@invisibleloop/pulse 0.20.30 → 0.20.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invisibleloop/pulse",
-  "version": "0.20.30",
+  "version": "0.20.31",
   "type": "module",
   "description": "AI-first frontend framework. The spec is the source of truth.",
   "license": "MIT",

package/public/.pulse-ui-version

@@ -1 +1 @@
-0.20.30
+0.20.31

package/src/server/index.js

@@ -1235,11 +1235,13 @@ async function handleNavResponse(spec, ctx, res, dev = false) {
     storeState:  ctx.store && Object.keys(ctx.store).length > 0 ? ctx.store : undefined,
   })
 
-  res.writeHead(200, {
+  // mergeCtxHeaders so cookies/headers queued on ctx during the request (the CSRF cookie, anything a
+  // guard or fetcher sets) reach the browser on client-side navigations, not just on full page loads.
+  res.writeHead(200, mergeCtxHeaders(ctx, {
     'Content-Type':  'application/json',
     'Cache-Control': buildCacheControl(spec, dev),
     ...SECURITY_HEADERS,
-  })
+  }))
   res.end(payload)
 }
 
@@ -1252,12 +1254,15 @@ async function handleNavResponse(spec, ctx, res, dev = false) {
 async function handleNavStreamResponse(spec, ctx, req, res) {
   const meta = await resolveMeta(spec.meta, ctx)
 
-  res.writeHead(200, {
+  // Headers go out before the stream renders, so this merges what is already queued on ctx — the CSRF
+  // cookie, guard output, meta functions. A cookie set by a `server` fetcher runs later, inside the
+  // stream, and can no longer be sent; set cookies in `guard` for streamed pages.
+  res.writeHead(200, mergeCtxHeaders(ctx, {
     'Content-Type':      'application/x-ndjson',
     'Cache-Control':     'no-store',
     'X-Accel-Buffering': 'no',
     ...SECURITY_HEADERS,
-  })
+  }))
 
   const navStream = renderToNavStream(spec, ctx, meta)
   const reader    = navStream.getReader()

package/src/server/server.test.js

@@ -32,6 +32,34 @@ function assert(condition, msg) {
   if (!condition) throw new Error(msg || 'Assertion failed')
 }
 
+// Guard against a silent early exit. Production code calls process.exit() (graceful shutdown), and a
+// test that lets it through ends the whole run with status 0 — skipping every later test and hiding
+// earlier failures. The summary at the bottom sets `finished`; if the process exits without it, fail.
+let finished = false
+process.on('exit', () => {
+  if (finished) return
+  console.error(`\n  ✗ test run ended early after ${passed + failed} tests — something called process.exit() before the summary\n`)
+  process.exitCode = 1
+})
+
+/**
+ * Replace process.exit while a test runs so graceful-shutdown code can "exit" without killing the run.
+ * Returns { codes, waitForExit(ms), restore() } — always restore() in a finally.
+ */
+function captureExit() {
+  const real  = process.exit
+  const codes = []
+  let notify
+  const called = new Promise(resolve => { notify = resolve })
+  process.exit = (code = 0) => { codes.push(code); notify() }
+  return {
+    codes,
+    /** Resolves true once process.exit() has been called, false if it wasn't within `ms`. */
+    waitForExit: (ms = 2000) => Promise.race([called.then(() => true), new Promise(r => setTimeout(() => r(false), ms))]),
+    restore: () => { process.exit = real },
+  }
+}
+
 // ---------------------------------------------------------------------------
 // HTTP helpers
 // ---------------------------------------------------------------------------
@@ -1524,6 +1552,81 @@ await test('submit pages are excluded from the in-process page cache', async ()
   })
 })
 
