@analogjs/router 2.6.4-beta.4 → 2.7.0-beta.1

package/fesm2022/analogjs-router-server.mjs

@@ -1,13 +1,315 @@
-import { ɵresetCompiledComponents as _resetCompiledComponents, InjectionToken, assertInInjectionContext, inject, TransferState, makeStateKey, reflectComponentType, APP_ID, ɵConsole as _Console, enableProdMode } from '@angular/core';
-import { ɵSERVER_CONTEXT as _SERVER_CONTEXT, provideServerRendering, renderApplication } from '@angular/platform-server';
+import { InjectionToken, Injector, runInInjectionContext, ɵresetCompiledComponents as _resetCompiledComponents, assertInInjectionContext, inject, TransferState, makeStateKey, reflectComponentType, APP_ID, ɵConsole as _Console, enableProdMode } from '@angular/core';
+import { ɵSERVER_CONTEXT as _SERVER_CONTEXT, provideServerRendering, renderApplication, platformServer } from '@angular/platform-server';
 import { REQUEST, RESPONSE, BASE_URL, LOCALE } from '@analogjs/router/tokens';
-import { bootstrapApplication } from '@angular/platform-browser';
-import { getHeader, createEvent, readBody } from 'h3';
+import { SERVER_FN_DISPATCHER, createServerFnRef } from '@analogjs/router';
+import { HttpErrorResponse } from '@angular/common/http';
+import { bootstrapApplication, createApplication } from '@angular/platform-browser';
+import { getHeader, createEvent, readBody, eventHandler, getRouterParam } from 'h3';
+
+/**
+ * Server-side registry of server functions, keyed by id. A `.server.ts` module
+ * populates it as a side effect of `serverFn(...)` running at import time; the
+ * Nitro dispatch route imports those modules to fill it, then looks up by id.
+ */
+const serverFnRegistry = new Map();
+
+const SERVER_FN_INTERCEPTORS = new InjectionToken('SERVER_FN_INTERCEPTORS');
+/** `withServerFnInterceptors([...])` — registers the chain (DI, ordered). */
+function withServerFnInterceptors(interceptors) {
+    return {
+        providers: interceptors.map((fn) => ({
+            provide: SERVER_FN_INTERCEPTORS,
+            useValue: fn,
+            multi: true,
+        })),
+    };
+}
+/** `provideServerFns(withServerFnInterceptors(...))` — mirrors provideHttpClient. */
+function provideServerFns(...features) {
+    return features.flatMap((f) => f.providers);
+}
+function makeCtx(input, context) {
+    return {
+        input,
+        context,
+        with(patch) {
+            return makeCtx(input, { ...context, ...patch });
+        },
+    };
+}
+/**
+ * Run the interceptor chain, then the handler, threading the context.
+ *
+ * `runInCtx` re-establishes the DI injection context around each interceptor
+ * and the handler individually. This is what keeps `inject()` working in a
+ * handler even when an upstream interceptor `await`s before calling `next`
+ * (which would otherwise resume outside Angular's synchronous injection
+ * context). It defaults to a pass-through for non-DI callers/tests.
+ */
+async function runInterceptors(interceptors, input, handler, runInCtx = (fn) => fn()) {
+    let i = -1;
+    const dispatch = async (ctx) => {
+        i += 1;
+        if (i < interceptors.length) {
+            return runInCtx(() => interceptors[i](ctx, dispatch));
+        }
+        return runInCtx(() => handler(ctx.input, ctx.context));
+    };
+    return dispatch(makeCtx(input, {}));
+}
+
+/**
+ * Same-origin enforcement for the server-function HTTP transport.
+ *
+ * Server functions are same-origin RPC: a client proxy only ever calls the
+ * relative `/_analog/fn/:id` URL of its own app. A cross-origin page must not be
+ * able to invoke them against a logged-in user (a CSRF-shaped attack), so the
+ * transport rejects browser requests whose origin is not the app's own — out of
+ * the box, with no per-app configuration.
+ *
+ * The signals used (`Sec-Fetch-Site`, `Origin`) are added by the browser and
+ * cannot be forged by a cross-origin page's `fetch`. Non-browser callers (curl,
+ * server-to-server, SSR in-process) send neither, so they are unaffected: the
+ * guard blocks the cross-origin browser attack it is meant to, and nothing else.
+ */
+/**
+ * Origins permitted beyond the app's own, registered through DI:
+ * `provideServerFns(withAllowedOrigins([...]))`. Empty by default — the
+ * transport is same-origin unless an app opts out explicitly.
