@chidchanun/bcp 0.1.9 → 0.1.10

package/packages/server/src/standalone-production-runtime-v2-guard.ts

@@ -0,0 +1,815 @@
+import fs from "node:fs";
+import * as http from "node:http";
+import * as net from "node:net";
+import path from "node:path";
+import {
+    pathToFileURL,
+} from "node:url";
+
+import {
+    GUARD_DATA_HEADER,
+    type PageLoader,
+} from "./page-loader.js";
+
+import {
+    createNavigationRedirectResponse,
+    sendNavigationWebResponse,
+} from "./navigation-response.js";
+
+import {
+    createStandaloneProductionServer as createBaseStandaloneProductionServer,
+    type StandaloneApiRoute,
+    type StandalonePageRoute,
+    type StandaloneProductionServerOptions as BaseStandaloneProductionServerOptions,
+} from "./standalone-production-runtime-v2-navigation.js";
+
+export type {
+    StandaloneApiRoute,
+    StandalonePageRoute,
+};
+
+export interface StandaloneProductionServerOptions
+    extends BaseStandaloneProductionServerOptions {}
+
+interface GuardAllowResult {
+    kind: "allow";
+    data: Record<string, unknown>;
+    setCookies: string[];
+}
+
+interface GuardResponseResult {
+    kind: "response";
+    response: Response;
+}
+
+type GuardResult =
+    | GuardAllowResult
+    | GuardResponseResult;
+
+interface ProductionGuardModule {
+    guardedPathnames: string[];
+    evaluateRouteGuards(
+        input: {
+            url: string;
+            method: string;
+            headers: Array<[
+                string,
+                string
+            ]>;
+            remoteAddress: string | null;
+        }
+    ): Promise<GuardResult | null>;
+}
+
+const MAX_GUARD_HEADER_BYTES =
+    16 * 1024;
+
+export function createStandaloneProductionServer(
+    options: StandaloneProductionServerOptions
+) {
+    const guardFile =
+        path.join(
+            options.buildDirectory,
+            "server",
+            "guards.mjs"
+        );
+
+    if (!fs.existsSync(guardFile)) {
+        return createBaseStandaloneProductionServer(
+            options
+        );
+    }
+
+    let baseServer:
+        ReturnType<
+            typeof createBaseStandaloneProductionServer
+        > | null =
+        null;
+    let gateway:
+        http.Server | null =
+        null;
+    let started =
+        false;
+    let guardModule:
+        ProductionGuardModule | null =
+        null;
+
+    async function start(): Promise<void> {
+        if (started) {
+            return;
+        }
+
+        guardModule =
+            await import(
+                pathToFileURL(
+                    guardFile
+                ).href
+            ) as ProductionGuardModule;
+
+        assertGuardModule(
+            guardModule,
+            guardFile
+        );
+
+        const guardedPathnames =
+            new Set(
+                guardModule.guardedPathnames
+            );
+        /*
+         * Guard-only routes still need the loader/navigation runtime so the
+         * internal guard-data header is decoded and exposed to React. Return
+         * null instead of undefined because loader results must remain JSON
+         * serializable in the production runtime.
+         */
+        const guardPassthroughLoader:
+            PageLoader =
+            async () =>
+                null;
+        const routes =
+            options.routes.map(
+                (route) =>
+                    guardedPathnames.has(
+                        route.pathname
+                    ) &&
+                    route.loader ===
+                        null
+                        ? {
+                            ...route,
+                            loader:
+                                guardPassthroughLoader,
+                        }
+                        : route
+            );
+        const internalPort =
+            await findFreePort();
+
+        baseServer =
+            createBaseStandaloneProductionServer({
+                ...options,
+                routes,
+                port:
+                    internalPort,
+                hostname:
+                    "127.0.0.1",
+            });
+
+        await baseServer.start();
+
+        gateway =
+            http.createServer(
+                async (
+                    req,
+                    res
+                ) => {
+                    try {
+                        const requestUrl =
+                            new URL(
+                                req.url ??
