@nifrajs/web 5.0.0 → 5.2.0

package/src/internal/page-execution.ts

@@ -3,7 +3,12 @@ import {
   NIFRA_BACKEND_BIND_PLATFORM,
   NIFRA_PLATFORM_CLIENT_IP_DERIVED,
 } from "@nifrajs/core/mount"
-import { type Platform, type ResponseResult, status as statusResult } from "@nifrajs/core/server"
+import {
+  isSameOriginForm,
+  type Platform,
+  type ResponseResult,
+  status as statusResult,
+} from "@nifrajs/core/server"
 import {
   type BoundaryRequestCtx,
   type BoundaryStates,
@@ -29,7 +34,7 @@ import type {
   ShouldRevalidate,
 } from "../manifest.ts"
 import type { NonceResolver } from "../nonce.ts"
-import type { MatchChain, RenderAdapter } from "../render-seam.ts"
+import type { MatchChain, PageLocale, PageLocales, RenderAdapter } from "../render-seam.ts"
 import {
   createMatcher,
   DATA_HEADER,
@@ -49,9 +54,11 @@ import {
   isStatusSignal,
   type LoadedLayoutModules,
   layoutErrorId,
+  notFound,
   type RenderAssemblyCache,
   type RenderedPage,
   type RevalidateResult,
+  redirect,
   renderPageResult,
   STATUS_SIGNAL,
   STATUS_TEXT,
@@ -167,11 +174,31 @@ function appTarget(location: string, requestUrl: string): string {
   } catch {
     return location // the browser fails on it the same way when it loads it
   }
-  return target.origin === new URL(requestUrl).origin
-    ? target.pathname + target.search + target.hash
-    : location
+  if (target.origin !== new URL(requestUrl).origin) return location
+  // A path starting `//` (from `/.//host`) is a protocol-relative URL to whoever resolves it next.
+  return target.pathname.startsWith("//")
+    ? target.href
+    : target.pathname + target.search + target.hash
+}
+
+/** The app's locale routing, as page execution reads it. */
+export interface PageI18n {
+  readonly locales: PageLocales
+  /** The served locale key a `pathname + search` is in. */
+  localeOf(path: string): string
+  /** The answer for a `[lang]` / `[[lang]]` segment's value (`undefined` when an optional one is
+   * absent), as `@nifrajs/i18n/routing`'s `matchSegment` gives it. */
+  matchSegment(
+    value: string | undefined,
+    pathname: string,
+  ):
+    | { readonly kind: "ok" | "not-found" }
+    | { readonly kind: "redirect"; readonly location: string }
 }
 
+// The route directories whose first segment names the locale.
+const LOCALE_SEGMENTS: ReadonlySet<string> = new Set(["[lang]", "[[lang]]"])
+
 export interface PageExecutionOptions<Env = unknown> {
   readonly serverComponents?: import("../server-components/types.ts").ServerComponentRuntime
   readonly rerenderOwnerGET?: (
@@ -191,6 +218,10 @@ export interface PageExecutionOptions<Env = unknown> {
   readonly prerenderedPaths?: readonly string[]
   /** Where pages fetch {@link prerenderedPaths} from when the list is too large to inline. */
   readonly prerenderedListUrl?: string
+  /** Locale key -> copy chunk URL, from a build that split copy tables by locale. */
+  readonly copyChunks?: Readonly<Record<string, string>>
+  /** The app's locale routing: each document's locale, and the check on a `[lang]` segment. */
+  readonly i18n?: PageI18n
   readonly staticFallbacks?: Readonly<Record<string, "ssr" | "404">>
   readonly staticBoundaryCache?: StaticBoundaryCache
   /** Per-request CSP nonce for framework-owned executable document scripts. */
@@ -294,6 +325,23 @@ export function createPageRequestExecutor<Env = unknown>(
     options.prerenderedListUrl === undefined
       ? { prerenderedPaths: options.prerenderedPaths ?? [] }
       : { prerenderedListUrl: options.prerenderedListUrl }
+  const copyOption = options.copyChunks === undefined ? {} : { copyChunks: options.copyChunks }
+  const { i18n } = options
+  const pageLocales = new Map(i18n?.locales.locales.map((locale) => [locale.key, locale]))
+  /** The request's locale for a document, with the served locales the client names locales from. */
+  const localeOption = (req: Request): { locale?: PageLocale; locales?: PageLocales } => {
+    if (i18n === undefined) return {}
+    const locale = pageLocales.get(i18n.localeOf(pathOf(req)))
+    return locale === undefined ? { locales: i18n.locales } : { locale, locales: i18n.locales }
+  }
+  /** Whether a route sits under a `[lang]` or `[[lang]]` directory, which the locale routing checks. */
+  const localeGuarded = (route: RouteEntry): boolean => {
+    if (i18n === undefined) return false
+    for (const segment of route.id.split("/")) {
+      if (!(segment.startsWith("(") && segment.endsWith(")"))) return LOCALE_SEGMENTS.has(segment)
+    }
+    return false
+  }
   const matchManifestRoute = createMatcher(
     manifest.routes.map((route) => ({ routeId: route.id, pattern: route.pattern })),
   )
@@ -415,6 +463,25 @@ export function createPageRequestExecutor<Env = unknown>(
     return value
   }
 
