@reckona/mreact-router 0.0.201 → 0.0.202

package/src/node-server.ts

@@ -30,6 +30,27 @@ export interface StartNodeRequestServerOptions {
     hostPolicy?: "strict" | "trusted-proxy" | undefined;
     rawHost: string | undefined;
   }) => string) | undefined;
+  trustForwardedProto?: boolean | undefined;
+}
+
+export function resolveNodeRequestProtocol(options: {
+  encrypted: boolean;
+  forwardedProto: string | readonly string[] | undefined;
+  trustForwardedProto?: boolean | undefined;
+}): "http" | "https" {
+  if (options.encrypted) {
+    return "https";
+  }
+
+  if (options.trustForwardedProto !== true) {
+    return "http";
+  }
+
+  const forwarded = Array.isArray(options.forwardedProto)
+    ? options.forwardedProto[0]
+    : options.forwardedProto;
+  const first = forwarded?.split(",", 1)[0]?.trim().toLowerCase();
+  return first === "https" ? "https" : "http";
 }
 
 export async function startNodeRequestServer(
@@ -51,7 +72,12 @@ export async function startNodeRequestServer(
         hostPolicy: options.hostPolicy,
         rawHost: incoming.headers.host,
       });
-      const request = nodeRequestToWebRequest(incoming, `http://${host}`);
+      const protocol = resolveNodeRequestProtocol({
+        encrypted: (incoming.socket as { encrypted?: boolean }).encrypted === true,
+        forwardedProto: incoming.headers["x-forwarded-proto"],
+        trustForwardedProto: options.trustForwardedProto,
+      });
+      const request = nodeRequestToWebRequest(incoming, `${protocol}://${host}`);
       const logFields = requestLogFields(request, "node");
       emitRouterLog(options.logger, "info", {
         ...logFields,

package/src/prerender-entry.ts

@@ -0,0 +1,56 @@
+import type { BuiltPrerenderedRoute } from "./build.js";
+
+export const PRERENDERED_ROUTE_SCHEMA_VERSION = 2;
+
+export function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerenderedRoute {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+
+  const entry = value as Partial<BuiltPrerenderedRoute>;
+  return (
+    entry.schemaVersion === PRERENDERED_ROUTE_SCHEMA_VERSION &&
+    isStringRecord(entry.headers) &&
+    isShareableHeaderRecord(entry.headers) &&
+    typeof entry.html === "string" &&
+    typeof entry.status === "number" &&
+    Number.isInteger(entry.status) &&
+    entry.status >= 100 &&
+    entry.status <= 599
+  );
+}
+
+export function isVisitorDependentResponse(response: Response): boolean {
+  return isVisitorDependentHeaders(response.headers);
+}
+
+function isShareableHeaderRecord(headers: Record<string, string>): boolean {
+  try {
+    return !isVisitorDependentHeaders(new Headers(headers));
+  } catch {
+    return false;
+  }
+}
+
+function isVisitorDependentHeaders(headers: Headers): boolean {
+  const cacheControl = headers.get("cache-control") ?? "";
+  const forbidsSharedStorage = cacheControl.split(",").some((directive) =>
+    /^(?:private|no-cache|no-store)(?:=|$)/i.test(directive.trim()),
+  );
+
+  return (
+    headers.get("x-mreact-cache")?.toUpperCase() === "DYNAMIC" ||
+    headers.has("set-cookie") ||
+    headers.has("vary") ||
+    forbidsSharedStorage
+  );
+}
+
+function isStringRecord(value: unknown): value is Record<string, string> {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.values(value).every((entry) => typeof entry === "string")
+  );
+}

