-	function benchmark(label, fn) {
-		var duration = time(function(){
-			for (var i = 0; i < currentSuite.times; ++i)
-				fn()
-		}).toFixed(3)
-		print(pad('  ' + label, 50 - duration.toString().length) + duration + ' |')
-	}
-	
-	/**
-	 * Create a benchmark suite with the given _label_, which
-	 * will run each benchmark n _times_. If _times_ is omitted
-	 * then it defaults to 1.
-	 *
-	 * @param  {string} label
-	 * @param  {integer, function} times
-	 * @param  {function} fn
-	 * @api public
-	 */
-	
-	suite = function(label, times, fn) {
-		currentSuite = this
-		if (typeof times == 'function')
-		  this.times = 1, fn = times
-    else
-		  this.times = times
-		print('\n  ' + pad(label, 42 - this.times.toString().length) + this.times + ' time(s)')
-		print('  -------------------------------------------------')
-		eval(contentsOf(fn))
-		print('')
-	}
-	
-})()

benchmarks/collection.js

@@ -1,111 +0,0 @@
-
-require.paths.unshift('lib')
-require.paths.unshift('benchmarks')
-process.mixin(GLOBAL, require('sys'))
-process.mixin(GLOBAL, require('benchmark'))
-require('express')
-
-print = puts
-
-range = function(a, b) {
-  var array = []
-  while (a++ < b)
-    array.push(a-1)
-  return array
-}
-
-suite('Collection with [0..10,000]', 100, function(){
-  array = range(0, 10000)
-  
-  benchmark('for', function(){
-    for (var i = 0, len = array.length; i < len; ++i) ;
-  })
-  
-  benchmark('for uncached', function(){
-    for (var i = 0; i < array.length; ++i) ;
-  })
-  
-  benchmark('forEach()', function(){
-    array.forEach(function(){})
-  })
-  
-  benchmark('#each()', function(){
-    $(array).each(function(){})
-  })
-  
-  benchmark('#map()', function(){
-    $(array).map(function(n){ return n += 1 })
-  })
-  
-  benchmark('#map() with shorthand', function(){
-    $(array).map('a += 1')
-  })
-  
-  benchmark('#find()', function(){
-    $(array).find(function(n){ return n > 5000 })
-  })
-  
-  benchmark('#select()', function(){
-    $(array).select(function(n){ return n % 2 })
-  })
-  
-  benchmark('#first()', function(){
-    $(array).first(5000)
-  })
-  
-  benchmark('#slice()', function(){
-    $(array).slice(100, 5000)
-  })
-  
-  benchmark('#drop()', function(){
-    $(array).drop(5000)
-  })
-  
-  benchmark('#length()', function(){
-    $(array).length()
-  })
-  
-  benchmark('#keys()', function(){
-    $(array).keys()
-  })
-  
-  benchmark('#toArray()', function(){
-    $(array).toArray()
-  })
-  
-  benchmark('#min()', function(){
-    $(array).min()
-  })
-  
-  benchmark('#max()', function(){
-    $(array).max()
-  })
-  
-  benchmark('#sum()', function(){
-    $(array).sum()
-  })
-  
-  benchmark('#avg()', function(){
-    $(array).avg()
-  })
-  
-  benchmark('#clone()', function(){
-    $(array).clone()
-  })
-  
-  benchmark('#merge()', function(){
-    $(array).merge({ foo: 'bar' })
-  })
-  
-  benchmark('#sample()', function(){
-    $(array).sample()
-  })
-  
-  benchmark('#chunk()', function(){
-    $(array).chunk(5)
-  })
-  
-  benchmark('#at()', function(){
-    $(array).at(5000)
-  })
-})

benchmarks/middleware.js

@@ -0,0 +1,23 @@
+
+var http = require('http');
+var express = require('..');
+var app = express();
+
+// number of middleware
+
+var n = parseInt(process.env.MW || '1', 10);
+console.log('  %s middleware', n);
+
+while (n--) {
+  app.use(function(req, res, next){
+    next();
+  });
+}
+
+var body = new Buffer('Hello World');
+
+app.use(function(req, res, next){
+  res.send(body);
+});
+
+app.listen(3333);

benchmarks/run

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+echo
+MW=$1 node $2 &
+pid=$!
+
+sleep 2
+
+wrk 'http://localhost:3333/?foo[bar]=baz' \
+  -d 3 \
+  -c 50 \
+  -t 8 \
+  | grep 'Requests/sec' \
+  | awk '{ print "  " $2 }'
+
+kill $pid

benchmarks/views.js

@@ -1,56 +0,0 @@
-
-require.paths.unshift('lib')
-require.paths.unshift('benchmarks')
-process.mixin(GLOBAL, require('sys'))
-process.mixin(GLOBAL, require('benchmark'))
-require('express')
-
-print = puts
-
-engine = {
-  ejs: require('ejs'),
-  haml: require('haml'),
-  sass: require('sass')
-}
-
-options = { locals: { article: { title: 'Foo', body: 'bar' }}}
-
-ejs = '                           \n\
-<div id="primary">                \n\
-  <div class="block first">       \n\
-    <h1><%= article.title %></h1> \n\
-    <p><%= article.body %></p>    \n\
-  </div>                          \n\
-</div>                            \n\
-'
-
-haml = '               \n\
-#primary               \n\
-  .block.first         \n\
-    %h1= article.title \n\
-    %p= article.body   \n\
-'
-
-sass = '                \n\
-red: #ff0000            \n\
-body                    \n\
-  ul                    \n\
-    li                  \n\
-      a                 \n\
-        :color !red     \n\
-      :list-style none  \n\
-'
-
-suite('Template Engines', 1000, function(){
-  benchmark('ejs', function(){
-    engine.ejs.render(ejs, options)
-  })
-  
-  benchmark('haml', function(){
-    engine.haml.render(haml, options)
-  })
-  
-  benchmark('sass', function(){
-    engine.sass.render(sass)
-  })
-})

examples/auth/app.js

@@ -0,0 +1,130 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var hash = require('./pass').hash;
+var bodyParser = require('body-parser');
+var session = require('express-session');
+
+var app = module.exports = express();
+
+// config
+
+app.set('view engine', 'ejs');
+app.set('views', __dirname + '/views');
+
+// middleware
+
+app.use(bodyParser.urlencoded({ extended: false }));
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'shhhh, very secret'
+}));
+
+// Session-persisted message middleware
+
+app.use(function(req, res, next){
+  var err = req.session.error;
+  var msg = req.session.success;
+  delete req.session.error;
+  delete req.session.success;
+  res.locals.message = '';
+  if (err) res.locals.message = '<p class="msg error">' + err + '</p>';
+  if (msg) res.locals.message = '<p class="msg success">' + msg + '</p>';
+  next();
+});
+
+// dummy database
+
+var users = {
+  tj: { name: 'tj' }
+};
+
+// when you create a user, generate a salt
+// and hash the password ('foobar' is the pass here)
+
+hash('foobar', function(err, salt, hash){
+  if (err) throw err;
+  // store the salt & hash in the "db"
+  users.tj.salt = salt;
+  users.tj.hash = hash;
+});
+
+
+// Authenticate using our plain-object database of doom!
+
+function authenticate(name, pass, fn) {
+  if (!module.parent) console.log('authenticating %s:%s', name, pass);
+  var user = users[name];
+  // query the db for the given username
+  if (!user) return fn(new Error('cannot find user'));
+  // apply the same algorithm to the POSTed password, applying
+  // the hash against the pass / salt, if there is a match we
+  // found the user
+  hash(pass, user.salt, function(err, hash){
+    if (err) return fn(err);
+    if (hash == user.hash) return fn(null, user);
+    fn(new Error('invalid password'));
+  });
+}
+
+function restrict(req, res, next) {
+  if (req.session.user) {
+    next();
+  } else {
+    req.session.error = 'Access denied!';
+    res.redirect('/login');
+  }
+}
+
+app.get('/', function(req, res){
+  res.redirect('/login');
+});
+
+app.get('/restricted', restrict, function(req, res){
+  res.send('Wahoo! restricted area, click to <a href="/logout">logout</a>');
+});
+
+app.get('/logout', function(req, res){
+  // destroy the user's session to log them out
+  // will be re-created next request
+  req.session.destroy(function(){
+    res.redirect('/');
+  });
+});
+
+app.get('/login', function(req, res){
+  res.render('login');
+});
+
+app.post('/login', function(req, res){
+  authenticate(req.body.username, req.body.password, function(err, user){
+    if (user) {
+      // Regenerate session when signing in
+      // to prevent fixation
+      req.session.regenerate(function(){
+        // Store the user's primary key
+        // in the session store to be retrieved,
+        // or in this case the entire user object
+        req.session.user = user;
+        req.session.success = 'Authenticated as ' + user.name
+          + ' click to <a href="/logout">logout</a>. '
+          + ' You may now access <a href="/restricted">/restricted</a>.';
+        res.redirect('back');
+      });
+    } else {
+      req.session.error = 'Authentication failed, please check your '
+        + ' username and password.'
+        + ' (use "tj" and "foobar")';
+      res.redirect('/login');
+    }
+  });
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/auth/pass.js