+ */
+const SERVER_FN_ALLOWED_ORIGINS = new InjectionToken('SERVER_FN_ALLOWED_ORIGINS');
+/**
+ * `withAllowedOrigins([...])` — permit cross-origin browser calls from the
+ * listed origins, or pass `'*'` to disable the same-origin guard entirely.
+ * Server functions are frequently cookie-authenticated, so this is an explicit
+ * opt-out of CSRF protection: allow-list the exact origins you control.
+ */
+function withAllowedOrigins(origins) {
+    return {
+        providers: origins.map((origin) => ({
+            provide: SERVER_FN_ALLOWED_ORIGINS,
+            useValue: origin,
+            multi: true,
+        })),
+    };
+}
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+/**
+ * Whether an HTTP request to a server function may proceed.
+ *
+ * Allowed when the request is same-origin, carries no browser-origin signal at
+ * all (a non-browser client, or a same-origin GET that omits `Origin`), or its
+ * `Origin` is listed in `allowedOrigins`. Passing `'*'` in `allowedOrigins`
+ * disables the check — the explicit opt-in to cross-origin access.
+ *
+ * `Sec-Fetch-Site` is the authoritative signal when present: `same-origin` and
+ * `none` (a direct navigation, not a cross-site fetch) pass; `same-site` and
+ * `cross-site` require an explicit `allowedOrigins` entry. When the header is
+ * absent (older browsers, some proxies) the `Origin` host is compared to the
+ * request host as a fallback.
+ */
+function isServerFnOriginAllowed(headers, allowedOrigins = []) {
+    if (allowedOrigins.includes('*')) {
+        return true;
+    }
+    const origin = firstHeader(headers['origin']);
+    const originAllowlisted = origin !== undefined && allowedOrigins.includes(origin);
+    const site = firstHeader(headers['sec-fetch-site']);
+    if (site) {
+        if (site === 'same-origin' || site === 'none') {
+            return true;
+        }
+        // same-site / cross-site: only when the origin is explicitly permitted.
+        return originAllowlisted;
+    }
+    // No `Sec-Fetch-Site`: fall back to comparing the `Origin` host to the host.
+    if (!origin) {
+        // Non-browser client, or a same-origin GET with no `Origin` — not the
+        // cross-origin browser request this guard exists to reject.
+        return true;
+    }
+    if (originAllowlisted) {
+        return true;
+    }
+    const host = firstHeader(headers['x-forwarded-host']) ?? firstHeader(headers['host']);
+    if (!host) {
+        return false;
+    }
+    try {
+        return new URL(origin).host === host;
+    }
+    catch {
+        return false;
+    }
+}
+
+/**
+ * Server-side dispatch for a server function call.
+ *
+ * 1. reject cross-origin browser calls (403), unless allow-listed — HTTP
+ *    transport only (in-process callers omit `method` and are exempt)
+ * 2. look up the function by id
+ * 3. enforce the configured HTTP method (405 on mismatch)
+ * 4. require a JSON body on input-bearing calls (415 otherwise)
+ * 5. validate `input` against the Standard-Schema (4xx on failure)
+ * 6. build a per-request injector (REQUEST/RESPONSE + app providers)
+ * 7. run the interceptor chain, then the handler, re-entering
+ *    `runInInjectionContext` at every hop so `inject()` works even after an
+ *    interceptor `await`s before calling `next`
+ * 8. a `Response` returned by an interceptor/handler (`fail`/`redirect`)
+ *    short-circuits with its status AND headers
+ *
+ * `options.method` is the request's HTTP method; when provided it is enforced
+ * against the function's configured method AND it turns on the same-origin
+ * guard. Transports (the generated Nitro handler) always pass it; trusted
+ * in-process callers may omit it, which also exempts them from the origin guard.
+ */
+async function dispatchServerFn(id, rawInput, event, options = {}) {
+    const { parent, providers = [], method, allowedOrigins = [] } = options;
+    const headers = (event.node.req.headers ?? {});
+    // Same-origin guard runs first — before we even confirm the function exists —
+    // so a cross-origin page cannot probe which ids are registered. Gated on
+    // `method` so only HTTP-transport calls are checked; in-process callers omit
+    // it. The signals (`Origin`/`Sec-Fetch-Site`) are browser-set and unforgeable.
