@bleedingdev/modern-js-app-tools-extensions 3.8.3-ultramodern.2

package/src/cloudflare/security-policies.ts

@@ -0,0 +1,194 @@
+import type { CloudflareWorkerSecurityConfig } from '../config';
+import type { CloudflareModernConfig } from './types';
+
+const DEFAULT_SECURITY_HEADERS = {
+  referrerPolicy: 'strict-origin-when-cross-origin',
+  contentTypeOptions: 'nosniff',
+  permissionsPolicy:
+    'camera=(), geolocation=(), microphone=(), payment=(), usb=()',
+} as const;
+const DEFAULT_CORS_ALLOWED_METHODS = [
+  'GET',
+  'HEAD',
+  'POST',
+  'PUT',
+  'PATCH',
+  'DELETE',
+  'OPTIONS',
+];
+const DEFAULT_CSP_DIRECTIVES: Record<string, string[]> = {
+  'base-uri': [`'self'`],
+  'connect-src': [`'self'`, 'https:', 'http:', 'wss:', 'ws:'],
+  'default-src': [`'self'`],
+  'font-src': [`'self'`, 'data:', 'https:', 'http:'],
+  'form-action': [`'self'`],
+  'frame-ancestors': [`'self'`],
+  'img-src': [`'self'`, 'data:', 'blob:', 'https:', 'http:'],
+  'manifest-src': [`'self'`, 'https:', 'http:'],
+  'object-src': [`'none'`],
+  'script-src': [
+    `'self'`,
+    `'unsafe-inline'`,
+    `'unsafe-eval'`,
+    'https:',
+    'http:',
+    'blob:',
+  ],
+  'style-src': [`'self'`, `'unsafe-inline'`, 'https:', 'http:'],
+  'worker-src': [`'self'`, 'blob:'],
+};
+
+const normalizeDirectiveValues = (value: string[] | string) => {
+  const values = Array.isArray(value) ? value : [value];
+
+  return [...new Set(values.map(entry => entry.trim()).filter(Boolean))];
+};
+
+const appendDirectiveValues = (
+  directives: Record<string, string[]>,
+  name: string,
+  values: string[] | undefined,
+) => {
+  if (!values?.length) {
+    return;
+  }
+
+  directives[name] = normalizeDirectiveValues([
+    ...(directives[name] ?? []),
+    ...values,
+  ]);
+};
+
+const createContentSecurityPolicy = (
+  config?: CloudflareWorkerSecurityConfig['contentSecurityPolicy'],
+) => {
+  const mode = config?.mode ?? 'report-only';
+
+  if (mode === 'off') {
+    return {
+      mode,
+      directives: {},
+      reason: config?.reason,
+    };
+  }
+
+  const directives = Object.fromEntries(
+    Object.entries(DEFAULT_CSP_DIRECTIVES).map(([name, values]) => [
+      name,
+      [...values],
+    ]),
+  );
+
+  for (const [name, value] of Object.entries(config?.directives ?? {})) {
+    if (value === false) {
+      delete directives[name];
+    } else {
+      directives[name] = normalizeDirectiveValues(value);
+    }
+  }
+
+  if (config?.frameAncestors === false) {
+    delete directives['frame-ancestors'];
+  } else if (config?.frameAncestors) {
+    directives['frame-ancestors'] = normalizeDirectiveValues(
+      config.frameAncestors,
+    );
+  }
+
+  appendDirectiveValues(directives, 'script-src', config?.additionalScriptSrc);
+  appendDirectiveValues(directives, 'style-src', config?.additionalStyleSrc);
+  appendDirectiveValues(
+    directives,
+    'connect-src',
+    config?.additionalConnectSrc,
+  );
+  appendDirectiveValues(directives, 'img-src', config?.additionalImgSrc);
+
+  if (config?.reportUri) {
+    directives['report-uri'] = [config.reportUri];
+  }
+
+  return {
+    mode,
+    directives,
+    reason: config?.reason,
+  };
+};
+
+const createNoindexPolicy = (
+  noindex: CloudflareWorkerSecurityConfig['noindex'],
+) => {
+  if (noindex === false) {
+    return {
+      workersDev: false,
+      localhost: false,
+      previewHostnames: [],
+    };
+  }
+
+  if (noindex === true || noindex === undefined) {
+    return {
+      workersDev: true,
+      localhost: true,
+      previewHostnames: [],
+    };
+  }
+
+  return {
