@arponascension/express-inertia 1.0.0 → 1.5.0

package/dist/index.js

@@ -2,6 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
+var crypto = require('crypto');
 var fs = require('fs');
 var ejs = require('ejs');
 var path = require('path');
@@ -12,6 +13,8 @@ var fs__default = /*#__PURE__*/_interopDefault(fs);
 var ejs__default = /*#__PURE__*/_interopDefault(ejs);
 var path__default = /*#__PURE__*/_interopDefault(path);
 
+// src/middleware.ts
+
 // src/utils.ts
 function lazy(callback) {
   return {
@@ -137,6 +140,10 @@ function safeStringify(obj) {
   });
 }
 var DEFAULT_COMPONENT_NAME_PATTERN = /^[\w-]+(?:\/[\w-]+)*$/;
+var DEFAULT_SECURITY_OPTIONS = {
+  validateComponentNames: true,
+  sanitizeViewData: true
+};
 function validateComponentName(component, pattern = DEFAULT_COMPONENT_NAME_PATTERN) {
   if (!pattern.test(component)) {
     throw new TypeError(
@@ -171,8 +178,13 @@ function sanitizeViewData(data) {
   }
   return sanitize(data);
 }
+var cryptoModule;
+async function getCrypto() {
+  cryptoModule ??= await import('crypto');
+  return cryptoModule;
+}
 async function generateSriHash(content) {
-  const crypto = await import('crypto');
+  const crypto = await getCrypto();
   const hash = crypto.createHash("sha384").update(content);
   return `sha384-${hash.digest("base64")}`;
 }
@@ -236,6 +248,12 @@ var DEFAULT_CIRCUIT_OPTIONS = {
   cooldownMs: 3e4,
   probeDelayMs: 1e3
 };
+var DEFAULT_RETRY_OPTIONS = {
+  maxRetries: 2,
+  baseDelayMs: 200,
+  maxDelayMs: 2e3,
+  retryableStatusCodes: [408, 429, 500, 502, 503, 504]
+};
 var CircuitBreaker = class {
   constructor(options = DEFAULT_CIRCUIT_OPTIONS) {
     this.options = options;
@@ -325,16 +343,19 @@ function calculateBackoff(attempt, baseDelayMs, maxDelayMs) {
 // src/ssr.ts
 var DEFAULT_SSR_URL = "http://127.0.0.1:13714/render";
 var DEFAULT_TIMEOUT = 2e3;
+var MAX_CIRCUIT_BREAKERS = 100;
 var logger = createLogger({ prefix: "express-inertia:ssr" });
-var DEFAULT_RETRY_OPTIONS = {
-  maxRetries: 2,
-  baseDelayMs: 200,
-  maxDelayMs: 2e3,
-  retryableStatusCodes: [408, 429, 500, 502, 503, 504]
-};
 var circuitBreakers = /* @__PURE__ */ new Map();
+function serializeCircuitOptions(options) {
+  if (!options) return "";
+  const ordered = Object.keys(options).sort().reduce((acc, key) => {
+    acc[key] = options[key];
+    return acc;
+  }, {});
+  return JSON.stringify(ordered);
+}
 function getCircuitBreaker(endpoint, options) {
-  const key = options?.circuitBreaker ? `${endpoint}:${JSON.stringify(options.circuitBreaker)}` : endpoint;
+  const key = options?.circuitBreaker ? `${endpoint}:${serializeCircuitOptions(options.circuitBreaker)}` : endpoint;
   let breaker = circuitBreakers.get(key);
   if (!breaker) {
     const cbOptions = {
@@ -342,6 +363,12 @@ function getCircuitBreaker(endpoint, options) {
       ...options?.circuitBreaker
     };
     breaker = new CircuitBreaker(cbOptions);
+    if (circuitBreakers.size >= MAX_CIRCUIT_BREAKERS) {
+      const oldest = circuitBreakers.keys().next().value;
+      if (oldest !== void 0) {
+        circuitBreakers.delete(oldest);
+      }
+    }
     circuitBreakers.set(key, breaker);
   }
   return breaker;
@@ -411,26 +438,30 @@ async function renderHttpSSR(page, endpoint, timeout) {
   try {
     pageJson = JSON.stringify(page);
   } catch (err) {
-    throw new Error(`Failed to serialize page for SSR: ${err.message}`);
+    clearTimeout(timer);
+    throw new Error(`Failed to serialize page for SSR: ${err instanceof Error ? err.message : String(err)}`);
   }
-  const response = await fetch(endpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json"
-    },
-    body: pageJson,
-    signal: controller.signal
-  });
-  clearTimeout(timer);
-  if (!response.ok) {
-    throw new Error(`SSR server responded with status: ${response.status} ${response.statusText}`);
+  try {
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: pageJson,
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`SSR server responded with status: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    return {
+      head: Array.isArray(data.head) ? data.head : [],
+      body: typeof data.body === "string" ? data.body : ""
+    };
+  } finally {
+    clearTimeout(timer);
   }
-  const data = await response.json();
-  return {
-    head: Array.isArray(data.head) ? data.head : [],
-    body: typeof data.body === "string" ? data.body : ""
-  };
 }
 async function renderWithRetry(fn, retryOptions, context) {
   const options = {
@@ -455,12 +486,15 @@ async function renderWithRetry(fn, retryOptions, context) {
         attempt: attempt + 1,
         maxRetries: options.maxRetries,
         delayMs: Math.round(delay),
-        error: err.message,
+        error: err instanceof Error ? err.message : String(err),
         component: context
       });
       await new Promise((resolve) => setTimeout(resolve, delay));
     }
   }
+  if (lastError === void 0) {
+    throw new Error("SSR renderWithRetry: no attempts executed");
+  }
   throw lastError;
 }
 