package/src/render.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { readFileSync } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { formatDiagnostic, transform } from "@reckona/mreact-compiler";
@@ -60,6 +61,15 @@ import {
   routeCacheKey,
   routeCachePolicyFromSource,
 } from "./cache.js";
+import {
+  trackRequestHeaderReads,
+  type TrackedHeaderRequest,
+  withTrackedRequest,
+} from "./request-header-tracking.js";
+import {
+  configuredHstsHeader,
+  hasInvalidConfiguredHsts,
+} from "./security-headers.js";
 import { resolveRouterCacheLimit } from "./cache-config.js";
 import {
   importAppRouterBuiltFileModule,
@@ -78,6 +88,7 @@ import {
   hasLoaderExport,
   isStreamRouteSource,
   routeClosureMayUseAwaitBoundary,
+  routeClosureMayUseRequestInput,
   stripRouteBuildExports,
   stripRouteModuleExports,
   stripRouteClientOnlyExports,
@@ -222,6 +233,17 @@ export interface RenderAppRequestOptions {
 }
 
 export interface RenderAppRequestRuntimeOptions extends RenderAppRequestOptions {
+  /**
+   * Receives whether the render depended on the incoming request headers.
+   *
+   * Callers that store the rendered HTML under a key which ignores headers,
+   * such as prerender regeneration, pass this to learn whether the result is
+   * only correct for the current visitor. Initialize it to a function returning
+   * `true`: a render that returns without reporting back stays header
+   * dependent. Call it only after draining the response body, because a
+   * streamed render can read headers while its deferred parts resolve.
+   */
+  renderSignals?: { headerDependent: () => boolean } | undefined;
   serverRenderArtifactLoader?: AppRouterServerRenderArtifactLoader | undefined;
 }
 
@@ -617,30 +639,18 @@ export function routerRenderRuntimeCacheStats(): RouterRuntimeCacheStat[] {
       maxComposedRouteMetadataCacheEntries,
       composedRouteMetadataCacheCounters,
     ),
-    routerRuntimeCacheStat(
-      "rendered-shell",
-      renderedShellCache,
-      MAX_RENDERED_SHELL_CACHE_ENTRIES,
-      renderedShellCacheCounters,
-    ),
+    // Preserve the public diagnostics entry while making explicit that rendered HTML reuse is disabled.
+    {
+      evictions: 0,
+      hits: 0,
+      maxEntries: 0,
+      misses: 0,
+      name: "rendered-shell",
+      size: 0,
+    },
   ];
 }
 
-// Issue 086: per-shell prefix/suffix cache. Pure layouts (whose
-// exported component takes zero arguments and therefore cannot
-// depend on the request props) produce the same HTML for every
-// request, so we cache the already-split { prefix, suffix } strings
-// keyed by appDir + shellFile + serverModuleCacheVersion. Impure
-// layouts (function.length > 0) are tagged "impure" so we skip the
-// detection on subsequent requests but still render per-request.
-//
-// The cache is only active when a version is present (production
-// builds); dev mode keeps the previous behaviour so reloads pick up
-// edits without server restart.
-const renderedShellCache = new Map<string, RenderedShell | "impure">();
-const MAX_RENDERED_SHELL_CACHE_ENTRIES = 1024;
-const renderedShellCacheCounters = createRouterRuntimeCacheCounters();
-
 interface RenderedShell {
   hasOutOfOrderBoundary: boolean;
   prefix: string;
@@ -654,6 +664,7 @@ interface RouteSourceAnalysis {
   hasLoader: boolean;
   routeCode: string;
   streamRoute: boolean;
+  usesRequestInput: boolean;
   usesRuntimeCacheControl: boolean;
 }
 