+    workersDev: noindex.workersDev ?? true,
+    localhost: noindex.localhost ?? true,
+    previewHostnames: noindex.previewHostnames ?? [],
+    reason: noindex.reason,
+  };
+};
+
+const createCloudflareWorkerCorsPolicy = (
+  cors: CloudflareWorkerSecurityConfig['cors'],
+) => ({
+  assets: cors?.assets ?? true,
+  allowedOrigins: normalizeDirectiveValues(cors?.allowedOrigins ?? []),
+  allowedMethods: cors?.allowedMethods?.length
+    ? normalizeDirectiveValues(
+        cors.allowedMethods.map(method => method.toUpperCase()),
+      )
+    : DEFAULT_CORS_ALLOWED_METHODS,
+  allowedHeaders: cors?.allowedHeaders?.length
+    ? normalizeDirectiveValues(cors.allowedHeaders)
+    : ['*'],
+  reason: cors?.reason,
+});
+
+export const createCloudflareWorkerSecurityPolicy = (
+  modernConfig: CloudflareModernConfig,
+) => {
+  const security = modernConfig.deploy?.worker?.security;
+
+  if (security?.enabled === false) {
+    return {
+      enabled: false,
+      cors: createCloudflareWorkerCorsPolicy(security.cors),
+      reason: security.reason,
+    };
+  }
+
+  return {
+    enabled: true,
+    headers: {
+      referrerPolicy:
+        security?.headers?.referrerPolicy ??
+        DEFAULT_SECURITY_HEADERS.referrerPolicy,
+      contentTypeOptions:
+        security?.headers?.contentTypeOptions ??
+        DEFAULT_SECURITY_HEADERS.contentTypeOptions,
+      permissionsPolicy:
+        security?.headers?.permissionsPolicy ??
+        DEFAULT_SECURITY_HEADERS.permissionsPolicy,
+    },
+    contentSecurityPolicy: createContentSecurityPolicy(
+      security?.contentSecurityPolicy,
+    ),
+    noindex: createNoindexPolicy(security?.noindex),
+    cors: createCloudflareWorkerCorsPolicy(security?.cors),
+    reason: security?.reason,
+  };
+};

package/src/cloudflare/types.ts

@@ -0,0 +1,33 @@
+import type { BffUserConfig } from '@modern-js/server-core';
+import type { ServerPlugin } from '@modern-js/types';
+import type { CloudflareDeployConfig } from '../config';
+
+export interface CloudflareAppContext {
+  apiOnly: boolean;
+  appDirectory: string;
+  distDirectory: string;
+  serverPlugins: ServerPlugin[];
+}
+
+export interface CloudflareModernConfig {
+  bff?: BffUserConfig;
+  deploy?: CloudflareDeployConfig;
+}
+
+export interface CloudflarePresetApi {
+  isPluginExists(name: string): boolean;
+}
+
+export type CloudflareDeployPreset = {
+  prepare?: () => Promise<void>;
+  writeOutput?: () => Promise<void>;
+  genEntry?: () => Promise<void>;
+  end?: () => Promise<void>;
+};
+
+export type CreateCloudflarePreset = (params: {
+  appContext: CloudflareAppContext;
+  modernConfig: CloudflareModernConfig;
+  api: CloudflarePresetApi;
+  needModernServer?: boolean;
+}) => CloudflareDeployPreset;

package/src/cloudflare/utils.ts

@@ -0,0 +1,40 @@
+import path from 'node:path';
+import type { JsonValue } from '../config';
+
+export const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);
+
+export const normalizeRelativePath = (
+  value: unknown,
+  label: string,
+  scope = 'app output',
+  options: { allowRoot?: boolean } = {},
+) => {
+  if (typeof value !== 'string') {
+    throw new Error(`${label} must be a relative path inside the ${scope}.`);
+  }
+
+  const normalized = value
+    .trim()
+    .replace(/\\/g, '/')
+    .replace(/^\.\/+/u, '')
+    .replace(/\/+$/u, '');
+  const segments = normalized.split('/');
+  const isRootDestination = normalized === '.';
+
+  if (
+    !normalized ||
+    path.isAbsolute(normalized) ||
+    (!options.allowRoot && isRootDestination) ||
+    segments.includes('..')