@@ -483,7 +517,7 @@ function createInertiaResponse(req, res, options, globalSharedProps = {}) {
     return currentVersion;
   }
   const renderFn = async (component, props = {}, viewData = {}) => {
-    const securityOptions = options.security ?? { validateComponentNames: true };
+    const securityOptions = options.security ?? DEFAULT_SECURITY_OPTIONS;
     if (securityOptions.validateComponentNames !== false) {
       const pattern = securityOptions.componentNamePattern ?? DEFAULT_COMPONENT_NAME_PATTERN;
       validateComponentName(component, pattern);
@@ -548,8 +582,9 @@ function createInertiaResponse(req, res, options, globalSharedProps = {}) {
     } else if (options.viewData) {
       globalViewData = options.viewData;
     }
-    const sanitizedViewData = securityOptions.validateComponentNames !== false ? sanitizeViewData(viewData) : viewData;
-    const sanitizedGlobalViewData = securityOptions.validateComponentNames !== false ? sanitizeViewData(globalViewData) : globalViewData;
+    const shouldSanitizeViewData = securityOptions.sanitizeViewData !== false;
+    const sanitizedViewData = shouldSanitizeViewData ? sanitizeViewData(viewData) : viewData;
+    const sanitizedGlobalViewData = shouldSanitizeViewData ? sanitizeViewData(globalViewData) : globalViewData;
     const templateData = {
       ...res.locals,
       ...sanitizedGlobalViewData,
@@ -647,17 +682,17 @@ function createInertia(options = {}) {
         resetData
       };
       res.inertia = createInertiaResponse(req, res, options, { ...globalShared });
-      const securityOptions = options.security ?? { validateComponentNames: true };
+      const securityOptions = options.security ?? DEFAULT_SECURITY_OPTIONS;
       if (securityOptions.validateComponentNames !== false && isInertia) {
         const pattern = securityOptions.componentNamePattern ?? DEFAULT_COMPONENT_NAME_PATTERN;
-        const partialComponent2 = req.header("X-Inertia-Partial-Component");
-        if (partialComponent2 && !pattern.test(partialComponent2)) {
+        const requestedPartialComponent = req.header("X-Inertia-Partial-Component");
+        if (requestedPartialComponent && !pattern.test(requestedPartialComponent)) {
           res.setHeader("X-Inertia-Location", req.originalUrl || req.url);
           res.status(409).end();
           return;
         }
       }
-      if (isInertia && req.method === "GET" && options.version) {
+      if (isInertia && options.version) {
         let currentVersion = null;
         if (typeof options.version === "function") {
           currentVersion = await options.version();
@@ -697,19 +732,22 @@ function requestIdMiddleware() {
   };
 }
 function generateRequestId() {
-  const timestamp = Date.now().toString(36);
-  const random = Math.random().toString(36).slice(2, 8);
-  return `${timestamp}-${random}`;
+  return crypto.randomUUID();
 }
 