+    if (method) {
+        const allowed = [
+            ...allowedOrigins,
+            ...(parent?.get(SERVER_FN_ALLOWED_ORIGINS, []) ?? []),
+        ];
+        if (!isServerFnOriginAllowed(headers, allowed)) {
+            return {
+                status: 403,
+                body: { message: 'Cross-origin server function call rejected' },
+            };
+        }
+    }
+    const def = serverFnRegistry.get(id);
+    if (!def) {
+        return { status: 404, body: { message: `Unknown server function: ${id}` } };
+    }
+    // Enforce the transport method: a GET-only read must not be POSTable, and an
+    // input-bearing POST must not be reachable via GET.
+    if (method && method.toUpperCase() !== def.method) {
+        return {
+            status: 405,
+            body: { message: `Method ${method} not allowed for ${id}` },
+            headers: { Allow: def.method },
+        };
+    }
+    // Input travels as a JSON body. Reject anything else before decoding, so a
+    // form post from a cross-origin page (which cannot set a JSON content type
+    // without a CORS preflight) never reaches a handler. HTTP transport only.
+    if (method && def.method === 'POST' && !isJsonContentType(headers)) {
+        return {
+            status: 415,
+            body: { message: 'Server functions accept an application/json body' },
+        };
+    }
+    let input = rawInput;
+    if (def.config.input) {
+        const result = await def.config.input['~standard'].validate(rawInput);
+        if ('issues' in result && result.issues) {
+            return { status: 400, body: { errors: result.issues } };
+        }
+        input = result.value;
+    }
+    // Child of the app injector: only the request tokens are per-request; app
+    // services + interceptors resolve up the parent chain. All four are provided
+    // here so a handler resolves them the same way it would inside a component
+    // during SSR, whether it was reached over HTTP or in-process.
+    const req = event.node.req;
+    const locale = detectLocale(req);
+    const injector = Injector.create({
+        parent,
+        providers: [
+            { provide: REQUEST, useValue: event.node.req },
+            { provide: RESPONSE, useValue: event.node.res },
+            { provide: BASE_URL, useValue: getBaseUrl(req) },
+            ...(locale ? [{ provide: LOCALE, useValue: locale }] : []),
+            ...providers,
+        ],
+    });
+    // Re-enter the injection context at each hop rather than wrapping the whole
+    // chain once: an interceptor that awaits before `next` would otherwise run the
+    // handler outside the context and break `inject()`.
+    const runInCtx = (fn) => runInInjectionContext(injector, fn);
+    const interceptors = injector.get(SERVER_FN_INTERCEPTORS, []);
+    const outcome = await runInterceptors(interceptors, input, def.handler, runInCtx);
+    if (outcome instanceof Response) {
+        const text = await outcome.text();
+        const body = text ? safeJson(text) : null;
+        const headers = {};
+        outcome.headers.forEach((value, key) => {
+            if (key.toLowerCase() !== 'set-cookie') {
+                headers[key] = value;
+            }
+        });
+        // `Headers.forEach` yields cookies comma-joined into a single value, which
+        // is not a valid way to send more than one; `getSetCookie` keeps them apart.
+        const setCookie = outcome.headers.getSetCookie?.() ?? [];
+        if (setCookie.length) {
+            headers['set-cookie'] = setCookie;
+        }
+        return {
+            status: outcome.status,
+            body,
+            headers: Object.keys(headers).length ? headers : undefined,
+        };
+    }
+    return { status: 200, body: outcome };
+}
+function isJsonContentType(headers) {
+    const contentType = headers['content-type'];
+    const value = Array.isArray(contentType) ? contentType[0] : contentType;
+    if (!value) {
+        return false;
+    }
+    const mediaType = value.split(';')[0].trim().toLowerCase();
+    return mediaType === 'application/json' || mediaType.endsWith('+json');
+}
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+
+/**
+ * The in-process transport used during SSR. `ServerFnClient` picks this up from
+ * DI and calls the handler directly instead of issuing an HTTP request back
+ * into the app — the render and the handler already share a process and a
+ * request, so the round-trip only adds latency (and would need an absolute URL).
+ *
+ * `method` is deliberately not passed to `dispatchServerFn`: this is a trusted
+ * in-process caller, so the HTTP-transport-only checks (same-origin, method
+ * enforcement, content type) do not apply. Validation and the interceptor chain
+ * still run, so an SSR call behaves like a browser call in every other respect.
+ *
+ * A non-2xx result is thrown as an `HttpErrorResponse` so the failure surfaces
+ * on `resource.error()` exactly as it does in the browser.
