@reckona/mreact-router 0.0.131 → 0.0.134

package/src/routes.ts

@@ -262,7 +262,7 @@ async function collectRouteFiles(directory: string, rootDirectory = directory):
 }
 
 function shouldSkipRouteScanDirectory(name: string): boolean {
-  return name === ".vite" || name === "node_modules";
+  return name === ".vite" || name === "__tests__" || name === "node_modules";
 }
 
 function appFileConventionForRelativeFile(

package/src/serve.ts

@@ -21,7 +21,13 @@ import {
   type RenderAppRequestOptions,
 } from "./render.js";
 import type { RouterInstrumentation } from "./trace.js";
-import { bytesResponse, htmlResponse, nodeRequestToWebRequest, sendResponse } from "./http.js";
+import {
+  bytesResponse,
+  htmlResponse,
+  nodeRequestToWebRequest,
+  rawNodeRequestUrl,
+  sendResponse,
+} from "./http.js";
 import {
   emitRouterLog,
   logDurationMs,
@@ -40,6 +46,7 @@ interface BuiltRuntime {
   appDir: string;
   allowedSourceDirs: readonly string[];
   assetBaseUrl?: string | undefined;
+  clientAssetPaths: ReadonlySet<string>;
   clientScripts: ReadonlyMap<string, string>;
   clientStylesByFile: ReadonlyMap<string, readonly string[]>;
   clientStyles: ReadonlyMap<string, readonly string[]>;
@@ -373,8 +380,14 @@ async function renderBuiltAppRequestWithRuntime(
   const url = new URL(options.request.url);
   const timing = createBuiltRenderTiming(options.logger);
 
-  if (url.pathname.startsWith("/_mreact/client/")) {
-    return readBuiltClientAsset(options.outDir, url.pathname);
+  const clientAssetPathname = builtClientAssetPathname(options.request, url);
+
+  if (clientAssetPathname !== undefined) {
+    return readBuiltClientAsset(
+      options.outDir,
+      clientAssetPathname,
+      options.runtime.clientAssetPaths,
+    );
   }
 
   if (options.request.method === "GET" || options.request.method === "HEAD") {
@@ -650,12 +663,15 @@ export async function startServer(
   };
 }
 
-async function readBuiltClientAsset(outDir: string, pathname: string): Promise<Response> {
+async function readBuiltClientAsset(
+  outDir: string,
+  pathname: string,
+  allowedPaths: ReadonlySet<string>,
+): Promise<Response> {
   const clientPrefix = "/_mreact/client/";
-  const relativePath = pathname.slice(clientPrefix.length);
-  const normalized = normalize(relativePath);
+  const normalized = safeBuiltClientAssetPath(pathname.slice(clientPrefix.length));
 
-  if (normalized.startsWith("..")) {
+  if (normalized === undefined || !allowedPaths.has(normalized)) {
     return new Response("Not Found", { status: 404 });
   }
 
@@ -670,6 +686,86 @@ async function readBuiltClientAsset(outDir: string, pathname: string): Promise<R
   }
 }
 
+function builtClientAssetPathname(request: Request, url: URL): string | undefined {
+  const rawUrl = rawNodeRequestUrl(request);
+  const rawPathname = rawUrl?.split(/[?#]/, 1)[0];
+  const pathname = rawPathname === undefined || rawPathname === "" ? url.pathname : rawPathname;
+  const normalizedPathname = pathname.startsWith("/") ? pathname : `/${pathname}`;
+
+  return normalizedPathname.startsWith("/_mreact/client/") ? normalizedPathname : undefined;
+}
+
+function safeBuiltClientAssetPath(relativePath: string): string | undefined {
+  let decoded: string;
+
+  try {
+    decoded = decodeURIComponent(relativePath);
+  } catch {
+    return undefined;
+  }
+
+  if (decoded.includes("\\") || decoded.includes("\0")) {
+    return undefined;
+  }
+
+  if (decoded.split("/").some((segment) => segment === "..")) {
+    return undefined;
+  }
+
+  const normalized = normalize(decoded);
+
+  if (isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${sep}`)) {
+    return undefined;
+  }
+
+  return normalized;
+}
+
+function builtClientAssetPaths(manifest: {
+  assets?: readonly string[] | undefined;
+  routes: readonly ClientRouteManifestEntry[];
+}): ReadonlySet<string> {
+  const paths = new Set<string>(["manifest.json"]);
+
+  for (const route of manifest.routes) {
+    for (const asset of [
+      route.script,
+      route.sourceMap,
+      route.navigationScript,
+      ...(route.css ?? []),
+      ...(route.imports ?? []),
+    ]) {
+      const path = safeClientManifestAssetPath(asset);
+
+      if (path !== undefined) {
+        paths.add(path);
+      }
+    }
+  }
+
+  for (const asset of manifest.assets ?? []) {
+    const path = safeClientManifestAssetPath(asset);
+
+    if (path !== undefined) {
+      paths.add(path);
+    }
+  }
+
+  return paths;
+}
+
+function safeClientManifestAssetPath(asset: string | undefined): string | undefined {
+  if (asset === undefined || asset === "" || asset.startsWith("/") || asset.includes("\\")) {
+    return undefined;
+  }
+
+  const segments = asset.split("/");
+
+  return segments.some((segment) => segment === "" || segment === "." || segment === "..")
+    ? undefined
+    : segments.join("/");
+}
+
 async function readBuiltPublicAsset(
   outDir: string,
   pathname: string,
@@ -734,9 +830,12 @@ async function readBuiltRuntime(options: {
     return cached.runtime;
   }
 