 // src/directives.ts
 var customDirectives = {};
 function escapeJsString(str) {
-  return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
 function registerDirective(name, handler) {
   customDirectives[name] = handler;
 }
+function clearCustomDirectives() {
+  for (const name of Object.keys(customDirectives)) {
+    delete customDirectives[name];
+  }
+}
 function compileBladeDirectives(templateSource, localDirectives) {
   let compiled = templateSource;
   compiled = compiled.replace(
@@ -803,6 +841,8 @@ function resolveDevServerUrl(config, override) {
 }
 function inertiaVitePlugin(options = {}) {
   const logger2 = createLogger({ prefix: "express-inertia:vite" });
+  let cleanupRegistered = false;
+  let exitConfig = null;
   const write = (config, server) => {
     try {
       const hotFile = path__default.default.resolve(config.root, options.hotFile || "public/hot");
@@ -821,6 +861,11 @@ function inertiaVitePlugin(options = {}) {
     } catch {
     }
   };
+  const removeOnExit = () => {
+    if (exitConfig) {
+      remove(exitConfig);
+    }
+  };
   return {
     name: "express-inertia-hot-file",
     configResolved(config) {
@@ -832,9 +877,13 @@ function inertiaVitePlugin(options = {}) {
     },
     configureServer(server) {
       write(server.config, server);
+      exitConfig = server.config;
       server.httpServer?.once("listening", () => write(server.config, server));
       server.httpServer?.on("close", () => remove(server.config));
-      process.once("exit", () => remove(server.config));
+      if (!cleanupRegistered) {
+        process.once("exit", removeOnExit);
+        cleanupRegistered = true;
+      }
     },
     buildStart() {
     }
@@ -857,7 +906,7 @@ var ViteHelper = class {
       ),
       base: config?.base || `/${buildDir}/`,
       manifest: config?.manifest || null,
-      isDev: config?.isDev ?? false,
+      isDev: config?.isDev,
       devServerUrlOverride: config?.devServerUrlOverride || null
     };
   }
@@ -869,8 +918,8 @@ var ViteHelper = class {
    * NODE_ENV switch is required to toggle between dev and build assets.
    */
   isDev() {
-    if (this.config.isDev === true) {
-      return true;
+    if (this.config.isDev !== void 0) {
+      return this.config.isDev;
     }
     const candidatePaths = [
       this.config.hotFile,
@@ -904,6 +953,12 @@ var ViteHelper = class {
     }
     return this.config.devServerUrl;
   }
+  /**
+   * Get the production asset base path (always ends with a trailing slash).
+   */
+  getBasePath() {
+    return this.config.base.endsWith("/") ? this.config.base : `${this.config.base}/`;
+  }
   /**
    * Check if manifest file exists.
    */
@@ -944,7 +999,9 @@ var ViteHelper = class {
           this.manifestCache = parsed;
           return parsed;
         } catch (err) {
-          throw new Error(`[express-inertia] Failed to parse Vite manifest at ${p}: ${err.message}`);
+          throw new Error(
+            `[express-inertia] Failed to parse Vite manifest at ${p}: ${err instanceof Error ? err.message : String(err)}`
+          );
         }
       }
     }
@@ -1050,26 +1107,49 @@ var defaultViteHelper = new ViteHelper();
 