@@ -0,0 +1,48 @@
+
+// check out https://github.com/visionmedia/node-pwd
+
+/**
+ * Module dependencies.
+ */
+
+var crypto = require('crypto');
+
+/**
+ * Bytesize.
+ */
+
+var len = 128;
+
+/**
+ * Iterations. ~300ms
+ */
+
+var iterations = 12000;
+
+/**
+ * Hashes a password with optional `salt`, otherwise
+ * generate a salt for `pass` and invoke `fn(err, salt, hash)`.
+ *
+ * @param {String} password to hash
+ * @param {String} optional salt
+ * @param {Function} callback
+ * @api public
+ */
+
+exports.hash = function (pwd, salt, fn) {
+  if (3 == arguments.length) {
+    crypto.pbkdf2(pwd, salt, iterations, len, function(err, hash){
+      fn(err, hash.toString('base64'));
+    });
+  } else {
+    fn = salt;
+    crypto.randomBytes(len, function(err, salt){
+      if (err) return fn(err);
+      salt = salt.toString('base64');
+      crypto.pbkdf2(pwd, salt, iterations, len, function(err, hash){
+        if (err) return fn(err);
+        fn(null, salt, hash.toString('base64'));
+      });
+    });
+  }
+};

examples/auth/views/foot.ejs

@@ -0,0 +1,2 @@
+  </body>
+</html>

examples/auth/views/head.ejs

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title><%= title %></title>
+    <style>
+      body {
+        padding: 50px;
+        font: 13px Helvetica, Arial, sans-serif;
+      }
+      .error {
+          color: red
+      }
+      .success {
+          color: green;
+      }
+    </style>
+  </head>
+  <body>

examples/auth/views/login.ejs

@@ -0,0 +1,22 @@
+
+<% var title = 'Authentication Example' %>
+<% include head %>
+
+<h1>Login</h1>
+<%- message %>
+Try accessing <a href="/restricted">/restricted</a>, then authenticate with "tj" and "foobar".
+<form method="post" action="/login">
+  <p>
+    <label>Username:</label>
+    <input type="text" name="username">
+  </p>
+  <p>
+    <label>Password:</label>
+    <input type="text" name="password">
+  </p>
+  <p>
+    <input type="submit" value="Login">
+  </p>
+</form>
+
+<% include foot %>

examples/big-view/index.js

@@ -0,0 +1,31 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
+
+app.set('views', __dirname);
+app.set('view engine', 'jade');
+
+var pets = [];
+
+var n = 1000;
+while (n--) {
+  pets.push({ name: 'Tobi', age: 2, species: 'ferret' });
+  pets.push({ name: 'Loki', age: 1, species: 'ferret' });
+  pets.push({ name: 'Jane', age: 6, species: 'ferret' });
+}
+
+app.use(logger('dev'));
+
+app.get('/', function(req, res){
+  res.render('pets', { pets: pets });
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/big-view/pets.jade

@@ -0,0 +1,12 @@
+style.
+  body {
+    padding: 50px;
+    font: 16px "Helvetica Neue", Helvetica;
+  }
+
+table
+  for pet in pets
+    tr
+      td= pet.name
+      td= pet.age
+      td= pet.species

examples/chat/app.js

@@ -1,81 +0,0 @@
-
-require.paths.unshift('lib')
-require('express')
-require('express/plugins')
-
-configure(function(){
-  var fiveMinutes = 300000,
-      oneMinute = 60000
-  use(MethodOverride)
-  use(ContentLength)
-  use(CommonLogger)
-  use(Cookie)
-  use(Cache, { lifetime: fiveMinutes, reapInterval: oneMinute })
-  use(Session, { lifetime: fiveMinutes, reapInterval: oneMinute })
-  set('root', __dirname)
-})
-
-var messages = [],
-    utils = require('express/utils')
-    
-get('/', function(){
-  this.redirect('/chat')
-})
-
-get('/chat', function(){
-  this.render('chat.haml.html', {
-    locals: {
-      title: 'Chat',
-      messages: messages,
-      name: this.session.name,
-      usersOnline: Session.store.length()
-    }
-  })
-})
-
-post('/chat', function(){
-  this.session.name = this.param('name')
-  messages
-    .push(utils.escape(this.param('name')) + ': ' + utils.escape(this.param('message'))
-    .replace(/(http:\/\/[^\s]+)/g, '<a href="$1" target="express-chat">$1</a>')
-    .replace(/:\)/g, '<img src="http://icons3.iconfinder.netdna-cdn.com/data/icons/ledicons/emoticon_smile.png">'))
-  this.halt(200)
-})
-
-get('/chat/messages', function(){
-  var self = this,
-      previousLength = messages.length,
-      timer = setInterval(function(){
-    if (messages.length > previousLength)
-      self.contentType('json'),
-      previousLength = messages.length,
-      self.halt(200, JSON.encode(messages)),
-      clearInterval(timer)
-  }, 100)
-})
-
-get('/public/*', function(file){
-  this.sendfile(__dirname + '/public/' + file)
-})
-
-get('/*.css', function(file){
-  this.render(file + '.sass.css', { layout: false })
-})
-
-get('/error/view', function(){
-  this.render('does.not.exist')
-})
-
-get('/error', function(){
-  throw new Error('oh noes!')
-})
-
-get('/simple', function(){
-  return 'Hello :)'
-})
-
-get('/favicon.ico', function(){
-  this.halt()
-})
-
-run()

examples/chat/public/javascripts/app.js

@@ -1,28 +0,0 @@
-
-$(function(){
-  // Send message
-  $('form').submit(function(){
-    var message = $('input[name=message]'),
-        name = $('input[name=name]')
-    if (message.val()) 
-      $.post('/chat', { name: name.val(), message: message.val() }, function(){
-        message.val('')
-      })
-    else
-      message.css('border', '1px solid red')
-    return false
-  })
-  
-  // Longpoll
-  ;(function poll(){
-    $.getJSON('/chat/messages', function(messages){
-      $('#messages').empty()
-      $.each(messages, function(i, msg){
-        $('#messages')
-          .append('<li>' + msg + '</li>')
-          .get(0).scrollTop = $('#messages').get(0).scrollHeight
-      })
-      poll()
-    })
-  })()
-})

examples/chat/views/chat.haml.html

@@ -1,10 +0,0 @@
-%h1 Chat
-%img.bubble{ src: '/public/images/bubble.png' }
-%ul#messages
-  :each msg in messages
-    %li= msg
-%form{ method: 'post' }
-  %input{ type: 'hidden', name: '_method', value: 'put' }
-  %input{ type: 'text', name: 'name', value: name || 'guest' }
-  %input{ type: 'text', name: 'message' }
-  %input{ type: 'submit', value: 'Send' }

examples/chat/views/layout.haml.html

@@ -1,11 +0,0 @@
-%html
-  %head
-    %title= title
-    %script{ src: '/public/javascripts/jquery.js' }
-    %script{ src: '/public/javascripts/app.js' }
-    %link{ rel: 'stylesheet', href: '/style.css' }
-  %body
-    #wrapper= body
-      #online 
-        Online:
-        %strong= usersOnline