+ */
+function createServerFnDispatcher(req, res) {
+    const event = { node: { req, res } };
+    return async (fn, input, injector) => {
+        const { status, body } = await dispatchServerFn(fn.id, input, event, {
+            parent: injector,
+        });
+        if (status < 200 || status > 299) {
+            throw new HttpErrorResponse({ status, error: body, url: fn.url });
+        }
+        return body;
+    };
+}
 
 function provideServerContext({ req, res, }) {
     const baseUrl = getBaseUrl(req);
     const locale = detectLocale(req);
-    if (import.meta.env.DEV) {
+    // Optional chaining: a Nitro-bundled caller has no `import.meta.env` at all.
+    if (import.meta.env?.DEV) {
         _resetCompiledComponents();
     }
     return [
@@ -15,6 +317,11 @@ function provideServerContext({ req, res, }) {
         { provide: REQUEST, useValue: req },
         { provide: RESPONSE, useValue: res },
         { provide: BASE_URL, useValue: baseUrl },
+        // Server functions called while rendering run in-process, in this injector.
+        {
+            provide: SERVER_FN_DISPATCHER,
+            useValue: createServerFnDispatcher(req, res),
+        },
         ...(locale ? [{ provide: LOCALE, useValue: locale }] : []),
     ];
 }
@@ -67,7 +374,10 @@ function parseAcceptLanguage(header) {
 }
 function getBaseUrl(req) {
     const protocol = getRequestProtocol(req);
-    const { originalUrl, headers } = req;
+    const { headers } = req;
+    // Node's `IncomingMessage` has no `originalUrl`, and a server function
+    // endpoint is reached with a plain request, so fall back before dereferencing.
+    const originalUrl = req.originalUrl || req.url || '/';
     const parsedUrl = new URL('', `${protocol}://${headers.host}${originalUrl.endsWith('/')
         ? originalUrl.substring(0, originalUrl.length - 1)
         : originalUrl}`);
@@ -115,9 +425,16 @@ function serverComponentRequest(serverContext) {
     }
     return serverComponentId;
 }
-const components = import.meta.glob([
-    '/src/server/components/**/*.{ts,analog,ag}',
-]);
+// Deferred so the module can be imported outside a Vite context (e.g. by the
+// Nitro server-function dispatch path, or tooling) without eagerly evaluating
+// the Vite-only `import.meta.glob` macro at load time. Vite still statically
+// rewrites the macro; it is just invoked lazily on first server-component render.
+let _components;
+function serverComponents() {
+    return (_components ??= import.meta.glob([
+        '/src/server/components/**/*.{ts,analog,ag}',
+    ]));
+}
 async function renderServerComponent(url, serverContext, config) {
     const componentReqId = serverComponentRequest(serverContext);
     const { componentLoader, componentId } = getComponentLoader(componentReqId);
@@ -181,6 +498,7 @@ function getComponentLoader(componentReqId) {
     let _componentId = `/src/server/components/${componentReqId.toLowerCase()}`;
     let componentLoader = undefined;
     let componentId = _componentId;
+    const components = serverComponents();
     if (components[`${_componentId}.ts`]) {
         componentId = `${_componentId}.ts`;
         componentLoader = components[componentId];
@@ -208,7 +526,9 @@ function retrieveTransferredState(html, appId) {
     }
 }
 
-if (import.meta.env.PROD) {
+// Optional chaining: the server-function dispatch endpoint imports this entry
+// from a Nitro bundle, where `import.meta.env` is not defined at all.
+if (import.meta.env?.PROD) {
     enableProdMode();
 }
 /**
@@ -262,9 +582,138 @@ function render(rootComponent, config, platformProviders = []) {
     };
 }
 
+function serverFn(arg1, arg2) {
+    const { config, handler } = normalizeArgs(arg1, arg2);
+    // GET is reserved for input-less reads; an input schema requires POST (the
+    // input travels in the body, not the query). Build transforms reject this too.
+    if (config.method === 'GET' && config.input) {
+        throw new Error('[analog] a serverFn with `input` must use POST; GET is reserved for input-less reads.');
+    }
+    // `createServerFnRef` throws if the build-derived id is missing, so `ref.id`
+    // is the authoritative route key here.
+    const ref = createServerFnRef(config);
+    serverFnRegistry.set(ref.id, {
+        id: ref.id,
+        method: ref.method,
+        config,
+        handler,
+    });
+    return ref;
+}
+function normalizeArgs(arg1, arg2) {
+    // serverFn(handler) — input-less GET.
+    if (typeof arg1 === 'function') {
+        return {
+            config: {},
+            handler: arg1,
+        };
+    }
+    // serverFn(schema, handler) — a Standard Schema ⇒ POST + input.
+    if (isStandardSchema(arg1)) {
+        return {
+            config: { input: arg1 },
+            handler: arg2,
+        };
+    }
+    // serverFn(config, handler) — explicit config object.
