@mosetta/server-action 0.0.12 → 0.0.13

package/README.md

@@ -35,13 +35,17 @@ export default defineServerSide({ services: [GreetAction] });
 The component side calls it with `useServerAction` from `@mosetta/react/server-action`; during
 server rendering the same call runs on the server, so the page arrives with the data in it.
 
+Beside the input, an action gets the block it is called from — `block: { page, node, reference,
+settings, draft }`, or `null`. The browser only says which block on which page calls; the host reads
+that block from the page itself, so its settings are the site author's, never the caller's.
+
 ## Entry points
 
 | Entry | What it holds |
 |---|---|
-| `@mosetta/server-action/server` | `defineServerSide`, `ServerAction`, `DiServerAction`, `DiInject`; what an action may ask for: the caller, the request, the project's secrets by name (`SECRETS_TOKEN`), its stores (`PROVIDERS_TOKEN`), the site's tile hosts (`TILE_HOSTS_TOKEN`) |
+| `@mosetta/server-action/server` | `defineServerSide`, `ServerAction`, `DiServerAction`, `DiInject`; what an action may ask for: the caller, the calling block (`BLOCK_TOKEN`), the request, the project's secrets by name (`SECRETS_TOKEN`), its stores (`PROVIDERS_TOKEN`), the site's tile hosts (`TILE_HOSTS_TOKEN`) |
 | `@mosetta/server-action/client` | the browser's call of an action |
-| `@mosetta/server-action/core` | `ServerActionToken` (shared by the server and the component side), serialization, the caller as the host vouches for it |
+| `@mosetta/server-action/core` | `ServerActionToken` (shared by the server and the component side), serialization, the caller and the calling block as the host vouches for them |
 
 An action runs in an isolated line of the factory: its privileges are handed in, never assumed —
 no store key and no secret value sits in its environment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mosetta/server-action",
-  "version": "0.0.12",
+  "version": "0.0.13",
   "license": "MIT",
   "description": "mosetta server actions (RPC): shared token/serializer contract, client hook, server-side action definition. Web-API native (workerd).",
   "type": "module",
@@ -15,10 +15,10 @@
   "dependencies": {
     "react": "*",
     "zod": "^3",
-    "@mosetta/di": "0.0.12",
-    "@mosetta/runtime": "0.0.12",
-    "@mosetta/router": "0.0.12",
-    "@mosetta/stores": "0.0.12"
+    "@mosetta/di": "0.0.13",
+    "@mosetta/stores": "0.0.13",
+    "@mosetta/router": "0.0.13",
+    "@mosetta/runtime": "0.0.13"
   },
   "devDependencies": {
     "@types/react": "^19"

package/src/client/executor.ts

@@ -4,6 +4,7 @@
 // it is not a server outcome — the manager initiated it and discards the whole try.
 import { DiInject, DiService } from '@mosetta/di';
 import {
+  BLOCK_ORIGIN_HEADER,
   CLIENT_SERIALIZER_TOKEN,
   ClientSerializer,
   IExecuteServerActionOptions,
@@ -43,7 +44,11 @@ export class FetchServerActionExecutor extends ServerActionExecutor {
       const response = await this.fetchImpl(this.route(request.fullId, request.actionName), {
         method: 'POST',
         body: body.content,
-        headers: body.contentType ? { 'content-type': body.contentType } : {},
+        headers: {
+          ...(body.contentType ? { 'content-type': body.contentType } : {}),
+          // where the call comes from: the host reads the block's settings there itself
+          ...(request.origin ? { [BLOCK_ORIGIN_HEADER]: request.origin } : {}),
+        },
         signal: options.signal,
       });
 

package/src/client/manager.ts

@@ -38,6 +38,8 @@ export interface ICreateManualOptions {
   readonly actionName: string;
   readonly invalidates: readonly string[];
   readonly customSerializer?: ClientSerializer;
+  /** where each call comes from (blockOrigin), read when it starts — a mounted block can change pages */
+  readonly originOf?: () => string | null;
 }
 
 /** the hook-facing subscription surface — same shape for query entries and manual handles */
@@ -192,7 +194,7 @@ export class ServerDataManager {
 
