@bleedingdev/modern-js-plugin-tanstack 3.5.0-ultramodern.98 → 3.8.1-ultramodern.1

package/tests/router/fixtures/rscDecoderSecurityChild.cjs

@@ -0,0 +1,162 @@
+const path = require('node:path');
+
+const scenario = process.argv[2];
+const serverPath = process.argv[3];
+const clientPath = process.argv[4];
+let moduleLoads = 0;
+
+global.__webpack_chunk_load__ = async () => {};
+global.__webpack_require__ = () => {
+  moduleLoads += 1;
+  return {
+    action(formData) {
+      return formData;
+    },
+  };
+};
+global.__rspack_rsc_hot_reloader__ = { on: () => () => {} };
+global.__rspack_rsc_manifest__ = {
+  clientManifest: {},
+  entryCssFiles: {},
+  entryJsFiles: [],
+  moduleLoading: { prefix: '', crossOrigin: '' },
+  serverConsumerModuleMap: {},
+  serverManifest: Object.fromEntries(
+    Array.from({ length: 8 }, (_, index) => [
+      `action-${index}`,
+      { id: 'server-module', chunks: [], name: 'action' },
+    ]),
+  ),
+};
+
+let mapArrayConstructions = 0;
+if (scenario === 'cycle') {
+  const NativeMap = Map;
+  global.Map = class CountedMap extends NativeMap {
+    constructor(iterable) {
+      if (Array.isArray(iterable)) {
+        mapArrayConstructions += 1;
+      }
+      super(iterable);
+    }
+  };
+}
+
+const server = require(path.resolve(serverPath));
+
+function output(value) {
+  process.stdout.write(JSON.stringify(value), () => process.exit(0));
+}
+
+async function main() {
+  switch (scenario) {
+    case 'cycle': {
+      const body = new FormData();
+      body.set(
+        '0',
+        JSON.stringify([
+          ...Array.from({ length: 8 }, (_, index) => [`key-${index}`, index]),
+          ...Array.from({ length: 8 }, () => '$Q0'),
+        ]),
+      );
+      let error;
+      try {
+        await server.decodeReply(body);
+      } catch (caught) {
+        error = caught;
+      }
+      output({ mapArrayConstructions, rejected: error instanceof Error });
+      return;
+    }
+    case 'referenced-form-data': {
+      const body = new FormData();
+      body.append('_1_item', 'first');
+      body.append('_2_item', 'second');
+      body.append('0', JSON.stringify(['$K1', '$K2']));
+      let keyIterations = 0;
+      const originalKeys = body.keys.bind(body);
+      body.keys = () => {
+        keyIterations += 1;
+        return originalKeys();
+      };
+      const decoded = await server.decodeReply(body);
+      output({
+        keyIterations,
+        values: decoded.map(value => value.get('item')),
+      });
+      return;
+    }
+    case 'blob-type': {
+      const body = new FormData();
+      body.set('1', 'not-a-blob');
+      body.set('0', JSON.stringify('$B1'));
+      let error;
+      try {
+        await server.decodeReply(body);
+      } catch (caught) {
+        error = caught;
+      }
+      output({
+        rejected: error instanceof Error,
+        returnedString: error === undefined,
+      });
+      return;
+    }
+    case 'async-iterator': {
+      let throwCalls = 0;
+      const reason = new Error('iterator failed');
+      const iterator = {
+        next: () => Promise.reject(reason),
+        throw: () => {
+          throwCalls += 1;
+          return throwCalls < 6
+            ? Promise.reject(reason)
+            : {
+                // biome-ignore lint/suspicious/noThenProperty: The regression requires a deliberately pending thenable to bound the vulnerable recursion.
+                then: () => {},
+              };
+        },
+      };
+      const iterable = { [Symbol.asyncIterator]: () => iterator };
+      try {
+        await server.decodeReplyFromAsyncIterable(iterable);
+      } catch {}
+      await new Promise(resolve => setImmediate(resolve));
+      output({ throwCalls });
+      return;
+    }
+    case 'action-load': {
+      const body = new FormData();
+      for (let index = 0; index < 8; index += 1) {
+        body.append(`$ACTION_ID_action-${index}`, '');
+      }
+      const action = await server.decodeAction(body);
+      if (action === null) {
+        throw new Error('Expected an action');
+      }
+      const submitted = await action();
+      output({
+        moduleLoads,
+        submittedEntries: Array.from(submitted.entries()),
+      });
+      return;
+    }
+    case 'form-data-roundtrip': {
+      const client = require(path.resolve(clientPath));
+      const nested = new FormData();
+      nested.append('item', 'first');
+      nested.append('item', 'second');
+      const encoded = await client.encodeReply({ nested });
+      const decoded = await server.decodeReply(encoded);
+      output({ values: decoded.nested.getAll('item') });
+      return;
+    }
+    default:
+      throw new Error(`Unknown scenario: ${scenario}`);
+  }
+}
+
+main().catch(error => {
+  console.error(error);
+  process.exitCode = 1;
+});