examples/chat/views/style.sass.css

@@ -1,81 +0,0 @@
-body
-  :font-family "Helvetica Neue", "Lucida Grande", "Arial"
-  :font-size 13px
-  :text-align center
-  =text-stroke 1px rgba(255, 255, 255, 0.1)
-  :color #555
-  
-h1, h2
-  :margin 0
-  :font-size 22px
-  :color #343434
-h1
-  :text-shadow 1px 2px 2px #ddd
-  :font-size 60px
-  
-img.bubble
-  :position absolute
-  :top -25px
-  :left 120px
-  
-#wrapper
-  :position relative
-  :margin 100px auto
-  :width 500px
-  :text-align left
-  
-ul
-  :margin 0
-  :padding 0
-  :max-height 300px
-  :overflow-x hidden
-  li
-    :margin 5px 0
-    :padding 3px 8px
-    :list-style none
-    :border 1px solid #eee
-    =border-radius 3px
-    =border-radius 3px
-  li:hover
-    :cursor pointer
-    :color #2E2E2E
-
-input[type=text]
-  :padding 5px
-  :border 1px solid #ddd
-  :outline none
-  =border-radius 2px
-input[type=text]:focus
-  :border-color #00C3FF
-
-input[type=submit]
-  =border-radius 2px
-  =box-shadow 0 1px 2px #ddd
-  :padding 6px 10px
-  :border solid 1px #999
-  :background -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ddd))
-  :color #333
-  :text-decoration none
-  :cursor pointer
-  :display inline-block
-  :text-align center
-  :text-shadow 0px 1px 1px #fff
-  :line-height 1
-input[type=submit]:hover
-  :background -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#E6E4E4))
-input[type=submit]:active
-  :background -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#c7c7c7))
-input[name=name]
-  :width 80px
-  
-a
-  :color #1ABFF1
-  =transition-property padding
-  =transition-duration 0.15s
-a:hover
-  :padding 0 5px
-a:hover:before
-  :content 'visit: '
-  
-#online
-  :font-size 12px

examples/content-negotiation/db.js

@@ -0,0 +1,7 @@
+var users = [];
+
+users.push({ name: 'Tobi' });
+users.push({ name: 'Loki' });
+users.push({ name: 'Jane' });
+
+module.exports = users;

examples/content-negotiation/index.js

@@ -0,0 +1,44 @@
+var express = require('../../');
+var app = module.exports = express();
+var users = require('./db');
+
+// so either you can deal with different types of formatting
+// for expected response in index.js
+app.get('/', function(req, res){
+  res.format({
+    html: function(){
+      res.send('<ul>' + users.map(function(user){
+        return '<li>' + user.name + '</li>';
+      }).join('') + '</ul>');
+    },
+
+    text: function(){
+      res.send(users.map(function(user){
+        return ' - ' + user.name + '\n';
+      }).join(''));
+    },
+
+    json: function(){
+      res.json(users);
+    }
+  });
+});
+
+// or you could write a tiny middleware like
+// this to add a layer of abstraction
+// and make things a bit more declarative:
+
+function format(path) {
+  var obj = require(path);
+  return function(req, res){
+    res.format(obj);
+  };
+}
+
+app.get('/users', format('./users'));
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/content-negotiation/users.js

@@ -0,0 +1,18 @@
+
+var users = require('./db');
+
+exports.html = function(req, res){
+  res.send('<ul>' + users.map(function(user){
+    return '<li>' + user.name + '</li>';
+  }).join('') + '</ul>');
+};
+
+exports.text = function(req, res){
+  res.send(users.map(function(user){
+    return ' - ' + user.name + '\n';
+  }).join(''));
+};
+
+exports.json = function(req, res){
+  res.json(users);
+};

examples/cookie-sessions/index.js

@@ -0,0 +1,26 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../');
+
+var app = module.exports = express();
+
+// add req.session cookie support
+app.use(cookieSession({ secret: 'manny is cool' }));
+
+// do something with the session
+app.use(count);
+
+// custom middleware
+function count(req, res) {
+  req.session.count = req.session.count || 0;
+  var n = req.session.count++;
+  res.send('viewed ' + n + ' times\n');
+}
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/cookies/app.js

@@ -0,0 +1,48 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../');
+var app = module.exports = express();
+var logger = require('morgan');
+var cookieParser = require('cookie-parser');
+var bodyParser = require('body-parser');
+
+// custom log format
+if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
+
+// parses request cookies, populating
+// req.cookies and req.signedCookies
+// when the secret is passed, used
+// for signing the cookies.
+app.use(cookieParser('my secret here'));
+
+// parses x-www-form-urlencoded
+app.use(bodyParser.urlencoded({ extended: false }));
+
+app.get('/', function(req, res){
+  if (req.cookies.remember) {
+    res.send('Remembered :). Click to <a href="/forget">forget</a>!.');
+  } else {
+    res.send('<form method="post"><p>Check to <label>'
+      + '<input type="checkbox" name="remember"/> remember me</label> '
+      + '<input type="submit" value="Submit"/>.</p></form>');
+  }
+});
+
+app.get('/forget', function(req, res){
+  res.clearCookie('remember');
+  res.redirect('back');
+});
+
+app.post('/', function(req, res){
+  var minute = 60000;
+  if (req.body.remember) res.cookie('remember', 1, { maxAge: minute });
+  res.redirect('back');
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/cors/index.js

@@ -0,0 +1,48 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
+var bodyParser = require('body-parser');
+var api = express();
+
+// app middleware
+
+app.use(express.static(__dirname + '/public'));
+
+// api middleware
+
+api.use(logger('dev'));
+api.use(bodyParser.json());
+
+/**
+ * CORS support.
+ */
+
+api.all('*', function(req, res, next){
+  if (!req.get('Origin')) return next();
+  // use "*" here to accept any origin
+  res.set('Access-Control-Allow-Origin', 'http://localhost:3000');
+  res.set('Access-Control-Allow-Methods', 'PUT');
+  res.set('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type');
+  // res.set('Access-Control-Allow-Max-Age', 3600);
+  if ('OPTIONS' == req.method) return res.send(200);
+  next();
+});
+
+/**
+ * PUT an existing user.
+ */
+
+api.put('/user/:id', function(req, res){
+  console.log(req.body);
+  res.send(204);
+});
+
+app.listen(3000);
+api.listen(3001);
+
+console.log('app listening on 3000');
+console.log('api listening on 3001');

examples/cors/public/index.html

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <script>
+      var req = new XMLHttpRequest;
+      req.open('PUT', 'http://localhost:3001/user/1', false);
+      req.setRequestHeader('Content-Type', 'application/json');
+      req.send('{"name":"tobi","species":"ferret"}');
+      console.log(req.responseText);
+    </script>
+  </body>
+</html>

examples/downloads/app.js

@@ -0,0 +1,36 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../');
+var app = module.exports = express();
+
+app.get('/', function(req, res){
+  res.send('<ul>'
+    + '<li>Download <a href="/files/amazing.txt">amazing.txt</a>.</li>'
+    + '<li>Download <a href="/files/utf-8 한中日.txt">utf-8 한中日.txt</a>.</li>'
+    + '<li>Download <a href="/files/missing.txt">missing.txt</a>.</li>'
+    + '<li>Download <a href="/files/CCTV大赛上海分赛区.txt">CCTV大赛上海分赛区.txt</a>.</li>'
+    + '</ul>');
+});
+
+// /files/* is accessed via req.params[0]
+// but here we name it :file
+app.get('/files/:file(*)', function(req, res, next){
+  var file = req.params.file;
+  var path = __dirname + '/files/' + file;
+
+  res.download(path, function(err){
+    if (!err) return; // file sent
+    if (err && err.status !== 404) return next(err); // non-404 error
+    // file for download not found
+    res.statusCode = 404;
+    res.send('Cant find that file, sorry!');
+  });
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/downloads/files/CCTV大赛上海分赛区.txt

@@ -0,0 +1,2 @@
+Only for test.
+The file name is faked.