+  const serverManifestPath = join(outDir, "server", "manifest.json");
+  const clientManifestPath = join(outDir, "client", "manifest.json");
+  const importPolicyPath = join(outDir, "server", "import-policy.json");
   const [serverManifestText, clientManifestText, importPolicyText] = await Promise.all([
-    readFile(join(outDir, "server", "manifest.json"), "utf8"),
-    readFile(join(outDir, "client", "manifest.json"), "utf8"),
+    readRequiredBuiltArtifactText(serverManifestPath, "built app server manifest"),
+    readRequiredBuiltArtifactText(clientManifestPath, "built app client manifest"),
     readBuiltImportPolicyText(outDir),
   ]);
 
@@ -751,10 +850,13 @@ async function readBuiltRuntime(options: {
 
   const runtime = materializeBuiltRuntime({
     clientManifestText,
+    clientManifestPath,
     importPolicyText,
+    importPolicyPath,
     outDir,
     runtimeDir,
     serverManifestText,
+    serverManifestPath,
   });
 
   builtRuntimeCache.set(cacheKey, {
@@ -769,16 +871,24 @@ async function readBuiltRuntime(options: {
 
 async function materializeBuiltRuntime(options: {
   clientManifestText: string;
+  clientManifestPath: string;
+  importPolicyPath: string;
   importPolicyText: string | undefined;
   outDir: string;
   runtimeDir: string;
   serverManifestText: string;
+  serverManifestPath: string;
 }): Promise<BuiltRuntime> {
-  const serverManifest = JSON.parse(options.serverManifestText) as BuiltServerManifest;
-  const clientManifest = JSON.parse(options.clientManifestText) as {
+  const serverManifest = parseBuiltJsonArtifact<BuiltServerManifest>(
+    options.serverManifestText,
+    options.serverManifestPath,
+    "built app server manifest",
+  );
+  const clientManifest = parseBuiltJsonArtifact<{
+    assets?: readonly string[];
     routes: ClientRouteManifestEntry[];
     styles?: Array<{ css?: readonly string[]; file: string }>;
-  };
+  }>(options.clientManifestText, options.clientManifestPath, "built app client manifest");
   const appDir = await materializeBuiltServerApp(options.runtimeDir, serverManifest);
   const projectRoot = appDir;
   const routesDir = join(projectRoot, serverManifest.routesDir ?? "");
@@ -860,7 +970,10 @@ async function materializeBuiltRuntime(options: {
   const allowedSourceDirs = (serverManifest.allowedSourceDirs ?? [""]).map((directory) =>
     join(projectRoot, directory),
   );
-  const generatedImportPolicy = builtGeneratedImportPolicy(options.importPolicyText);
+  const generatedImportPolicy = builtGeneratedImportPolicy(
+    options.importPolicyText,
+    options.importPolicyPath,
+  );
 
   return {
     appDir: routesDir,
@@ -868,6 +981,7 @@ async function materializeBuiltRuntime(options: {
     ...(serverManifest.assetBaseUrl === undefined
       ? {}
       : { assetBaseUrl: serverManifest.assetBaseUrl }),
+    clientAssetPaths: builtClientAssetPaths(clientManifest),
     clientScripts,
     clientStylesByFile,
     clientStyles,
@@ -898,27 +1012,30 @@ async function materializeBuiltRuntime(options: {
 }
 
 async function readBuiltImportPolicyText(outDir: string): Promise<string | undefined> {
+  const policyPath = join(outDir, "server", "import-policy.json");
+
   try {
-    return await readFile(join(outDir, "server", "import-policy.json"), "utf8");
+    return await readFile(policyPath, "utf8");
   } catch (error) {
     if (isMissingFileError(error)) {
       return undefined;
     }
 
-    throw error;
+    throw builtArtifactReadError("built app import policy", policyPath, error);
   }
 }
 
 function builtGeneratedImportPolicy(
   importPolicyText: string | undefined,
+  importPolicyPath: string,
 ): AppRouterImportPolicy | undefined {
   if (importPolicyText === undefined) {
     return undefined;
   }
 