package/tests/router/preloadRedirect.test.ts

@@ -11,7 +11,7 @@ describe('tanstack router-core preload redirects', () => {
     rstest.restoreAllMocks();
   });
 
-  test('keeps concurrent cached preload redirects from reading deleted matches', async () => {
+  test('resolves concurrent preload redirects without stale loader work', async () => {
     const consoleErrorSpy = rstest
       .spyOn(console, 'error')
       .mockImplementation(() => {});
@@ -58,12 +58,7 @@ describe('tanstack router-core preload redirects', () => {
 
     expect(consoleErrorSpy).not.toHaveBeenCalled();
     expect(router.options.defaultStructuralSharing).toBe(true);
-    expect(redirectLoaderCalls).toBeGreaterThan(0);
-    expect(targetLoader).toHaveBeenCalled();
-    expect(
-      router.stores.cachedMatches
-        .get()
-        .some(match => match.status === 'redirected'),
-    ).toBe(false);
+    expect(redirectLoaderCalls).toBe(1);
+    expect(targetLoader).toHaveBeenCalledTimes(1);
   });
 });

package/tests/router/routeTree.test.ts

@@ -3,7 +3,12 @@ import path from 'node:path';
 import type { RouteObject } from '@modern-js/runtime-utils/router';
 import type { NestedRoute } from '@modern-js/types';
 import { createMemoryHistory } from '@tanstack/history';
-import { createRouter, Outlet, RouterProvider } from '@tanstack/react-router';
+import {
+  createRouter,
+  Outlet,
+  RouterProvider,
+  redirect,
+} from '@tanstack/react-router';
 import type { ComponentType } from 'react';
 import { createElement, lazy } from 'react';
 import { renderToStaticMarkup, renderToString } from 'react-dom/server';
@@ -77,15 +82,23 @@ type PreloadableTestComponent = {
 };
 
 type TestRouter = {
+  _serverResult?:
+    | {
+        type: 'redirect';
+        redirect: Response;
+      }
+    | {
+        type: 'render';
+        status: 200 | 404 | 500;
+      };
   load: () => Promise<void>;
-  looseRoutesById: Partial<Record<string, TestRoute>>;
+  routesById: Partial<Record<string, TestRoute>>;
   state: {
     matches: Array<{
       error?: unknown;
       loaderData?: unknown;
       routeId: string;
     }>;
-    statusCode?: number;
   };
 };
 
@@ -110,19 +123,19 @@ async function loadRouteTree(
   return router as unknown as TestRouter;
 }
 
-function getLooseRoute(router: TestRouter, id: string): TestRoute {
-  const route = router.looseRoutesById[id];
+function getRoute(router: TestRouter, id: string): TestRoute {
+  const route = router.routesById[id];
   if (!route) {
     throw new Error(`Expected TanStack route ${id} to exist`);
   }
   return route;
 }
 
-function getLooseRouteByModernRouteId(
+function getRouteByModernRouteId(
   router: TestRouter,
   modernRouteId: string,
 ): TestRoute {
-  const route = Object.values(router.looseRoutesById).find(
+  const route = Object.values(router.routesById).find(
     route => route?.options.staticData?.modernRouteId === modernRouteId,
   );
   if (!route) {
@@ -255,7 +268,47 @@ describe('tanstack route tree from RouteObject[]', () => {
     const routeTree = createRouteTreeFromRouteObjects(routes);
     const router = await loadRouteTree(routeTree, '/missing');
 