+// Regression: the client router fetches pages with X-Pulse-Navigate and the JSON / NDJSON
+// responses used to be written without ctx's queued cookies and headers. A first-time visitor
+// who reached a form via a link got a CSRF token but never the pulse_csrf cookie it is bound
+// to, so every submit failed with "Invalid or missing CSRF token".
+console.log('\nClient-side navigation — cookies and headers set during the request\n')
+
+await test('JSON navigation response sets the CSRF cookie for a submit page', async () => {
+  await withServer([formSpec], { stream: false }, async (port) => {
+    const res = await request(port, 'GET', '/signup', { 'X-Pulse-Navigate': 'true' })
+    assert(res.headers['content-type'].includes('application/json'), `Expected JSON, got ${res.headers['content-type']}`)
+    const setCookie = [].concat(res.headers['set-cookie'] || []).find(c => c.startsWith('pulse_csrf='))
+    assert(setCookie, `Expected a pulse_csrf Set-Cookie on the navigation response, got: ${JSON.stringify(res.headers['set-cookie'])}`)
+    assert(/HttpOnly/i.test(setCookie), 'CSRF cookie must stay HttpOnly')
+  })
+})
+
+await test('a form reached via client navigation can be submitted (cookie and token pair up)', async () => {
+  await withServer([formSpec], { stream: false }, async (port) => {
+    const res    = await request(port, 'GET', '/signup', { 'X-Pulse-Navigate': 'true' })
+    const cookie = [].concat(res.headers['set-cookie'] || []).find(c => c.startsWith('pulse_csrf='))?.split(';')[0] || ''
+    const token  = JSON.parse(res.body).html.match(/name="_csrf" value="([^"]+)"/)?.[1] || ''
+    assert(cookie && token, `Expected both a cookie and a token, got cookie="${cookie}" token="${token}"`)
+    const { status, headers } = await postForm(port, '/signup', { email: 'a@b.com', _csrf: token }, cookie)
+    assert(status === 303 && headers.location === '/signup?done=1', `Expected 303 for a valid POST, got ${status}`)
+  })
+})
+
+await test('JSON navigation response carries cookies and headers set by a server fetcher', async () => {
+  const spec = {
+    route:  '/nav-ctx',
+    meta:   { title: 'Nav ctx' },
+    server: {
+      flag: async (ctx) => {
+        ctx.setCookie('seen', '1', { httpOnly: true })
+        ctx.setHeader('X-Custom', 'yes')
+        return 'ok'
+      },
+    },
+    view: (_s, srv) => `<main id="main-content">${srv.flag}</main>`,
+  }
+  await withServer([spec], { stream: false }, async (port) => {
+    const res = await request(port, 'GET', '/nav-ctx', { 'X-Pulse-Navigate': 'true' })
+    assert([].concat(res.headers['set-cookie'] || []).some(c => c.startsWith('seen=1')),
+      `Expected seen=1 cookie, got: ${JSON.stringify(res.headers['set-cookie'])}`)
+    assert(res.headers['x-custom'] === 'yes', `Expected X-Custom header, got: ${res.headers['x-custom']}`)
+    assert(res.headers['x-content-type-options'] === 'nosniff', 'Security headers must still be present')
+  })
+})
+
+await test('NDJSON (streaming) navigation response carries cookies and headers set in a guard', async () => {
+  const spec = {
+    ...deferredNavSpec,
+    route: '/deferred-nav-ctx',
+    guard: async (ctx) => {
+      ctx.setCookie('seen', '1', { httpOnly: true })
+      ctx.setHeader('X-Custom', 'yes')
+    },
+  }
+  await withServer([spec], { stream: true }, async (port) => {
+    const res = await request(port, 'GET', '/deferred-nav-ctx', { 'X-Pulse-Navigate': 'true' })
+    assert(res.headers['content-type'].includes('application/x-ndjson'), `Expected NDJSON, got ${res.headers['content-type']}`)
+    assert([].concat(res.headers['set-cookie'] || []).some(c => c.startsWith('seen=1')),
+      `Expected seen=1 cookie, got: ${JSON.stringify(res.headers['set-cookie'])}`)
+    assert(res.headers['x-custom'] === 'yes', `Expected X-Custom header, got: ${res.headers['x-custom']}`)
+    assert(res.headers['x-accel-buffering'] === 'no', 'Streaming headers must be preserved')
+  })
+})
+
+await test('navigation responses without queued cookies/headers are unchanged', async () => {
+  await withServer([helloSpec], { stream: false }, async (port) => {
+    const res = await request(port, 'GET', '/hello', { 'X-Pulse-Navigate': 'true' })
+    assert(res.status === 200 && res.headers['set-cookie'] === undefined, `Unexpected Set-Cookie: ${res.headers['set-cookie']}`)
+  })
+})
+
 // ---------------------------------------------------------------------------
 
 console.log('\nDeclarative redirects\n')
@@ -2140,31 +2243,49 @@ await test('shutdown() is returned from createServer', async () => {
   await new Promise(resolve => result.server.close(resolve))
 })
 
+// shutdown() ends with server.close(() => process.exit(0)). That is right for production, but in a
+// test it would terminate the whole run, so each of these tests stubs process.exit (captureExit) and
+// waits for the stub to be hit before restoring it.
 await test('shutdown() stops the server from accepting new connections', async () => {
-  const port = nextPort++
-  const { server, shutdown } = await createServer([helloSpec], { port, stream: false })
-  await new Promise(resolve => server.once('listening', resolve))
+  const exit = captureExit()
+  try {
+    const port = nextPort++
+    const { server, shutdown } = await createServer([helloSpec], { port, stream: false })
+    await new Promise(resolve => server.once('listening', resolve))
 
