@pylonsync/functions 0.3.309 → 0.3.311

package/dist/runtime.d.ts

@@ -15,5 +15,5 @@
  *   needs to queue multiple RPCs per call_id.
  */
 import type { DbReader, DbWriter } from "./types";
-export declare function buildDbReader(callId: string): DbReader;
+export declare function buildDbReader(callId: string, ssrRead?: boolean): DbReader;
 export declare function buildDbWriter(callId: string): DbWriter;

package/dist/ssr-runtime.d.ts

@@ -101,6 +101,7 @@ export interface SsrCookieOptions {
     expires?: Date | string;
     /** Defaults to true (secure default). Pass false for a client-readable cookie. */
     httpOnly?: boolean;
+    /** Defaults to true in prod / false in dev. Forced true when sameSite="none". */
     secure?: boolean;
     /** Defaults to "lax". */
     sameSite?: "strict" | "lax" | "none";
@@ -181,7 +182,7 @@ export declare function makeRevocableReadTrackingProxy(obj: Record<string, unkno
     proxy: Record<string, unknown>;
     revoke: () => void;
 };
-export declare function finalizeHeaders(state: ResponseState, extra?: Record<string, string>, internal?: Record<string, string>): Record<string, string>;
+export declare function finalizeHeaders(state: ResponseState, extra?: Record<string, string>, internal?: Record<string, string>, effectiveStatus?: number): Record<string, string>;
 /**
  * Phase 1 SSR handler. Resolves the component, renders it via
  * react-dom/server.renderToReadableStream, pumps chunks back to the
@@ -341,6 +342,14 @@ export declare function applyAutoSocialImages(component: string, headers: Record
  * marker + probe are in place before the deferred client entry boots the sync
  * engine. `<` is escaped so the JSON can't break out of the script.
  */
+/**
+ * Escape a JSON string so it can't break out of a `<script>` element: `<`
+ * closes a `</script>` (or `<!--`, `<script`); U+2028/U+2029 are JS statement
+ * terminators (valid in JSON, not in a JS string literal). Applied to every
+ * server-serialized blob embedded in a script tag \u2014 the `application/json`
+ * data blobs AND the executable fallback warning.
+ */
+export declare function escapeScriptJson(json: string): string;
 export declare function buildDevHudChunk(devInfo: Record<string, unknown>): string;
 /**
  * Build the hydration tail appended after React's stream EOFs: the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/functions",
-  "version": "0.3.309",
+  "version": "0.3.311",
   "description": "TypeScript function runtime for pylon — defines server-side queries, mutations, and actions.",
   "type": "module",
   "main": "src/index.ts",

package/src/runtime.ts

@@ -391,11 +391,24 @@ function rpc(callId: string, msg: Record<string, unknown>): Promise<unknown> {
 // `serverData` read handle that reuses this module's `send` + `pendingRpcs`
 // + reader loop. The render call_id ("r_<n>") correlates DB replies back
 // through the shared pendingRpcs map.
-export function buildDbReader(callId: string): DbReader {
-  return { ...buildReaderOps(callId, false), unsafe: buildReaderOps(callId, true) };
+export function buildDbReader(callId: string, ssrRead = false): DbReader {
+  return {
+    ...buildReaderOps(callId, false, ssrRead),
+    unsafe: buildReaderOps(callId, true, ssrRead),
+  };
 }
 