+                                "/",
+                                `http://${
+                                    req.headers.host ??
+                                    `${options.hostname}:${options.port}`
+                                }`
+                            );
+                        const target =
+                            resolveGuardTarget(
+                                requestUrl
+                            );
+
+                        if (
+                            !target ||
+                            !guardModule
+                        ) {
+                            proxyRequest(
+                                req,
+                                res,
+                                internalPort,
+                                null,
+                                []
+                            );
+                            return;
+                        }
+
+                        const result =
+                            await guardModule
+                                .evaluateRouteGuards({
+                                    url:
+                                        target.href,
+                                    method:
+                                        requestUrl.pathname ===
+                                            "/_bcp/navigation"
+                                            ? "GET"
+                                            : req.method ??
+                                                "GET",
+                                    headers:
+                                        collectRequestHeaders(
+                                            req
+                                        ),
+                                    remoteAddress:
+                                        req.socket
+                                            .remoteAddress ??
+                                        null,
+                                });
+
+                        if (!result) {
+                            proxyRequest(
+                                req,
+                                res,
+                                internalPort,
+                                null,
+                                []
+                            );
+                            return;
+                        }
+
+                        if (
+                            result.kind ===
+                            "response"
+                        ) {
+                            const response =
+                                result.response;
+
+                            if (
+                                requestUrl.pathname ===
+                                "/_bcp/navigation"
+                            ) {
+                                const navigationRedirect =
+                                    createNavigationRedirectResponse(
+                                        response
+                                    );
+
+                                if (
+                                    navigationRedirect
+                                ) {
+                                    await sendNavigationWebResponse(
+                                        req,
+                                        res,
+                                        navigationRedirect
+                                    );
+                                    return;
+                                }
+                            }
+
+                            await sendWebResponse(
+                                req,
+                                res,
+                                response
+                            );
+                            return;
+                        }
+
+                        const encodedData =
+                            encodeGuardData(
+                                result.data
+                            );
+
+                        proxyRequest(
+                            req,
+                            res,
+                            internalPort,
+                            encodedData,
+                            result.setCookies
+                        );
+                    } catch (error) {
+                        console.error(
+                            "[BCP Guard Error]",
+                            error
+                        );
+
+                        if (
+                            res.headersSent
+                        ) {
+                            res.destroy();
+                            return;
+                        }
+
+                        res.writeHead(
+                            500,
+                            {
+                                "Content-Type":
+                                    "text/plain; charset=utf-8",
+                                "Cache-Control":
+                                    "no-store",
+                            }
+                        );
+                        res.end(
+                            "Internal Server Error"
+                        );
+                    }
+                }
+            );
+
+        gateway.keepAliveTimeout =
+            65_000;
+        gateway.headersTimeout =
