@bakery-framework/plugin-vue 2.4.2 → 2.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/plugin-vue",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "Bakery vue plugin.",
   "keywords": [
     "bakery",
@@ -43,7 +43,7 @@
     "vue": "^3.5.38"
   },
   "dependencies": {
-    "@bakery-framework/core": "^2.4.2"
+    "@bakery-framework/core": "^2.4.3"
   },
   "engines": {
     "bun": ">=1.4.0"

package/src/actions.ts

@@ -1,5 +1,10 @@
 import { Bakery, hostKey } from '@bakery-framework/core/core/bakery'
-import { fs, response, toHash } from '@bakery-framework/core/utils'
+import {
+  fs,
+  requestOrigin,
+  response,
+  toHash,
+} from '@bakery-framework/core/utils'
 import type { VueMeta } from './types'
 import { collectExportedFunctionNames } from './utils'
 
@@ -33,15 +38,18 @@ export function validateActionRequest(req: Request, url: URL): Response | null {
     return response.error('Server actions require a JSON body', 415)
   }
 
-  const origin = req.headers.get('origin')
-  if (origin && origin !== url.origin) {
-    return response.error('Cross-origin server action rejected', 403)
-  }
-
   const fetchSite = req.headers.get('sec-fetch-site')
   if (fetchSite && fetchSite !== 'same-origin' && fetchSite !== 'none') {
     return response.error('Cross-site server action rejected', 403)
   }
+  // Settled, as in `checkSameOrigin`: behind a proxy that ends TLS, `Origin`
+  // names a scheme this server never saw.
+  if (fetchSite) return null
+
+  const origin = req.headers.get('origin')
+  if (origin && origin !== requestOrigin(req, url)) {
+    return response.error('Cross-origin server action rejected', 403)
+  }
 
   return null
 }

package/src/compile.ts

@@ -123,6 +123,13 @@ export function vuePluginOptionsFingerprint(): string {
   )
 }
 
+/**
+ * Elements no component resolves. `selectedcontent` belongs to the customizable
+ * `<select>`, and Vue's list of HTML tags predates it: compiled as a component,
+ * every page holding one warned in development.
+ */
+const BUILT_IN_ELEMENTS = ['iconify-icon', 'selectedcontent']
+
 export function resolveIsCustomElement(tag: string): boolean {
   const ce = vuePluginOptions?.customElements
   const userFn = vuePluginOptions?.compilerOptions?.isCustomElement
@@ -137,9 +144,7 @@ export function resolveIsCustomElement(tag: string): boolean {
     if (userFn(tag)) return true
   }
 
-  if (tag === 'iconify-icon') return true
-
-  return false
+  return BUILT_IN_ELEMENTS.includes(tag)
 }
 
 export async function parseVue(
@@ -286,10 +291,13 @@ export async function compileStyleBlock(
 export function assembleComponent(options: AssembleComponentOptions): string {
   const { scriptCode, renderCode, isRoot, scopeId, layoutRoute } = options
   const COMPONENT_VAR = '__sfc__'
-  let output = scriptCode.replace(
-    /\bexport\s+default\s*/,
-    `const ${COMPONENT_VAR} = `,
-  )
+  // A plain `<script>` with no `export default` has nothing to rewrite, and
+  // everything below hangs off the variable all the same. Measured: the module
+  // answered 200 and died with `ReferenceError: __sfc__ is not defined`, on a
+  // blank page, with `--build` exiting 0.
+  let output = /\bexport\s+default\b/.test(scriptCode)
+    ? scriptCode.replace(/\bexport\s+default\s*/, `const ${COMPONENT_VAR} = `)
+    : `${scriptCode}\nconst ${COMPONENT_VAR} = {};`
 
   if (renderCode) {
     // No export strip here, deliberately. `compileTemplateBlock` has already
@@ -353,12 +361,15 @@ export function assembleComponent(options: AssembleComponentOptions): string {
  */
 function buildRuntimeCustomElementCheck(): string {
   const ce = vuePluginOptions.customElements
+  const builtIn = JSON.stringify(BUILT_IN_ELEMENTS)
 
   if (typeof ce === 'function') {
-    return `(tag) => { try { return (${ce.toString()})(tag) || tag === 'iconify-icon' } catch { return tag === 'iconify-icon' } }`
+    return `(tag) => { try { return (${ce.toString()})(tag) || ${builtIn}.includes(tag) } catch { return ${builtIn}.includes(tag) } }`
   }
 
-  const tags = [...new Set([...(Array.isArray(ce) ? ce : []), 'iconify-icon'])]
+  const tags = [
+    ...new Set([...(Array.isArray(ce) ? ce : []), ...BUILT_IN_ELEMENTS]),
+  ]
   return `(tag) => ${JSON.stringify(tags)}.includes(tag)`
 }