@lovrozagar/flare 0.1.2 → 0.2.1

package/src/server-fn/get-input.ts

@@ -0,0 +1,90 @@
+/**
+ * GET server-fn input codec. Client-safe (no node:async_hooks).
+ *
+ * Nested objects/arrays JSON-encode so they do not become `[object Object]`.
+ * Primitive arrays use repeated keys (`tag=a&tag=b`) to match the existing
+ * multi-value GET parser. Strings that look like JSON literals are quoted so
+ * `{ id: "42" }` and `{ id: 42 }` round-trip as distinct values.
+ */
+
+function isPrimitive(value: unknown): value is boolean | number | string | null {
+	return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+
+/** Query tokens that JSON.parse would accept — quote strings that collide with these. */
+function isJsonLiteralToken(val: string): boolean {
+	if (val === "true" || val === "false" || val === "null") return true;
+	if (val.length >= 2 && val.startsWith('"') && val.endsWith('"')) return true;
+	if ((val.startsWith("{") && val.endsWith("}")) || (val.startsWith("[") && val.endsWith("]"))) return true;
+	return /^-?\d+(\.\d+)?([eE][+-]?\d+)?$/.test(val);
+}
+
+function encodeGetPrimitive(value: boolean | number | string | null): string {
+	if (typeof value === "string") return isJsonLiteralToken(value) ? JSON.stringify(value) : value;
+	return JSON.stringify(value);
+}
+
+function appendGetParam(params: URLSearchParams, key: string, value: unknown): void {
+	if (value === undefined) return;
+	if (isPrimitive(value)) {
+		params.append(key, encodeGetPrimitive(value));
+		return;
+	}
+	if (Array.isArray(value) && value.length === 0) {
+		params.append(key, "[]");
+		return;
+	}
+	if (Array.isArray(value) && value.every(isPrimitive)) {
+		for (const item of value) {
+			params.append(key, encodeGetPrimitive(item));
+		}
+		return;
+	}
+	params.append(key, JSON.stringify(value));
+}
+
+export function serializeGetInput(input: unknown): string {
+	if (input === undefined || input === null) return "";
+	if (typeof input !== "object" || Array.isArray(input)) {
+		const params = new URLSearchParams();
+		appendGetParam(params, "value", input);
+		return params.toString();
+	}
+	const params = new URLSearchParams();
+	for (const [key, value] of Object.entries(input as Record<string, unknown>)) {
+		appendGetParam(params, key, value);
+	}
+	return params.toString();
+}
+
+export function serverFnGetUrl(path: string, input: unknown): string {
+	if (input === undefined) return path;
+	const qs = serializeGetInput(input);
+	return qs.length > 0 ? `${path}?${qs}` : path;
+}
+
+function parseGetValue(val: string): unknown {
+	if (!isJsonLiteralToken(val)) return val;
+	try {
+		return JSON.parse(val) as unknown;
+	} catch {
+		return val;
+	}
+}
+
+export function parseGetSearchParams(searchParams: URLSearchParams): Record<string, unknown> | undefined {
+	const obj: Record<string, unknown> = Object.create(null);
+	let hasParams = false;
+	for (const [key, val] of searchParams) {
+		if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+		hasParams = true;
+		const parsed = parseGetValue(val);
+		const existing = obj[key];
+		if (existing !== undefined) {
+			obj[key] = Array.isArray(existing) ? [...(existing as unknown[]), parsed] : [existing, parsed];
+		} else {
+			obj[key] = parsed;
+		}
+	}
+	return hasParams ? obj : undefined;
+}

package/src/server-fn/http-error.ts

@@ -0,0 +1,13 @@
+import { type FlattenedError, ServerFnValidationError } from "../errors/index.ts";
+
+/** Map a failed server-fn HTTP body to the same error the server module throws. */
+export function throwServerFnHttpError(body: unknown, status: number, name: string): never {
+	if (typeof body === "object" && body !== null && "errors" in body) {
+		throw new ServerFnValidationError((body as { errors: FlattenedError }).errors);
+	}
+	const errMsg =
+		typeof body === "object" && body !== null && "message" in body
+			? String((body as Record<string, unknown>).message)
+			: `Request failed (${status})`;
+	throw new Error(`Server function "${name}" failed: ${errMsg}`);
+}