@@ -932,6 +943,9 @@ async function renderAppRequestInternal(
         renderAppRequestInternal({
           ...options,
           matchedRoute: undefined,
+          // This renders a different route than the caller asked about, so its
+          // header dependence says nothing about the caller's request.
+          renderSignals: undefined,
           request: singleFlightNavigationRequest({
             path: singleFlight.path,
             request: singleFlight.request,
@@ -983,6 +997,9 @@ async function renderAppRequestInternal(
         script: string | undefined;
       }
     | undefined;
+  let trackedRequest: TrackedHeaderRequest | undefined;
+  let sourceUsesRequestInput = true;
+  let invalidConfiguredHsts = false;
   return (await withRouteCacheContext(options.routeCache, async () => {
   try {
     if (matched.route.kind === "asset") {
@@ -1055,14 +1072,16 @@ async function renderAppRequestInternal(
       timing,
       vitePlugins: options.vitePlugins,
     });
+    sourceUsesRequestInput = originalAnalysis.usesRequestInput;
     finishRenderTimingPhase(timing, phaseStartedAt, "sourceAnalysisMs");
     const cachePolicy = originalAnalysis.cachePolicy;
     const navigationScript = options.navigationScripts?.get(matched.route.path);
     const cacheKey = routeCacheKey(options.appDir, matched.route.path, url);
     const mayUseRouteCache =
-      cachePolicy === undefined
+      !sourceUsesRequestInput &&
+      (cachePolicy === undefined
         ? originalAnalysis.usesRuntimeCacheControl
-        : cachePolicy.revalidateSeconds !== 0;
+        : cachePolicy.revalidateSeconds !== 0);
     const reloadRouteCache = isNavigationRouteCacheReloadRequest(options.request);
     phaseStartedAt = renderTimingPhaseStartedAt(timing);
     const cachedResponse =
@@ -1079,6 +1098,18 @@ async function renderAppRequestInternal(
       return cachedResponse;
     }
 
+    // Only a route whose result may be stored pays for header-read tracking;
+    // cache hits returned above never construct it. Application code reads
+    // headers through this request so that a render depending on one is never
+    // stored under a key that ignores it. Callers that store by path alone ask
+    // for tracking through `renderSignals` even when the route itself declares
+    // no cache policy.
+    trackedRequest =
+      mayUseRouteCache || options.renderSignals !== undefined
+        ? trackRequestHeaderReads(options.request)
+        : undefined;
+    const appRequest = trackedRequest?.request ?? options.request;
+
     phaseStartedAt = renderTimingPhaseStartedAt(timing);
     const preparedActions = await prepareRouteServerActions({
       appDir: options.appDir,
@@ -1120,12 +1151,11 @@ async function renderAppRequestInternal(
       ? loadRouteDataWithInstrumentation({
           appDir: options.appDir,
           code: originalCode,
-          context: {
+          context: withTrackedRequest({
             env: options.env,
             params: matched.params,
             queryClient,
-            request: options.request,
-          },
+          }, appRequest, trackedRequest),
           filename: matched.route.file,
           importPolicy: options.importPolicy,
           instrumentation: options.instrumentation,
@@ -1210,12 +1240,11 @@ async function renderAppRequestInternal(
         const renderedPage = await runWithQueryClient(queryClient, () =>
           runServerModuleWithSlots(
             stringOutput.code,
-            {
+            withTrackedRequest({
               data,
               params: matched.params,
               queryClient,
-              request: options.request,
-            },
+            }, appRequest, trackedRequest),
             matched.route.file,
             options.serverModules,
             options.serverModuleCacheVersion,
@@ -1251,12 +1280,11 @@ async function renderAppRequestInternal(
             appDir: options.appDir,
             pageFile: matched.route.file,
             html: pageHtmlForLayout,
-            props: {
+            props: withTrackedRequest({
               data,
               params: matched.params,
               queryClient,
-              request: options.request,
-            },
+            }, appRequest, trackedRequest),
             slots: renderedPage.slots,
             serverModules: options.serverModules,
             serverModuleCacheVersion: options.serverModuleCacheVersion,
@@ -1270,11 +1298,10 @@ async function renderAppRequestInternal(
         const metadata = await loadComposedRouteMetadata({
           appDir: options.appDir,
           code: originalCode,
-          context: {
+          context: withTrackedRequest({
             data,
             params: matched.params,
-            request: options.request,
-          },
+          }, appRequest, trackedRequest),
           filename: matched.route.file,
           importPolicy: options.importPolicy,
           routes,
@@ -1388,7 +1415,8 @@ async function renderAppRequestInternal(
           pageFile: matched.route.file,
           params: matched.params,
           queryClient,
-          request: options.request,
+          request: appRequest,
+          trackedRequest,
           routePath: matched.route.path,
           routeScripts: options.clientScripts,
           serverModules: options.serverModules,
@@ -1414,12 +1442,11 @@ async function renderAppRequestInternal(
       }
 
