@mandujs/core 0.41.2 → 0.43.0

package/src/runtime/security.ts

@@ -1,155 +1,155 @@
-/**
- * Runtime Security
- *
- * 동적 import 및 경로 접근 보안 검증
- */
-
-import path from "path";
-import type { Result } from "../error/result";
-import { ok, err } from "../error/result";
-import { SecurityError } from "../error/domains";
-
-/**
- * 허용된 import 경로 패턴
- */
-const ALLOWED_IMPORT_PATTERNS = [
-  /^app\//,           // app/ 디렉토리 (FS Routes)
-  /^src\/client\//,   // 클라이언트 코드
-  /^src\/server\//,   // 서버 코드
-  /^src\/shared\//,   // 공유 코드
-  /^spec\//,          // Spec 디렉토리 (레거시)
-];
-
-/**
- * 허용된 파일 확장자
- */
-const ALLOWED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs"];
-
-/**
- * 차단된 경로 패턴
- */
-const BLOCKED_PATTERNS = [
-  /node_modules/,     // node_modules 직접 접근 차단
-  /\.env/,            // 환경 변수 파일
-  /\.git/,            // Git 디렉토리
-  /\.mandu\/.*\.json$/, // 설정 파일
-];
-
-/**
- * 동적 import 경로 검증
- *
- * @param rootDir 프로젝트 루트 디렉토리
- * @param modulePath 상대 모듈 경로 (예: "app/layout.tsx")
- * @returns 검증된 전체 경로 또는 에러
- */
-export function validateImportPath(
-  rootDir: string,
-  modulePath: string
-): Result<string> {
-  // 1. 경로 정규화
-  const normalized = path.posix.normalize(modulePath).replace(/\\/g, "/");
-
-  // 2. Path traversal 체크
-  if (normalized.includes("..")) {
-    return err(
-      new SecurityError(
-        "path_traversal",
-        `경로 탐색 공격 감지: ${modulePath}`,
-        modulePath
-      ).toManduError()
-    );
-  }
-
-  // 3. 차단된 패턴 체크
-  for (const pattern of BLOCKED_PATTERNS) {
-    if (pattern.test(normalized)) {
-      return err(
-        new SecurityError(
-          "import_violation",
-          `차단된 경로 접근: ${modulePath}`,
-          modulePath
-        ).toManduError()
-      );
-    }
-  }
-
-  // 4. 화이트리스트 검증
-  const isAllowed = ALLOWED_IMPORT_PATTERNS.some((pattern) =>
-    pattern.test(normalized)
-  );
-
-  if (!isAllowed) {
-    return err(
-      new SecurityError(
-        "import_violation",
-        `허용되지 않은 import 경로: ${modulePath}. 허용된 경로: app/, src/client/, src/server/, src/shared/, spec/`,
-        modulePath
-      ).toManduError()
-    );
-  }
-
-  // 5. 확장자 검증 (있는 경우만)
-  const ext = path.extname(normalized);
-  if (ext && !ALLOWED_EXTENSIONS.includes(ext)) {
-    return err(
-      new SecurityError(
-        "import_violation",
-        `허용되지 않은 파일 확장자: ${ext}`,
-        modulePath
-      ).toManduError()
-    );
-  }
-
-  // 6. 전체 경로 생성
-  const fullPath = path.join(rootDir, normalized);
-
-  // 7. 최종 경로가 rootDir 내에 있는지 확인
-  const resolvedPath = path.resolve(fullPath);
-  const resolvedRoot = path.resolve(rootDir);
-
-  if (!resolvedPath.startsWith(resolvedRoot + path.sep)) {
-    return err(
-      new SecurityError(
-        "path_traversal",
-        `루트 디렉토리 외부 접근 시도: ${modulePath}`,
-        modulePath
-      ).toManduError()
-    );
-  }
-
-  return ok(fullPath);
-}
-
-/**
- * 안전한 동적 import
- *
- * @param rootDir 프로젝트 루트 디렉토리
- * @param modulePath 상대 모듈 경로
- * @returns 로드된 모듈 또는 null
- */
-export async function safeImport<T = unknown>(
-  rootDir: string,
-  modulePath: string
-): Promise<T | null> {
-  const validation = validateImportPath(rootDir, modulePath);
-
-  if (!validation.ok) {
-    console.error(`[Mandu Security] ${validation.error.message}`);
-    return null;
-  }
-
-  try {
-    const module = await import(validation.value);
-    return module as T;
-  } catch (error) {
-    console.error(`[Mandu] Failed to import: ${modulePath}`, error);
-    return null;
-  }
-}
-
-/**
- * 모듈 경로 검증 (boolean 반환)
- */
-export function isValidImportPath(rootDir: string, modulePath: string): boolean {