package/src/server-fn/index.ts

@@ -1,12 +1,13 @@
-import type { FlattenedError } from "../errors/index.ts";
+import { FORM_FN_FIELD, parseServerFnPathname, serverFnPath } from "../protocol.ts";
 import {
 	isNotFoundError,
 	isRedirectResponse,
 	isServerFnValidationError,
 	isUnauthenticatedError,
 	isUnauthorizedError,
-	ServerFnValidationError,
 } from "../errors/index.ts";
+import { parseGetSearchParams, serverFnGetUrl } from "./get-input.ts";
+import { throwServerFnHttpError } from "./http-error.ts";
 import type { RevalidateFn, RevalidateOptions } from "../revalidation/index.ts";
 import { createRevalidateFn } from "../revalidation/index.ts";
 /* package self-reference: routes through `exports.browser` -> stub on client, real on server.
@@ -284,22 +285,79 @@ function jsonResponse(data: unknown, status: number): Response {
 	});
 }
 
+/** Max POST body for `/_flare/server-fn/*` (JSON or form). */
+export const SERVER_FN_MAX_BODY_BYTES = 1_048_576;
+
+export async function readLimitedBody(
+	request: Request,
+	maxBytes: number,
+): Promise<{ bytes: ArrayBuffer } | { error: Response }> {
+	const declared = Number(request.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared > maxBytes) {
+		return { error: jsonResponse({ message: "Payload too large" }, 413) };
+	}
+
+	const stream = request.body;
+	if (!stream) {
+		return { bytes: new ArrayBuffer(0) };
+	}
+
+	const reader = stream.getReader();
+	const chunks: Uint8Array[] = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		if (!value) continue;
+		size += value.byteLength;
+		if (size > maxBytes) {
+			await reader.cancel().catch(() => {});
+			return { error: jsonResponse({ message: "Payload too large" }, 413) };
+		}
+		chunks.push(value);
+	}
+
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return { bytes: bytes.buffer };
+}
+
 /* ── CSRF Origin validation ────────────────────────────────────────── */
 
+const ALLOWED_FETCH_SITES = new Set(["none", "same-origin", "same-site"]);
+
 /**
- * Validate that the request Origin header matches the request URL origin.
- * Browsers always send Origin on POST; some browsers omit it on GET.
- * When Origin is present (any method), validate it — cross-origin GET
- * server function calls are just as dangerous as POST for CSRF.
- * Missing Origin is allowed since CSRF is a browser-only attack vector
- * and non-browser clients (curl, etc) won't have cookies.
+ * CSRF: Origin when present (any method), else Sec-Fetch-Site, else Referer.
+ * Top-level GET navigations omit Origin; SameSite=Lax still sends cookies.
+ * Missing all three is allowed for non-browser clients (curl, server-to-server).
  */
 function validateOrigin(request: Request): boolean {
+	const requestOrigin = new URL(request.url).origin;
+
 	const origin = request.headers.get("origin");
-	if (!origin) return true;
+	if (origin !== null) {
+		return origin === requestOrigin;
+	}
 
-	const requestOrigin = new URL(request.url).origin;
-	return origin === requestOrigin;
+	const site = request.headers.get("sec-fetch-site");
+	if (site !== null) {
+		return ALLOWED_FETCH_SITES.has(site);
+	}
+
+	const referer = request.headers.get("referer");
+	if (referer !== null) {
+		try {
+			return new URL(referer).origin === requestOrigin;
+		} catch {
+			return false;
+		}
+	}
+
+	return true;
 }
 
 /* ── formDataToObject ───────────────────────────────────────────────── */
@@ -307,7 +365,7 @@ function validateOrigin(request: Request): boolean {
 export function formDataToObject(formData: FormData): Record<string, File | string | string[]> {
 	const obj: Record<string, File | string | string[]> = Object.create(null);
 	for (const [key, val] of formData) {
-		if (key === "__flare_fn" || key === "__proto__" || key === "constructor" || key === "prototype") continue;
+		if (key === FORM_FN_FIELD || key === "__proto__" || key === "constructor" || key === "prototype") continue;
 		if (val instanceof File) {
 			obj[key] = val;
 			continue;
@@ -330,20 +388,14 @@ export async function handleServerFnRequest(
 	fns: Map<string, ServerFnRegistration>,
 	authenticateFn?: (env: unknown, request: Request) => unknown | Promise<unknown>,
 ): Promise<Response> {
-	/* parse URL: /_fn/{id}/{name} */
+	/* parse URL: /_flare/server-fn/{id}/{name} */
 	const url = new URL(request.url);
-	const segments = url.pathname.split("/").filter(Boolean);
-	/* segments: ["_fn", id, name] */
-	if (segments.length < 3 || segments[0] !== "_fn") {
+	const parsed = parseServerFnPathname(url.pathname);
+	if (!parsed) {
 		return jsonResponse({ message: "Server function not found" }, 404);
 	}
 
