@reckona/mreact-router 0.0.141 → 0.0.143

package/src/adapters/cloudflare.ts

@@ -5,6 +5,7 @@ import {
   __MREACT_QUERY_STATE_SCRIPT_ID,
   createQueryClient,
   dehydrate,
+  isQueryClientScopeUnavailableError,
   runWithQueryClient,
   type DehydratedQueryClient,
   type QueryClient,
@@ -26,7 +27,9 @@ import {
 } from "../logger.js";
 import { normalizeRoutePath } from "../route-path.js";
 import type { AppRoute } from "../routes.js";
+import { contentSecurityPolicy } from "../csp.js";
 import { isNotFoundError } from "../navigation.js";
+import { validateRouteMetadata } from "../metadata.js";
 import { routeSecurityHeaders } from "../security-headers.js";
 import type { AppRouterPrerenderStore } from "../serve.js";
 import { emitRouterDevtoolsEvent } from "./devtools.js";
@@ -361,7 +364,7 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
       data =
         pageModule.loader === undefined
           ? undefined
-          : await runWithQueryClient(queryClient, () => pageModule.loader!(loaderContext));
+          : await runWithCloudflareQueryClient(queryClient, () => pageModule.loader!(loaderContext));
     } catch (error) {
       if (error instanceof Response) {
         return error;
@@ -382,7 +385,7 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
     let rendered: Awaited<ReturnType<typeof component>>;
 
     try {
-      rendered = await runWithQueryClient(queryClient, () => component(props));
+      rendered = await runWithCloudflareQueryClient(queryClient, () => component(props));
     } catch (error) {
       if (isNotFoundError(error)) {
         return cloudflareNotFoundResponse(request);
@@ -391,14 +394,15 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
       throw error;
     }
 
+    const metadata = await runWithCloudflareQueryClient(queryClient, () =>
+      resolveCloudflareRouteMetadata([pageModule], props),
+    );
+
     if (rendered instanceof Response) {
-      return withDefaultSecurityHeaders(rendered, request);
+      return withDefaultSecurityHeaders(rendered, request, metadata);
     }
 
     const modulePreload = cloudflareModulePreloadTag(context.clientManifest, context.route.path);
-    const metadata = await runWithQueryClient(queryClient, () =>
-      resolveCloudflareRouteMetadata([pageModule], props),
-    );
     const body = withCloudflareHydrationMarkers({
       data,
       html: rendered,
@@ -410,7 +414,7 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
     const documented =
       options.document === undefined
         ? defaultCloudflareDocument(body, modulePreload, metadata)
-        : await runWithQueryClient(queryClient, () =>
+        : await runWithCloudflareQueryClient(queryClient, () =>
             options.document!({
               ...props,
               body,
@@ -429,6 +433,7 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
             headers: { "content-type": "text/html; charset=utf-8" },
           }),
       request,
+      metadata,
     );
   };
 }
@@ -469,6 +474,18 @@ function injectCloudflareQueryStateScript(html: string, state: DehydratedQueryCl
     : `${html}${script}`;
 }
 
+function runWithCloudflareQueryClient<T>(queryClient: QueryClient, fn: () => T): T {
+  try {
+    return runWithQueryClient(queryClient, fn);
+  } catch (error) {
+    if (isQueryClientScopeUnavailableError(error)) {
+      return fn();
+    }
+
+    throw error;
+  }
+}
+
 async function dispatchCloudflareServerRoute<Env>(
   module: CloudflareServerRouteModule<Env>,
   request: Request,
@@ -675,10 +692,25 @@ function cloudflareDocumentReloadNavigationResponse(): Response {
   });
 }
 
-function withDefaultSecurityHeaders(response: Response, request: Request): Response {
+function withDefaultSecurityHeaders(
+  response: Response,
+  request: Request,
+  metadata?: RouteMetadata | undefined,
+): Response {
   const headers = new Headers(response.headers);
+  const csp = contentSecurityPolicy(metadata?.csp);
 
-  for (const [name, value] of Object.entries(routeSecurityHeaders({ request, security: undefined }))) {
+  if (
+    isHtmlContentType(headers.get("content-type")) &&
+    csp !== undefined &&
+    !headers.has("content-security-policy")
+  ) {
+    headers.set("content-security-policy", csp);
+  }
+
+  for (const [name, value] of Object.entries(
+    routeSecurityHeaders({ request, security: metadata?.security }),
+  )) {
     if (!headers.has(name)) {
       headers.set(name, value);
     }
@@ -1343,11 +1375,15 @@ async function resolveCloudflareRouteMetadata<Data, Env>(
   const metadata: RouteMetadata[] = [];
 
   for (const module of modules) {
-    let next = module.metadata;
+    let next = validateRouteMetadata(module.metadata);
 
     if (module.generateMetadata !== undefined) {
       const generated = await module.generateMetadata(context);
-      next = mergeCloudflareRouteMetadata([next, generated].filter(isCloudflareRouteMetadata));
+      next = mergeCloudflareRouteMetadata(
+        [next, validateRouteMetadata(generated, "generateMetadata")].filter(
+          isCloudflareRouteMetadata,
+        ),
+      );
     }
 
     if (next !== undefined) {
@@ -1355,7 +1391,7 @@ async function resolveCloudflareRouteMetadata<Data, Env>(
     }
   }
 
-  return mergeCloudflareRouteMetadata(metadata);
+  return validateRouteMetadata(mergeCloudflareRouteMetadata(metadata));
 }
 
 function isCloudflareRouteMetadata(value: RouteMetadata | undefined): value is RouteMetadata {