-  return validateImportPath(rootDir, modulePath).ok;
-}
+/**
+ * Runtime Security
+ *
+ * 동적 import 및 경로 접근 보안 검증
+ */
+
+import path from "path";
+import type { Result } from "../error/result";
+import { ok, err } from "../error/result";
+import { SecurityError } from "../error/domains";
+
+/**
+ * 허용된 import 경로 패턴
+ */
+const ALLOWED_IMPORT_PATTERNS = [
+  /^app\//,           // app/ 디렉토리 (FS Routes)
+  /^src\/client\//,   // 클라이언트 코드
+  /^src\/server\//,   // 서버 코드
+  /^src\/shared\//,   // 공유 코드
+  /^spec\//,          // Spec 디렉토리 (레거시)
+];
+
+/**
+ * 허용된 파일 확장자
+ */
+const ALLOWED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs"];
+
+/**
+ * 차단된 경로 패턴
+ */
+const BLOCKED_PATTERNS = [
+  /node_modules/,     // node_modules 직접 접근 차단
+  /\.env/,            // 환경 변수 파일
+  /\.git/,            // Git 디렉토리
+  /\.mandu\/.*\.json$/, // 설정 파일
+];
+
+/**
+ * 동적 import 경로 검증
+ *
+ * @param rootDir 프로젝트 루트 디렉토리
+ * @param modulePath 상대 모듈 경로 (예: "app/layout.tsx")
+ * @returns 검증된 전체 경로 또는 에러
+ */
+export function validateImportPath(
+  rootDir: string,
+  modulePath: string
+): Result<string> {
+  // 1. 경로 정규화
+  const normalized = path.posix.normalize(modulePath).replace(/\\/g, "/");
+
+  // 2. Path traversal 체크
+  if (normalized.includes("..")) {
+    return err(
+      new SecurityError(
+        "path_traversal",
+        `경로 탐색 공격 감지: ${modulePath}`,
+        modulePath
+      ).toManduError()
+    );
+  }
+
+  // 3. 차단된 패턴 체크
+  for (const pattern of BLOCKED_PATTERNS) {
+    if (pattern.test(normalized)) {
+      return err(
+        new SecurityError(
+          "import_violation",
+          `차단된 경로 접근: ${modulePath}`,
+          modulePath
+        ).toManduError()
+      );
+    }
+  }
+
+  // 4. 화이트리스트 검증
+  const isAllowed = ALLOWED_IMPORT_PATTERNS.some((pattern) =>
+    pattern.test(normalized)
+  );
+
+  if (!isAllowed) {
+    return err(
+      new SecurityError(
+        "import_violation",
+        `허용되지 않은 import 경로: ${modulePath}. 허용된 경로: app/, src/client/, src/server/, src/shared/, spec/`,
+        modulePath
+      ).toManduError()
+    );
+  }
+
+  // 5. 확장자 검증 (있는 경우만)
+  const ext = path.extname(normalized);
+  if (ext && !ALLOWED_EXTENSIONS.includes(ext)) {
+    return err(
+      new SecurityError(
+        "import_violation",
+        `허용되지 않은 파일 확장자: ${ext}`,
+        modulePath
+      ).toManduError()
+    );
+  }
+
+  // 6. 전체 경로 생성
+  const fullPath = path.join(rootDir, normalized);
+
+  // 7. 최종 경로가 rootDir 내에 있는지 확인
+  const resolvedPath = path.resolve(fullPath);
+  const resolvedRoot = path.resolve(rootDir);
+
+  if (!resolvedPath.startsWith(resolvedRoot + path.sep)) {
+    return err(
+      new SecurityError(
+        "path_traversal",
+        `루트 디렉토리 외부 접근 시도: ${modulePath}`,
+        modulePath
+      ).toManduError()
+    );
+  }
+
+  return ok(fullPath);
+}
+
+/**
+ * 안전한 동적 import
+ *
+ * @param rootDir 프로젝트 루트 디렉토리
+ * @param modulePath 상대 모듈 경로
+ * @returns 로드된 모듈 또는 null
+ */
+export async function safeImport<T = unknown>(
+  rootDir: string,
+  modulePath: string
+): Promise<T | null> {
+  const validation = validateImportPath(rootDir, modulePath);
+
+  if (!validation.ok) {
+    console.error(`[Mandu Security] ${validation.error.message}`);
+    return null;
+  }
+
+  try {
+    const module = await import(validation.value);
+    return module as T;
+  } catch (error) {
+    console.error(`[Mandu] Failed to import: ${modulePath}`, error);
+    return null;
+  }
+}
+
+/**
+ * 모듈 경로 검증 (boolean 반환)
+ */
+export function isValidImportPath(rootDir: string, modulePath: string): boolean {
+  return validateImportPath(rootDir, modulePath).ok;
+}