+  // Development only. A layout loader that refuses access reads as a guard, and is not one: a client
+  // navigation can skip it and an action below it runs without it.
+  const warnsUngatedRefusal =
+    typeof process !== "undefined" && process.env?.NODE_ENV === "development"
+  const warnedUngated = new Set<string>()
+  const warnUngatedRefusal = (layoutId: string, outcome: unknown): void => {
+    if (warnedUngated.has(layoutId)) return
+    // notFound() and gone() say the record is missing, which a layout may decide without guarding.
+    const refusesAccess = isStatusSignal(outcome)
+      ? outcome.status === 401 || outcome.status === 403
+      : isControlFlow(outcome)
+    if (!refusesAccess) return
+    warnedUngated.add(layoutId)
+    const file = manifest.layouts?.[layoutId]?.file ?? layoutId
+    console.warn(
+      `[nifra/web] the loader in "${file}" refused a request, but that layout is not a gate. A client navigation that keeps the layout on screen can skip its loader, and an action below it runs without it, so it does not protect the pages under it. Export \`gate = true\` from that file, or move the check into middleware. (Shown in development only.)`,
+    )
+  }
+
   /**
    * Run layout loaders, awaiting gates before starting the page loader and retaining only safe data.
    * `gated` carries gates that already ran for this request, so none runs twice.
@@ -469,15 +536,25 @@ export function createPageRequestExecutor<Env = unknown>(
         if (value !== null && (typeof value === "object" || typeof value === "function")) {
           pending.push(
             (async () => {
+              let settled: unknown
               try {
-                results[index] = await value
+                settled = await value
               } catch (err) {
+                if (warnsUngatedRefusal) warnUngatedRefusal(layoutId, err)
                 throw tagLayoutError(err, layoutId)
               }
+              // A returned redirect or Response refuses exactly as a thrown one: kept as layout data,
+              // it would ship beside the page loader's data.
+              if (isControlFlow(settled)) {
+                if (warnsUngatedRefusal) warnUngatedRefusal(layoutId, settled)
+                throw tagLayoutError(settled, layoutId)
+              }
+              results[index] = settled
             })(),
           )
         } else results[index] = value
       } catch (err) {
+        if (warnsUngatedRefusal) warnUngatedRefusal(layoutId, err)
         // Preserve a synchronous throw as a pending layout failure, just like the async lane.
         pending.push(Promise.reject(tagLayoutError(err, layoutId)))
       }
@@ -517,6 +594,21 @@ export function createPageRequestExecutor<Env = unknown>(
     ctx: LoaderContext,
     controls: PageResponseControls,
   ): Promise<void> => {
+    if (i18n !== undefined && localeGuarded(route)) {
+      // Before any app middleware, as a root `_middleware` would run: an unserved locale, or a page
+      // missing from it, never reaches the app's code.
+      const match = i18n.matchSegment(ctx.params.lang, pathOf(ctx.request))
+      if (match.kind === "redirect") {
+        throw tagLayoutError(redirect(match.location, { status: 308 }), "_layout")
+      }
+      if (match.kind === "not-found") {
+        try {
+          notFound()
+        } catch (signal) {
+          throw tagLayoutError(signal, "_layout")
+        }
+      }
+    }
     const ids = route.middlewareIds ?? []
     for (let i = 0; i < ids.length; i++) {
       const id = ids[i] as string
@@ -740,6 +832,7 @@ export function createPageRequestExecutor<Env = unknown>(
         chain: components,
         data,
         ...(wrapped === undefined ? {} : { head: wrapped.head }),
+        ...localeOption(req),
         clientEntry,
         routeId: errorId,
         status: 500,
@@ -903,6 +996,8 @@ export function createPageRequestExecutor<Env = unknown>(
       // The build keys stylesheets by route, so a page inside the root layout links the whole-app one.
       ...(chain === undefined ? stylesOf(routeId) : stylesFrom(options.styles)),
       ...prerenderedHandover,
+      ...copyOption,
+      ...localeOption(req),
       ...titleOption,
     }
     if (chain === undefined) return renderPageResult(statusPage)
@@ -1051,6 +1146,8 @@ export function createPageRequestExecutor<Env = unknown>(
         ...preloadOf(route.id),
         ...stylesOf(route.id),
         ...prerenderedHandover,
+        ...copyOption,
+        ...localeOption(req),
         ...(responseHeaders === undefined ? {} : { headers: responseHeaders }),
         // A response that sets a cookie is one visitor's: it never advertises ISR freshness.
         ...(mod.revalidate !== undefined && !personalized && options.cacheChannel?.enabled === true
@@ -1177,6 +1274,7 @@ export function createPageRequestExecutor<Env = unknown>(
       matchChain: matchChainOf(page.layoutIds, layoutModules, id, mod),
       status: 404,
       hydrate: false,
+      ...localeOption(req),
       ...(layoutData !== undefined ? { layoutData } : {}),
       ...stylesOf(id),
       ...(headers === undefined ? {} : { headers }),
@@ -1268,12 +1366,14 @@ export function createPageRequestExecutor<Env = unknown>(
   return {
     get: (route) => {
       const is404Fallback = options.staticFallbacks?.[route.pattern] === "404"
-      let assemblySlot: RenderAssemblyCache | undefined
+      // One shell per locale: `<html lang>` is in it, and one route serves every locale.
+      let assemblySlots = new Map<string, RenderAssemblyCache>()
       let assemblySlotMod: unknown
       let assemblySlotLayouts: LoadedLayoutModules | undefined
       const assemblyCacheFor = (
         mod: RouteModule,
         layouts: LoadedLayoutModules,
+        req: Request,
       ): RenderAssemblyCache | undefined => {
         if (typeof mod.meta === "function") return undefined
         for (const layout of layouts) if (typeof layout.meta === "function") return undefined
@@ -1282,11 +1382,17 @@ export function createPageRequestExecutor<Env = unknown>(
           assemblySlotLayouts.length === layouts.length &&
           assemblySlotLayouts.every((layout, index) => layout === layouts[index])
         if (assemblySlotMod !== mod || !layoutsUnchanged) {
-          assemblySlot = {}
+          assemblySlots = new Map()
           assemblySlotMod = mod
           assemblySlotLayouts = layouts
         }
-        return assemblySlot
+        const key = i18n === undefined ? "" : i18n.localeOf(pathOf(req))
+        let slot = assemblySlots.get(key)
+        if (slot === undefined) {
+          slot = {}
+          assemblySlots.set(key, slot)
+        }
+        return slot
       }
 
