@fastang/core 0.1.0-alpha.0 → 0.1.0-alpha.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.0-alpha.1
+
+- Preserve separate Set-Cookie headers and allow explicit per-dispatch forwarding to HTML responses.
+- Keep inherited credentials out of Angular's default HTTP transfer cache.
+- Treat internal API redirects as HttpClient errors and normalize local dispatch paths.
+- Reject Set-Cookie responses during public prerendering.
+
+- Validate prerender and Vercel configuration before changing build output, including plain config exports.
+- Reject unknown options, invalid types, reserved paths and conflicting prerender destinations.
+
 ## 0.1.0-alpha.0
 
 Initial experimental release.

package/README.md

@@ -1,7 +1,7 @@
 # @fastang/core
 
 Experimental FastAng runtime and tooling for Angular + Fastify applications.
-Version 0.1.0-alpha.0 is an experimental alpha. Public APIs may change between alpha releases.
+Version 0.1.0-alpha.1 is an experimental alpha. Public APIs may change between alpha releases.
 
 The package contains compiled JavaScript and TypeScript declarations. Angular,
 Fastify, Vite and the Angular compiler are explicit peer dependencies so the app

package/dist/adapters/vercel-plan.d.ts

@@ -1,4 +1,4 @@
-import type { VercelOptions } from '../config.ts';
+import { type VercelOptions } from '../config.ts';
 import { type FileRoute } from '../routes.ts';
 export interface FunctionPlan {
     name: string;

package/dist/adapters/vercel-plan.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { mkdir, rm, writeFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
+import { validateVercelOptions } from "../config.js";
 import { discover, discoverPageTree, pageRoutesSource, renderedPageFiles } from "../routes.js";
 export const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 /** Match an entire route; parameter segments never consume a slash. */
@@ -15,15 +16,9 @@ function identifier(path) {
     return slug + '-' + createHash('sha256').update(normalized).digest('hex').slice(0, 12);
 }
 export function planVercelFunctions(pages, apis, prerendered, options = {}) {
+    validateVercelOptions(options);
     const mode = options.functions ?? 'shared';
-    if (mode !== 'shared' && mode !== 'routes')
-        throw new Error('vercel.functions must be shared or routes');
     const prefixes = [...new Set(options.pagePrefixes ?? [''])];
-    if (!prefixes.length || prefixes.some((prefix) => prefix !== '' && !/^\/(?:[\w-]+)(?:\/[\w-]+)*$/.test(prefix))) {
-        throw new Error('vercel.pagePrefixes must contain empty or absolute static prefixes without a trailing slash');
-    }
-    if (prefixes.some((prefix) => /^\/(?:api|assets|__fastang)(?:\/|$)/.test(prefix)))
-        throw new Error('Reserved Vercel page prefix');
     const functions = [
         { name: mode === 'routes' ? '__fastang/ssr' : 'ssr', kind: 'ssr', entry: 'vercel', paths: [], sources: [] },
         { name: mode === 'routes' ? '__fastang/api' : 'api', kind: 'api', entry: 'api', paths: [], sources: [] },

package/dist/angular.js

@@ -19,8 +19,12 @@ function localApiBackend() {
             if (contentType && !request.headers.has('content-type'))
                 headers['content-type'] = contentType;
             return from(context.dispatchApi(target.pathname + target.search, request.method, request.body, headers)).pipe(map((response) => {
-                const responseHeaders = new HttpHeaders(response.headers);
-                if (response.status >= 400)
+                let responseHeaders = new HttpHeaders(response.headers);
+                // Inherited credentials were invisible to the transfer-cache request check.
+                // Mark the response private so Angular's native response check excludes it.
+                if (response.credentialed)
+                    responseHeaders = responseHeaders.set('cache-control', 'private, no-store');
+                if (response.status < 200 || response.status >= 300)
                     throw new HttpErrorResponse({ status: response.status, error: response.body, headers: responseHeaders, url: request.url });
                 return new HttpResponse({ status: response.status, body: response.body, headers: responseHeaders, url: request.url });
             }));

