@ilha/router 0.9.0 → 0.9.2

package/dist/{plugin-DPGzrIVj.js → plugin-BHuojFhQ.js}

@@ -1,5 +1,5 @@
-import { t as runWithIslandRequest } from "./request-scope-D6_4rqMb.js";
-import { FrameError, getFrameGuard, renderServerIsland, setFrameGuard } from "./server-island-registry.js";
+import { t as runWithIslandRequest } from "./request-scope-C4reU4v0.js";
+import { FrameError, getFrameAuth, getFrameGuard, isTrustedOrigin, renderServerIsland, setFrameAuth, setFrameGuard, setLoaderGuard } from "./server-island-registry.js";
 import { existsSync, readFileSync, statSync, watch } from "node:fs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
 import { createUnplugin } from "unplugin";
@@ -472,7 +472,7 @@ function buildServerFile(entries, serverFile) {
 		`// Import via: import { pageRouter, registry } from "ilha:pages/server";`,
 		``,
 		...imports,
-		...entries.some((e) => e.hasLoader || e.loaderLayouts.length > 0) ? [`import { setFrameLoaderRunner } from "@ilha/router/server-island-registry";`, `setFrameLoaderRunner((path) => pageRouter.runLoader(path));`] : [],
+		...entries.some((e) => e.hasLoader || e.loaderLayouts.length > 0) ? [`import { setFrameLoaderRunner } from "@ilha/router/server-island-registry";`, `setFrameLoaderRunner((path, request) => pageRouter.runLoader(path, request));`] : [],
 		``,
 		...wrappedIslandLines,
 		``,
@@ -989,6 +989,12 @@ const pagesFactory = (options = {}) => {
 			configureServer(server) {
 				server.watcher.add(state.pagesDir);
 				if (options.frameGuard) setFrameGuard(options.frameGuard);
+				if (options.loaderGuard) setLoaderGuard(options.loaderGuard);
+				if (options.trustedOrigins || options.csrf) setFrameAuth({
+					trustedOrigins: options.trustedOrigins,
+					csrf: options.csrf,
+					defaultAction: "open"
+				});
 				server.middlewares.use(async (req, res, next) => {
 					if ((req.url ?? "").split("?")[0] !== "/__ilha/frame") return next();
 					if (req.method !== "POST") {
@@ -1001,19 +1007,24 @@ const pagesFactory = (options = {}) => {
 						res.end();
 						return;
 					}
+					const guardHeaders = new Headers();
+					if (req.headers.origin) guardHeaders.set("origin", String(req.headers.origin));
+					if (req.headers.host) guardHeaders.set("host", String(req.headers.host));
+					if (!isTrustedOrigin(new Request(`http://${req.headers.host ?? "localhost"}${req.url ?? "/"}`, { headers: guardHeaders }), getFrameAuth())) {
+						console.warn(`[ilha-router] dev frame request rejected: Origin ${String(req.headers.origin)} is not trusted (host: ${String(req.headers.host ?? "localhost")}). Configure trustedOrigins via IlhaPagesOptions if this origin is expected.`);
+						res.statusCode = 403;
+						res.end();
+						return;
+					}
+					const identityHeaders = new Headers();
+					for (const name of ["cookie", "authorization"]) {
+						const v = req.headers[name];
+						if (typeof v === "string") identityHeaders.set(name, v);
+					}
 					try {
-						const guardHeaders = new Headers();
-						for (const name of [
-							"cookie",
-							"authorization",
-							"x-forwarded-for"
-						]) {
-							const v = req.headers[name];
-							if (typeof v === "string") guardHeaders.set(name, v);
-						}
 						const denied = await getFrameGuard()?.(new Request(`http://${req.headers.host ?? "localhost"}${req.url ?? "/"}`, {
 							method: req.method,
-							headers: guardHeaders
+							headers: identityHeaders
 						}));
 						if (denied) {
 							res.statusCode = denied.status;
@@ -1026,9 +1037,17 @@ const pagesFactory = (options = {}) => {
 						res.end();
 						return;
 					}
-					const origin = req.headers.origin;
-					const host = req.headers.host;
-					if (origin && origin !== `http://${host}` && origin !== `https://${host}`) {
+					const csrf = getFrameAuth()?.csrf;
+					if (csrf) try {
+						if (!await csrf(new Request(`http://${req.headers.host ?? "localhost"}${req.url ?? "/"}`, {
+							method: req.method,
+							headers: identityHeaders
+						}))) {
+							res.statusCode = 403;
+							res.end();
+							return;
+						}
+					} catch {
 						res.statusCode = 403;
 						res.end();
 						return;
@@ -1049,15 +1068,14 @@ const pagesFactory = (options = {}) => {
 						const target = serverIslands.get(body.id ?? "");
 						if (!target) throw new Error("unknown island");
 						let framePath = "/__ilha/frame";
-						if (typeof body.path === "string" && body.path.startsWith("/") && !body.path.includes("//") && body.path.length <= 2048) framePath = body.path;
+						if (typeof body.path === "string" && body.path.startsWith("/") && !body.path.includes("//") && !body.path.includes("\\") && body.path.length <= 2048) framePath = body.path;
 						await server.ssrLoadModule(VIRTUAL_PAGES_SERVER);
 						if (typeof (await server.ssrLoadModule(target.file))[target.name]?.[Symbol.for("ilha.renderState")] !== "function") throw new Error("unknown island");
 						const headers = new Headers();
 						for (const name of [
 							"cookie",
 							"authorization",
-							"user-agent",
-							"x-forwarded-for"
+							"user-agent"
 						]) {
 							const value = req.headers[name];
 							if (typeof value === "string") headers.set(name, value);