       const data = streamData;
-      const props = {
+      const props = withTrackedRequest({
         data,
         params: matched.params,
         queryClient,
-        request: options.request,
-      };
+      }, appRequest, trackedRequest);
       phaseStartedAt = renderTimingPhaseStartedAt(timing);
       const stream = runServerStreamModule(output.code, {
         appDir: options.appDir,
@@ -1463,6 +1490,12 @@ async function renderAppRequestInternal(
       emitRenderTiming(options, timing, data.status);
       return data;
     }
+    sourceUsesRequestInput ||= await routeShellsMayUseRequestInput({
+      appDir: options.appDir,
+      pageFile: matched.route.file,
+      serverModuleCacheVersion: options.serverModuleCacheVersion,
+      serverSourceFiles: options.serverSourceFiles,
+    });
     await waitForRenderPreload(options, timing);
     await loadServerRenderArtifacts(options, matched.route.file, timing);
     phaseStartedAt = renderTimingPhaseStartedAt(timing);
@@ -1488,12 +1521,11 @@ async function renderAppRequestInternal(
     const renderedPage = await runWithQueryClient(queryClient, () =>
       runServerModuleWithSlots(
         output.code,
-        {
+        withTrackedRequest({
           data,
           params: matched.params,
           queryClient,
-          request: options.request,
-        },
+        }, appRequest, trackedRequest),
         matched.route.file,
         options.serverModules,
         options.serverModuleCacheVersion,
@@ -1536,12 +1568,11 @@ async function renderAppRequestInternal(
         appDir: options.appDir,
         pageFile: matched.route.file,
         html: pageHtmlForLayout,
-        props: {
+        props: withTrackedRequest({
           data,
           params: matched.params,
           queryClient,
-          request: options.request,
-        },
+        }, appRequest, trackedRequest),
         slots: renderedPage.slots,
         serverModules: options.serverModules,
         serverModuleCacheVersion: options.serverModuleCacheVersion,
@@ -1556,11 +1587,10 @@ async function renderAppRequestInternal(
     const metadata = await loadComposedRouteMetadata({
       appDir: options.appDir,
       code: originalCode,
-      context: {
+      context: withTrackedRequest({
         data,
         params: matched.params,
-        request: options.request,
-      },
+      }, appRequest, trackedRequest),
       filename: matched.route.file,
       importPolicy: options.importPolicy,
       routes,
@@ -1608,12 +1638,23 @@ async function renderAppRequestInternal(
     );
 
     const effectiveCachePolicy = cachePolicy ?? activeRouteCacheContext()?.cachePolicy;
+    const configuredHsts = configuredHstsHeader(metadata?.security);
+    invalidConfiguredHsts = hasInvalidConfiguredHsts(metadata?.security);
 
     const finalResponse = preparedActions.hasFormActions
       ? withRouteCacheHeader(response, effectiveCachePolicy)
       : await cacheRouteResponse({
           key: cacheKey,
           cache: options.routeCache,
+          // A policy can still arrive from a runtime cacheControl() call made
+          // outside the page source, which is what `mayUseRouteCache` scans.
+          // Without a tracker there is no evidence the render ignored request
+          // headers, so the entry is treated as header dependent.
+          headerDependent:
+            sourceUsesRequestInput ||
+            invalidConfiguredHsts ||
+            (trackedRequest?.requestDependent() ?? true),
+          ...(configuredHsts === undefined ? {} : { strictTransportSecurity: configuredHsts }),
           path: matched.route.path,
           policy: effectiveCachePolicy,
           request: options.request,
@@ -1686,6 +1727,17 @@ async function renderAppRequestInternal(
     });
     emitRenderTiming(options, timing, response.status);
     return response;
+  } finally {
+    // Reported from every return path, including the streaming ones, so that a
+    // caller storing by path alone never mistakes an unreported render for a
+    // shareable one. The value stays lazy because a streamed render can still
+    // read request headers while its deferred parts resolve; callers read it
+    // after draining the body.
+    if (options.renderSignals !== undefined) {
+      const tracked = trackedRequest;
+      options.renderSignals.headerDependent = () =>
+        sourceUsesRequestInput || invalidConfiguredHsts || (tracked?.requestDependent() ?? true);
+    }
   }
   })).value;
 }
@@ -1695,9 +1747,24 @@ async function applyAppRouterResponseHook(
   options: RenderAppRequestOptions,
 ): Promise<Response> {
   const onResponse = await resolveAppRouterResponseHook(options);
-  const hooked = await onResponse?.(response, {
-    request: options.request,
-  });
+
+  if (onResponse === undefined) {
+    return response;
+  }
+
+  const renderSignals = (options as RenderAppRequestRuntimeOptions).renderSignals;
+  const trackedRequest =
+    renderSignals === undefined ? undefined : trackRequestHeaderReads(options.request);
+  const hooked = await onResponse(
+    response,
+    withTrackedRequest({}, trackedRequest?.request ?? options.request, trackedRequest),
+  );
+
+  if (renderSignals !== undefined && trackedRequest !== undefined) {
+    const renderHeaderDependent = renderSignals.headerDependent;
+    renderSignals.headerDependent = () =>
+      renderHeaderDependent() || trackedRequest.requestDependent();
+  }
 