-function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsafe"> {
+function buildReaderOps(
+  callId: string,
+  unsafeOp: boolean,
+  // `ssrRead`: true when the reader backs SSR `serverData.*` (results are
+  // serialized into the client-visible `__PYLON_DATA__` blob). The Rust side
+  // then applies the same per-row policy filter + `server_only`/`passwordHash`
+  // projection the entity/sync read API does — UNLESS `unsafe_op` is also set
+  // (`serverData.unsafe.*` stays server-trust). Server-function `ctx.db.*`
+  // leaves it false and reads raw.
+  ssrRead = false,
+): Omit<DbReader, "unsafe"> {
   // All DB ops use rpcDb so Promise.all over ctx.db reads can run in
   // parallel without colliding on the outer call_id key.
   //
@@ -412,6 +425,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         entity,
         id,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async list(entity) {
@@ -420,6 +434,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         op: "list",
         entity,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async lookup(entity, field, value) {
@@ -430,6 +445,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         field,
         value,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async query(entity, filter) {
@@ -439,6 +455,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         entity,
         data: filter,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async queryGraph(query) {
@@ -448,6 +465,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         entity: "",
         data: query,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async paginate(entity, opts) {
@@ -461,6 +479,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         after: opts.cursor ?? undefined,
         limit: numItems,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
     async search(entity, query) {
@@ -470,6 +489,7 @@ function buildReaderOps(callId: string, unsafeOp: boolean): Omit<DbReader, "unsa
         entity,
         data: query,
         unsafe_op: unsafeOp,
+        ssr_read: ssrRead,
       })) as any;
     },
   };
@@ -1057,11 +1077,15 @@ async function main() {
   send({ type: "ready", functions });
 
   // Belt-and-suspenders against orphaning: if the host dies in a way that
-  // somehow leaves our stdin open, we'll have been reparented to init
-  // (ppid === 1). Notice and exit. Unref'd so it never keeps us alive on its
-  // own.
+  // somehow leaves our stdin open, we'll have been REPARENTED — our ppid
+  // changes (to init or the nearest subreaper). Compare against the ppid we
+  // were born with rather than testing `ppid === 1`: in a container the
+  // host pylon usually IS PID 1, so every healthy runner is born with
+  // ppid 1 and the equality check kills the whole pool in a 2s respawn
+  // loop. Unref'd so the watch never keeps us alive on its own.
+  const initialPpid = process.ppid;
   const orphanWatch = setInterval(() => {
-    if (process.ppid === 1) process.exit(0);
+    if (process.ppid !== initialPpid) process.exit(0);
   }, 2000);
   if (typeof orphanWatch.unref === "function") orphanWatch.unref();
 

package/src/ssr-form-runtime.ts

@@ -19,6 +19,7 @@ import {
   PylonRouteControl,
   finalizeHeaders,
   importModule,
+  isDevMode,
   type ResponseState,
 } from "./ssr-runtime";
 import { buildDbWriter } from "./runtime";
@@ -81,8 +82,9 @@ function makeFormFields(raw: Record<string, string | string[]>): FormFields {
 // the list drives the 405 `Allow` header advertising which a route.ts exports.
 const HANDLER_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"] as const;
 const b64 = (s: string) => Buffer.from(s, "utf8").toString("base64");
-const isDev = () =>
-  process.env.PYLON_DEV_MODE === "1" || process.env.PYLON_DEV_MODE === "true";
+// Share ONE dev-mode parse with ssr-runtime (case-insensitive "1"/"true") so
+// the form path and the render path never disagree on whether to leak stacks.
+const isDev = isDevMode;
 
 export async function handleForm(
   msg: HandleFormMessage,
@@ -172,11 +174,15 @@ export async function handleForm(
       for (const [k, v] of Object.entries(raw.headers ?? {})) {
         extra[k.toLowerCase()] = String(v);
       }
+      const rawStatus = raw.status ?? responseState.status;
       send({
         type: "response_start",
         call_id: msg.call_id,
-        status: raw.status ?? responseState.status,
-        headers: finalizeHeaders(responseState, extra),
+        status: rawStatus,
+        // Pass rawStatus so the open-redirect guard sees the handler's own
+        // status (a raw GET's redirect status lives on `raw.status`, not
+        // `responseState.status`).
+        headers: finalizeHeaders(responseState, extra, undefined, rawStatus),
       });
       if (raw.body != null) {
         const bodyStr =

package/src/ssr-runtime.test.ts

@@ -15,6 +15,7 @@ import {
   asRouteControl,
   PylonRouteControl,
   finalizeHeaders,
+  escapeScriptJson,
   makeResponseController,
   makeReadTrackingProxy,
   makeRevocableReadTrackingProxy,
@@ -127,6 +128,54 @@ describe("reserved x-pylon-* header namespace (cache-proof forgery fence)", () =
     expect(out2["x-pylon-cacheable"]).toBeUndefined();
   });
 