package/dist/plugin.d.ts

@@ -36,6 +36,23 @@ export interface IlhaPagesOptions {
      * `setFrameGuard()` from `@ilha/router/server-island-registry`.
      */
     frameGuard?: (request: Request) => Response | void | Promise<Response | void>;
+    /**
+     * Guard consulted only by `GET /__ilha/loader` in production. When absent,
+     * the loader endpoint falls back to the frame guard for backwards
+     * compatibility. Mirrors `setLoaderGuard()`.
+     */
+    loaderGuard?: (request: Request) => Response | void | Promise<Response | void>;
+    /**
+     * Explicit trusted origins for frame/loader requests (e.g. a `.vercel.app`
+     * or custom domain). When unset, origin checks compare the `Origin` header
+     * against the request's own `Host`. Mirrors `setFrameAuth({ trustedOrigins })`.
+     */
+    trustedOrigins?: string[];
+    /**
+     * Optional CSRF verifier for the state-changing `/__ilha/frame` POST.
+     * Mirrors `setFrameAuth({ csrf })`.
+     */
+    csrf?: (request: Request) => boolean | Promise<boolean>;
     /**
      * Fail codegen on duplicate route patterns / registry name collisions
      * instead of warning. Recommended for CI/production builds. Default: `false`.

package/dist/public-types.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Compile-time type anchors for the router API. Every imperative call lives
+ * inside this never-invoked function so module scope has NO side effects:
+ * `router()` resets the module-global route registry, which must not happen
+ * at import time (tsconfig.build emits declarations for these anchors only).
+ */
+export declare function typecheckRouterApi(): void;

package/dist/{request-scope-D6_4rqMb.js → request-scope-C4reU4v0.js}

@@ -8,7 +8,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 * page SSR through the router, or streamed frames through the plugin's
 * `/__ilha/frame` endpoint. Both seed this scope with the originating
 * `Request`, so render functions can read request data (URL, headers,
-* cookies) without depending on Oxide's action-only `useRequest()`.
+* cookies) through `useContext().request` or a host integration such as Oxide's `useRequest()`.
 *
 * The storage lives on `globalThis` under `ilha.requestAls` so every module
 * copy (plugin bundle, SSR graph) shares one instance. The public accessor
@@ -17,10 +17,17 @@ import { AsyncLocalStorage } from "node:async_hooks";
 * sole place that constructs it.
 */
 const REQUEST_ALS_KEY = Symbol.for("ilha.requestAls");
-/** Run `fn` with `request` available to `useContext().request`. */
+/** Installed by oxidejs when its module loads. Lets `useRequest()` resolve
+* inside island renders and frames, not just `/__oxide/action`. */
+const OXIDE_RUN_WITH_REQUEST = Symbol.for("oxidejs.runWithRequest");
+/** Run `fn` with `request` available to `useContext().request`. When oxidejs
+* is loaded, its action scope is entered too, so `useRequest()` works in
+* island renders and streamed frames. */
 function runWithIslandRequest(request, fn) {
 	const g = globalThis;
-	return (g[REQUEST_ALS_KEY] ??= new AsyncLocalStorage()).run(request, fn);
+	const als = g[REQUEST_ALS_KEY] ??= new AsyncLocalStorage();
+	const oxide = g[OXIDE_RUN_WITH_REQUEST];
+	return als.run(request, () => oxide ? oxide(request, fn) : fn());
 }
 