   /** a per-hook mutation handle (START_MANUAL): never cached, never aborted (the write is already
    *  on the server; killing the .then would silently lose `invalidate`), input arrives at start(input) */
-  createManual<TIn, TOut>({ fullId, actionName, invalidates, customSerializer }: ICreateManualOptions): IServerDataHandle<TOut, TIn> {
+  createManual<TIn, TOut>({ fullId, actionName, invalidates, customSerializer, originOf }: ICreateManualOptions): IServerDataHandle<TOut, TIn> {
     const listeners = new Set<() => void>();
     const notify = () => {
       for (const listener of listeners) listener(); 
@@ -200,7 +202,8 @@ export class ServerDataManager {
 
     let current: ServerData<TOut, TIn>;
     const start: IManualStart<TIn> = (input) => {
-      const request: IServerActionRequest = { fullId, actionName, input };
+      const origin = originOf?.() ?? null;
+      const request: IServerActionRequest = { fullId, actionName, input, ...(origin ? { origin } : {}) };
       const promise = this.executor
         .executeServerAction<TOut>({ request, requestHash: `${fullId}/${actionName}#manual`, customSerializer })
         .then((result) => {

package/src/core/core.ts

@@ -49,6 +49,68 @@ export function parseCaller(header: string | null | undefined): ICaller | null {
 
 export const CALLER_TOKEN = new SingleDiToken<ICaller | null>('CALLER_TOKEN');
 
+// THE CALLING BLOCK. A block's action may trust what the block is set to on its page — the
+// working hours a booking form offers, the address a contact form writes to — only when the HOST
+// read it from the published page, never when the browser sent it. The browser says WHERE the call
+// comes from (BLOCK_ORIGIN_HEADER: `page=<name>&node=<id>`, `preview=<token>&node=<id>` in a draft's
+// preview); the host finds that node on the page as published — the page's live revision, or the
+// draft for a caller the host lets read drafts (DRAFT_ACCESS_HEADER) — and hands the action what it
+// found (BLOCK_HEADER, stripped from every incoming request like the identity). A call from no page,
+// or from a node the host cannot find, has no block.
+export const BLOCK_ORIGIN_HEADER = 'x-mosetta-block-origin';
+export const BLOCK_HEADER = 'x-mosetta-block';
+// the host's word that this call may read the site's drafts (its editors may): set by the host,
+// stripped from every incoming request
+export const DRAFT_ACCESS_HEADER = 'x-mosetta-draft-access';
+
+/** the block an action was called from, as the host read it from the page */
+export interface IBlock {
+  /** the page's name (a draft's page for a draft) */
+  readonly page: string;
+  /** the node's id on the page (`<prefab node>/<inner>` inside a prefab) */
+  readonly node: string;
+  /** the node's tile — a tile of the action's own palette, not always the action's own tile */
+  readonly reference: string;
+  /** the node's settings as stored: translation references stay references */
+  readonly settings: Readonly<Record<string, unknown>>;
+  /** read from a draft (an editor's preview), not from the page as published */
+  readonly draft: boolean;
+}
+
+export const BLOCK_TOKEN = new SingleDiToken<IBlock | null>('BLOCK_TOKEN');
+
+/** where a call comes from, as the browser says it: the page's origin and the node */
+export function blockOrigin(pageOrigin: string | null | undefined, node: string | null | undefined): string | null {
+  return pageOrigin && node ? `${pageOrigin}&${new URLSearchParams({ node }).toString()}` : null;
+}
+
+const toBase64Url = (text: string): string => {
+  let binary = '';
+  for (const byte of new TextEncoder().encode(text)) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+
+const fromBase64Url = (value: string): string => {
+  const binary = atob(value.replace(/-/g, '+').replace(/_/g, '/'));
+  return new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+};
+
+/** the block as its header carries it: JSON, base64url — settings hold any language's words */
+export const encodeBlock = (block: IBlock): string => toBase64Url(JSON.stringify(block));
+
+/** the header's block, or null: absent or not one */
+export function parseBlock(header: string | null | undefined): IBlock | null {
+  if (!header) return null;
+  try {
+    const raw = JSON.parse(fromBase64Url(header)) as Partial<IBlock> | null;
+    if (!raw || typeof raw.page !== 'string' || typeof raw.node !== 'string' || typeof raw.reference !== 'string') return null;
+    const settings = raw.settings && typeof raw.settings === 'object' && !Array.isArray(raw.settings) ? raw.settings : {};
+    return { page: raw.page, node: raw.node, reference: raw.reference, settings, draft: raw.draft === true };
+  } catch {
+    return null;
+  }
+}
+
 // ---- canonical naming ----
 // MUST agree with cli/runtime/naming.js (the build-side single source of truth for artifact ids) —
 // the CLI runtime is plain dependency-free JS bundled into bootstrap, so the encoder is duplicated
@@ -70,6 +132,8 @@ export interface IServerActionRequest {
   readonly fullId: string;
   readonly actionName: string;
   readonly input: unknown;
+  /** where the call comes from — the page and the node (blockOrigin) — absent outside a page */
+  readonly origin?: string | null;
 }
 