+  test("finalizeHeaders: 3xx open-redirect guard on setHeader('location') / returned headers", () => {
+    const st = (status: number, location: string) => ({
+      status,
+      headers: { location } as Record<string, string>,
+      cookies: [] as string[],
+    });
+
+    // An off-site absolute Location on a 3xx (set via setHeader or a route
+    // handler's returned headers) is refused — the same rule redirect() applies.
+    expect(() => finalizeHeaders(st(302, "https://evil.example/steal"))).toThrow(
+      /open redirect/i,
+    );
+    // Protocol-relative `//host` is the classic bypass — also refused.
+    expect(() => finalizeHeaders(st(307, "//evil.example"))).toThrow(/open redirect/i);
+    // A backslash variant that browsers normalize cross-origin — refused.
+    expect(() => finalizeHeaders(st(303, "/\\evil.example"))).toThrow(/open redirect/i);
+
+    // A same-site relative path is fine and passes through unchanged.
+    expect(finalizeHeaders(st(302, "/dashboard"))["location"]).toBe("/dashboard");
+
+    // Case-insensitive header name is still caught (host lowercases, but guard
+    // must not depend on that).
+    expect(() =>
+      finalizeHeaders({
+        status: 302,
+        headers: { Location: "https://evil.example" } as Record<string, string>,
+        cookies: [],
+      }),
+    ).toThrow(/open redirect/i);
+
+    // NON-3xx status → `location` is just a header, not a redirect: no guard.
+    expect(
+      finalizeHeaders(st(200, "https://evil.example"))["location"],
+    ).toBe("https://evil.example");
+
+    // A raw `route.ts` GET returns its OWN status via the `effectiveStatus`
+    // arg — an off-site Location there is still refused even though
+    // `state.status` is 200.
+    expect(() =>
+      finalizeHeaders(
+        { status: 200, headers: {}, cookies: [] },
+        { location: "https://evil.example" },
+        undefined,
+        302,
+      ),
+    ).toThrow(/open redirect/i);
+  });
+
   test("makeReadTrackingProxy trips on get / in / Object.keys / descriptor / spread", () => {
     const probes: Array<(o: any) => unknown> = [
       (o) => o.host,
@@ -702,3 +751,68 @@ describe("isSafeRedirect — open-redirect guard for response.redirect()", () =>
     expect(isSafeRedirect("https://app.example.com/x", {})).toBe(false);
   });
 });
+
+describe("script-escaping + secure cookies", () => {
+  test("escapeScriptJson neutralizes a </script> breakout", () => {
+    const out = escapeScriptJson(JSON.stringify("</script><script>alert(1)</script>"));
+    expect(out).not.toContain("<");
+    expect(out).toContain("\\u003c");
+  });
+
+  test("buildHydrationTail fallback warn script escapes manifestErr", () => {
+    const tail = buildHydrationTail({
+      component: "app/x/page",
+      layouts: [],
+      props: {},
+      ssrData: {},
+      manifestRoute: null,
+      publicPrefix: "/_pylon/build/",
+      manifestErr: 'no entry for "</script><script>evil</script>"',
+    });
+    const warn = tail.slice(tail.indexOf("console.warn"));
+    // The executable fallback must escape the error — no raw injected tag.
+    expect(warn).not.toContain("<script>evil");
+    expect(warn).toContain("\\u003c");
+  });
+
+  test("serializeCookie: Secure defaults + SameSite=None forces Secure", () => {
+    const mk = () => {
+      const s = { status: 200, headers: {}, cookies: [] as string[] };
+      return { s, r: makeResponseController(s) };
+    };
+    const prev = process.env.PYLON_DEV_MODE;
+    try {
+      // Prod (dev off): Secure defaults ON.
+      delete process.env.PYLON_DEV_MODE;
+      {
+        const { s, r } = mk();
+        r.setCookie("a", "1");
+        expect(s.cookies[0]).toContain("; Secure");
+        expect(s.cookies[0]).toContain("; HttpOnly");
+      }
+      // Explicit secure:false (non-None) wins even in prod.
+      {
+        const { s, r } = mk();
+        r.setCookie("a", "1", { secure: false });
+        expect(s.cookies[0]).not.toContain("; Secure");
+      }
+      // Dev: Secure defaults OFF so http://localhost keeps the cookie.
+      process.env.PYLON_DEV_MODE = "1";
+      {
+        const { s, r } = mk();
+        r.setCookie("a", "1");
+        expect(s.cookies[0]).not.toContain("; Secure");
+      }
+      // SameSite=None forces Secure even in dev (browsers drop it otherwise).
+      {
+        const { s, r } = mk();
+        r.setCookie("a", "1", { sameSite: "none" });
+        expect(s.cookies[0]).toContain("; Secure");
+        expect(s.cookies[0]).toContain("SameSite=None");
+      }
+    } finally {
+      if (prev === undefined) delete process.env.PYLON_DEV_MODE;
+      else process.env.PYLON_DEV_MODE = prev;
+    }
+  });
+});