 //#endregion

package/dist/request-scope.d.ts

@@ -5,7 +5,7 @@
  * page SSR through the router, or streamed frames through the plugin's
  * `/__ilha/frame` endpoint. Both seed this scope with the originating
  * `Request`, so render functions can read request data (URL, headers,
- * cookies) without depending on Oxide's action-only `useRequest()`.
+ * cookies) through `useContext().request` or a host integration such as Oxide's `useRequest()`.
  *
  * The storage lives on `globalThis` under `ilha.requestAls` so every module
  * copy (plugin bundle, SSR graph) shares one instance. The public accessor
@@ -15,6 +15,8 @@
  */
 import type { IslandContext } from "./index";
 export declare const REQUEST_ALS_KEY: unique symbol;
-/** Run `fn` with `request` available to `useContext().request`. */
+/** Run `fn` with `request` available to `useContext().request`. When oxidejs
+ * is loaded, its action scope is entered too, so `useRequest()` works in
+ * island renders and streamed frames. */
 export declare function runWithIslandRequest<T>(request: Request, fn: () => T): T;
 export type { IslandContext };

package/dist/rolldown.d.ts

@@ -2,5 +2,5 @@ export type { LayoutHandler, ErrorHandler, RouteSnapshot, AppError } from "./ind
 export { ilhaPages, type IlhaPagesOptions } from "./plugin";
 import { type IlhaPagesOptions } from "./plugin";
 /** Rolldown plugin — use via `@ilha/router/rolldown`. */
-export declare function pages(options?: IlhaPagesOptions): import("unplugin").RolldownPlugin<any> | import("unplugin").RolldownPlugin<any>[];
+export declare function pages(options?: IlhaPagesOptions): import("rolldown").Plugin<any> | import("rolldown").Plugin<any>[];
 export default pages;

package/dist/rolldown.js

@@ -1,4 +1,4 @@
-import { t as ilhaPages } from "./plugin-DPGzrIVj.js";
+import { t as ilhaPages } from "./plugin-BHuojFhQ.js";
 
 //#region src/rolldown.ts
 /** Rolldown plugin — use via `@ilha/router/rolldown`. */

package/dist/route-match.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared, decoded-aware route pattern matching used by both the router
+ * (`index.ts`) and the server-frame path (`server-island-registry.ts`) so the
+ * two never drift on segment semantics or parameter decoding.
+ *
+ * Patterns support `:name` segments, a bare mid-pattern `*` (one segment), and
+ * a trailing `/**:name` catch-all. Static segments take priority over params,
+ * which take priority over catch-alls — callers sort by that before matching.
+ */
+export interface ParsedPattern {
+    segments: string[];
+    kinds: number[];
+}
+export declare function parsePattern(pattern: string): ParsedPattern;
+/**
+ * Match `segments` against a pathname. Returns raw (still-encoded) captured
+ * params, or `null` when the path doesn't match — the caller decides whether to
+ * decode via {@link safeDecode}.
+ */
+export declare function matchSegments(segments: string[], pathname: string): Record<string, string> | null;
+/** Decode a route-param value, tolerating malformed percent-encoding. */
+export declare function safeDecode(value: string): string;

package/dist/rspack.js

@@ -1,4 +1,4 @@
-import { t as ilhaPages } from "./plugin-DPGzrIVj.js";
+import { t as ilhaPages } from "./plugin-BHuojFhQ.js";
 