+  ) {
+    throw new Error(`${label} must be a relative path inside the ${scope}.`);
+  }
+
+  return normalized;
+};
+
+export const isJsonRecord = (
+  value: unknown,
+): value is Record<string, JsonValue> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);

package/src/cloudflare/worker-manifest.ts

@@ -0,0 +1,313 @@
+import path from 'node:path';
+import { fs as fse } from '@modern-js/utils';
+import { readRouteSpec } from './artifacts';
+import {
+  ASSETS_BINDING,
+  BFF_EFFECT_WORKER_DISPATCHER_EXPORT,
+  BFF_EFFECT_WORKER_ENTRY,
+  CLOUDFLARE_RUNTIME_TYPE,
+  CLOUDFLARE_WORKER_BUNDLE_FORMAT,
+  DEFAULT_SERVER_ONLY_PUBLIC_ASSET_EXCLUDES,
+  EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE,
+  LOADABLE_STATS_FILE,
+  PUBLIC_ASSETS_DIRECTORY,
+  ROUTE_MANIFEST_FILE,
+  ROUTE_SPEC_FILE,
+  ROUTE_SPEC_OUTPUT,
+  SERVER_BUNDLE_DIRECTORY,
+  WORKER_BUNDLE_DIRECTORY,
+  WORKER_ENTRY,
+} from './constants';
+import type { DeliveryUnitStamp } from './delivery-unit';
+import { createI18nWorkerManifest } from './i18n-worker';
+import { createCloudflareWorkerSecurityPolicy } from './security-policies';
+import type { CloudflareAppContext, CloudflareModernConfig } from './types';
+import { isRecord, normalizeRelativePath } from './utils';
+import {
+  createWorkerManifestServiceBindings,
+  createWorkerServiceBindings,
+} from './wrangler-config';
+
+const createMissingEffectBffWorkerError = (
+  outputDirectory: string,
+  worker: string,
+) =>
+  new Error(
+    `Cloudflare Effect API runtime is configured, but the BFF worker bundle is missing: ${path.join(
+      outputDirectory,
+      worker,
+    )}. ${EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE}`,
+  );
+
+const createEffectBffWorkerManifest = (
+  modernConfig: CloudflareModernConfig,
+) => {
+  const bff = modernConfig.bff;
+  const configuredPolicy = bff?.crossProjectPolicy;
+  if (configuredPolicy?.verifyProducerIdentity !== undefined) {
+    throw new Error(
+      'Cloudflare Effect BFF cannot serialize bff.crossProjectPolicy.verifyProducerIdentity into the worker manifest. Configure a worker-native identity binding before enabling this policy at the edge.',
+    );
+  }
+  const crossProjectPolicy = {
+    ...configuredPolicy,
+    enabled: configuredPolicy?.enabled ?? Boolean(bff?.isCrossProjectServer),
+    requireEnvelope: configuredPolicy?.requireEnvelope ?? true,
+    requireOperationContext: configuredPolicy?.requireOperationContext ?? true,
+    requireOperationContextDetails:
+      configuredPolicy?.requireOperationContextDetails ?? true,
+    requireOperationSchemaHash:
+      configuredPolicy?.requireOperationSchemaHash ?? true,
+    requireOperationVersion: configuredPolicy?.requireOperationVersion ?? true,
+    allowUnknownOperations: configuredPolicy?.allowUnknownOperations ?? false,
+    expectedOperationContracts: {
+      ...(configuredPolicy?.expectedOperationContracts ?? {}),
+    },
+  };
+
+  const openapi = bff?.effect?.openapi;
+  const dataPlatform = bff?.effect?.dataPlatform;
+
+  return {
+    ...(openapi === undefined ? {} : { openapi }),
+    ...(dataPlatform === undefined ? {} : { dataPlatform }),
+    crossProjectPolicy,
+  };
+};
+
+const createModuleFederationWorkerManifest = async (
+  outputDirectory: string,
+) => {
+  const manifestPath = path.join(
+    outputDirectory,
+    PUBLIC_ASSETS_DIRECTORY,
+    'mf-manifest.json',
+  );
+
+  if (!(await fse.pathExists(manifestPath))) {