package/src/runtime/server.ts

@@ -1,4 +1,4 @@
-import type { Server } from "bun";
+import type { Server, ServerWebSocket } from "bun";
 import type { RoutesManifest, RouteSpec, HydrationConfig, StaticParamSetSchema } from "../spec/schema";
 import type { BundleManifest } from "../bundler/types";
 import type { ManduFilling, RenderMode } from "../filling/filling";
@@ -77,8 +77,9 @@ import { collectPerfSnapshot } from "../perf/user-marks";
 // `startServer()`; `runWithSpan` is used at the absolute TOP of the
 // request handler so every downstream await (middleware, filling
 // loader, SSR render) inherits the active span via AsyncLocalStorage.
+import type {
+  Tracer} from "../observability/tracing";
 import {
-  Tracer,
   createTracerFromConfig,
   runWithSpan,
   setTracer,
@@ -4305,12 +4306,17 @@ function startBunServerWithFallback(options: {
   const { port: startPort, hostname, fetch, websocket } = options;
   let lastError: unknown = null;
 
+  // `Parameters<typeof Bun.serve>[0]` captures the full `Serve.Options`
+  // XOR union. We only ever use the hostname/port branch, so cast through
+  // `unknown` at the call site to express "these are valid options we've
+  // assembled dynamically" without widening the whole local to `any`.
+  type BunServeOptions = Parameters<typeof Bun.serve>[0];
   const serveOptions: Record<string, unknown> = { hostname, fetch, idleTimeout: 255 };
   if (websocket) serveOptions.websocket = websocket;
 
   // Port 0: let Bun/OS pick an available ephemeral port.
   if (startPort === 0) {
-    const server = Bun.serve({ port: 0, ...serveOptions } as any);
+    const server = Bun.serve({ port: 0, ...serveOptions } as unknown as BunServeOptions);
     return { server, port: server.port ?? 0, attempts: 0 };
   }
 
@@ -4320,7 +4326,7 @@ function startBunServerWithFallback(options: {
       continue;
     }
     try {
-      const server = Bun.serve({ port: candidate, ...serveOptions } as any);
+      const server = Bun.serve({ port: candidate, ...serveOptions } as unknown as BunServeOptions);
       return { server, port: server.port ?? candidate, attempts: attempt };
     } catch (error) {
       if (!isPortInUseError(error)) {
@@ -4669,27 +4675,26 @@ export function startServer(manifest: RoutesManifest, options: ServerOptions = {
     handleRequest,
   });
 