 //#region src/rspack.ts
 /** Rspack plugin — use via `@ilha/router/rspack`. */

package/dist/server-island-registry.d.ts

@@ -38,7 +38,52 @@ export type FrameGuard = (request: Request) => Response | void | Promise<Respons
  */
 export declare function setFrameGuard(guard: FrameGuard): void;
 export declare function getFrameGuard(): FrameGuard | undefined;
-export type FrameLoaderRunner = (path: string) => Promise<{
+/**
+ * Install a guard consulted only by `GET /__ilha/loader`. When absent, the
+ * loader endpoint falls back to `getFrameGuard()` for backwards compatibility.
+ * Prefer a dedicated loader guard so gating the loader endpoint is independent
+ * of frame rendering.
+ */
+export declare function setLoaderGuard(guard: FrameGuard): void;
+export declare function getLoaderGuard(): FrameGuard | undefined;
+/** Frame-authorization policy, installed via {@link setFrameAuth}. */
+export interface FrameAuthPolicy {
+    /**
+     * Action taken when no frame guard is registered. `"deny"` (default in the
+     * production handler) rejects every `/__ilha/frame` request with 403;
+     * `"open"` preserves the legacy unauthenticated behavior. The dev
+     * middleware stays permissive unless a guard is registered.
+     */
+    defaultAction?: "open" | "deny";
+    /**
+     * Explicit trusted origins (e.g. `"https://app.example.com"`). When set,
+     * origin checks accept only these; otherwise the check compares the `Origin`
+     * header against `https://{host}` / `http://{host}`.
+     */
+    trustedOrigins?: string[];
+    /**
+     * Optional CSRF verifier for the state-changing frame POST. Receives the
+     * original `Request`; returning falsy rejects the request. Use this for
+     * server-to-server frame callers that have no browser `Origin`.
+     */
+    csrf?: (request: Request) => boolean | Promise<boolean>;
+}
+/**
+ * Install the frame-authorization policy consumed by the production
+ * `@ilha/router/ssr` handler. `trustedOrigins` and `csrf` are also applied by
+ * the dev middleware (via `IlhaPagesOptions`).
+ */
+export declare function setFrameAuth(policy: FrameAuthPolicy): void;
+export declare function getFrameAuth(): FrameAuthPolicy | undefined;
+/**
+ * Same-origin check for frame/loader requests. Browsers always send `Origin`
+ * on cross-origin and same-origin `POST`; its absence implies a non-browser
+ * caller (allowed — gate those via a guard or `csrf`). When `Origin` is
+ * present it must match the configured trusted origins, else the request's
+ * own `Host`.
+ */
+export declare function isTrustedOrigin(request: Request, policy: FrameAuthPolicy | undefined): boolean;
+export type FrameLoaderRunner = (path: string, request?: Request) => Promise<{
     kind: string;
     data?: unknown;
     headEntries?: unknown;