package/dist/commands/build.js

@@ -13,22 +13,17 @@ import { build } from 'vite';
 import { loadConfigFromFile } from 'vite';
 import { prepareVercelPlan } from "../adapters/vercel-plan.js";
 import { buildVercelOutput } from "../adapters/vercel.js";
-import { staticFile } from "../server.js";
+import { staticFile } from "../static-path.js";
+import { validateConfig } from "../config.js";
 const loaded = await loadConfigFromFile({ command: 'build', mode: 'production' }, 'fastang.config.ts');
 if (!loaded)
     throw new Error('Missing fastang.config.ts');
-const config = loaded.config;
+const config = validateConfig(loaded.config);
 const vercel = process.argv.includes('--vercel');
-await rm('dist', { recursive: true, force: true });
 const paths = [...new Set(config.prerender)];
-for (const path of paths) {
-    staticFile(path);
-    if (path === '/' || path === '/api' || path.startsWith('/api/') || path.startsWith('/assets/')) {
-        throw new Error(`Percorso riservato al runtime: ${path}`);
-    }
-}
 const vercelPlan = vercel ? await prepareVercelPlan(paths, config.vercel) : undefined;
 const endpointEntries = Object.fromEntries((vercelPlan?.functions ?? []).filter((fn) => fn.entry.startsWith('endpoint-')).map((fn) => [fn.entry, `.fastang/vercel/${fn.entry}.ts`]));
+await rm('dist', { recursive: true, force: true });
 await build({ build: { outDir: 'dist/client' } });
 await build({ build: {
         outDir: 'dist/server', minify: true, ssr: vercel ? true : 'src/server/start.ts',
@@ -57,6 +52,8 @@ try {
         const response = await app.inject({ url: path });
         if (response.statusCode !== 200)
             throw new Error(`Prerender ${path}: HTTP ${response.statusCode}`);
+        if (response.headers['set-cookie'])
+            throw new Error(`Prerender ${path}: Set-Cookie is not allowed in public HTML`);
         const target = resolve('dist/client', staticFile(path));
         await mkdir(dirname(target), { recursive: true });
         await writeFile(target, response.body);

package/dist/config.d.ts

@@ -11,3 +11,7 @@ export interface FastangConfig {
     vercel?: VercelOptions;
 }
 export declare function defineConfig(config: FastangConfig): FastangConfig;
+/** Also used by the adapter when invoked without defineConfig. */
+export declare function validateVercelOptions(value: unknown): asserts value is VercelOptions;
+/** Validate plain exports too, before the build touches existing output. */
+export declare function validateConfig(value: unknown): FastangConfig;