 // src/engine.ts
 var engineCaches = /* @__PURE__ */ new Set();
+var engineTimestamps = /* @__PURE__ */ new Set();
+var TEMPLATE_SOURCE_KEY = "__express_inertia_template_source__";
 function createInertiaEngine(options) {
   const viteHelper = options?.vite ? createViteHelper(options.vite) : createViteHelper();
   const shouldCache = options?.cache ?? !viteHelper.isDev();
   const inertiaVersion = options?.inertiaVersion ?? 2;
   const defaultRootElement = options?.rootElement ?? true;
   const templateCache = /* @__PURE__ */ new Map();
+  const templateTimestamps = /* @__PURE__ */ new Map();
   engineCaches.add(templateCache);
+  engineTimestamps.add(templateTimestamps);
   return function inertiaBladeEngine(filePath, rawOptions, callback) {
     try {
-      let compiledTemplate = shouldCache ? templateCache.get(filePath) : void 0;
+      const template = options?.templateSource;
+      const hasTemplateSource = template !== void 0;
+      const cacheKey = hasTemplateSource ? TEMPLATE_SOURCE_KEY : filePath;
+      let compiledTemplate;
+      let templateMtimeMs = -1;
+      if (hasTemplateSource) {
+        compiledTemplate = templateCache.get(cacheKey);
+      } else if (shouldCache) {
+        compiledTemplate = templateCache.get(cacheKey);
+      } else {
+        try {
+          templateMtimeMs = fs__default.default.statSync(filePath).mtimeMs;
+        } catch {
+          templateMtimeMs = 0;
+        }
+        if (templateTimestamps.get(cacheKey) === templateMtimeMs) {
+          compiledTemplate = templateCache.get(cacheKey);
+        }
+      }
       if (!compiledTemplate) {
-        const templateSource = options?.templateSource || fs__default.default.readFileSync(filePath, "utf-8");
+        const templateSource = template !== void 0 ? template : fs__default.default.readFileSync(filePath, "utf-8");
         const compiledSource = options?.compileTemplate ? options.compileTemplate(templateSource) : compileBladeDirectives(templateSource, options?.directives);
         compiledTemplate = ejs__default.default.compile(compiledSource, {
           filename: filePath,
-          cache: shouldCache,
+          cache: false,
           async: false
         });
-        if (shouldCache) {
-          templateCache.set(filePath, compiledTemplate);
+        templateCache.set(cacheKey, compiledTemplate);
+        if (!hasTemplateSource) {
+          templateTimestamps.set(cacheKey, templateMtimeMs);
         }
       }
       const locals = { ...rawOptions };
@@ -1121,15 +1201,15 @@ ${scriptTag}`;
       };
       locals.csrf = () => {
         const token = locals._csrf || locals.csrfToken || (typeof locals.req?.csrfToken === "function" ? locals.req.csrfToken() : "") || "";
-        return token ? `<input type="hidden" name="_token" value="${token}">` : "";
+        return token ? `<input type="hidden" name="_token" value="${escapeHtmlAttr(token)}">` : "";
       };
       locals.json = (value) => {
         return JSON.stringify(value);
       };
       if (!locals.routes) {
-        locals.routes = (group) => {
+        locals.routes = (_group) => {
           if (locals.routeConfig || locals.ziggy) {
-            const routesData = JSON.stringify(locals.routeConfig || locals.ziggy);
+            const routesData = JSON.stringify(locals.routeConfig || locals.ziggy).replace(/</g, "\\u003c");
             return `<script>const Ziggy = ${routesData};</script>`;
           }
           return "";
@@ -1138,7 +1218,7 @@ ${scriptTag}`;
       const html = compiledTemplate(locals);
       callback(null, html);
     } catch (err) {
-      callback(err);
+      callback(err instanceof Error ? err : new Error(String(err)));
     }
   };
 }
@@ -1147,6 +1227,9 @@ function clearEngineCache() {
   for (const cache of engineCaches) {
     cache.clear();
   }
+  for (const timestamps of engineTimestamps) {
+    timestamps.clear();
+  }
 }
 
 // src/prefetch.ts
@@ -1164,15 +1247,19 @@ var PrefetchHelper = class {
     const mode = options.mode || "prefetch";
     const tags = [];
     if (this.viteHelper.isDev()) {
-      const devUrl = this.viteHelper["getDevServerUrl"]().replace(/\/$/, "");
+      const devUrl = this.viteHelper.getDevServerUrl().replace(/\/$/, "");
       for (const entry of entrypoints) {
         const cleanEntry = entry.replace(/^\//, "");
-        tags.push(`<link rel="${mode}" href="${devUrl}/${cleanEntry}" crossorigin>`);
+        const attrs = [`rel="${mode}"`, `href="${devUrl}/${cleanEntry}"`];
+        if (options.crossorigin) {
+          attrs.push("crossorigin");
+        }
+        tags.push(`<link ${attrs.join(" ")}>`);
       }
       return tags.join("\n");
     }
-    const manifest = this.viteHelper["getManifest"]();
-    const basePath = this.viteHelper["config"].base.endsWith("/") ? this.viteHelper["config"].base : `${this.viteHelper["config"].base}/`;
+    const manifest = this.viteHelper.getManifest();
+    const basePath = this.viteHelper.getBasePath();
     const rendered = /* @__PURE__ */ new Set();
     for (const entry of entrypoints) {
       const cleanEntry = entry.replace(/^\//, "");
@@ -1225,10 +1312,12 @@ var src_default = createInertia;
 
 exports.CircuitBreaker = CircuitBreaker;
 exports.DEFAULT_COMPONENT_NAME_PATTERN = DEFAULT_COMPONENT_NAME_PATTERN;
+exports.DEFAULT_SECURITY_OPTIONS = DEFAULT_SECURITY_OPTIONS;
 exports.PrefetchHelper = PrefetchHelper;
 exports.ViteHelper = ViteHelper;
 exports.always = always;
 exports.calculateBackoff = calculateBackoff;
+exports.clearCustomDirectives = clearCustomDirectives;
 exports.clearEngineCache = clearEngineCache;
 exports.compileBladeDirectives = compileBladeDirectives;
 exports.createInertia = createInertia;