-  const artifact = JSON.parse(importPolicyText) as {
+  const artifact = parseBuiltJsonArtifact<{
     runtimePackages?: unknown;
-  };
+  }>(importPolicyText, importPolicyPath, "built app import policy");
   const runtimePackages = Array.isArray(artifact.runtimePackages)
     ? artifact.runtimePackages.filter((name): name is string => typeof name === "string")
     : [];
@@ -961,6 +1078,31 @@ function isMissingFileError(error: unknown): boolean {
   );
 }
 
+async function readRequiredBuiltArtifactText(labelPath: string, label: string): Promise<string> {
+  try {
+    return await readFile(labelPath, "utf8");
+  } catch (error) {
+    throw builtArtifactReadError(label, labelPath, error);
+  }
+}
+
+function builtArtifactReadError(label: string, artifactPath: string, error: unknown): Error {
+  const prefix = isMissingFileError(error) ? "Missing" : "Unable to read";
+  const detail = error instanceof Error && error.message !== "" ? `: ${error.message}` : "";
+
+  return new Error(`${prefix} ${label}: ${artifactPath}${detail}`, { cause: error });
+}
+
+function parseBuiltJsonArtifact<T>(text: string, artifactPath: string, label: string): T {
+  try {
+    return JSON.parse(text) as T;
+  } catch (error) {
+    const detail = error instanceof Error && error.message !== "" ? `: ${error.message}` : "";
+
+    throw new Error(`Invalid ${label}: ${artifactPath}${detail}`, { cause: error });
+  }
+}
+
 async function loadBuiltServerModuleArtifacts(
   runtime: BuiltRuntime,
   files: Iterable<string>,
@@ -1008,7 +1150,11 @@ async function loadBuiltServerModuleArtifact(
         mergeBuiltServerModuleArtifacts(
           existing,
           hydrateBuiltServerModuleArtifact(
-            JSON.parse(text) as BuiltServerModuleArtifact,
+            parseBuiltJsonArtifact<BuiltServerModuleArtifact>(
+              text,
+              artifactPath,
+              `built server module artifact for ${file}`,
+            ),
             builtServerDirForArtifactPath(artifactPath),
           ),
         ),
@@ -1016,6 +1162,9 @@ async function loadBuiltServerModuleArtifact(
     })
     .catch((error) => {
       runtime.serverModuleArtifactLoads.delete(`${kind}\0${file}`);
+      if (isMissingFileError(error)) {
+        throw builtArtifactReadError(`built server module artifact for ${file}`, artifactPath, error);
+      }
       throw error;
     });
   runtime.serverModuleArtifactLoads.set(`${kind}\0${file}`, loaded);

package/src/vite-plugin-cache-key.ts

@@ -1,4 +1,4 @@
-import type { PluginOption } from "vite";
+import type { PluginOption, UserConfig } from "vite";
 
 const pluginObjectIds = new WeakMap<object, number>();
 let nextPluginObjectId = 1;
@@ -13,6 +13,17 @@ export function vitePluginsCacheKey(plugins: readonly PluginOption[] | undefined
     .join("\0");
 }
 
+export function viteDefineCacheKey(define: UserConfig["define"] | undefined): string {
+  if (define === undefined) {
+    return "";
+  }
+
+  return Object.entries(define)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, value]) => `${key}:${String(value)}`)
+    .join("\0");
+}
+
 function flattenVitePluginOptions(
   options: readonly PluginOption[],
 ): Array<{ name?: string; objectId: number }> {

package/src/vite.ts

@@ -11,6 +11,7 @@ import {
   type Connect,
   type Plugin,
   type PluginOption,
+  type UserConfig,
   type ViteDevServer,
 } from "vite";
 import type { AppRouterServerActionOptions } from "./actions.js";
@@ -46,6 +47,7 @@ import { workspacePackageFile } from "./workspace-packages.js";
 
 export interface AppRouterViteMiddlewareOptions extends AppRouterProjectOptions {
   allowedHosts?: readonly string[] | undefined;
+  define?: UserConfig["define"] | undefined;
   hostPolicy?: RequestHostPolicy | undefined;
   importPolicy?: AppRouterImportPolicy | undefined;
   routeCache?: AppRouterCache | undefined;
@@ -203,6 +205,7 @@ export function createAppRouterVitePlugin(options: AppRouterVitePluginOptions):
       return () => {
         const middlewareOptions: AppRouterViteRuntimeMiddlewareOptions = {
           ...options,
+          define: server.config.define,
           navigationScanVitePlugins: userVitePlugins ?? [],
           viteDevServer: server,
           vitePlugins: server.config.plugins,
@@ -503,6 +506,7 @@ async function handleAppRouterViteRequest(
       outgoing,
       await renderAppRequest({
         appDir: project.routesDir,
+        define: options.define,
         importPolicy: {
           ...options.importPolicy,
           allowedSourceDirs: project.allowedSourceDirs,