-    expect(router.state.statusCode).toBe(404);
+    expect(router._serverResult).toMatchObject({
+      type: 'render',
+      status: 404,
+    });
+  });
+
+  test('reports native TanStack loader redirects as server responses', async () => {
+    const routes: RouteObject[] = [
+      {
+        id: 'root',
+        path: '/',
+        Component: () => null,
+        children: [
+          {
+            id: 'redirect',
+            path: 'redirect',
+            loader: () => {
+              throw redirect({ to: '/target' });
+            },
+            Component: () => null,
+          },
+          {
+            id: 'target',
+            path: 'target',
+            Component: () => null,
+          },
+        ],
+      },
+    ];
+
+    const routeTree = createRouteTreeFromRouteObjects(routes);
+    const router = await loadRouteTree(routeTree, '/redirect');
+
+    expect(router._serverResult?.type).toBe('redirect');
+    if (router._serverResult?.type !== 'redirect') {
+      throw new Error('Expected a TanStack redirect server result');
+    }
+    expect(router._serverResult.redirect.status).toBe(307);
+    expect(router._serverResult.redirect.headers.get('Location')).toBe(
+      '/target',
+    );
   });
 
   test('does not force Suspense wrappers for ordinary generated routes', async () => {
@@ -278,9 +331,7 @@ describe('tanstack route tree from RouteObject[]', () => {
     const router = await loadRouteTree(routeTree, '/plain');
 
     expect(routeTree.options.wrapInSuspense).toBeUndefined();
-    expect(
-      getLooseRoute(router, '/plain').options.wrapInSuspense,
-    ).toBeUndefined();
+    expect(getRoute(router, '/plain').options.wrapInSuspense).toBeUndefined();
   });
 
   test('renders Modern Outlet through TanStack native outlet', async () => {
@@ -395,7 +446,7 @@ describe('tanstack route tree from RouteObject[]', () => {
       }),
       context: {},
     }) as unknown as TestRouter;
-    const searchRoute = getLooseRoute(router, '/search');
+    const searchRoute = getRoute(router, '/search');
 
     expect(routeTree.options.validateSearch).toBe(rootValidateSearch);
     expect(routeTree.options.loaderDeps).toBe(rootLoaderDeps);
@@ -516,7 +567,7 @@ describe('tanstack route tree from RouteObject[]', () => {
 
     const routeTree = createRouteTreeFromRouteObjects(routes);
     const router = await loadRouteTree(routeTree, '/lazy');
-    const lazyRoute = getLooseRoute(router, '/lazy');
+    const lazyRoute = getRoute(router, '/lazy');
     const component = lazyRoute.options.component as ComponentType & {
       preload?: () => Promise<unknown>;
     };
@@ -550,7 +601,7 @@ describe('tanstack route tree from RouteObject[]', () => {
 
     const routeTree = createRouteTreeFromRouteObjects(routes);
     const router = await loadRouteTree(routeTree, '/lazy');
-    const lazyRoute = getLooseRoute(router, '/lazy');
+    const lazyRoute = getRoute(router, '/lazy');
     const lazyComponent = lazyRoute.options
       .component as PreloadableTestComponent;
 
@@ -586,7 +637,7 @@ describe('tanstack route tree from RouteObject[]', () => {
 
     const routeTree = createRouteTreeFromRouteObjects(routes);
     const router = await loadRouteTree(routeTree, '/load-only');
-    const loadOnlyRoute = getLooseRoute(router, '/load-only');
+    const loadOnlyRoute = getRoute(router, '/load-only');
     const loadOnlyComponent = loadOnlyRoute.options
       .component as PreloadableTestComponent;
 
@@ -665,7 +716,7 @@ describe('tanstack route tree from RouteObject[]', () => {
 
     const routeTree = createRouteTreeFromRouteObjects(routes);
     const router = await loadRouteTree(routeTree, '/user/123');
-    const userRoute = getLooseRoute(router, '/user/$id');
+    const userRoute = getRoute(router, '/user/$id');
 
     expect(routeTree.options.staticData.modernRouteHandle).toEqual({
       shell: true,
@@ -718,7 +769,7 @@ describe('tanstack route tree from RouteObject[]', () => {
 
     const routeTree = createRouteTreeFromRouteObjects(routes);
     const router = await loadRouteTree(routeTree, '/client');
-    const clientRoute = getLooseRoute(router, '/client');
+    const clientRoute = getRoute(router, '/client');
 
     expect(clientRoute.options.ssr).toBe(false);
     expect(clientRoute.options.staticData).toMatchObject({
@@ -789,7 +840,10 @@ describe('tanstack route tree from RouteObject[]', () => {
       match => match.routeId === '/broken',
     );
 