+            66_000;
+
+        try {
+            await listen(
+                gateway,
+                options.port,
+                options.hostname
+            );
+        } catch (error) {
+            await baseServer.stop();
+            baseServer =
+                null;
+            gateway =
+                null;
+            guardModule =
+                null;
+            throw error;
+        }
+
+        started =
+            true;
+
+        console.log(
+            `[BCP Guard] Protected routes: ${guardedPathnames.size}`
+        );
+        console.log(
+            `[BCP Guard] Gateway: http://${options.hostname}:${options.port}`
+        );
+        console.log("");
+    }
+
+    async function stop(): Promise<void> {
+        if (gateway) {
+            await closeServer(
+                gateway
+            );
+            gateway =
+                null;
+        }
+
+        if (baseServer) {
+            await baseServer.stop();
+            baseServer =
+                null;
+        }
+
+        guardModule =
+            null;
+        started =
+            false;
+    }
+
+    return {
+        start,
+        stop,
+    };
+}
+
+function assertGuardModule(
+    value: ProductionGuardModule,
+    filePath: string
+): void {
+    if (
+        !Array.isArray(
+            value.guardedPathnames
+        ) ||
+        typeof value.evaluateRouteGuards !==
+            "function"
+    ) {
+        throw new Error(
+            `BCP Framework: invalid standalone guard module at "${filePath}".`
+        );
+    }
+}
+
+function resolveGuardTarget(
+    requestUrl: URL
+): URL | null {
+    if (
+        requestUrl.pathname !==
+        "/_bcp/navigation"
+    ) {
+        return requestUrl;
+    }
+
+    const targetPath =
+        requestUrl.searchParams.get(
+            "url"
+        );
+
+    if (!targetPath) {
+        return null;
+    }
+
+    try {
+        const target =
+            new URL(
+                targetPath,
+                requestUrl.origin
+            );
+
+        return target.origin ===
+            requestUrl.origin
+            ? target
+            : null;
+    } catch {
+        return null;
+    }
+}
+
+function collectRequestHeaders(
+    req: http.IncomingMessage
+): Array<[
+    string,
+    string
+]> {
+    const result:
+        Array<[
+            string,
+            string
+        ]> = [];
+
+    for (
+        const [
+            key,
+            value,
+        ]
+        of Object.entries(
+            req.headers
+        )
+    ) {
+        if (
+            key.toLowerCase() ===
+            GUARD_DATA_HEADER ||
+            value ===
+            undefined
+        ) {
+            continue;
+        }
+
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                result.push([
+                    key,
+                    item,
+                ]);
+            }
+        } else {
+            result.push([
+                key,
+                value,
+            ]);
+        }
+    }
+
+    return result;
+}
+
+function encodeGuardData(
+    data: Record<string, unknown>
+): string {
+    const content =
+        Buffer.from(
+            JSON.stringify(
+                data
+            ),
+            "utf8"
+        );
+
+    if (
+        content.length >
+        MAX_GUARD_HEADER_BYTES
+    ) {
+        throw new Error(
+            `BCP Framework: serialized guard data exceeds ${MAX_GUARD_HEADER_BYTES} bytes.`
+        );
+    }
+
+    return content.toString(
+        "base64url"
+    );
+}
+
+function proxyRequest(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    internalPort: number,
+    encodedGuardData: string | null,
+    guardCookies: string[]
+): void {
+    const headers:
+        http.OutgoingHttpHeaders = {
+        ...req.headers,
+        host:
+            req.headers.host,
+    };
+
+    delete headers[
+        GUARD_DATA_HEADER
+    ];
+
+    if (encodedGuardData) {
+        headers[
+            GUARD_DATA_HEADER
+        ] =
+            encodedGuardData;
+    }
+
+    const upstream =
+        http.request({
+            hostname:
+                "127.0.0.1",
+            port:
+                internalPort,
+            method:
+                req.method ??
+                "GET",
+            path:
+                req.url ??
+                "/",
+            headers,
+        });
+
+    upstream.on(
+        "response",
+        (upstreamResponse) => {
+            const responseHeaders:
+                http.OutgoingHttpHeaders = {
+                ...upstreamResponse.headers,
+            };
+            const upstreamCookies =
+                normalizeSetCookieHeader(
+                    responseHeaders[
+                        "set-cookie"
+                    ]
+                );
+            const combinedCookies = [
+                ...guardCookies,
+                ...upstreamCookies,
+            ];
+
+            if (
+                combinedCookies.length >
+                0
+            ) {
+                responseHeaders[
+                    "set-cookie"
+                ] =
+                    combinedCookies;
+            }
+
+            const statusCode =
+                upstreamResponse.statusCode ??
