@pylonsync/functions 0.3.309 → 0.3.310

package/dist/runtime.d.ts

@@ -15,5 +15,5 @@
  *   needs to queue multiple RPCs per call_id.
  */
 import type { DbReader, DbWriter } from "./types";
-export declare function buildDbReader(callId: string): DbReader;
+export declare function buildDbReader(callId: string, ssrRead?: boolean): DbReader;
 export declare function buildDbWriter(callId: string): DbWriter;

package/dist/ssr-runtime.d.ts

@@ -181,7 +181,7 @@ export declare function makeRevocableReadTrackingProxy(obj: Record<string, unkno
     proxy: Record<string, unknown>;
     revoke: () => void;
 };
-export declare function finalizeHeaders(state: ResponseState, extra?: Record<string, string>, internal?: Record<string, string>): Record<string, string>;
+export declare function finalizeHeaders(state: ResponseState, extra?: Record<string, string>, internal?: Record<string, string>, effectiveStatus?: number): Record<string, string>;
 /**
  * Phase 1 SSR handler. Resolves the component, renders it via
  * react-dom/server.renderToReadableStream, pumps chunks back to the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/functions",
-  "version": "0.3.309",
+  "version": "0.3.310",
   "description": "TypeScript function runtime for pylon — defines server-side queries, mutations, and actions.",
   "type": "module",
   "main": "src/index.ts",

package/src/runtime.ts

@@ -391,11 +391,24 @@ function rpc(callId: string, msg: Record<string, unknown>): Promise<unknown> {
 // `serverData` read handle that reuses this module's `send` + `pendingRpcs`
 // + reader loop. The render call_id ("r_<n>") correlates DB replies back
 // through the shared pendingRpcs map.
-export function buildDbReader(callId: string): DbReader {
-  return { ...buildReaderOps(callId, false), unsafe: buildReaderOps(callId, true) };
+export function buildDbReader(callId: string, ssrRead = false): DbReader {
+  return {
+    ...buildReaderOps(callId, false, ssrRead),
+    unsafe: buildReaderOps(callId, true, ssrRead),
+  };
 }
 
-function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsafe"> {
+function buildReaderOps(
+  callId: string,
+  unsafeOp: boolean,
+  // `ssrRead`: true when the reader backs SSR `serverData.*` (results are
+  // serialized into the client-visible `__PYLON_DATA__` blob). The Rust side
+  // then applies the same per-row policy filter + `server_only`/`passwordHash`
+  // projection the entity/sync read API does — UNLESS `unsafe_op` is also set
+  // (`serverData.unsafe.*` stays server-trust). Server-function `ctx.db.*`
+  // leaves it false and reads raw.
+  ssrRead = false,
+): Omit<DbReader, "unsafe"> {
   // All DB ops use rpcDb so Promise.all over ctx.db reads can run in
   // parallel without colliding on the outer call_id key.
   //
@@ -412,6 +425,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         entity,
         id,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async list(entity) {
@@ -420,6 +434,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         op: "list",
         entity,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async lookup(entity, field, value) {
@@ -430,6 +445,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         field,
         value,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async query(entity, filter) {
@@ -439,6 +455,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         entity,
         data: filter,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async queryGraph(query) {
@@ -448,6 +465,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         entity: "",
         data: query,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async paginate(entity, opts) {
@@ -461,6 +479,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         after: opts.cursor ?? undefined,
         limit: numItems,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async search(entity, query) {
@@ -470,6 +489,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         entity,
         data: query,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
   };
@@ -1057,11 +1077,15 @@ async function main() {
   send({ type: "ready", functions });
 
   // Belt-and-suspenders against orphaning: if the host dies in a way that
-  // somehow leaves our stdin open, we'll have been reparented to init
-  // (ppid === 1). Notice and exit. Unref'd so it never keeps us alive on its
-  // own.
+  // somehow leaves our stdin open, we'll have been REPARENTED — our ppid
+  // changes (to init or the nearest subreaper). Compare against the ppid we
+  // were born with rather than testing `ppid === 1`: in a container the
+  // host pylon usually IS PID 1, so every healthy runner is born with
+  // ppid 1 and the equality check kills the whole pool in a 2s respawn
+  // loop. Unref'd so the watch never keeps us alive on its own.
+  const initialPpid = process.ppid;
   const orphanWatch = setInterval(() => {
-    if (process.ppid === 1) process.exit(0);
+    if (process.ppid !== initialPpid) process.exit(0);
   }, 2000);
   if (typeof orphanWatch.unref === "function") orphanWatch.unref();
 

package/src/ssr-form-runtime.ts

@@ -172,11 +172,15 @@ export async function handleForm(
       for (const [k, v] of Object.entries(raw.headers ?? {})) {
         extra[k.toLowerCase()] = String(v);
       }
+      const rawStatus = raw.status ?? responseState.status;
       send({
         type: "response_start",
         call_id: msg.call_id,
-        status: raw.status ?? responseState.status,
-        headers: finalizeHeaders(responseState, extra),
+        status: rawStatus,
+        // Pass rawStatus so the open-redirect guard sees the handler's own
+        // status (a raw GET's redirect status lives on `raw.status`, not
+        // `responseState.status`).
+        headers: finalizeHeaders(responseState, extra, undefined, rawStatus),
       });
       if (raw.body != null) {
         const bodyStr =

package/src/ssr-runtime.test.ts

@@ -127,6 +127,54 @@ describe("reserved x-pylon-* header namespace (cache-proof forgery fence)", () =
     expect(out2["x-pylon-cacheable"]).toBeUndefined();
   });
 