examples/downloads/files/amazing.txt

@@ -0,0 +1 @@
+what an amazing download

examples/downloads/files/utf-8 한中日.txt

@@ -0,0 +1 @@
+한中日

examples/ejs/index.js

@@ -0,0 +1,50 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../');
+
+var app = module.exports = express();
+
+// Register ejs as .html. If we did
+// not call this, we would need to
+// name our views foo.ejs instead
+// of foo.html. The __express method
+// is simply a function that engines
+// use to hook into the Express view
+// system by default, so if we want
+// to change "foo.ejs" to "foo.html"
+// we simply pass _any_ function, in this
+// case `ejs.__express`.
+
+app.engine('.html', require('ejs').__express);
+
+// Optional since express defaults to CWD/views
+
+app.set('views', __dirname + '/views');
+
+// Without this you would need to
+// supply the extension to res.render()
+// ex: res.render('users.html').
+app.set('view engine', 'html');
+
+// Dummy users
+var users = [
+  { name: 'tobi', email: 'tobi@learnboost.com' },
+  { name: 'loki', email: 'loki@learnboost.com' },
+  { name: 'jane', email: 'jane@learnboost.com' }
+];
+
+app.get('/', function(req, res){
+  res.render('users', {
+    users: users,
+    title: "EJS example",
+    header: "Some users"
+  });
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/ejs/views/footer.html

@@ -0,0 +1,2 @@
+</body>
+</html>

examples/ejs/views/header.html

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title> <%= title %> </title>
+  <style type="text/css">
+    body {
+      padding: 50px;
+      font: 13px Helvetica, Arial, sans-serif;
+    }
+  </style>
+</head>
+<body>

examples/ejs/views/users.html

@@ -0,0 +1,10 @@
+<% include header.html %>
+
+<h1>Users</h1>
+<ul id="users">
+  <% users.forEach(function(user){ %>
+    <li><%= user.name %> &lt;<%= user.email %>&gt;</li>
+  <% }) %>
+</ul>
+
+<% include footer.html %>

examples/error-pages/index.js

@@ -0,0 +1,104 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../');
+var app = module.exports = express();
+var logger = require('morgan');
+var silent = 'test' == process.env.NODE_ENV;
+
+// general config
+app.set('views', __dirname + '/views');
+app.set('view engine', 'jade');
+
+// our custom "verbose errors" setting
+// which we can use in the templates
+// via settings['verbose errors']
+app.enable('verbose errors');
+
+// disable them in production
+// use $ NODE_ENV=production node examples/error-pages
+if ('production' == app.settings.env) app.disable('verbose errors');
+
+silent || app.use(logger('dev'));
+
+// Routes
+
+app.get('/', function(req, res){
+  res.render('index.jade');
+});
+
+app.get('/404', function(req, res, next){
+  // trigger a 404 since no other middleware
+  // will match /404 after this one, and we're not
+  // responding here
+  next();
+});
+
+app.get('/403', function(req, res, next){
+  // trigger a 403 error
+  var err = new Error('not allowed!');
+  err.status = 403;
+  next(err);
+});
+
+app.get('/500', function(req, res, next){
+  // trigger a generic (500) error
+  next(new Error('keyboard cat!'));
+});
+
+// Error handlers
+
+// Since this is the last non-error-handling
+// middleware use()d, we assume 404, as nothing else
+// responded.
+
+// $ curl http://localhost:3000/notfound
+// $ curl http://localhost:3000/notfound -H "Accept: application/json"
+// $ curl http://localhost:3000/notfound -H "Accept: text/plain"
+
+app.use(function(req, res, next){
+  res.status(404);
+
+  // respond with html page
+  if (req.accepts('html')) {
+    res.render('404', { url: req.url });
+    return;
+  }
+
+  // respond with json
+  if (req.accepts('json')) {
+    res.send({ error: 'Not found' });
+    return;
+  }
+
+  // default to plain-text. send()
+  res.type('txt').send('Not found');
+});
+
+// error-handling middleware, take the same form
+// as regular middleware, however they require an
+// arity of 4, aka the signature (err, req, res, next).
+// when connect has an error, it will invoke ONLY error-handling
+// middleware.
+
+// If we were to next() here any remaining non-error-handling
+// middleware would then be executed, or if we next(err) to
+// continue passing the error, only error-handling middleware
+// would remain being executed, however here
+// we simply respond with an error page.
+
+app.use(function(err, req, res, next){
+  // we may use properties of the error object
+  // here and next(err) appropriately, or if
+  // we possibly recovered from the error, simply next().
+  res.status(err.status || 500);
+  res.render('500', { error: err });
+});
+
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/error-pages/views/404.jade

@@ -0,0 +1,5 @@
+
+extends error
+
+block content
+  h2 Cannot find #{url}

examples/error-pages/views/500.jade

@@ -0,0 +1,13 @@
+
+// note that we extend a different
+// layout with jade for 4xx & 5xx
+// responses
+
+extends error
+
+block content
+  h1 Error: #{error.message}
+  if settings['verbose errors']
+    pre= error.stack
+  else
+    p An error ocurred!

examples/error-pages/views/error.jade

@@ -0,0 +1,6 @@
+html
+  head 
+    title Error
+  body
+    h1 An error occurred!
+    block content

examples/error-pages/views/index.jade

@@ -0,0 +1,15 @@
+
+extends layout
+
+block content
+  h2 Pages Example
+  ul
+    li 
+      | visit 
+      a(href="/500") 500
+    li
+      | visit 
+      a(href="/404") 404
+    li
+      | visit 
+      a(href='/403') 403

examples/error-pages/views/layout.jade

@@ -0,0 +1,6 @@
+html
+  head 
+    title Custom Pages Example
+  body
+    h1 My Site
+    block content

examples/error/index.js

@@ -0,0 +1,48 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../');
+var logger = require('morgan');
+var app = module.exports = express();
+var test = app.get('env') == 'test';
+
+if (!test) app.use(logger('dev'));
+
+// error handling middleware have an arity of 4
+// instead of the typical (req, res, next),
+// otherwise they behave exactly like regular
+// middleware, you may have several of them,
+// in different orders etc.
+
+function error(err, req, res, next) {
+  // log it
+  if (!test) console.error(err.stack);
+
+  // respond with 500 "Internal Server Error".
+  res.status(500);
+  res.send('Internal Server Error');
+}
+
+app.get('/', function(req, res){
+  // Caught and passed down to the errorHandler middleware
+  throw new Error('something broke!');
+});
+
+app.get('/next', function(req, res, next){
+  // We can also pass exceptions to next()
+  process.nextTick(function(){
+    next(new Error('oh no!'));
+  });
+});
+
+// the error handler is placed after routes
+// if it were above it would not receive errors
+// from app.get() etc
+app.use(error);
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/expose-data-to-client/index.js

@@ -0,0 +1,64 @@
+
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
+
+app.set('view engine', 'jade');
+app.set('views', __dirname + '/views');
+
+function User(name) {
+  this.private = 'heyyyy';
+  this.secret = 'something';
+  this.name = name;
+  this.id = 123;
+}
+
+// You'll probably want to do
+// something like this so you
+// dont expose "secret" data.
+
+User.prototype.toJSON = function(){
+  return {
+    id: this.id,
+    name: this.name
+  };
+};
+
+app.use(logger('dev'));
+
+// earlier on expose an object
+// that we can tack properties on.
+// all res.locals props are exposed
+// to the templates, so "expose" will
+// be present.
+
+app.use(function(req, res, next){
+  res.locals.expose = {};
+  // you could alias this as req or res.expose
+  // to make it shorter and less annoying
+  next();
+});
+
+// pretend we loaded a user
+
+app.use(function(req, res, next){
+  req.user = new User('Tobi');
+  next();
+});
+
+app.get('/', function(req, res){
+  res.redirect('/user');
+});
+
+app.get('/user', function(req, res){
+  // we only want to expose the user
+  // to the client for this route:
+  res.locals.expose.user = req.user;
+  res.render('page');
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/expose-data-to-client/views/page.jade

@@ -0,0 +1,14 @@
+html
+  head
+    title Express
+    script.
+      // call this whatever you like,
+      // or dump them into individual
+      // props like "var user ="
+      var data = !{JSON.stringify(expose)}
+  body
+    h1 Expose client data
+    p The following was exposed to the client:
+    pre
+      script.
+        document.write(JSON.stringify(data, null, 2))

examples/hello-world/index.js

@@ -0,0 +1,13 @@
+var express = require('../../');
+
+var app = express();
+
+app.get('/', function(req, res){
+  res.send('Hello World');
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/jade/index.js