+    return {
+        config: arg1 ?? {},
+        handler: arg2,
+    };
+}
+function isStandardSchema(value) {
+    return typeof value === 'object' && value !== null && '~standard' in value;
+}
+
+/**
+ * Builds the parent injector the server-function dispatch endpoint runs handlers
+ * against, over HTTP.
+ *
+ * A plain `Injector.create({ providers })` resolves explicitly-listed providers
+ * but not tree-shakeable `providedIn: 'root'` services — those attach to a
+ * *bootstrapped* application's root injector, which `Injector.create` is not.
+ * So the in-process SSR leg (whose parent is the app's own bootstrapped
+ * injector) resolved `root` services while the HTTP leg did not — the same
+ * handler could work while rendering and fail when called from the browser.
+ *
+ * Bootstrapping a real application on the server platform closes that gap: the
+ * returned `appRef.injector` is a root environment injector, so both listed
+ * providers and `providedIn: 'root'` services resolve, matching SSR.
+ *
+ * The generated endpoint passes the app's own server `ApplicationConfig` (the
+ * one `main.server.ts` renders with), so a handler sees exactly the DI the app
+ * configured — services, tokens, and interceptors alike — with no second
+ * provider list to keep in sync. No root component is bootstrapped
+ * (`createApplication`, not `bootstrapApplication`), so nothing renders, no
+ * change detection runs, and the router registers but never navigates. It is a
+ * DI container with the app's providers, built once and reused for the process,
+ * with only `REQUEST`/`RESPONSE` rebuilt per call in the child.
+ *
+ * A bare provider array is also accepted (direct callers and tests without an
+ * app config); it is wrapped with `provideServerRendering` so the server tokens
+ * resolve the same way.
+ */
+async function createServerFnAppInjector(configOrProviders = []) {
+    const config = Array.isArray(configOrProviders)
+        ? { providers: [provideServerRendering(), ...configOrProviders] }
+        : configOrProviders;
+    const appRef = await createApplication(config, {
+        platformRef: platformServer(),
+    });
+    return appRef.injector;
+}
+
+/**
+ * The h3 request/response layer for the server-function dispatch route.
+ *
+ * `createServerFnAppInjector` bootstraps the parent injector once; this wraps
+ * that in the `/_analog/fn/:id` handler the Nitro build registers. Kept as a
+ * runtime function (rather than inlined into the generated module) so the
+ * transport behaviour — body decoding, the malformed-body contract, and header
+ * propagation — is unit-tested directly instead of by matching generated source.
+ *
+ * `appInjector` may be a promise: the generated module bootstraps the app at
+ * import time and passes the pending injector, which is awaited on first request
+ * and resolved instantly thereafter.
+ */
+function createServerFnEventHandler(appInjector) {
+    return eventHandler((event) => handleServerFnRequest(event, appInjector));
+}
+/**
+ * Decode a server-function request, dispatch it, and write the result to the
+ * h3 response. Same-origin, method, content-type, validation, and interceptors
+ * are enforced inside `dispatchServerFn`; this owns only the h3 I/O around it.
+ */
+async function handleServerFnRequest(event, appInjector) {
+    const id = getRouterParam(event, 'id') ?? '';
+    // h3 parses the body before dispatch gets a say, and its parse error is an
+    // HTML/500-shaped response rather than the JSON contract callers expect.
+    let input;
+    if (event.method !== 'GET') {
+        try {
+            input = await readBody(event);
+        }
+        catch {
+            event.node.res.statusCode = 400;
+            return { message: 'Malformed request body' };
+        }
+    }
+    const { status, body, headers } = await dispatchServerFn(id, input, event, {
+        parent: await appInjector,
+        method: event.method,
+    });
+    event.node.res.statusCode = status;
+    if (headers) {
+        for (const [key, value] of Object.entries(headers)) {
+            event.node.res.setHeader(key, value);
+        }
+    }
+    return body;
+}
+
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { injectStaticOutputs, injectStaticProps, provideServerContext, render, renderServerComponent, serverComponentRequest };
+export { SERVER_FN_ALLOWED_ORIGINS, SERVER_FN_INTERCEPTORS, createServerFnAppInjector, createServerFnEventHandler, dispatchServerFn, handleServerFnRequest, injectStaticOutputs, injectStaticProps, isServerFnOriginAllowed, provideServerContext, provideServerFns, render, renderServerComponent, runInterceptors, serverComponentRequest, serverFn, serverFnRegistry, withAllowedOrigins, withServerFnInterceptors };
 //# sourceMappingURL=analogjs-router-server.mjs.map