   return hooked instanceof Response ? hooked : response;
 }
@@ -3010,6 +3077,9 @@ function routeSourceAnalysisFromArtifact(
     hasLoader: artifact.hasLoader,
     routeCode: artifact.routeCode,
     streamRoute: artifact.streamRoute,
+    // Older built artifacts predate request-input safety analysis. Treat them
+    // as dependent until rebuilt rather than trusting an absent safety signal.
+    usesRequestInput: artifact.usesRequestInput ?? true,
     usesRuntimeCacheControl: artifact.usesRuntimeCacheControl,
   };
 }
@@ -3052,17 +3122,77 @@ async function analyzeRouteSourceUncached(options: {
         projectRoot: options.appDir,
         source: options.code,
       }),
+    usesRequestInput: routeClosureMayUseRequestInput({
+      filename: options.filename,
+      files: routeSourceFilesForAnalysis(options),
+      projectRoot: options.appDir,
+      source: options.code,
+    }),
     usesRuntimeCacheControl: usesRuntimeCacheControl(options.code),
   };
 }
 
 function routeSourceFilesForAnalysis(options: {
+  appDir: string;
   code: string;
   filename: string;
   serverSourceFiles?: ReadonlyMap<string, string> | undefined;
 }): (file: string) => string | undefined {
-  return (file) =>
-    file === options.filename ? options.code : options.serverSourceFiles?.get(file);
+  return (file) => {
+    const known = file === options.filename ? options.code : options.serverSourceFiles?.get(file);
+    if (known !== undefined) {
+      return known;
+    }
+
+    const relativeFile = relative(resolve(options.appDir), resolve(file));
+    if (relativeFile === "" || relativeFile === ".." || relativeFile.startsWith(`..${sep}`)) {
+      return undefined;
+    }
+
+    try {
+      return readFileSync(file, "utf8");
+    } catch {
+      return undefined;
+    }
+  };
+}
+
+async function routeShellsMayUseRequestInput(options: {
+  appDir: string;
+  pageFile: string;
+  serverModuleCacheVersion: string | undefined;
+  serverSourceFiles: ReadonlyMap<string, string> | undefined;
+}): Promise<boolean> {
+  const shells = await shellFilesForPage(
+    options.appDir,
+    options.pageFile,
+    options.serverModuleCacheVersion,
+  );
+
+  for (const shell of shells) {
+    const source = await readServerSourceFile(
+      shell.file,
+      options.serverModuleCacheVersion,
+      options.serverSourceFiles,
+    );
+    if (
+      routeClosureMayUseRequestInput({
+        filename: shell.file,
+        files: routeSourceFilesForAnalysis({
+          appDir: options.appDir,
+          code: source,
+          filename: shell.file,
+          serverSourceFiles: options.serverSourceFiles,
+        }),
+        projectRoot: options.appDir,
+        source,
+      })
+    ) {
+      return true;
+    }
+  }
+
+  return false;
 }
 