@@ -0,0 +1,51 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../lib/express');
+
+// Path to our public directory
+
+var pub = __dirname + '/public';
+
+// setup middleware
+
+var app = express();
+app.use(express.static(pub));
+
+// Optional since express defaults to CWD/views
+
+app.set('views', __dirname + '/views');
+
+// Set our default template engine to "jade"
+// which prevents the need for extensions
+// (although you can still mix and match)
+app.set('view engine', 'jade');
+
+function User(name, email) {
+  this.name = name;
+  this.email = email;
+}
+
+// Dummy users
+var users = [
+    new User('tj', 'tj@vision-media.ca')
+  , new User('ciaran', 'ciaranj@gmail.com')
+  , new User('aaron', 'aaron.heckmann+github@gmail.com')
+];
+
+app.get('/', function(req, res){
+  res.render('users', { users: users });
+});
+
+// change this to a better error handler in your code
+// sending stacktrace to users in production is not good
+app.use(function(err, req, res, next) {
+  res.send(err.stack);
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/jade/public/stylesheets/style.css

@@ -0,0 +1,4 @@
+body {
+  padding: 50px 80px;
+  font: 14px "Helvetica Nueue", "Lucida Grande", Arial, sans-serif;
+}

examples/jade/views/header.jade

@@ -0,0 +1,3 @@
+head
+  title Jade Example
+  link(rel="stylesheet", href="/stylesheets/style.css")

examples/jade/views/layout.jade

@@ -0,0 +1,5 @@
+doctype html
+html
+  include header
+  body
+    block content

examples/jade/views/users/index.jade

@@ -0,0 +1,8 @@
+
+extends ../layout
+
+block content
+  h1 Users
+  #users
+    for user in users
+      include user

examples/jade/views/users/user.jade

@@ -0,0 +1,3 @@
+.user
+  h2= user.name
+  .email= user.email

examples/markdown/index.js

@@ -0,0 +1,45 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var fs = require('fs');
+var md = require('marked').parse;
+
+var app = module.exports = express();
+
+// register .md as an engine in express view system
+
+app.engine('md', function(path, options, fn){
+  fs.readFile(path, 'utf8', function(err, str){
+    if (err) return fn(err);
+    try {
+      var html = md(str);
+      html = html.replace(/\{([^}]+)\}/g, function(_, name){
+        return options[name] || '';
+      });
+      fn(null, html);
+    } catch(err) {
+      fn(err);
+    }
+  });
+});
+
+app.set('views', __dirname + '/views');
+
+// make it the default so we dont need .md
+app.set('view engine', 'md');
+
+app.get('/', function(req, res){
+  res.render('index', { title: 'Markdown Example' });
+});
+
+app.get('/fail', function(req, res){
+  res.render('missing', { title: 'Markdown Example' });
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/markdown/views/index.md

@@ -0,0 +1,4 @@
+
+# {title}
+
+Just an example view rendered with _markdown_.

examples/multipart/index.js

@@ -0,0 +1,60 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var multiparty = require('multiparty');
+var format = require('util').format;
+
+var app = module.exports = express();
+
+app.get('/', function(req, res){
+  res.send('<form method="post" enctype="multipart/form-data">'
+    + '<p>Title: <input type="text" name="title" /></p>'
+    + '<p>Image: <input type="file" name="image" /></p>'
+    + '<p><input type="submit" value="Upload" /></p>'
+    + '</form>');
+});
+
+app.post('/', function(req, res, next){
+  // create a form to begin parsing
+  var form = new multiparty.Form();
+  var image;
+  var title;
+
+  form.on('error', next);
+  form.on('close', function(){
+    res.send(format('\nuploaded %s (%d Kb) as %s'
+      , image.filename
+      , image.size / 1024 | 0
+      , title));
+  });
+
+  // listen on field event for title
+  form.on('field', function(name, val){
+    if (name !== 'title') return;
+    title = val;
+  });
+
+  // listen on part event for image file
+  form.on('part', function(part){
+    if (!part.filename) return;
+    if (part.name !== 'image') return part.resume();
+    image = {};
+    image.filename = part.filename;
+    image.size = 0;
+    part.on('data', function(buf){
+      image.size += buf.length;
+    });
+  });
+
+
+  // parse the form
+  form.parse(req);
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(4000);
+  console.log('Express started on port 4000');
+}

examples/mvc/controllers/main/index.js

@@ -0,0 +1,3 @@
+exports.index = function(req, res){
+  res.redirect('/users');
+};

examples/mvc/controllers/pet/index.js

@@ -0,0 +1,27 @@
+/**
+ * Module dependencies.
+ */
+
+var db = require('../../db');
+
+exports.before = function(req, res, next){
+  var pet = db.pets[req.params.pet_id];
+  if (!pet) return next('route');
+  req.pet = pet;
+  next();
+};
+
+exports.show = function(req, res, next){
+  res.render('show', { pet: req.pet });
+};
+
+exports.edit = function(req, res, next){
+  res.render('edit', { pet: req.pet });
+};
+
+exports.update = function(req, res, next){
+  var body = req.body;
+  req.pet.name = body.pet.name;
+  res.message('Information updated!');
+  res.redirect('/pet/' + req.pet.id);
+};

examples/mvc/controllers/pet/views/edit.jade

@@ -0,0 +1,6 @@
+link(rel='stylesheet', href='/style.css')
+h1= pet.name
+form(action='/pet/#{pet.id}?_method=put', method='post')
+  label= 'Name: '
+    input(type='text', name='pet[name]', value=pet.name)
+  input(type='submit', value='Update')

examples/mvc/controllers/pet/views/show.jade

@@ -0,0 +1,6 @@
+link(rel='stylesheet', href='/style.css')
+
+h1= pet.name
+  a(href='/pet/#{pet.id}/edit')  edit
+
+p You are viewing #{pet.name}

examples/mvc/controllers/user-pet/index.js

@@ -0,0 +1,20 @@
+/**
+ * Module dependencies.
+ */
+
+var db = require('../../db');
+
+exports.name = 'pet';
+exports.prefix = '/user/:user_id';
+
+exports.create = function(req, res, next){
+  var id = req.params.user_id;
+  var user = db.users[id];
+  var body = req.body;
+  if (!user) return next('route');
+  var pet = { name: body.pet.name };
+  pet.id = db.pets.push(pet) - 1;
+  user.pets.push(pet);
+  res.message('Added pet ' + body.pet.name);
+  res.redirect('/user/' + id);
+};

examples/mvc/controllers/user/index.js

@@ -0,0 +1,37 @@
+/**
+ * Module dependencies.
+ */
+
+var db = require('../../db');
+
+exports.before = function(req, res, next){
+  var id = req.params.user_id;
+  if (!id) return next();
+  // pretend to query a database...
+  process.nextTick(function(){
+    req.user = db.users[id];
+    // cant find that user
+    if (!req.user) return next('route');
+    // found it, move on to the routes
+    next();
+  });
+};
+
+exports.list = function(req, res, next){
+  res.render('list', { users: db.users });
+};
+
+exports.edit = function(req, res, next){
+  res.render('edit', { user: req.user });
+};
+
+exports.show = function(req, res, next){
+  res.render('show', { user: req.user });
+};
+
+exports.update = function(req, res, next){
+  var body = req.body;
+  req.user.name = body.user.name;
+  res.message('Information updated!');
+  res.redirect('/user/' + req.user.id);
+};

examples/mvc/controllers/user/views/edit.jade

@@ -0,0 +1,11 @@
+link(rel='stylesheet', href='/style.css')
+h1= user.name
+form(action='/user/#{user.id}?_method=put', method='post')
+  label= 'Name: '
+    input(type='text', name='user[name]', value='#{user.name}')
+  input(type='submit', value='Update')
+
+form(action='/user/#{user.id}/pet', method='post')
+  label= 'Pet: '
+    input(type='text', name='pet[name]', placeholder='Name')
+  input(type='submit', value='Add')

examples/mvc/controllers/user/views/list.jade

@@ -0,0 +1,7 @@
+link(rel='stylesheet', href='/style.css')
+h1 Users
+p Click a user below to view their pets.
+ul
+  each user in users
+    li
+      a(href='/user/#{user.id}')= user.name

examples/mvc/controllers/user/views/show.jade

@@ -0,0 +1,17 @@
+link(rel='stylesheet', href='/style.css')
+h1= user.name + ' '
+  a(href='/user/#{user.id}/edit') edit
+
+if (hasMessages)
+  ul#messages
+    each msg in messages
+      li= msg
+
+if (user.pets.length)
+  p View #{user.name}'s pets:
+  ul
+    each pet in user.pets
+      li
+        a(href='/pet/#{pet.id}')= pet.name
+else
+  p No pets!