+    return undefined;
+  }
+
+  const manifest = (await fse.readJson(manifestPath)) as unknown;
+  const name =
+    isRecord(manifest) && typeof manifest.name === 'string'
+      ? manifest.name
+      : undefined;
+  const manifestExposes =
+    isRecord(manifest) && Array.isArray(manifest.exposes)
+      ? manifest.exposes
+      : [];
+  const exposes = manifestExposes.filter(isRecord).flatMap(expose => {
+    if (typeof expose.path !== 'string') {
+      return [];
+    }
+    const assets = isRecord(expose.assets) ? expose.assets : undefined;
+    const css = assets && isRecord(assets.css) ? assets.css : undefined;
+    return [
+      {
+        path: expose.path,
+        css: [
+          ...(css && Array.isArray(css.sync) ? css.sync : []),
+          ...(css && Array.isArray(css.async) ? css.async : []),
+        ].filter(
+          (asset): asset is string =>
+            typeof asset === 'string' && asset.endsWith('.css'),
+        ),
+      },
+    ];
+  });
+
+  return name && exposes.length > 0 ? { name, exposes } : undefined;
+};
+
+export const createWorkerManifest = async (
+  outputDirectory: string,
+  modernConfig: CloudflareModernConfig,
+  appContext: CloudflareAppContext,
+  deliveryUnitStamp: DeliveryUnitStamp | undefined,
+) => {
+  const routeSpec = await readRouteSpec(outputDirectory);
+  const routes = await Promise.all(
+    routeSpec.routes.map(async (route: Record<string, any>) => {
+      const worker =
+        typeof route.worker === 'string' ? route.worker : undefined;
+
+      return {
+        urlPath: route.urlPath,
+        entryName: route.entryName,
+        entryPath: route.entryPath,
+        isSSR: Boolean(route.isSSR),
+        worker,
+        workerExists: worker
+          ? await fse.pathExists(path.join(outputDirectory, worker))
+          : false,
+      };
+    }),
+  );
+
+  const bffPrefix = modernConfig.bff?.prefix;
+  const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+  const isEffectApi =
+    Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+  const effectApiWorkerExists = await fse.pathExists(
+    path.join(outputDirectory, BFF_EFFECT_WORKER_ENTRY),
+  );
+  const serviceBindings = createWorkerManifestServiceBindings(
+    createWorkerServiceBindings(modernConfig, undefined),
+  );
+  const moduleFederation =
+    await createModuleFederationWorkerManifest(outputDirectory);
+
+  if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) {
+    throw createMissingEffectBffWorkerError(
+      outputDirectory,
+      BFF_EFFECT_WORKER_ENTRY,
+    );
+  }
+  const effectBffManifest = isEffectApi
+    ? createEffectBffWorkerManifest(modernConfig)
+    : undefined;
+
+  return {
+    version: 1,
+    runtime: {
+      type: CLOUDFLARE_RUNTIME_TYPE,
+      entry: WORKER_ENTRY,
+      fetchExport: true,
+      nodeListen: false,
+    },
+    assets: {
+      binding: ASSETS_BINDING,
+      directory: `./${PUBLIC_ASSETS_DIRECTORY}`,
+      runWorkerFirst: true,
+    },
+    routeSpec: {
+      file: ROUTE_SPEC_OUTPUT,
+      routes,
+    },
+    workerBundles: {
+      directory: WORKER_BUNDLE_DIRECTORY,
+      format: CLOUDFLARE_WORKER_BUNDLE_FORMAT,
+      importableFromModuleWorker: true,
+      requestHandlerExport: 'requestHandler',
+    },
+    resources: {
+      loadableStats: LOADABLE_STATS_FILE,
+      routeManifest: ROUTE_MANIFEST_FILE,
+    },
+    security: createCloudflareWorkerSecurityPolicy(modernConfig),