package/dist/config.js

@@ -1,3 +1,53 @@
+import { staticFile } from "./static-path.js";
 export function defineConfig(config) {
-    return config;
+    return validateConfig(config);
+}
+function object(value, field, keys) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${field} must be an object`);
+    for (const key of Object.keys(value))
+        if (!keys.includes(key))
+            throw new Error(`Unknown ${field} option: ${key}`);
+}
+/** Also used by the adapter when invoked without defineConfig. */
+export function validateVercelOptions(value) {
+    object(value, 'vercel', ['functions', 'pagePrefixes', 'prunePages']);
+    if (value.functions !== undefined && value.functions !== 'shared' && value.functions !== 'routes')
+        throw new Error('vercel.functions must be shared or routes');
+    if (value.prunePages !== undefined && typeof value.prunePages !== 'boolean')
+        throw new Error('vercel.prunePages must be a boolean');
+    if (value.pagePrefixes !== undefined) {
+        if (!Array.isArray(value.pagePrefixes) || !value.pagePrefixes.length || value.pagePrefixes.some(prefix => typeof prefix !== 'string' || (prefix !== '' && !/^\/(?:[\w-]+)(?:\/[\w-]+)*$/.test(prefix)))) {
+            throw new Error('vercel.pagePrefixes must contain empty or absolute static prefixes without a trailing slash');
+        }
+        if (value.pagePrefixes.some(prefix => /^\/(?:api|assets|__fastang)(?:\/|$)/.test(prefix)))
+            throw new Error('Reserved Vercel page prefix');
+    }
+}
+/** Validate plain exports too, before the build touches existing output. */
+export function validateConfig(value) {
+    object(value, 'FastAng', ['prerender', 'vercel']);
+    if (!Array.isArray(value.prerender))
+        throw new Error('prerender must be an array of URL paths');
+    const targets = new Map();
+    for (const [index, path] of value.prerender.entries()) {
+        if (typeof path !== 'string')
+            throw new Error(`prerender[${index}] must be a URL path string`);
+        let target;
+        try {
+            target = staticFile(path);
+        }
+        catch {
+            throw new Error(`Invalid prerender[${index}] path: ${JSON.stringify(path)}`);
+        }
+        if (path === '/' || /^\/(?:api|assets|__fastang)(?:\/|$)/.test(path))
+            throw new Error(`Reserved prerender path: ${path}`);
+        const previous = targets.get(target);
+        if (previous !== undefined && previous !== path)
+            throw new Error(`Conflicting prerender paths: ${previous} and ${path}`);
+        targets.set(target, path);
+    }
+    if (value.vercel !== undefined)
+        validateVercelOptions(value.vercel);
+    return value;
 }

package/dist/render-context.d.ts

@@ -1,7 +1,14 @@
 export interface ApiDispatchResult {
     status: number;
     body: unknown;
-    headers: Record<string, string>;
+    /** Set-Cookie values remain separate, including Expires commas. */
+    headers: Record<string, string | string[]>;
+    /** Credentials actually sent to the internal endpoint, including inherited ones. */
+    credentialed: boolean;
+}
+export interface ApiDispatchOptions {
+    /** Append internal Set-Cookie headers to this HTML response only. Default: false. */
+    forwardSetCookie?: boolean;
 }
 export interface RenderContext {
     status: number;
@@ -9,5 +16,5 @@ export interface RenderContext {
         location: string;
         status?: 301 | 302 | 303 | 307 | 308;
     };
-    dispatchApi(path: string, method: string, body: unknown, headers: Record<string, string>): Promise<ApiDispatchResult>;
+    dispatchApi(path: string, method: string, body: unknown, headers: Record<string, string>, options?: ApiDispatchOptions): Promise<ApiDispatchResult>;
 }

package/dist/server.d.ts

@@ -1,3 +1,4 @@
+export { staticFile } from './static-path.ts';
 import { type FastifyInstance, type FastifyServerOptions } from 'fastify';
 import type { RenderContext } from './render-context.ts';
 export type Renderer = (url: string, document: string, context: RenderContext) => Promise<string>;
@@ -10,6 +11,5 @@ export interface ServerOptions {
     prerendered?: string[];
     configure?: (app: FastifyInstance) => Promise<void> | void;
 }
-export declare function staticFile(path: string): string;
 export declare function createApiServer(options?: Pick<ServerOptions, 'logger' | 'configure' | 'registerApi'>): Promise<FastifyInstance>;
 export declare function createServer(options: ServerOptions): Promise<FastifyInstance>;