 async function runServerModule(
@@ -3541,6 +3671,7 @@ async function runServerStreamModuleWithLoading(
     params: RouteParams;
     queryClient: QueryClient;
     request: Request;
+    trackedRequest?: TrackedHeaderRequest | undefined;
     routePath: string;
     routeScripts?: ReadonlyMap<string, string> | undefined;
     serverModules?: ReadonlyMap<string, BuiltServerModuleArtifact> | undefined;
@@ -3551,12 +3682,11 @@ async function runServerStreamModuleWithLoading(
     importPolicy?: AppRouterImportPolicy | undefined;
   },
 ): Promise<ReadableStream<Uint8Array>> {
-  const loadingProps = {
+  const loadingProps = withTrackedRequest({
     data: undefined,
     params: options.params,
     queryClient: options.queryClient,
-    request: options.request,
-  };
+  }, options.request, options.trackedRequest);
   const layoutShells = await layoutShellsForPage(
     options.appDir,
     options.pageFile,
@@ -3616,12 +3746,11 @@ async function runServerStreamModuleWithLoading(
         await appendServerStreamModule(
           code,
           boundarySink,
-          {
+          withTrackedRequest({
             data,
             params: options.params,
             queryClient: options.queryClient,
-            request: options.request,
-          },
+          }, options.request, options.trackedRequest),
           options.pageFile,
           options.serverModules,
           options.serverModuleCacheVersion,
@@ -4014,17 +4143,6 @@ async function renderShellPrefixSuffix(
     serverModuleCacheVersion === undefined || hasNamedSlots || shell.kind === "template"
       ? undefined
       : `${appDir}\0${shell.file}\0${serverModuleCacheVersion}\0${importPolicyCacheKey(importPolicy)}\0${viteDefineCacheKey(define)}\0${vitePluginsCacheKey(vitePlugins)}`;
-  if (cacheKey !== undefined) {
-    const cached = readRouterRuntimeCacheEntry(
-      renderedShellCache,
-      cacheKey,
-      renderedShellCacheCounters,
-    );
-    if (cached !== undefined && cached !== "impure") {
-      return cached;
-    }
-  }
-
   const staticEntry = cacheKey === undefined ? undefined : shellStaticRenderCache.get(cacheKey);
   const loadedStaticEntry =
     staticEntry ??
@@ -4052,34 +4170,6 @@ async function renderShellPrefixSuffix(
     hasOutOfOrderBoundary: loadedStaticEntry.hasOutOfOrderBoundary,
   };
   addRenderTimingPhaseDuration(timing, phaseStartedAt, "layoutSlotSplitMs");
-  const shellCacheKey = loadedStaticEntry.shellUsesAwait ? undefined : cacheKey;
-  const cached =
-    shellCacheKey !== undefined
-      ? readRouterRuntimeCacheEntry(renderedShellCache, shellCacheKey, renderedShellCacheCounters)
-      : undefined;
-
-  // Detect purity: a zero-arg component cannot depend on props. The
-  // markShellBoundary + splitLayoutSlot output is then constant for
-  // the (appDir, shellFile, version) tuple. We only set the cache
-  // entry on the first request that observes the function arity; on
-  // an "impure" tag we never overwrite it.
-  if (shellCacheKey !== undefined && cached !== "impure") {
-    if (loadedStaticEntry.component.length === 0) {
-      if (renderedShellCache.size >= MAX_RENDERED_SHELL_CACHE_ENTRIES) {
-        const oldestKey = renderedShellCache.keys().next().value;
-        if (oldestKey !== undefined) {
-          renderedShellCache.delete(oldestKey);
-          renderedShellCacheCounters.evictions += 1;
-        }
-      }
-      renderedShellCache.set(shellCacheKey, rendered);
-    } else {
-      // Impure — stamp the cache so subsequent lookups short-circuit
-      // without re-checking arity. We still run the per-request
-      // render path above so the props are honoured.
-      renderedShellCache.set(shellCacheKey, "impure");
-    }
-  }
 
   return rendered;
 }