examples/mvc/db.js

@@ -0,0 +1,14 @@
+// faux database
+
+var pets = exports.pets = [];
+
+pets.push({ name: 'Tobi', id: 0 });
+pets.push({ name: 'Loki', id: 1 });
+pets.push({ name: 'Jane', id: 2 });
+pets.push({ name: 'Raul', id: 3 });
+
+var users = exports.users = [];
+
+users.push({ name: 'TJ', pets: [pets[0], pets[1], pets[2]], id: 0  });
+users.push({ name: 'Guillermo', pets: [pets[3]], id: 1 });
+users.push({ name: 'Nathan', pets: [], id: 2 });

examples/mvc/index.js

@@ -0,0 +1,95 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var logger = require('morgan');
+var session = require('express-session');
+var bodyParser = require('body-parser');
+var methodOverride = require('method-override');
+
+var app = module.exports = express();
+
+// settings
+
+// set our default template engine to "jade"
+// which prevents the need for extensions
+app.set('view engine', 'jade');
+
+// set views for error and 404 pages
+app.set('views', __dirname + '/views');
+
+// define a custom res.message() method
+// which stores messages in the session
+app.response.message = function(msg){
+  // reference `req.session` via the `this.req` reference
+  var sess = this.req.session;
+  // simply add the msg to an array for later
+  sess.messages = sess.messages || [];
+  sess.messages.push(msg);
+  return this;
+};
+
+// log
+if (!module.parent) app.use(logger('dev'));
+
+// serve static files
+app.use(express.static(__dirname + '/public'));
+
+// session support
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'some secret here'
+}));
+
+// parse request bodies (req.body)
+app.use(bodyParser.urlencoded({ extended: true }));
+
+// allow overriding methods in query (?_method=put)
+app.use(methodOverride('_method'));
+
+// expose the "messages" local variable when views are rendered
+app.use(function(req, res, next){
+  var msgs = req.session.messages || [];
+
+  // expose "messages" local variable
+  res.locals.messages = msgs;
+
+  // expose "hasMessages"
+  res.locals.hasMessages = !! msgs.length;
+
+  /* This is equivalent:
+   res.locals({
+     messages: msgs,
+     hasMessages: !! msgs.length
+   });
+  */
+
+  next();
+  // empty or "flush" the messages so they
+  // don't build up
+  req.session.messages = [];
+});
+
+// load controllers
+require('./lib/boot')(app, { verbose: !module.parent });
+
+app.use(function(err, req, res, next){
+  // log it
+  if (!module.parent) console.error(err.stack);
+
+  // error page
+  res.status(500).render('5xx');
+});
+
+// assume 404 since no middleware responded
+app.use(function(req, res, next){
+  res.status(404).render('404', { url: req.originalUrl });
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/mvc/lib/boot.js

@@ -0,0 +1,77 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../..');
+var fs = require('fs');
+
+module.exports = function(parent, options){
+  var verbose = options.verbose;
+  fs.readdirSync(__dirname + '/../controllers').forEach(function(name){
+    verbose && console.log('\n   %s:', name);
+    var obj = require('./../controllers/' + name);
+    var name = obj.name || name;
+    var prefix = obj.prefix || '';
+    var app = express();
+    var handler;
+    var method;
+    var path;
+
+    // allow specifying the view engine
+    if (obj.engine) app.set('view engine', obj.engine);
+    app.set('views', __dirname + '/../controllers/' + name + '/views');
+
+    // generate routes based
+    // on the exported methods
+    for (var key in obj) {
+      // "reserved" exports
+      if (~['name', 'prefix', 'engine', 'before'].indexOf(key)) continue;
+      // route exports
+      switch (key) {
+        case 'show':
+          method = 'get';
+          path = '/' + name + '/:' + name + '_id';
+          break;
+        case 'list':
+          method = 'get';
+          path = '/' + name + 's';
+          break;
+        case 'edit':
+          method = 'get';
+          path = '/' + name + '/:' + name + '_id/edit';
+          break;
+        case 'update':
+          method = 'put';
+          path = '/' + name + '/:' + name + '_id';
+          break;
+        case 'create':
+          method = 'post';
+          path = '/' + name;
+          break;
+        case 'index':
+          method = 'get';
+          path = '/';
+          break;
+        default:
+          /* istanbul ignore next */
+          throw new Error('unrecognized route: ' + name + '.' + key);
+      }
+
+      // setup
+      handler = obj[key];
+      path = prefix + path;
+
+      // before middleware support
+      if (obj.before) {
+        app[method](path, obj.before, handler);
+        verbose && console.log('     %s %s -> before -> %s', method.toUpperCase(), path, key);
+      } else {
+        app[method](path, obj[key]);
+        verbose && console.log('     %s %s -> %s', method.toUpperCase(), path, key);
+      }
+    }
+
+    // mount the app
+    parent.use(app);
+  });
+};

examples/mvc/public/style.css

@@ -0,0 +1,14 @@
+body {
+  padding: 50px;
+  font: 16px "Helvetica Neue", Helvetica, Arial;
+}
+a {
+  color: #107aff;
+  text-decoration: none;
+}
+a:hover {
+  text-decoration: underline;
+}
+h1 a {
+  font-size: 16px;
+}

examples/mvc/views/404.jade

@@ -0,0 +1,3 @@
+link(rel='stylesheet', href='/style.css')
+h1 404: Not Found
+p Sorry we can't find #{url}

examples/mvc/views/5xx.jade

@@ -0,0 +1,3 @@
+link(rel='stylesheet', href='/style.css')
+h1 500: Internal Server Error
+p Looks like something blew up!

examples/online/index.js

@@ -0,0 +1,56 @@
+// first:
+// $ npm install redis online
+// $ redis-server
+
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var online = require('online');
+var redis = require('redis');
+var db = redis.createClient();
+
+// online
+
+online = online(db);
+
+// app
+
+var app = express();
+
+// activity tracking, in this case using
+// the UA string, you would use req.user.id etc
+
+app.use(function(req, res, next){
+  // fire-and-forget
+  online.add(req.headers['user-agent']);
+  next();
+});
+
+/**
+ * List helper.
+ */
+
+function list(ids) {
+  return '<ul>' + ids.map(function(id){
+    return '<li>' + id + '</li>';
+  }).join('') + '</ul>';
+}
+
+/**
+ * GET users online.
+ */
+
+app.get('/', function(req, res, next){
+  online.last(5, function(err, ids){
+    if (err) return next(err);
+    res.send('<p>Users online: ' + ids.length + '</p>' + list(ids));
+  });
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/params/app.js

@@ -0,0 +1,70 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../');
+var app = module.exports = express();
+
+// Faux database
+
+var users = [
+    { name: 'tj' }
+  , { name: 'tobi' }
+  , { name: 'loki' }
+  , { name: 'jane' }
+  , { name: 'bandit' }
+];
+
+// Convert :to and :from to integers
+
+app.param(['to', 'from'], function(req, res, next, num, name){
+  req.params[name] = parseInt(num, 10);
+  if( isNaN(req.params[name]) ){
+    next(new Error('failed to parseInt '+num));
+  } else {
+    next();
+  }
+});
+
+// Load user by id
+
+app.param('user', function(req, res, next, id){
+  if (req.user = users[id]) {
+    next();
+  } else {
+    next(new Error('failed to find user'));
+  }
+});
+
+/**
+ * GET index.
+ */
+
+app.get('/', function(req, res){
+  res.send('Visit /user/0 or /users/0-2');
+});
+
+/**
+ * GET :user.
+ */
+
+app.get('/user/:user', function(req, res, next){
+  res.send('user ' + req.user.name);
+});
+
+/**
+ * GET users :from - :to.
+ */
+
+app.get('/users/:from-:to', function(req, res, next){
+  var from = req.params.from;
+  var to = req.params.to;
+  var names = users.map(function(user){ return user.name; });
+  res.send('users ' + names.slice(from, to).join(', '));
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/resource/app.js