-  // Confirm server is up
-  const before = await get(port, '/hello')
-  assert(before.status === 200, `Expected 200 before shutdown, got ${before.status}`)
+    // Confirm server is up
+    const before = await get(port, '/hello')
+    assert(before.status === 200, `Expected 200 before shutdown, got ${before.status}`)
 
-  shutdown()
+    shutdown()
 
-  // Server should no longer accept connections
-  await new Promise(resolve => setTimeout(resolve, 20))
-  let refused = false
-  try { await get(port, '/hello') } catch { refused = true }
-  assert(refused, 'Expected connection to be refused after shutdown()')
+    // Server should no longer accept connections
+    await new Promise(resolve => setTimeout(resolve, 20))
+    let refused = false
+    try { await get(port, '/hello') } catch { refused = true }
+    assert(refused, 'Expected connection to be refused after shutdown()')
+
+    assert(await exit.waitForExit(), 'Expected process.exit() once all connections closed')
+    assert(exit.codes.length === 1 && exit.codes[0] === 0, `Expected a single clean exit(0), got ${JSON.stringify(exit.codes)}`)
+  } finally {
+    exit.restore()
+  }
 })
 
 await test('shutdown() is idempotent — calling twice does not throw', async () => {
-  const port = nextPort++
-  const { server, shutdown } = await createServer([helloSpec], { port, stream: false })
-  await new Promise(resolve => server.once('listening', resolve))
-  shutdown()
-  shutdown() // second call is a no-op
-  await new Promise(resolve => setTimeout(resolve, 20))
+  const exit = captureExit()
+  try {
+    const port = nextPort++
+    const { server, shutdown } = await createServer([helloSpec], { port, stream: false })
+    await new Promise(resolve => server.once('listening', resolve))
+    shutdown()
+    shutdown() // second call is a no-op
+    assert(await exit.waitForExit(), 'Expected process.exit() once the server closed')
+    await new Promise(resolve => setTimeout(resolve, 20))
+    assert(exit.codes.length === 1, `Expected exactly one exit from two shutdown() calls, got ${JSON.stringify(exit.codes)}`)
+  } finally {
+    exit.restore()
+  }
 })
 
 await test('in-flight request completes after shutdown() is called', async () => {
@@ -2179,22 +2300,33 @@ await test('in-flight request completes after shutdown() is called', async () =>
     view: (_s, server) => `<p>${server.data}</p>`
   }
 
-  const { server, shutdown } = await createServer([slowSpec], { port, stream: false })
-  await new Promise(resolve => server.once('listening', resolve))
+  const exit = captureExit()
+  try {
+    const { server, shutdown } = await createServer([slowSpec], { port, stream: false })
+    await new Promise(resolve => server.once('listening', resolve))
 
-  // Start a request but don't resolve its server fetch yet
-  const pending = get(port, '/slow')
+    // Start a request but don't resolve its server fetch yet
+    const pending = get(port, '/slow')
 
-  // Small delay to ensure the request is in flight before shutdown
-  await new Promise(resolve => setTimeout(resolve, 20))
+    // Small delay to ensure the request is in flight before shutdown
+    await new Promise(resolve => setTimeout(resolve, 20))
 
-  shutdown()
+    shutdown()
 
-  // Now resolve the slow fetch — the response should still complete
-  resolveSlowFetch()
-  const { status, body } = await pending
-  assert(status === 200, `Expected 200, got ${status}`)
-  assert(body.includes('<p>done</p>'), `Expected response body, got: ${body}`)
+    // The process must wait for the in-flight request before exiting
+    assert(exit.codes.length === 0, 'Must not exit while a request is still in flight')
+
+    // Now resolve the slow fetch — the response should still complete
+    resolveSlowFetch()
+    const { status, body } = await pending
+    assert(status === 200, `Expected 200, got ${status}`)
+    assert(body.includes('<p>done</p>'), `Expected response body, got: ${body}`)
+
+    assert(await exit.waitForExit(), 'Expected process.exit() once the in-flight request finished')
+    assert(exit.codes[0] === 0, `Expected exit(0), got ${JSON.stringify(exit.codes)}`)
+  } finally {
+    exit.restore()
+  }
 })
 
 // ---------------------------------------------------------------------------
@@ -2313,4 +2445,5 @@ await test('ctx.formData() still handles URL-encoded body correctly', async () =
 // ---------------------------------------------------------------------------
 
 console.log(`\n${passed + failed} tests: ${passed} passed, ${failed} failed\n`)
+finished = true
 if (failed > 0) process.exit(1)