package/src/ssr-runtime.ts

@@ -146,6 +146,7 @@ export interface SsrCookieOptions {
   expires?: Date | string;
   /** Defaults to true (secure default). Pass false for a client-readable cookie. */
   httpOnly?: boolean;
+  /** Defaults to true in prod / false in dev. Forced true when sameSite="none". */
   secure?: boolean;
   /** Defaults to "lax". */
   sameSite?: "strict" | "lax" | "none";
@@ -194,8 +195,13 @@ function serializeCookie(
     c += `; Domain=${opts.domain}`;
   }
   if (opts.httpOnly !== false) c += `; HttpOnly`;
-  if (opts.secure) c += `; Secure`;
   const ss = opts.sameSite ?? "lax";
+  // `Secure` defaults ON in prod (mirrors the framework session cookie), OFF in
+  // dev so an http://localhost cookie isn't dropped. `SameSite=None` REQUIRES
+  // `Secure` — browsers silently drop a None cookie without it — so force it
+  // there regardless of the caller / dev mode.
+  const secure = ss === "none" ? true : (opts.secure ?? !isDevMode());
+  if (secure) c += `; Secure`;
   c += `; SameSite=${ss[0].toUpperCase()}${ss.slice(1)}`;
   return c;
 }
@@ -385,6 +391,10 @@ export function finalizeHeaders(
   // TRUSTED runtime headers (e.g. the #277 `x-pylon-cacheable` proof). The ONLY
   // legitimate source of `x-pylon-*`; merged last and never stripped.
   internal?: Record<string, string>,
+  // The status this header map ships with, when it isn't `state.status` (a raw
+  // `route.ts` GET handler returns its own status). Used for the open-redirect
+  // guard below. Defaults to `state.status`.
+  effectiveStatus?: number,
 ): Record<string, string> {
   // The host TRUSTS `x-pylon-*` headers (cache verdict, etc.). They must come
   // ONLY from `internal` — strip them from BOTH page-set headers AND `extra` so
@@ -402,6 +412,34 @@ export function finalizeHeaders(
   mergeStripped(state.headers);
   mergeStripped(extra);
   if (internal) Object.assign(h, internal); // trusted, never stripped
+  // SECURITY: open-redirect guard. A 3xx response's `Location` must be same-site
+  // or a trusted host — the SAME rule `response.redirect()` enforces — no matter
+  // how it was set: `response.setHeader("location", …)`, a `route.ts` handler's
+  // returned `headers`, or a `location` in `extra`. Those paths skip
+  // `redirect()`'s check, so without this a request-derived value becomes an
+  // off-site redirect. Fail loud (throws → 500/error boundary) rather than
+  // silently emitting the redirect. The `redirect()`/route-control paths pass an
+  // already-validated URL, so re-checking them here is a safe no-op.
+  const status = effectiveStatus ?? state.status;
+  if (status >= 300 && status < 400) {
+    const locKey = Object.keys(h).find((k) => k.toLowerCase() === "location");
+    if (locKey != null) {
+      const env = (globalThis as any).process?.env ?? {};
+      if (
+        !isSafeRedirect(h[locKey], {
+          publicUrl: env.PYLON_PUBLIC_URL,
+          canonicalHost: env.PYLON_CANONICAL_HOST,
+          trustedHostsCsv: env.PYLON_TRUSTED_HOSTS,
+        })
+      ) {
+        throw new Error(
+          `pylon ssr: refused an untrusted redirect target ${JSON.stringify(h[locKey])} ` +
+            `in a ${status} response — use a same-site path (e.g. "/dashboard") or add the ` +
+            `host to PYLON_TRUSTED_HOSTS. (Refusing to emit an open redirect.)`,
+        );
+      }
+    }
+  }
   if (!h["content-type"]) h["content-type"] = "text/html; charset=utf-8";
   if (state.cookies.length > 0) {