+  test("finalizeHeaders: 3xx open-redirect guard on setHeader('location') / returned headers", () => {
+    const st = (status: number, location: string) => ({
+      status,
+      headers: { location } as Record<string, string>,
+      cookies: [] as string[],
+    });
+
+    // An off-site absolute Location on a 3xx (set via setHeader or a route
+    // handler's returned headers) is refused — the same rule redirect() applies.
+    expect(() => finalizeHeaders(st(302, "https://evil.example/steal"))).toThrow(
+      /open redirect/i,
+    );
+    // Protocol-relative `//host` is the classic bypass — also refused.
+    expect(() => finalizeHeaders(st(307, "//evil.example"))).toThrow(/open redirect/i);
+    // A backslash variant that browsers normalize cross-origin — refused.
+    expect(() => finalizeHeaders(st(303, "/\\evil.example"))).toThrow(/open redirect/i);
+
+    // A same-site relative path is fine and passes through unchanged.
+    expect(finalizeHeaders(st(302, "/dashboard"))["location"]).toBe("/dashboard");
+
+    // Case-insensitive header name is still caught (host lowercases, but guard
+    // must not depend on that).
+    expect(() =>
+      finalizeHeaders({
+        status: 302,
+        headers: { Location: "https://evil.example" } as Record<string, string>,
+        cookies: [],
+      }),
+    ).toThrow(/open redirect/i);
+
+    // NON-3xx status → `location` is just a header, not a redirect: no guard.
+    expect(
+      finalizeHeaders(st(200, "https://evil.example"))["location"],
+    ).toBe("https://evil.example");
+
+    // A raw `route.ts` GET returns its OWN status via the `effectiveStatus`
+    // arg — an off-site Location there is still refused even though
+    // `state.status` is 200.
+    expect(() =>
+      finalizeHeaders(
+        { status: 200, headers: {}, cookies: [] },
+        { location: "https://evil.example" },
+        undefined,
+        302,
+      ),
+    ).toThrow(/open redirect/i);
+  });
+
   test("makeReadTrackingProxy trips on get / in / Object.keys / descriptor / spread", () => {
     const probes: Array<(o: any) => unknown> = [
       (o) => o.host,

package/src/ssr-runtime.ts

@@ -385,6 +385,10 @@ export function finalizeHeaders(
   // TRUSTED runtime headers (e.g. the #277 `x-pylon-cacheable` proof). The ONLY
   // legitimate source of `x-pylon-*`; merged last and never stripped.
   internal?: Record<string, string>,
+  // The status this header map ships with, when it isn't `state.status` (a raw
+  // `route.ts` GET handler returns its own status). Used for the open-redirect
+  // guard below. Defaults to `state.status`.
+  effectiveStatus?: number,
 ): Record<string, string> {
   // The host TRUSTS `x-pylon-*` headers (cache verdict, etc.). They must come
   // ONLY from `internal` — strip them from BOTH page-set headers AND `extra` so
@@ -402,6 +406,34 @@ export function finalizeHeaders(
   mergeStripped(state.headers);
   mergeStripped(extra);
   if (internal) Object.assign(h, internal); // trusted, never stripped
+  // SECURITY: open-redirect guard. A 3xx response's `Location` must be same-site
+  // or a trusted host — the SAME rule `response.redirect()` enforces — no matter
+  // how it was set: `response.setHeader("location", …)`, a `route.ts` handler's
+  // returned `headers`, or a `location` in `extra`. Those paths skip
+  // `redirect()`'s check, so without this a request-derived value becomes an
+  // off-site redirect. Fail loud (throws → 500/error boundary) rather than
+  // silently emitting the redirect. The `redirect()`/route-control paths pass an
+  // already-validated URL, so re-checking them here is a safe no-op.
+  const status = effectiveStatus ?? state.status;
+  if (status >= 300 && status < 400) {
+    const locKey = Object.keys(h).find((k) => k.toLowerCase() === "location");
+    if (locKey != null) {
+      const env = (globalThis as any).process?.env ?? {};
+      if (
+        !isSafeRedirect(h[locKey], {
+          publicUrl: env.PYLON_PUBLIC_URL,
+          canonicalHost: env.PYLON_CANONICAL_HOST,
+          trustedHostsCsv: env.PYLON_TRUSTED_HOSTS,
+        })
+      ) {
+        throw new Error(
+          `pylon ssr: refused an untrusted redirect target ${JSON.stringify(h[locKey])} ` +
+            `in a ${status} response — use a same-site path (e.g. "/dashboard") or add the ` +
+            `host to PYLON_TRUSTED_HOSTS. (Refusing to emit an open redirect.)`,
+        );
+      }
+    }
+  }
   if (!h["content-type"]) h["content-type"] = "text/html; charset=utf-8";
   if (state.cookies.length > 0) {
     // Preserve a set-cookie value set via setHeader() (rare) and join it
@@ -2397,8 +2429,12 @@ export async function handleRenderRoute(
     // cached so `use()` doesn't re-suspend forever; resolved values land in
     // `ssrValueCache` for hydration replay.
     const { buildDbReader } = await import("./runtime");
+    // `ssrRead: true` — serverData results are serialized into the
+    // client-visible `__PYLON_DATA__` blob, so the host applies the same
+    // per-row policy filter + `server_only`/`passwordHash` projection the
+    // entity/sync read API does. `serverData.unsafe.*` stays server-trust.
     const serverData = makeServerData(
-      buildDbReader(msg.call_id),
+      buildDbReader(msg.call_id, true),
       ssrValueCache,
     );