@@ -0,0 +1,93 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../');
+
+var app = module.exports = express();
+
+// Ad-hoc example resource method
+
+app.resource = function(path, obj) {
+  this.get(path, obj.index);
+  this.get(path + '/:a..:b.:format?', function(req, res){
+    var a = parseInt(req.params.a, 10);
+    var b = parseInt(req.params.b, 10);
+    var format = req.params.format;
+    obj.range(req, res, a, b, format);
+  });
+  this.get(path + '/:id', obj.show);
+  this.delete(path + '/:id', function(req, res){
+    var id = parseInt(req.params.id, 10);
+    obj.destroy(req, res, id);
+  });
+};
+
+// Fake records
+
+var users = [
+    { name: 'tj' }
+  , { name: 'ciaran' }
+  , { name: 'aaron' }
+  , { name: 'guillermo' }
+  , { name: 'simon' }
+  , { name: 'tobi' }
+];
+
+// Fake controller.
+
+var User = {
+  index: function(req, res){
+    res.send(users);
+  },
+  show: function(req, res){
+    res.send(users[req.params.id] || { error: 'Cannot find user' });
+  },
+  destroy: function(req, res, id){
+    var destroyed = id in users;
+    delete users[id];
+    res.send(destroyed ? 'destroyed' : 'Cannot find user');
+  },
+  range: function(req, res, a, b, format){
+    var range = users.slice(a, b + 1);
+    switch (format) {
+      case 'json':
+        res.send(range);
+        break;
+      case 'html':
+      default:
+        var html = '<ul>' + range.map(function(user){
+          return '<li>' + user.name + '</li>';
+        }).join('\n') + '</ul>';
+        res.send(html);
+        break;
+    }
+  }
+};
+
+// curl http://localhost:3000/users     -- responds with all users
+// curl http://localhost:3000/users/1   -- responds with user 1
+// curl http://localhost:3000/users/4   -- responds with error
+// curl http://localhost:3000/users/1..3 -- responds with several users
+// curl -X DELETE http://localhost:3000/users/1  -- deletes the user
+
+app.resource('/users', User);
+
+app.get('/', function(req, res){
+  res.send([
+      '<h1>Examples:</h1> <ul>'
+    , '<li>GET /users</li>'
+    , '<li>GET /users/1</li>'
+    , '<li>GET /users/3</li>'
+    , '<li>GET /users/1..3</li>'
+    , '<li>GET /users/1..3.json</li>'
+    , '<li>DELETE /users/4</li>'
+    , '</ul>'
+  ].join('\n'));
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/route-map/index.js

@@ -0,0 +1,72 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../lib/express');
+
+var verbose = process.env.NODE_ENV != 'test';
+
+var app = module.exports = express();
+
+app.map = function(a, route){
+  route = route || '';
+  for (var key in a) {
+    switch (typeof a[key]) {
+      // { '/path': { ... }}
+      case 'object':
+        app.map(a[key], route + key);
+        break;
+      // get: function(){ ... }
+      case 'function':
+        if (verbose) console.log('%s %s', key, route);
+        app[key](route, a[key]);
+        break;
+    }
+  }
+};
+
+var users = {
+  list: function(req, res){
+    res.send('user list');
+  },
+
+  get: function(req, res){
+    res.send('user ' + req.params.uid);
+  },
+
+  delete: function(req, res){
+    res.send('delete users');
+  }
+};
+
+var pets = {
+  list: function(req, res){
+    res.send('user ' + req.params.uid + '\'s pets');
+  },
+
+  delete: function(req, res){
+    res.send('delete ' + req.params.uid + '\'s pet ' + req.params.pid);
+  }
+};
+
+app.map({
+  '/users': {
+    get: users.list,
+    delete: users.delete,
+    '/:uid': {
+      get: users.get,
+      '/pets': {
+        get: pets.list,
+        '/:pid': {
+          delete: pets.delete
+        }
+      }
+    }
+  }
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/route-middleware/index.js

@@ -0,0 +1,88 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../../lib/express');
+
+var app = express();
+
+// Example requests:
+//     curl http://localhost:3000/user/0
+//     curl http://localhost:3000/user/0/edit
+//     curl http://localhost:3000/user/1
+//     curl http://localhost:3000/user/1/edit (unauthorized since this is not you)
+//     curl -X DELETE http://localhost:3000/user/0 (unauthorized since you are not an admin)
+
+// Dummy users
+var users = [
+    { id: 0, name: 'tj', email: 'tj@vision-media.ca', role: 'member' }
+  , { id: 1, name: 'ciaran', email: 'ciaranj@gmail.com', role: 'member' }
+  , { id: 2, name: 'aaron', email: 'aaron.heckmann+github@gmail.com', role: 'admin' }
+];
+
+function loadUser(req, res, next) {
+  // You would fetch your user from the db
+  var user = users[req.params.id];
+  if (user) {
+    req.user = user;
+    next();
+  } else {
+    next(new Error('Failed to load user ' + req.params.id));
+  }
+}
+
+function andRestrictToSelf(req, res, next) {
+  // If our authenticated user is the user we are viewing
+  // then everything is fine :)
+  if (req.authenticatedUser.id == req.user.id) {
+    next();
+  } else {
+    // You may want to implement specific exceptions
+    // such as UnauthorizedError or similar so that you
+    // can handle these can be special-cased in an error handler
+    // (view ./examples/pages for this)
+    next(new Error('Unauthorized'));
+  }
+}
+
+function andRestrictTo(role) {
+  return function(req, res, next) {
+    if (req.authenticatedUser.role == role) {
+      next();
+    } else {
+      next(new Error('Unauthorized'));
+    }
+  }
+}
+
+// Middleware for faux authentication
+// you would of course implement something real,
+// but this illustrates how an authenticated user
+// may interact with middleware
+
+app.use(function(req, res, next){
+  req.authenticatedUser = users[0];
+  next();
+});
+
+app.get('/', function(req, res){
+  res.redirect('/user/0');
+});
+
+app.get('/user/:id', loadUser, function(req, res){
+  res.send('Viewing user ' + req.user.name);
+});
+
+app.get('/user/:id/edit', loadUser, andRestrictToSelf, function(req, res){
+  res.send('Editing user ' + req.user.name);
+});
+
+app.delete('/user/:id', loadUser, andRestrictTo('admin'), function(req, res){
+  res.send('Deleted user ' + req.user.name);
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/route-separation/index.js

@@ -0,0 +1,53 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var app = express();
+var logger = require('morgan');
+var cookieParser = require('cookie-parser');
+var bodyParser = require('body-parser');
+var methodOverride = require('method-override');
+var site = require('./site');
+var post = require('./post');
+var user = require('./user');
+
+module.exports = app;
+
+// Config
+
+app.set('view engine', 'jade');
+app.set('views', __dirname + '/views');
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.use(express.logger('dev'));
+}
+
+app.use(methodOverride('_method'));
+app.use(cookieParser());
+app.use(bodyParser.urlencoded({ extended: true }));
+app.use(express.static(__dirname + '/public'));
+
+// General
+
+app.get('/', site.index);
+
+// User
+
+app.get('/users', user.list);
+app.all('/user/:id/:op?', user.load);
+app.get('/user/:id', user.view);
+app.get('/user/:id/view', user.view);
+app.get('/user/:id/edit', user.edit);
+app.put('/user/:id/edit', user.update);
+
+// Posts
+
+app.get('/posts', post.list);
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/route-separation/post.js