       return withResponseControls(async (c, controls) => {
@@ -1328,7 +1434,9 @@ export function createPageRequestExecutor<Env = unknown>(
             search: loaderSearch(mod.searchSchema, c.req),
             set: controls.scope(PAGE_SCOPE),
           }
-          if (route.middlewareIds !== undefined) await runMiddleware(route, ctx, controls)
+          if (route.middlewareIds !== undefined || localeGuarded(route)) {
+            await runMiddleware(route, ctx, controls)
+          }
           run = await runLayoutChain(
             route,
             ctx,
@@ -1474,7 +1582,7 @@ export function createPageRequestExecutor<Env = unknown>(
           layoutModules ?? (await loadLayoutModules(route)),
           layoutRetained,
           boundaryStates,
-          layoutModules === undefined ? undefined : assemblyCacheFor(mod, layoutModules),
+          layoutModules === undefined ? undefined : assemblyCacheFor(mod, layoutModules, c.req),
           responseHeaders,
           controls.personalized,
           componentState,
@@ -1493,6 +1601,32 @@ export function createPageRequestExecutor<Env = unknown>(
             headers: { allow: "GET", "content-type": "text/plain; charset=utf-8" },
           })
         }
+        const isDataRequest = c.req.headers.get(DATA_HEADER) !== null
+        // Before anything runs: a form posts cross-site without a preflight and carries the visitor's
+        // cookies, so an action is a CSRF target unless its route names the origins it accepts.
+        const origin = c.req.headers.get("origin")
+        const allowedOrigins = mod.allowedOrigins
+        const allowed =
+          allowedOrigins === undefined
+            ? origin === null ||
+              isSameOriginForm(origin, c.req.headers.get("sec-fetch-site"), c.req)
+            : typeof allowedOrigins === "function"
+              ? allowedOrigins(origin) === true
+              : origin !== null && allowedOrigins.includes(origin)
+        if (!allowed) {
+          return isDataRequest
+            ? Response.json(
+                { ok: false, error: "forbidden_origin" },
+                { status: 403, headers: { "cache-control": PRIVATE_NO_STORE } },
+              )
+            : new Response("Forbidden", {
+                status: 403,
+                headers: {
+                  "content-type": "text/plain; charset=utf-8",
+                  "cache-control": PRIVATE_NO_STORE,
+                },
+              })
+        }
         const requestApi = apiFor(c)
         const actionContext: LoaderContext = {
           params: c.params,
@@ -1504,11 +1638,12 @@ export function createPageRequestExecutor<Env = unknown>(
           search: loaderSearch(mod.searchSchema, c.req),
           set: controls.scope(ACTION_SCOPE),
         }
-        const isDataRequest = c.req.headers.get(DATA_HEADER) !== null
         let gated: GatedLayouts
         let result: unknown
         try {
-          if (route.middlewareIds !== undefined) await runMiddleware(route, actionContext, controls)
+          if (route.middlewareIds !== undefined || localeGuarded(route)) {
+            await runMiddleware(route, actionContext, controls)
+          }
           gated = await runLayoutGates(route, actionContext, controls)
           result = await mod.action(actionContext)
         } catch (err) {
@@ -1697,6 +1832,8 @@ export function createPageRequestExecutor<Env = unknown>(
           ...preloadOf(route.id),
           ...stylesOf(route.id),
           ...prerenderedHandover,
+          ...copyOption,
+          ...localeOption(c.req),
           ...(responseHeaders === undefined ? {} : { headers: responseHeaders }),
           ...(nonce === undefined ? {} : { nonce }),
           ...cspOption,