 // The error shape ON THE WIRE — exactly what the isolate glue returns ({ error: { code, ... } });

package/src/server/server.ts

@@ -3,14 +3,17 @@ import { parseStoreConnectors } from '@mosetta/stores';
 import type { IStoreConnector } from '@mosetta/stores';
 import { z, ZodType } from 'zod';
 import {
+  BLOCK_HEADER,
+  BLOCK_TOKEN,
   CALLER_TOKEN,
   IDENTITY_HEADER,
   JsonServerSerializer,
+  parseBlock,
   parseCaller,
   ServerActionToken,
   ServerSerializer,
 } from '../core/core';
-import type { ICaller } from '../core/core';
+import type { IBlock, ICaller } from '../core/core';
 
 // re-export the DI essentials a coder needs — so a server module imports everything from
 // `@mosetta/server-action/server` (not the legacy @mosetta/di directly).
@@ -86,6 +89,12 @@ export interface ICreateSchema {
 
 export interface IServerActionPayload<TIn> {
   input: TIn;
+  /**
+   * the block the call came from, as the HOST read it from the page — its settings to trust (the
+   * hours a booking form offers), where the input is only what the browser sent; null — the call
+   * came from no page, or the host found no such block
+   */
+  block: IBlock | null;
 }
 
 /** what an action's `authorize` decides by */
@@ -96,6 +105,8 @@ export interface IServerActionAccess<TIn> {
   caller: ICaller | null;
   /** the request the action answers (its body already read into `input`) */
   request: Request;
+  /** the block the call came from, as the host read it from the page — or null */
+  block: IBlock | null;
 }
 
 export abstract class ServerAction<TIn, TOut> {
@@ -190,6 +201,9 @@ export function defineServerSide({ services }: IServerSideDefinition): IServerSi
         // the caller: what the trust boundary vouches for, in its words (null — nobody)
         const caller = parseCaller(request.headers.get(IDENTITY_HEADER));
         di.registerValueOfToken(CALLER_TOKEN, caller);
+        // the calling block: what the host read from the page (null — none it could vouch for)
+        const block = parseBlock(request.headers.get(BLOCK_HEADER));
+        di.registerValueOfToken(BLOCK_TOKEN, block);
         di.registerValueOfToken(SECRETS_TOKEN, secretsOf(env?.SECRETS));
         di.registerValueOfToken(REQUEST_TOKEN, request);
 
@@ -209,14 +223,14 @@ export function defineServerSide({ services }: IServerSideDefinition): IServerSi
         }
 
         // the action decides who may call it — before it runs, by the valid input and the caller
-        if (!(await action.authorize({ input: validation.data as unknown, caller, request }))) {
+        if (!(await action.authorize({ input: validation.data as unknown, caller, request, block }))) {
           return caller
             ? json({ error: { code: 'SERVER_ACTION_FORBIDDEN', actionName } }, 403)
             : json({ error: { code: 'SERVER_ACTION_UNAUTHORIZED', actionName } }, 401);
         }
 
         // the action's TOut is erased at this generic call site — pin to unknown for the serializer
-        const output = (await action.action({ input: validation.data as unknown })) as unknown;
+        const output = (await action.action({ input: validation.data as unknown, block })) as unknown;
         const serialized = await serializer.serializeIntoString(output as object);
         return new Response(serialized.content, {
           status: 200,
@@ -232,5 +246,5 @@ export function defineServerSide({ services }: IServerSideDefinition): IServerSi
   };
 }
 
-export { CALLER_TOKEN, IDENTITY_HEADER, parseCaller } from '../core/core';
-export type { ICaller } from '../core/core';
+export { BLOCK_TOKEN, CALLER_TOKEN, IDENTITY_HEADER, parseCaller } from '../core/core';
+export type { IBlock, ICaller } from '../core/core';