@@ -0,0 +1,11 @@
+// Fake posts database
+
+var posts = [
+  { title: 'Foo', body: 'some foo bar' },
+  { title: 'Foo bar', body: 'more foo bar' },
+  { title: 'Foo bar baz', body: 'more foo bar baz' }
+];
+
+exports.list = function(req, res){
+  res.render('posts', { title: 'Posts', posts: posts });
+};

examples/route-separation/public/style.css

@@ -0,0 +1,24 @@
+body {
+  padding: 50px;
+  font: 14px "Helvetica Neue", Arial, sans-serif;
+}
+a {
+  color: #00AEFF;
+  text-decoration: none;
+}
+a.edit {
+  color: #000;
+  opacity: .3;
+}
+a.edit::before {
+  content: ' [';
+}
+a.edit::after {
+  content: ']';
+}
+dt {
+  font-weight: bold;
+}
+dd {
+  margin: 15px;
+}

examples/route-separation/site.js

@@ -0,0 +1,3 @@
+exports.index = function(req, res){
+  res.render('index', { title: 'Route Separation Example' });
+};

examples/route-separation/user.js

@@ -0,0 +1,45 @@
+// Fake user database
+
+var users = [
+  { name: 'TJ', email: 'tj@vision-media.ca' },
+  { name: 'Tobi', email: 'tobi@vision-media.ca' }
+];
+
+exports.list = function(req, res){
+  res.render('users', { title: 'Users', users: users });
+};
+
+exports.load = function(req, res, next){
+  var id = req.params.id;
+  req.user = users[id];
+  if (req.user) {
+    next();
+  } else {
+    var err = new Error('cannot find user ' + id);
+    err.status = 404;
+    next(err);
+  }
+};
+
+exports.view = function(req, res){
+  res.render('users/view', {
+    title: 'Viewing user ' + req.user.name,
+    user: req.user
+  });
+};
+
+exports.edit = function(req, res){
+  res.render('users/edit', {
+    title: 'Editing user ' + req.user.name,
+    user: req.user
+  });
+};
+
+exports.update = function(req, res){
+  // Normally you would handle all kinds of
+  // validation and save back to the db
+  var user = req.body.user;
+  req.user.name = user.name;
+  req.user.email = user.email;
+  res.redirect('back');
+};

examples/route-separation/views/index.jade

@@ -0,0 +1,6 @@
+extends layout
+
+block content
+  ul
+    li Visit the <a href="/users">users</a> page
+    li Visit the <a href="/posts">posts</a> page

examples/route-separation/views/layout.jade

@@ -0,0 +1,6 @@
+html
+  head
+    title= title
+    link(href="/style.css", rel="stylesheet")
+  body
+    block content

examples/route-separation/views/posts/index.jade

@@ -0,0 +1,8 @@
+extends ../layout
+
+block content
+  h1 Posts
+  dl#posts
+    for post in posts
+      dt= post.title
+      dd= post.body

examples/route-separation/views/users/edit.jade

@@ -0,0 +1,12 @@
+extends ../layout
+
+block content
+  h1 Editing #{user.name}
+  #user
+    form(action="?_method=put", method="post")
+      p Name: 
+        input(type="text", value= user.name, name="user[name]")
+      p Email: 
+        input(type="text", value= user.email, name="user[email]")
+      p 
+        input(type="submit", value="Save")

examples/route-separation/views/users/index.jade

@@ -0,0 +1,9 @@
+extends ../layout
+
+block content
+  h1 Users
+  #users
+    for user, i in users
+      li
+        a(href="/user/#{i}")= user.name
+        a.edit(href="/user/#{i}/edit") edit

examples/route-separation/views/users/view.jade

@@ -0,0 +1,6 @@
+extends ../layout
+
+block content
+  h1= user.name
+  #user
+    p Email: #{user.email}

examples/search/client.js

@@ -0,0 +1,13 @@
+var search = document.querySelector('[type=search]');
+var code = document.querySelector('pre');
+
+search.addEventListener('keyup', function(){
+  var xhr = new XMLHttpRequest;
+  xhr.open('GET', '/search/' + search.value, true);
+  xhr.onreadystatechange = function(){
+    if (4 == xhr.readyState) {
+      code.textContent = xhr.responseText;
+    }
+  };
+  xhr.send();
+}, false);

examples/search/index.js

@@ -0,0 +1,64 @@
+// first:
+// $ npm install redis
+// $ redis-server
+
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var redis = require('redis');
+
+var db = redis.createClient();
+
+// npm install redis
+
+var app = express();
+
+app.set('view engine', 'jade');
+app.set('views', __dirname);
+
+// populate search
+
+db.sadd('ferret', 'tobi');
+db.sadd('ferret', 'loki');
+db.sadd('ferret', 'jane');
+db.sadd('cat', 'manny');
+db.sadd('cat', 'luna');
+
+/**
+ * GET the search page.
+ */
+
+app.get('/', function(req, res){
+  res.render('search');
+});
+
+/**
+ * GET search for :query.
+ */
+
+app.get('/search/:query?', function(req, res){
+  var query = req.params.query;
+  db.smembers(query, function(err, vals){
+    if (err) return res.send(500);
+    res.send(vals);
+  });
+});
+
+/**
+ * GET client javascript. Here we use sendFile()
+ * because serving __dirname with the static() middleware
+ * would also mean serving our server "index.js" and the "search.jade"
+ * template.
+ */
+
+app.get('/client.js', function(req, res){
+  res.sendFile(__dirname + '/client.js');
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/search/search.jade

@@ -0,0 +1,15 @@
+doctype
+html
+  head
+    title Search example
+    style.
+      body {
+        font: 14px "Helvetica Neue", Helvetica;
+        padding: 50px;
+      }
+  body
+    h2 Search
+    p Try searching for "ferret" or "cat".
+    input(type='search')
+    pre
+    script(src='client.js')

examples/session/index.js

@@ -0,0 +1,32 @@
+// first:
+// $ npm install redis
+// $ redis-server
+
+var express = require('../..');
+var session = require('express-session');
+
+var app = express();
+
+// Populates req.session
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'keyboard cat'
+}));
+
+app.get('/', function(req, res){
+  var body = '';
+  if (req.session.views) {
+    ++req.session.views;
+  } else {
+    req.session.views = 1;
+    body += '<p>First time visiting? view this page in several browsers :)</p>';
+  }
+  res.send(body + '<p>viewed <strong>' + req.session.views + '</strong> times.</p>');
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/session/redis.js

@@ -0,0 +1,37 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var logger = require('morgan');
+var session = require('express-session');
+
+// pass the express to the connect redis module
+// allowing it to inherit from session.Store
+var RedisStore = require('connect-redis')(session);
+
+var app = express();
+
+app.use(logger('dev'));
+
+// Populates req.session
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'keyboard cat',
+  store: new RedisStore
+}));
+
+app.get('/', function(req, res){
+  var body = '';
+  if (req.session.views) {
+    ++req.session.views;
+  } else {
+    req.session.views = 1;
+    body += '<p>First time visiting? view this page in several browsers :)</p>';
+  }
+  res.send(body + '<p>viewed <strong>' + req.session.views + '</strong> times.</p>');
+});
+
+app.listen(3000);
+console.log('Express app started on port 3000');

examples/static-files/index.js

@@ -0,0 +1,40 @@
+/**
+ * Module dependencies.
+ */
+
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
+
+// log requests
+app.use(logger('dev'));
+
+// express on its own has no notion
+// of a "file". The express.static()
+// middleware checks for a file matching
+// the `req.path` within the directory
+// that you pass it. In this case "GET /js/app.js"
+// will look for "./public/js/app.js".
+
+app.use(express.static(__dirname + '/public'));
+
+// if you wanted to "prefix" you may use
+// the mounting feature of Connect, for example
+// "GET /static/js/app.js" instead of "GET /js/app.js".
+// The mount-path "/static" is simply removed before
+// passing control to the express.static() middleware,
+// thus it serves the file correctly by ignoring "/static"
+app.use('/static', express.static(__dirname + '/public'));
+
+// if for some reason you want to serve files from
+// several directories, you can use express.static()
+// multiple times! Here we're passing "./public/css",
+// this will allow "GET /style.css" instead of "GET /css/style.css":
+app.use(express.static(__dirname + '/public/css'));
+
+app.listen(3000);
+console.log('listening on port 3000');
+console.log('try:');
+console.log('  GET /hello.txt');
+console.log('  GET /js/app.js');
+console.log('  GET /css/style.css');