-    expect(router.state.statusCode).toBe(200);
+    expect(router._serverResult).toMatchObject({
+      type: 'render',
+      status: 200,
+    });
     expect(brokenMatch?.loaderData).toBe(response);
     expect(brokenMatch?.error).toBeUndefined();
   });
@@ -829,7 +883,7 @@ describe('tanstack route tree from RouteObject[]', () => {
       }),
       context: {},
     }) as unknown as TestRouter;
-    const clientRoute = getLooseRouteByModernRouteId(router, 'client');
+    const clientRoute = getRouteByModernRouteId(router, 'client');
 
     expect(clientRoute.options.ssr).toBe(false);
     expect(clientRoute.options.staticData).toMatchObject({

package/tests/router/routerCompatibility.test.ts

@@ -199,12 +199,6 @@ describe('runtime router compatibility', () => {
       runTsgo(tsgoBin, path.join(tempRoot, 'emit.json'));
 
       const declarationPath = path.join(emittedRoot, 'router.d.ts');
-      const declaration = readFileSync(declarationPath, 'utf8');
-      expect(declaration).not.toMatch(
-        /\b(?:createRouterPlugin|RouterPluginFactory)\b/u,
-      );
-      expect(declaration).toContain("['routerPlugin']");
-
       writeFileSync(
         path.join(tempRoot, 'legacyRuntimeRouter.ts'),
         readFileSync(legacyFixturePath, 'utf8'),

package/tests/router/rscDecoderSecurity.test.ts

@@ -0,0 +1,113 @@
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+type DecoderScenario =
+  | 'action-load'
+  | 'async-iterator'
+  | 'blob-type'
+  | 'cycle'
+  | 'form-data-roundtrip'
+  | 'referenced-form-data';
+
+const resolvePackage = createRequire(
+  path.join(__dirname, 'rsc-decoder-security-resolver.cjs'),
+).resolve;
+const childPath = path.join(
+  __dirname,
+  'fixtures',
+  'rscDecoderSecurityChild.cjs',
+);
+
+function runDecoderScenario(options: {
+  entry: 'edge' | 'node';
+  nodeEnv: 'development' | 'production';
+  scenario: DecoderScenario;
+}): Record<string, unknown> {
+  const result = spawnSync(
+    process.execPath,
+    [
+      '--conditions=react-server',
+      childPath,
+      options.scenario,
+      resolvePackage(`react-server-dom-rspack/server.${options.entry}`),
+      resolvePackage(`react-server-dom-rspack/client.${options.entry}`),
+    ],
+    {
+      encoding: 'utf8',
+      env: { ...process.env, NODE_ENV: options.nodeEnv },
+      timeout: 5_000,
+    },
+  );
+
+  if (result.error || result.status !== 0) {
+    throw new Error(
+      [
+        `RSC decoder child failed for ${options.entry}/${options.nodeEnv}/${options.scenario}`,
+        result.stdout,
+        result.stderr,
+      ]
+        .filter(Boolean)
+        .join('\n'),
+      { cause: result.error },
+    );
+  }
+
+  return JSON.parse(result.stdout) as Record<string, unknown>;
+}
+
+for (const entry of ['node', 'edge'] as const) {
+  for (const nodeEnv of ['development', 'production'] as const) {
+    describe(`${entry} ${nodeEnv} Flight decoder security`, () => {
+      test('bounds cyclic Map reconstruction before invoking constructors', () => {
+        expect(
+          runDecoderScenario({ entry, nodeEnv, scenario: 'cycle' }),
+        ).toEqual({
+          mapArrayConstructions: 2,
+          rejected: true,
+        });
+      });
+
+      test('decodes referenced FormData with one backing-store enumeration', () => {
+        expect(
+          runDecoderScenario({
+            entry,
+            nodeEnv,
+            scenario: 'referenced-form-data',
+          }),
+        ).toEqual({ keyIterations: 1, values: ['first', 'second'] });
+      });
+
+      test('round-trips referenced FormData through the public client and server APIs', () => {
+        expect(
+          runDecoderScenario({
+            entry,
+            nodeEnv,
+            scenario: 'form-data-roundtrip',
+          }),
+        ).toEqual({ values: ['first', 'second'] });
+      });
+
+      test('rejects a Blob reference backed by a string', () => {
+        expect(
+          runDecoderScenario({ entry, nodeEnv, scenario: 'blob-type' }),
+        ).toEqual({
+          rejected: true,
+          returnedString: false,
+        });
+      });
+
+      test('does not recursively throw into a rejecting async iterator', () => {
+        expect(
+          runDecoderScenario({ entry, nodeEnv, scenario: 'async-iterator' }),
+        ).toEqual({ throwCalls: 1 });
+      });
+
+      test('loads one server module for eight distinct action identifiers', () => {
+        expect(
+          runDecoderScenario({ entry, nodeEnv, scenario: 'action-load' }),
+        ).toEqual({ moduleLoads: 1, submittedEntries: [] });
+      });
+    });
+  }
+}