package/src/internal/parity.ts

@@ -586,6 +586,17 @@ const linkedRepoBoundary = async (packageRoot: string): Promise<string> => {
   return packageRoot
 }
 
+/** Where a real package folder lives when only its files are links: Bun installs a `file:` folder
+ * dependency as a directory of per-file symlinks, so its imports resolve beside the linked files. */
+const fileLinkedDir = async (dir: string): Promise<string | undefined> => {
+  const manifest = join(dir, "package.json")
+  try {
+    return (await lstat(manifest)).isSymbolicLink() ? dirname(await realpath(manifest)) : undefined
+  } catch {
+    return undefined
+  }
+}
+
 const linkedPackageRoots = async (
   importerRoots: readonly string[],
   manifests: readonly Record<string, unknown>[],
@@ -605,8 +616,10 @@ const linkedPackageRoots = async (
       }
       const candidate = join(importerRoot, "node_modules", ...name.split("/"))
       const link = await lstat(candidate).catch(() => undefined)
-      if (link === undefined || !link.isSymbolicLink()) continue
-      const resolved = await realpath(candidate).catch(() => undefined)
+      if (link === undefined) continue
+      const resolved = link.isSymbolicLink()
+        ? await realpath(candidate).catch(() => undefined)
+        : await fileLinkedDir(candidate)
       if (resolved === undefined || pathInside(realScanRoot, resolved)) continue
       found.set(resolved, true)
     }

package/src/internal/private-env.ts

@@ -32,12 +32,12 @@ const BEFORE_EXPRESSION = new Set([
   "instanceof",
 ])
 