package/dist/server.js

@@ -1,14 +1,10 @@
+import { staticFile } from "./static-path.js";
+export { staticFile } from "./static-path.js";
 import { createHttpServer } from "./http-server.js";
 import {} from 'fastify';
 import { readFile } from 'node:fs/promises';
 import { extname, resolve } from 'node:path';
 import { normalizeRedirectLocation } from "./redirect.js";
-export function staticFile(path) {
-    if (!path.startsWith('/') || path.includes('//') || !/^\/[a-zA-Z0-9_/-]*$/.test(path) || path.split('/').includes('..')) {
-        throw new Error(`Percorso di prerendering non supportato: ${path}`);
-    }
-    return `${path.replace(/^\/|\/$/g, '')}${path === '/' ? '' : '/'}index.html`;
-}
 export async function createApiServer(options = {}) {
     return createHttpServer({
         ...options,
@@ -42,9 +38,11 @@ export async function createServer(options) {
                 const html = await readFile(resolve(options.clientDir, staticPath), 'utf8');
                 return reply.header('x-fastang-render', 'prerender').header('cache-control', 'public, max-age=0, must-revalidate').type('text/html; charset=utf-8').send(html);
             }
+            const responseCookies = [];
             const context = {
                 status: 200,
-                async dispatchApi(path, method, body, headers) {
+                async dispatchApi(path, method, body, headers, dispatchOptions = {}) {
+                    path = normalizeRedirectLocation(path);
                     if (!path.startsWith('/api/'))
                         throw new Error('Solo API locali consentite');
                     const forwarded = {};
@@ -53,18 +51,24 @@ export async function createServer(options) {
                         if (typeof value === 'string')
                             forwarded[name] = value;
                     }
+                    const outgoing = { ...forwarded, ...(body == null ? {} : { 'content-type': 'application/json' }), ...Object.fromEntries(Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value])) };
                     const response = await app.inject({
                         method: method, url: path,
-                        headers: { ...forwarded, ...(body == null ? {} : { 'content-type': 'application/json' }), ...headers },
+                        headers: outgoing,
                         ...(body == null ? {} : { payload: typeof body === 'string' ? body : JSON.stringify(body) }),
                     });
                     const responseHeaders = {};
                     for (const [name, value] of Object.entries(response.headers)) {
                         if (value !== undefined)
-                            responseHeaders[name] = Array.isArray(value) ? value.join(', ') : String(value);
+                            responseHeaders[name] = Array.isArray(value) ? [...value] : String(value);
+                    }
+                    if (dispatchOptions.forwardSetCookie === true) {
+                        const cookies = responseHeaders['set-cookie'];
+                        if (cookies)
+                            responseCookies.push(...(Array.isArray(cookies) ? cookies : [cookies]));
                     }
                     const contentType = String(response.headers['content-type'] ?? '');
-                    return { status: response.statusCode, body: contentType.includes('json') ? response.json() : response.body, headers: responseHeaders };
+                    return { status: response.statusCode, body: contentType.includes('json') ? response.json() : response.body, headers: responseHeaders, credentialed: !!(outgoing['cookie'] || outgoing['authorization']) };
                 },
             };
             const html = await options.render(`http://fastang.local${request.url}`, await options.template(request.url), context);
@@ -72,9 +76,14 @@ export async function createServer(options) {
                 const status = context.redirect.status ?? 302;
                 if (![301, 302, 303, 307, 308].includes(status))
                     throw new Error('Stato redirect non valido');
+                const location = normalizeRedirectLocation(context.redirect.location);
+                if (responseCookies.length)
+                    reply.header('set-cookie', responseCookies);
                 return reply.header('x-fastang-render', 'redirect').header('cache-control', 'private, no-store')
-                    .redirect(normalizeRedirectLocation(context.redirect.location), status);
+                    .redirect(location, status);
             }
+            if (responseCookies.length)
+                reply.header('set-cookie', responseCookies);
             return reply.code(context.status).header('x-fastang-render', 'ssr').header('cache-control', 'private, no-store').type('text/html; charset=utf-8').send(html);
         });
         return app;

package/dist/static-path.d.ts

@@ -0,0 +1 @@
+export declare function staticFile(path: string): string;

package/dist/static-path.js

@@ -0,0 +1,6 @@
+export function staticFile(path) {
+    if (!path.startsWith('/') || path.includes('//') || !/^\/[a-zA-Z0-9_/-]*$/.test(path) || path.split('/').includes('..')) {
+        throw new Error(`Percorso di prerendering non supportato: ${path}`);
+    }
+    return `${path.replace(/^\/|\/$/g, '')}${path === '/' ? '' : '/'}index.html`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastang/core",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.1",
   "type": "module",
   "description": "Angular rendering, Fastify APIs and file-based routing.",
   "license": "MIT",