package/dist/server-island-registry.js

@@ -1,4 +1,18 @@
+import { F as parsePattern, I as safeDecode, P as matchSegments, S as resolveRedirectTarget } from "./src-BBsbD5vU.js";
+
 //#region src/server-island-registry.ts
+/**
+* Process-global registry of server-island renderers, keyed by the public
+* island id (`sha256(file#name)`, see `serverIslandPublicId`). Lives on
+* `globalThis` so every module copy (plugin bundle, SSR graph, frame entry)
+* shares one instance — same pattern as `request-scope.ts`.
+*
+* `.server` modules self-register when the plugin appends registration code
+* to their server-graph copy; the production `/__ilha/frame` handler (see
+* `@ilha/router/frame`) consumes the registry to re-render an island from a
+* client state snapshot. Server pages additionally register their `load` and
+* route pattern so frame handlers can run the loader with matched params.
+*/
 const REGISTRY_KEY = Symbol.for("ilha.serverIslandRenderers");
 function registry() {
 	const g = globalThis;
@@ -24,6 +38,58 @@ function setFrameGuard(guard) {
 function getFrameGuard() {
 	return globalThis[GUARD_KEY];
 }
+const LOADER_GUARD_KEY = Symbol.for("ilha.loaderGuard");
+/**
+* Install a guard consulted only by `GET /__ilha/loader`. When absent, the
+* loader endpoint falls back to `getFrameGuard()` for backwards compatibility.
+* Prefer a dedicated loader guard so gating the loader endpoint is independent
+* of frame rendering.
+*/
+function setLoaderGuard(guard) {
+	const g = globalThis;
+	g[LOADER_GUARD_KEY] = guard;
+}
+function getLoaderGuard() {
+	return globalThis[LOADER_GUARD_KEY];
+}
+const AUTH_KEY = Symbol.for("ilha.frameAuth");
+/**
+* Install the frame-authorization policy consumed by the production
+* `@ilha/router/ssr` handler. `trustedOrigins` and `csrf` are also applied by
+* the dev middleware (via `IlhaPagesOptions`).
+*/
+function setFrameAuth(policy) {
+	const g = globalThis;
+	g[AUTH_KEY] = policy;
+}
+function getFrameAuth() {
+	return globalThis[AUTH_KEY];
+}
+function normalizeOrigin(value) {
+	try {
+		return new URL(value).origin;
+	} catch {
+		return null;
+	}
+}
+/**
+* Same-origin check for frame/loader requests. Browsers always send `Origin`
+* on cross-origin and same-origin `POST`; its absence implies a non-browser
+* caller (allowed — gate those via a guard or `csrf`). When `Origin` is
+* present it must match the configured trusted origins, else the request's
+* own `Host`.
+*/
+function isTrustedOrigin(request, policy) {
+	const originHeader = request.headers.get("origin");
+	if (originHeader === null) return true;
+	const origin = normalizeOrigin(originHeader);
+	if (origin === null) return false;
+	const trusted = policy?.trustedOrigins ?? [];
+	if (trusted.length > 0) return trusted.some((o) => normalizeOrigin(o) === origin);
+	const host = request.headers.get("host");
+	if (!host) return false;
+	return origin === `https://${host}` || origin === `http://${host}`;
+}
 const LOADER_RUNNER_KEY = Symbol.for("ilha.frameLoaderRunner");
 /**
 * Install the handler backing `GET /__ilha/loader` in production. The
@@ -62,27 +128,14 @@ var FrameError = class extends Error {
 	}
 };
 /** Match a route pattern (`/user/:id`, `/docs/**:slug`) against a pathname.
-* Returns raw (still-encoded) params, or null when the path doesn't match.
-* Mirrors the router's matcher semantics in miniature. */
+* Returns decoded params, or null when the path doesn't match. Shares the
+* router's matcher semantics via `route-match.ts`. */
 function matchPatternParams(pattern, pathname) {
-	const patternSegments = pattern.split("/").filter(Boolean);
-	const pathSegments = pathname.split("/").filter(Boolean);
+	const raw = matchSegments(parsePattern(pattern).segments, pathname);
+	if (!raw) return null;
 	const params = {};
-	let cursor = 0;
-	for (const segment of patternSegments) {
-		if (segment.startsWith("*")) {
-			const name = segment.slice(2).replace(/^:/, "");
-			if (name) params[name] = pathSegments.slice(cursor).join("/");
-			cursor = pathSegments.length;
-			break;
-		}
-		const value = pathSegments[cursor];
-		if (value === void 0) return null;
-		if (segment.startsWith(":")) params[segment.slice(1)] = value;
-		else if (value !== segment) return null;
-		cursor++;
-	}
-	return cursor === pathSegments.length ? params : null;
+	for (const [k, v] of Object.entries(raw)) params[k] = safeDecode(v);
+	return params;
 }
 /**
 * Shared tail of every frame request: run the page's `load` when registered
@@ -104,17 +157,23 @@ async function renderServerIsland(id, request, runWithScope) {
 		const params = entry.pattern ? matchPatternParams(entry.pattern, url.pathname) : {};
 		if (!params) throw new FrameError(400, "frame failed");
 		try {
-			props = await entry.load({
-				params,
-				request,
-				url,
-				signal: request.signal
-			});
+			props = { load: {
+				loading: false,
+				value: await entry.load({
+					params,
+					request,
+					url,
+					signal: request.signal
+				}) ?? {},
+				error: void 0
+			} };
 		} catch (error) {
 			const marker = error;
 			if (marker.__ilhaRedirect === true) {
 				const r = error;
-				throw new FrameError(r.status || 302, "frame failed", r.to);
+				const safe = resolveRedirectTarget(r.to, url, false);
+				if (!safe.ok) throw new FrameError(500, "unsafe redirect target");
+				throw new FrameError(r.status || 302, "frame failed", safe.to);
 			}
 			if (marker.__ilhaLoaderError === true) throw new FrameError(error.status || 500, "frame failed");
 			throw error;
@@ -127,4 +186,4 @@ async function renderServerIsland(id, request, runWithScope) {
 }
 
 //#endregion
-export { FrameError, getFrameGuard, getFrameLoaderRunner, getServerIslandEntry, getServerIslandRenderer, registerServerIsland, renderServerIsland, setFrameGuard, setFrameLoaderRunner };
+export { FrameError, getFrameAuth, getFrameGuard, getFrameLoaderRunner, getLoaderGuard, getServerIslandEntry, getServerIslandRenderer, isTrustedOrigin, registerServerIsland, renderServerIsland, setFrameAuth, setFrameGuard, setFrameLoaderRunner, setLoaderGuard };