@dokebi/template-inertia 0.4.6 → 0.4.7

package/AI.md

@@ -59,6 +59,7 @@ route.post('/orders', async (request, reply, page) => {
 - The Vue side is type-checked too: `dokebi app add --inertia` makes `npm run typecheck` run `vue-tsc` after `tsc` (`node typecheck-vue.mjs -p tsconfig.vue.json`), which checks the `<script>` and the `<template>` of every `.vue` file. Write pages as `<script setup lang="ts">` with `defineProps<{ … }>()`; the shared props (`$page.props`, `usePage().props`) are typed in `src/infra/inertia/page.d.ts` (add a key there for what `src/infra/inertia/shared.ts` returns), and a prop only some pages get with `usePage<{ … }>()`. A Vite build is not a Vue type check.
 - `redirect(request, reply, localUrl)`: 302 for GET/HEAD, 303 for mutations; an Inertia `#` navigation gets 409 + `X-Inertia-Redirect`.
 - `location(request, reply, url)`: a local or external http(s) navigation. Inertia requests get 409 + `X-Inertia-Location`.
+- Both write the URL into a response header: characters outside printable ASCII (a Korean path or query value) are percent-encoded as UTF-8 for you, and what is already encoded (`%EA%B0%80`) stays as it is; text that is not well formed (a lone surrogate) is `INVALID_URL`.
 
 ### 3.1 deferred, merge and once props (D-0052)
 

package/dist/i18n.js

@@ -267,7 +267,10 @@ export class I18n {
         const formats = this.#formatsOf(locale);
         let formatter = formats.numbers.get(format);
         if (!formatter) {
-            const preset = format === 'default' ? {} : this.#settings.numberFormats[format];
+            // Own names only: the settings are parsed JSON, where `constructor` or `toString` would
+            // name an Object.prototype member and format with the default (audit R9-g13-7).
+            const presets = this.#settings.numberFormats;
+            const preset = format === 'default' ? {} : Object.hasOwn(presets, format) ? presets[format] : undefined;
             if (!preset)
                 throw new PageI18nError('INVALID_FORMAT', 'Unknown number format');
             try {
@@ -294,7 +297,8 @@ export class I18n {
         const formats = this.#formatsOf(locale);
         let formatter = formats.dates.get(format);
         if (!formatter) {
-            const preset = format === 'default' ? {} : this.#settings.dateFormats[format];
+            const presets = this.#settings.dateFormats;
+            const preset = format === 'default' ? {} : Object.hasOwn(presets, format) ? presets[format] : undefined;
             if (!preset)
                 throw new PageI18nError('INVALID_FORMAT', 'Unknown date format');
             try {

package/dist/index.js

@@ -1036,7 +1036,7 @@ class InertiaRuntime {
 }
 export const createPlugin = definePlugin({
     name: 'dokebi-template-inertia',
-    version: '0.4.6',
+    version: '0.4.7',
     core: '^0.4.2',
     options,
     entry: parseEntry,

package/dist/responder.js

@@ -41,6 +41,36 @@ function localUrl(value) {
         throw new InertiaUsageError('INVALID_URL', 'Expected a local absolute URL');
     return value;
 }
+/**
+ * A checked redirect or location URL as a response header can carry it (audit R9-g13-3). Node
+ * refuses a header value with a character above U+00FF, and Fastify then destroys the socket:
+ * a redirect to a path with Korean text was a dropped connection, not a redirect.
+ * Printable ASCII (`%XX` included) is written as it is; anything else is percent-encoded as
+ * UTF-8, as a browser does with the same text in a link (an external URL through the URL
+ * parser, so its host becomes punycode). Text that is not well formed (a lone surrogate) is
+ * INVALID_URL.
+ */
+const LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+function headerUrl(url) {
+    if (/^[\x21-\x7e]*$/.test(url))
+        return url;
+    if (LONE_SURROGATE.test(url))
+        throw new InertiaUsageError('INVALID_URL', 'Expected a URL of well-formed text');
+    return url.startsWith('/')
+        ? url.replace(/[^\x21-\x7e]+/g, (text) => encodeURIComponent(text))
+        : new URL(url).href;
+}
+/**
+ * The location of a version mismatch (409): the request's own path and query. A request target
+ * is client input: `//host/x` or `/\host/x` as a location would send the browser to that host
+ * (and was refused with INVALID_URL, a 500 any client could ask for; audit R9-g13-4), so the
+ * leading slashes become one and a backslash is written `%5C`. A target that is no path (`*`,
+ * an absolute form) goes to `/`.
+ */
+function ownLocation(url) {
+    const path = url.replace(/^\/+/, '/').replace(/\\/g, '%5C');
+    return path.startsWith('/') ? path : '/';
+}
 export function vary(reply) {
     const values = String(reply.getHeader('vary') ?? '')
         .split(',')
@@ -301,7 +331,7 @@ export class InertiaResponder {
             request.headers['x-inertia-version'] !== this.options.version) {
             return reply
                 .code(409)
-                .header('X-Inertia-Location', localUrl(request.url))
+                .header('X-Inertia-Location', ownLocation(request.url))
                 .header('X-Inertia-Version', this.options.version)
                 .send();
         }
@@ -553,11 +583,11 @@ export class InertiaResponder {
     }
     redirect(request, reply, url) {
         this.#check();
-        localUrl(url);
+        const target = headerUrl(localUrl(url));
         vary(reply);
-        if (request.headers['x-inertia'] === 'true' && url.includes('#'))
-            return reply.code(409).header('X-Inertia-Redirect', url).send();
-        return reply.redirect(url, ['GET', 'HEAD'].includes(request.method) ? 302 : 303);
+        if (request.headers['x-inertia'] === 'true' && target.includes('#'))
+            return reply.code(409).header('X-Inertia-Redirect', target).send();
+        return reply.redirect(target, ['GET', 'HEAD'].includes(request.method) ? 302 : 303);
     }
     location(request, reply, url) {
         this.#check();
@@ -568,10 +598,11 @@ export class InertiaResponder {
             !/^https?:$/.test(new URL(url).protocol) ||
             /[\r\n]/.test(url))
             throw new InertiaUsageError('INVALID_URL', 'Invalid location');
+        const target = headerUrl(url);
         vary(reply);
         return request.headers['x-inertia'] === 'true'
-            ? reply.code(409).header('X-Inertia-Location', url).send()
-            : reply.redirect(url, 302);
+            ? reply.code(409).header('X-Inertia-Location', target).send()
+            : reply.redirect(target, 302);
     }
 }
 const RESCUED = Symbol('rescued');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dokebi/template-inertia",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Inertia v3 server adapter for Dokebi: page JSON, Vite manifest assets and optional server-side rendering.",
   "keywords": [
     "dokebi",
@@ -135,11 +135,11 @@
     ]
   },
   "devDependencies": {
-    "@dokebi/i18n": "0.2.2",
-    "@dokebi/session": "0.4.6",
-    "@dokebi/web": "0.4.6",
-    "@dokebi/websocket": "0.4.2",
-    "@dokebi/websocket-hub": "0.4.2",
+    "@dokebi/i18n": "0.2.4",
+    "@dokebi/session": "0.4.7",
+    "@dokebi/web": "0.4.7",
+    "@dokebi/websocket": "0.4.3",
+    "@dokebi/websocket-hub": "0.4.3",
     "@inertiajs/vue3": "3.9.1",
     "vue": "3.5.44"
   },