-	const id = segments[1];
-	const name = segments[2];
-
-	if (!id || !name) {
-		return jsonResponse({ message: "Server function not found" }, 404);
-	}
+	const { id, name } = parsed;
 
 	/* CSRF: validate Origin before any processing */
 	if (!validateOrigin(request)) {
@@ -377,36 +429,26 @@ export async function handleServerFnRequest(
 		/* parse input — FormData for form submissions, JSON for programmatic calls */
 		let input: unknown;
 		if (registration.method === "post") {
+			const limited = await readLimitedBody(request, SERVER_FN_MAX_BODY_BYTES);
+			if ("error" in limited) return limited.error;
 			const contentType = request.headers.get("content-type") ?? "";
 			if (contentType.includes("multipart/form-data") || contentType.includes("x-www-form-urlencoded")) {
-				input = formDataToObject(await request.formData());
-			} else {
-				const text = await request.text();
-				if (text) {
-					try {
-						input = JSON.parse(text);
-					} catch {
-						return jsonResponse({ message: "Invalid JSON" }, 400);
-					}
+				const formRequest = new Request(request.url, {
+					body: limited.bytes,
+					headers: { "content-type": contentType },
+					method: "POST",
+				});
+				input = formDataToObject(await formRequest.formData());
+			} else if (limited.bytes.byteLength > 0) {
+				const text = new TextDecoder().decode(limited.bytes);
+				try {
+					input = JSON.parse(text);
+				} catch {
+					return jsonResponse({ message: "Invalid JSON" }, 400);
 				}
 			}
 		} else {
-			const params = url.searchParams;
-			const obj: Record<string, string | string[]> = Object.create(null);
-			let hasParams = false;
-			for (const [key, val] of params) {
-				if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
-				hasParams = true;
-				const existing = obj[key];
-				if (existing !== undefined) {
-					obj[key] = Array.isArray(existing) ? [...existing, val] : [existing, val];
-				} else {
-					obj[key] = val;
-				}
-			}
-			if (hasParams) {
-				input = obj;
-			}
+			input = parseGetSearchParams(url.searchParams);
 		}
 
 		/* validate input — ServerFnValidationError propagates to outer catch for structured errors */
@@ -577,16 +619,12 @@ export function serverFnQueryOptions<TInput, TOutput>(
 			}
 
 			/* client: HTTP fetch */
-			const url = `/_fn/${id}/${name}`;
+			const url = serverFnPath(id, name);
 			const method = reg?.method ?? "post";
 
 			const res =
 				method === "get"
-					? await fetch(
-							config?.input !== undefined
-								? `${url}?${new URLSearchParams(config.input as Record<string, string>)}`
-								: url,
-						)
+					? await fetch(serverFnGetUrl(url, config?.input))
 					: await fetch(url, {
 							body: config?.input !== undefined ? JSON.stringify(config.input) : undefined,
 							headers: { "content-type": "application/json" },
@@ -595,14 +633,7 @@ export function serverFnQueryOptions<TInput, TOutput>(
 
 			if (!res.ok) {
 				const body: unknown = await res.json().catch(() => null);
-				if (typeof body === "object" && body !== null && "errors" in body) {
-					throw new ServerFnValidationError((body as { errors: FlattenedError }).errors);
-				}
-				const errMsg =
-					typeof body === "object" && body !== null && "message" in body
-						? String((body as Record<string, unknown>).message)
-						: `Request failed (${res.status})`;
-				throw new Error(`Server function "${name}" failed: ${errMsg}`);
+				throwServerFnHttpError(body, res.status, name);
 			}
 
 			const json = (await res.json()) as {
@@ -658,7 +689,7 @@ export function serverFnMutationOptions<TInput, TOutput>(
 			}
 