     // Preserve a set-cookie value set via setHeader() (rare) and join it
@@ -1485,11 +1523,22 @@ function pylonDevHud() {
  * marker + probe are in place before the deferred client entry boots the sync
  * engine. `<` is escaped so the JSON can't break out of the script.
  */
-export function buildDevHudChunk(devInfo: Record<string, unknown>): string {
-  const json = JSON.stringify(devInfo)
+/**
+ * Escape a JSON string so it can't break out of a `<script>` element: `<`
+ * closes a `</script>` (or `<!--`, `<script`); U+2028/U+2029 are JS statement
+ * terminators (valid in JSON, not in a JS string literal). Applied to every
+ * server-serialized blob embedded in a script tag \u2014 the `application/json`
+ * data blobs AND the executable fallback warning.
+ */
+export function escapeScriptJson(json: string): string {
+  return json
     .replace(/</g, "\\u003c")
     .replace(/\u2028/g, "\\u2028")
     .replace(/\u2029/g, "\\u2029");
+}
+
+export function buildDevHudChunk(devInfo: Record<string, unknown>): string {
+  const json = escapeScriptJson(JSON.stringify(devInfo));
   return (
     `<script id="__PYLON_DEV__" type="application/json">${json}</script>` +
     `<script>(${pylonDevHud.toString()})();</script>`
@@ -1629,13 +1678,7 @@ export function buildHydrationTail(args: {
     ssrData: args.ssrData,
   };
   if (args.kind) hydrationPayload.kind = args.kind;
-  // Escape `<` (closes a </script> breakout) + U+2028/U+2029 (JSON-valid but
-  // JS statement terminators). Regex form keeps the separators visible in
-  // source rather than as invisible literals.
-  const json = JSON.stringify(hydrationPayload)
-    .replace(/</g, "\\u003c")
-    .replace(/\u2028/g, "\\u2028")
-    .replace(/\u2029/g, "\\u2029");
+  const json = escapeScriptJson(JSON.stringify(hydrationPayload));
   let tail = `<script id="__PYLON_DATA__" type="application/json">${json}</script>`;
   if (args.manifestRoute) {
     // A cross-origin CDN module (`public_prefix` is an absolute http(s) URL) is
@@ -1645,7 +1688,10 @@ export function buildHydrationTail(args: {
     const co = /^https?:\/\//i.test(args.publicPrefix) ? " crossorigin" : "";
     tail += `<script type="module"${co} src="${args.publicPrefix}${args.manifestRoute.file}"></script>`;
   } else {
-    tail += `<script>console.warn(${JSON.stringify(`[pylon ssr] hydration disabled: ${args.manifestErr}`)})</script>`;
+    // Executable script → the serialized message MUST be script-escaped
+    // (`manifestErr` is server-derived today, but this is the one script sink
+    // that would otherwise skip the `<`-escape every other blob applies).
+    tail += `<script>console.warn(${escapeScriptJson(JSON.stringify(`[pylon ssr] hydration disabled: ${args.manifestErr}`))})</script>`;
   }
   if (isDevMode()) tail += DEV_LIVE_RELOAD_SNIPPET;
   return tail;
@@ -2397,8 +2443,12 @@ export async function handleRenderRoute(
     // cached so `use()` doesn't re-suspend forever; resolved values land in
     // `ssrValueCache` for hydration replay.
     const { buildDbReader } = await import("./runtime");
+    // `ssrRead: true` — serverData results are serialized into the
+    // client-visible `__PYLON_DATA__` blob, so the host applies the same
+    // per-row policy filter + `server_only`/`passwordHash` projection the
+    // entity/sync read API does. `serverData.unsafe.*` stays server-trust.
     const serverData = makeServerData(
-      buildDbReader(msg.call_id),
+      buildDbReader(msg.call_id, true),
       ssrValueCache,
     );