package/tests/router/serverPlugin.test.ts

@@ -0,0 +1,115 @@
+import type { TInternalRuntimeContext } from '@modern-js/runtime/context';
+import { routerProviderRegistryHooks } from '@modern-js/runtime/context';
+import { getRouterServerSnapshot } from '../../src/runtime/lifecycle';
+import { tanstackRouterPlugin } from '../../src/runtime/plugin.node';
+import type { TanstackRouterPluginAPI } from '../../src/runtime/pluginShared';
+import type { RouterConfig } from '../../src/runtime/types';
+
+type BeforeRenderListener = Parameters<
+  TanstackRouterPluginAPI['onBeforeRender']
+>[0];
+
+function collectBeforeRender(
+  createRoutes: NonNullable<RouterConfig['createRoutes']>,
+) {
+  let listener: BeforeRenderListener | undefined;
+  tanstackRouterPlugin({ createRoutes }).setup?.({
+    getRuntimeConfig: () => ({}),
+    getHooks: () => routerProviderRegistryHooks,
+    onBeforeRender: nextListener => {
+      listener = nextListener;
+    },
+    wrapRoot: () => {},
+  });
+
+  if (!listener) {
+    throw new Error('Expected the TanStack server plugin to register a hook');
+  }
+  return listener;
+}
+
+function createServerContext(pathname: string) {
+  const status = rstest.fn();
+  const context = {
+    ssrContext: {
+      baseUrl: '/',
+      loaderContext: {},
+      mode: 'string',
+      request: {
+        raw: new Request(`http://localhost${pathname}`),
+      },
+      response: { status },
+    },
+  } as unknown as TInternalRuntimeContext;
+
+  return { context, status };
+}
+
+describe('tanstack server plugin router results', () => {
+  afterEach(() => {
+    rstest.restoreAllMocks();
+  });
+
+  test('uses the router render result as the HTTP and hydration status', async () => {
+    const beforeRender = collectBeforeRender(() => [
+      {
+        id: 'root',
+        path: '/',
+        Component: () => null,
+        children: [
+          {
+            id: 'target',
+            path: 'target',
+            Component: () => null,
+          },
+        ],
+      },
+    ]);
+    const { context, status } = createServerContext('/target');
+
+    await beforeRender(context, value => value);
+
+    expect(status).toHaveBeenCalledWith(200);
+    expect(getRouterServerSnapshot(context)).toMatchObject({
+      framework: 'tanstack',
+      statusCode: 200,
+    });
+  });
+
+  test('interrupts SSR with the router redirect response', async () => {
+    const beforeRender = collectBeforeRender(() => [
+      {
+        id: 'root',
+        path: '/',
+        Component: () => null,
+        children: [
+          {
+            id: 'redirect',
+            path: 'redirect',
+            loader: () =>
+              new Response(null, {
+                status: 307,
+                headers: { Location: '/target' },
+              }),
+            Component: () => null,
+          },
+          {
+            id: 'target',
+            path: 'target',
+            Component: () => null,
+          },
+        ],
+      },
+    ]);
+    const { context, status } = createServerContext('/redirect');
+    const interrupt = rstest.fn((value: unknown) => value);
+
+    const response = await beforeRender(context, interrupt);
+
+    expect(response).toBeInstanceOf(Response);
+    expect((response as Response).status).toBe(307);
+    expect((response as Response).headers.get('Location')).toBe('/target');
+    expect(interrupt).toHaveBeenCalledWith(response);
+    expect(status).not.toHaveBeenCalled();
+  });
+});