+    ...(moduleFederation === undefined ? {} : { moduleFederation }),
+    ...(deliveryUnitStamp ? { deliveryUnit: deliveryUnitStamp } : {}),
+    i18n: createI18nWorkerManifest(routeSpec, appContext),
+    bff:
+      isEffectApi && primaryBffPrefix && effectApiWorkerExists
+        ? {
+            dispatcherExport: BFF_EFFECT_WORKER_DISPATCHER_EXPORT,
+            runtimeFramework: 'effect',
+            prefix: primaryBffPrefix,
+            worker: BFF_EFFECT_WORKER_ENTRY,
+            effect: effectBffManifest,
+          }
+        : undefined,
+    ...(serviceBindings === undefined ? {} : { serviceBindings }),
+  };
+};
+
+export const createWorkerModuleLoaders = (manifest: any) => {
+  const imports = new Map<string, string>();
+
+  for (const route of manifest.routeSpec.routes) {
+    if (route.worker && route.workerExists) {
+      const importPath = `../${String(route.worker).replace(/^\/+/u, '')}`;
+      imports.set(route.worker, `() => import(${JSON.stringify(importPath)})`);
+    }
+  }
+
+  if (manifest.bff?.worker) {
+    const importPath = `../${String(manifest.bff.worker).replace(/^\/+/u, '')}`;
+    imports.set(
+      manifest.bff.worker,
+      `() => import(${JSON.stringify(importPath)})`,
+    );
+  }
+
+  if (imports.size === 0) {
+    return '{}';
+  }
+
+  const loaders = [...imports.entries()].map(
+    ([worker, loader]) => `${JSON.stringify(worker)}: ${loader}`,
+  );
+
+  return `{\n${loaders.join(',\n')}\n}`;
+};
+
+export const getPublicAssetExcludes = (
+  appDirectory: string,
+  modernConfig: CloudflareModernConfig,
+) =>
+  [
+    ...DEFAULT_SERVER_ONLY_PUBLIC_ASSET_EXCLUDES.filter(directory => {
+      try {
+        return fse.statSync(path.join(appDirectory, directory)).isDirectory();
+      } catch {
+        return false;
+      }
+    }),
+    ...(modernConfig.deploy?.worker?.publicAssetExcludes ?? []),
+  ].map(entry =>
+    normalizeRelativePath(entry, 'deploy.worker.publicAssetExcludes'),
+  );
+
+export const shouldCopyToPublicAssets = (
+  src: string,
+  distDirectory: string,
+  publicAssetExcludes: string[],
+) => {
+  const relativePath = path.relative(distDirectory, src);
+
+  if (!relativePath) {
+    return true;
+  }
+
+  const normalizedRelativePath = relativePath.replace(/\\/g, '/');
+  const [topLevelDirectory] = normalizedRelativePath.split('/');
+  const basename = normalizedRelativePath.split('/').pop() ?? '';
+
+  return (
+    normalizedRelativePath !== ROUTE_SPEC_FILE &&
+    topLevelDirectory !== WORKER_BUNDLE_DIRECTORY &&
+    topLevelDirectory !== SERVER_BUNDLE_DIRECTORY &&
+    basename !== '.env' &&
+    !basename.startsWith('.env.') &&
+    !publicAssetExcludes.some(
+      exclude =>
+        normalizedRelativePath === exclude ||
+        normalizedRelativePath.startsWith(`${exclude}/`),
+    )
+  );
+};
+
+export const shouldCopyToWorkerBundle = (
+  src: string,
+  workerBundleDirectory: string,
+) => {
+  const relativePath = path.relative(workerBundleDirectory, src);
+
+  if (!relativePath) {
+    return true;
+  }
+
+  const normalizedRelativePath = relativePath.replace(/\\/g, '/');
+  const basename = path.basename(normalizedRelativePath);
+
+  if (basename.startsWith('.') || normalizedRelativePath.includes('/.')) {
+    return false;
+  }
+
+  if (fse.statSync(src).isDirectory()) {
+    return true;
+  }
+
+  return ['.cjs', '.js', '.mjs'].includes(path.extname(normalizedRelativePath));
+};