+                502;
+
+            if (
+                upstreamResponse.statusMessage
+            ) {
+                res.writeHead(
+                    statusCode,
+                    upstreamResponse.statusMessage,
+                    responseHeaders
+                );
+            } else {
+                res.writeHead(
+                    statusCode,
+                    responseHeaders
+                );
+            }
+
+            upstreamResponse.pipe(
+                res
+            );
+        }
+    );
+
+    upstream.on(
+        "error",
+        (error) => {
+            console.error(
+                "[BCP Guard Proxy Error]",
+                error
+            );
+
+            if (
+                res.headersSent
+            ) {
+                res.destroy(
+                    error
+                );
+                return;
+            }
+
+            res.writeHead(
+                502,
+                {
+                    "Content-Type":
+                        "text/plain; charset=utf-8",
+                    "Cache-Control":
+                        "no-store",
+                }
+            );
+            res.end(
+                "Bad Gateway"
+            );
+        }
+    );
+
+    req.pipe(
+        upstream
+    );
+}
+
+async function sendWebResponse(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    response: Response
+): Promise<void> {
+    const headers:
+        http.OutgoingHttpHeaders = {};
+
+    response.headers.forEach(
+        (value, key) => {
+            if (
+                key.toLowerCase() !==
+                "set-cookie"
+            ) {
+                headers[key] =
+                    value;
+            }
+        }
+    );
+
+    const setCookies =
+        response.headers
+            .getSetCookie();
+
+    if (
+        setCookies.length > 0
+    ) {
+        headers[
+            "set-cookie"
+        ] =
+            setCookies;
+    }
+
+    res.writeHead(
+        response.status,
+        response.statusText,
+        headers
+    );
+
+    if (
+        (
+            req.method ??
+            "GET"
+        ).toUpperCase() ===
+            "HEAD" ||
+        !response.body
+    ) {
+        res.end();
+        return;
+    }
+
+    const reader =
+        response.body.getReader();
+
+    try {
+        while (true) {
+            const {
+                done,
+                value,
+            } =
+                await reader.read();
+
+            if (done) {
+                break;
+            }
+
+            res.write(
+                Buffer.from(
+                    value
+                )
+            );
+        }
+
+        res.end();
+    } finally {
+        reader.releaseLock();
+    }
+}
+
+function normalizeSetCookieHeader(
+    value:
+        string |
+        string[] |
+        undefined
+): string[] {
+    if (!value) {
+        return [];
+    }
+
+    return Array.isArray(value)
+        ? value
+        : [
+            value,
+        ];
+}
+
+async function findFreePort(): Promise<number> {
+    const server =
+        net.createServer();
+
+    try {
+        await listen(
+            server,
+            0,
+            "127.0.0.1"
+        );
+
+        const address =
+            server.address();
+
+        if (
+            !address ||
+            typeof address ===
+                "string"
+        ) {
+            throw new Error(
+                "BCP Framework: could not allocate guard production port."
+            );
+        }
+
+        return address.port;
+    } finally {
+        if (server.listening) {
+            await closeServer(
+                server
+            );
+        }
+    }
+}
+
+function listen(
+    server: net.Server,
+    port: number,
+    hostname: string
+): Promise<void> {
+    return new Promise<void>(
+        (
+            resolve,
+            reject
+        ) => {
+            const onError =
+                (error: Error) => {
+                    server.off(
+                        "listening",
+                        onListening
+                    );
+                    reject(
+                        error
+                    );
+                };
+            const onListening =
+                () => {
+                    server.off(
+                        "error",
+                        onError
+                    );
+                    resolve();
+                };
+
+            server.once(
+                "error",
+                onError
+            );
+            server.once(
+                "listening",
+                onListening
+            );
+            server.listen(
+                port,
+                hostname
+            );
+        }
+    );
+}
+
+function closeServer(
+    server: net.Server
+): Promise<void> {
+    return new Promise<void>(
+        (
+            resolve,
+            reject
+        ) => {
+            server.close(
+                (error) => {
+                    if (error) {
+                        reject(
+                            error
+                        );
+                        return;
+                    }
+
+                    resolve();
+                }
+            );
+        }
+    );
+}