 			/* client: HTTP fetch — mutations always POST */
-			const url = `/_fn/${id}/${name}`;
+			const url = serverFnPath(id, name);
 			const res = await fetch(url, {
 				body: input !== undefined ? JSON.stringify(input) : undefined,
 				headers: { "content-type": "application/json" },
@@ -667,14 +698,7 @@ export function serverFnMutationOptions<TInput, TOutput>(
 
 			if (!res.ok) {
 				const body: unknown = await res.json().catch(() => null);
-				if (typeof body === "object" && body !== null && "errors" in body) {
-					throw new ServerFnValidationError((body as { errors: FlattenedError }).errors);
-				}
-				const errMsg =
-					typeof body === "object" && body !== null && "message" in body
-						? String((body as Record<string, unknown>).message)
-						: `Request failed (${res.status})`;
-				throw new Error(`Server function "${name}" failed: ${errMsg}`);
+				throwServerFnHttpError(body, res.status, name);
 			}
 
 			const json = (await res.json()) as {

package/src/server-fn-query.ts

@@ -4,6 +4,10 @@
  * to avoid pulling in node:async_hooks on the client.
  */
 
+import { serverFnGetUrl } from "./server-fn/get-input.ts";
+import { throwServerFnHttpError } from "./server-fn/http-error.ts";
+import { serverFnPath } from "./protocol.ts";
+
 export interface PiggybackedQuery {
 	data: unknown;
 	key: unknown[];
@@ -48,16 +52,12 @@ export function serverFnQueryOptions<TInput, TOutput>(
 				return serverFn(config?.input as TInput);
 			}
 
-			const url = `/_fn/${id}/${name}`;
+			const url = serverFnPath(id, name);
 			const method = reg?.method ?? "post";
 
 			const res =
 				method === "get"
-					? await fetch(
-							config?.input !== undefined
-								? `${url}?${new URLSearchParams(config.input as Record<string, string>)}`
-								: url,
-						)
+					? await fetch(serverFnGetUrl(url, config?.input))
 					: await fetch(url, {
 							body: config?.input !== undefined ? JSON.stringify(config.input) : undefined,
 							headers: { "content-type": "application/json" },
@@ -66,11 +66,7 @@ export function serverFnQueryOptions<TInput, TOutput>(
 
 			if (!res.ok) {
 				const body: unknown = await res.json().catch(() => null);
-				const errMsg =
-					typeof body === "object" && body !== null && "message" in body
-						? String((body as Record<string, unknown>).message)
-						: `Request failed (${res.status})`;
-				throw new Error(`Server function request failed: ${errMsg}`);
+				throwServerFnHttpError(body, res.status, name);
 			}
 
 			const json = (await res.json()) as {
@@ -121,7 +117,7 @@ export function serverFnMutationOptions<TInput, TOutput>(
 				return serverFn(input);
 			}
 
-			const url = `/_fn/${id}/${name}`;
+			const url = serverFnPath(id, name);
 			const res = await fetch(url, {
 				body: input !== undefined ? JSON.stringify(input) : undefined,
 				headers: { "content-type": "application/json" },
@@ -130,11 +126,7 @@ export function serverFnMutationOptions<TInput, TOutput>(
 
 			if (!res.ok) {
 				const body: unknown = await res.json().catch(() => null);
-				const errMsg =
-					typeof body === "object" && body !== null && "message" in body
-						? String((body as Record<string, unknown>).message)
-						: `Request failed (${res.status})`;
-				throw new Error(`Server function request failed: ${errMsg}`);
+				throwServerFnHttpError(body, res.status, name);
 			}
 
 			const json = (await res.json()) as {

package/src/server-handler/etag.ts

@@ -4,6 +4,8 @@
  * the actual bytes while content is semantically identical.
  */
 
+import { HEADER_DATA } from "../protocol.ts";
+
 /** Compute weak ETag from content using SHA-256, truncated to 16 hex chars */
 export async function computeEtag(body: string): Promise<string> {
 	const encoded = new TextEncoder().encode(body);
@@ -35,11 +37,11 @@ export function weakMatch(ifNoneMatch: string, etag: string): boolean {
 }
 
 /**
- * Build Vary header value. Always includes `x-d` (flare's NDJSON protocol header).
+ * Build Vary header value. Always includes `flare-data` (NDJSON protocol header).
  * Additional values are appended, with deduplication.
  */
 export function buildVaryHeader(additional?: string[]): string {
-	const values = ["x-d"];
+	const values = [HEADER_DATA];
 	if (additional) {
 		for (const v of additional) {
 			if (!values.some((existing) => existing.toLowerCase() === v.toLowerCase())) {

package/src/server-handler/headers.ts

@@ -1,5 +1,4 @@
 export type FlareCacheStatus = "HIT" | "MISS" | "STALE";
 export type FlareRenderMode = "ISR" | "SSG" | "SSR";
 
-export const FLARE_CACHE_HEADER = "Flare-Cache" as const;
-export const FLARE_RENDER_HEADER = "Flare-Render" as const;
+export { FLARE_CACHE_HEADER, FLARE_RENDER_HEADER } from "../protocol.ts";