-  // WebSocket 핸들러 빌드 (등록된 WS 라우트가 있을 때만)
+  // WebSocket 핸들러 빌드 (등록된 WS 라우트가 있을 때만).
+  // Bun's `ServerWebSocket<T>` carries the upgrade payload in `ws.data`;
+  // we set `T = WSUpgradeData` at upgrade time (see `bunServer.upgrade`
+  // below) so downstream handlers get proper inference without casts.
   const hasWsRoutes = registry.wsHandlers.size > 0;
   const wsConfig = hasWsRoutes ? {
-    open(ws: any) {
-      const data = ws.data as WSUpgradeData;
-      const handlers = registry.wsHandlers.get(data.routeId);
+    open(ws: ServerWebSocket<WSUpgradeData>) {
+      const handlers = registry.wsHandlers.get(ws.data.routeId);
       handlers?.open?.(wrapBunWebSocket(ws));
     },
-    message(ws: any, message: string | ArrayBuffer) {
-      const data = ws.data as WSUpgradeData;
-      const handlers = registry.wsHandlers.get(data.routeId);
+    message(ws: ServerWebSocket<WSUpgradeData>, message: string | ArrayBuffer) {
+      const handlers = registry.wsHandlers.get(ws.data.routeId);
       handlers?.message?.(wrapBunWebSocket(ws), message);
     },
-    close(ws: any, code: number, reason: string) {
-      const data = ws.data as WSUpgradeData;
-      const handlers = registry.wsHandlers.get(data.routeId);
+    close(ws: ServerWebSocket<WSUpgradeData>, code: number, reason: string) {
+      const handlers = registry.wsHandlers.get(ws.data.routeId);
       handlers?.close?.(wrapBunWebSocket(ws), code, reason);
     },
-    drain(ws: any) {
-      const data = ws.data as WSUpgradeData;
-      const handlers = registry.wsHandlers.get(data.routeId);
+    drain(ws: ServerWebSocket<WSUpgradeData>) {
+      const handlers = registry.wsHandlers.get(ws.data.routeId);
       handlers?.drain?.(wrapBunWebSocket(ws));
     },
   } : undefined;
@@ -4710,6 +4715,13 @@ export function startServer(manifest: RoutesManifest, options: ServerOptions = {
   };
 
   // fetch handler: WS upgrade 감지 추가
+  //
+  // Bun narrows `server.upgrade()` to require the matching WS data generic
+  // (see `Server<T>` in bun-types/serve.d.ts:908). Our wsConfig is typed
+  // against `WSUpgradeData`, so the server we receive at runtime is really
+  // `Server<WSUpgradeData>`. The outer startBunServerWithFallback returns
+  // `Server<undefined>` for back-compat; a single cast here threads the
+  // correct generic through to `.upgrade()` without widening to `any`.
   const wrappedFetch = hasWsRoutes
     ? async (req: Request, bunServer: Server<undefined>): Promise<Response | undefined> => {
         // WebSocket upgrade 요청 감지
@@ -4717,7 +4729,8 @@ export function startServer(manifest: RoutesManifest, options: ServerOptions = {
           const url = new URL(req.url);
           const match = router.match(url.pathname);
           if (match && registry.wsHandlers.has(match.route.id)) {
-            const upgraded = (bunServer as any).upgrade(req, {
+            const wsServer = bunServer as unknown as Server<WSUpgradeData>;
+            const upgraded = wsServer.upgrade(req, {
               data: { routeId: match.route.id, params: match.params, id: newId() },
             });
             return upgraded ? undefined : new Response("WebSocket upgrade failed", { status: 400 });
@@ -4736,7 +4749,11 @@ export function startServer(manifest: RoutesManifest, options: ServerOptions = {
   const { server, port: actualPort, attempts } = startBunServerWithFallback({
     port,
     hostname,
-    fetch: wrappedFetch as any,
+    // `wrappedFetch` has a `Server<undefined>` signature but the WS-enabled
+    // branch internally treats it as `Server<WSUpgradeData>` (see wsServer
+    // cast above). The fallback helper accepts the narrower type; a cast
+    // through `unknown` threads the WS-aware fetch without `any`.
+    fetch: wrappedFetch as unknown as Parameters<typeof startBunServerWithFallback>[0]["fetch"],
     websocket: wsConfig,
   });