-type Token =
+export type Token =
   | { readonly kind: "id" | "punct" | "string"; readonly value: string }
   | { readonly kind: "other" }
 
 /** JavaScript tokens, with strings, template text, comments and regular expressions skipped. */
-function tokenize(code: string): Token[] {
+export function tokenize(code: string): Token[] {
   const tokens: Token[] = []
   // One entry per open `${`: how many `{` are open inside it.
   const templates: number[] = []
@@ -152,24 +152,37 @@ function envReads(tokens: readonly Token[]): EnvRead[] {
     const token = tokens[at]
     return token?.kind === "id" ? token.value : undefined
   }
-  /** A property read after an env object that ends at `at`: `.X` or `["X"]`. */
+  // The tokenizer reads `?.` as `.`, so `?.[` and `?.(` arrive as `.` before the bracket.
+  const open = (at: number, bracket: "[" | "("): number =>
+    is(at, "punct", ".") && is(at + 1, "punct", bracket) ? at + 1 : at
+  /** The string key of `["X"]` (or `?.["X"]`) at `at`, and the index after it. */
+  const keyAt = (at: number): { readonly key: string; readonly next: number } | undefined => {
+    const bracket = open(at, "[")
+    const key =
+      is(bracket, "punct", "[") && is(bracket + 2, "punct", "]") ? stringAt(bracket + 1) : undefined
+    return key === undefined ? undefined : { key, next: bracket + 3 }
+  }
+  /** A property read after an env object that ends at `at`: `.X`, `["X"]` or `?.["X"]`. */
   const member = (base: string, at: number, importMeta: boolean): EnvRead => {
     const property = is(at, "punct", ".") ? idAt(at + 1) : undefined
     if (property !== undefined)
       return { expression: `${base}.${property}`, name: property, importMeta }
-    const key = is(at, "punct", "[") && is(at + 2, "punct", "]") ? stringAt(at + 1) : undefined
+    const key = keyAt(at)?.key
     if (key !== undefined)
       return { expression: `${base}[${JSON.stringify(key)}]`, name: key, importMeta }
     return { expression: base, importMeta }
   }
+  /** The index after `.env`, `["env"]` or `?.["env"]` at `at`, or `-1`. */
+  const envAt = (at: number): number => {
+    if (is(at, "punct", ".") && is(at + 1, "id", "env")) return at + 2
+    const bracket = keyAt(at)
+    return bracket?.key === "env" ? bracket.next : -1
+  }
   for (let i = 0; i < tokens.length; i++) {
     const head = idAt(i)
-    if (
-      (head === "process" || head === "Bun") &&
-      is(i + 1, "punct", ".") &&
-      is(i + 2, "id", "env")
-    ) {
-      reads.push(member(`${head}.env`, i + 3, false))
+    const env = head === "process" || head === "Bun" ? envAt(i + 1) : -1
+    if (env !== -1) {
+      reads.push(member(`${head}.env`, env, false))
     } else if (
       head === "import" &&
       is(i + 1, "punct", ".") &&
@@ -180,12 +193,13 @@ function envReads(tokens: readonly Token[]): EnvRead[] {
       reads.push(member("import.meta.env", i + 5, true))
     } else if (head === "Deno" && is(i + 1, "punct", ".") && is(i + 2, "id", "env")) {
       const method = is(i + 3, "punct", ".") ? idAt(i + 4) : undefined
+      const call = open(i + 5, "(")
       const name =
-        (method === "get" || method === "has") && is(i + 5, "punct", "(")
-          ? stringAt(i + 6)
+        (method === "get" || method === "has") && is(call, "punct", "(")
+          ? stringAt(call + 1)
           : undefined
       reads.push(
-        name !== undefined && is(i + 7, "punct", ")")
+        name !== undefined && is(call + 2, "punct", ")")
           ? { expression: `Deno.env.${method}(${JSON.stringify(name)})`, name, importMeta: false }
           : {
               expression: method === undefined ? "Deno.env" : `Deno.env.${method}()`,