@reckona/mreact-router 0.0.201 → 0.0.203

package/src/actions.ts

@@ -9,6 +9,7 @@ import {
 import {
   createServerActionHandler,
   type ServerActionHandlerOptions,
+  type ServerActionReplayClaim,
   type ServerActionRegistry,
   type ServerActionReplayStore,
   type ServerActionRequestReference,
@@ -112,42 +113,44 @@ function configuredActionTokenSecret(value: string | undefined): string {
 }
 
 class BoundedReplayStore {
-  private readonly entries = new Map<string, number>();
+  private readonly entries = new Map<
+    string,
+    { state: "in-flight" } | { state: "completed"; expiresAt: number }
+  >();
 
   constructor(
     private readonly ttlMs: number,
     private readonly maxEntries: number,
   ) {}
 
-  has(value: string): boolean {
-    const expiresAt = this.entries.get(value);
-    if (expiresAt === undefined) return false;
-    if (expiresAt < Date.now()) {
+  claim(value: string): ServerActionReplayClaim {
+    const existing = this.entries.get(value);
+    if (existing?.state === "completed" && existing.expiresAt < Date.now()) {
       this.entries.delete(value);
-      return false;
     }
-    return true;
-  }
 
-  add(value: string): void {
-    const now = Date.now();
+    if (this.entries.has(value)) return { status: "replay" };
     if (this.entries.size >= this.maxEntries) {
-      const oldest = this.entries.entries().next().value;
-      if (oldest !== undefined) {
-        const [key, expiresAt] = oldest;
-        this.entries.delete(key);
-        if (expiresAt < now) {
-          while (this.entries.size >= this.maxEntries) {
-            const nextOldest = this.entries.entries().next().value;
-            if (nextOldest === undefined || nextOldest[1] >= now) {
-              break;
-            }
-            this.entries.delete(nextOldest[0]);
-          }
-        }
+      const now = Date.now();
+      for (const [key, entry] of this.entries) {
+        if (entry.state === "completed" && entry.expiresAt < now) this.entries.delete(key);
       }
+      if (this.entries.size >= this.maxEntries) return { status: "capacity-exceeded" };
     }
-    this.entries.set(value, now + this.ttlMs);
+
+    const entry = { state: "in-flight" as const };
+    this.entries.set(value, entry);
+    let finalized = false;
+    return {
+      status: "claimed",
+      finalize: () => {
+        if (finalized) return;
+        finalized = true;
+        if (this.entries.get(value) === entry) {
+          this.entries.set(value, { state: "completed", expiresAt: Date.now() + this.ttlMs });
+        }
+      },
+    };
   }
 
   // Exposed for tests; not part of the ServerActionReplayStore interface.
@@ -456,7 +459,7 @@ async function dispatchServerActionRequestWithoutCacheContext(options: {
         : { allowedActions: jsonAllowedServerActions(options.serverActions.allowedActions) }),
       csrf: { cookieName: serverActionCookieName() },
       maxBodyBytes: options.serverActions?.maxBodyBytes ?? DEFAULT_ACTION_BODY_MAX_BYTES,
-      replayProtection: { seen: replayStore },
+      replayProtection: { store: replayStore },
     });
 
     return handle(options.request);
@@ -528,15 +531,6 @@ async function dispatchServerActionRequestWithoutCacheContext(options: {
     return jsonResponse({ ok: false, error: "Unknown server action." }, 404);
   }
 
-  const nonceResponse = validateFormNonce(
-    formData,
-    options.serverActions?.replayStore ?? usedFormActionNonces,
-  );
-
-  if (nonceResponse !== undefined) {
-    return nonceResponse;
-  }
-
   let registry: ServerActionRegistry;
   try {
     registry = await loadServerActionRegistry({
@@ -570,24 +564,40 @@ async function dispatchServerActionRequestWithoutCacheContext(options: {
     return authorizationResponse;
   }
 
+  const replayClaim = await claimFormNonce(
+    nonce,
+    options.serverActions?.replayStore ?? usedFormActionNonces,
+  );
+  if (replayClaim instanceof Response) return replayClaim;
+
+  let actionResponse: Response | undefined;
+  let actionError: unknown;
   try {
     const value = await action(actionFormData, createServerActionContext(options.request));
 
     if (value instanceof Response) {
-      return value;
+      actionResponse = value;
+    } else if (value === undefined || value === null) {
+      actionResponse = redirectToFormReferer(options.request);
+    } else {
+      actionResponse = jsonResponse({ ok: true, value }, 200);
     }
-
-    if (value === undefined || value === null) {
-      return redirectToFormReferer(options.request);
-    }
-
-    return jsonResponse({ ok: true, value }, 200);
   } catch (error) {
-    return jsonResponse(
-      { ok: false, error: error instanceof Error ? error.message : String(error) },
-      500,
-    );
+    actionError = error;
+  }
+
+  try {
+    await replayClaim.finalize();
+  } catch {
+    return replayStoreUnavailableResponse();
   }
+
+  return actionError === undefined
+    ? actionResponse!
+    : jsonResponse(
+        { ok: false, error: actionError instanceof Error ? actionError.message : String(actionError) },
+        500,
+      );
 }
 
 function createServerActionContext(request: Request): ServerActionContext {
@@ -1482,22 +1492,28 @@ function validateServerActionRequestOrigin(request: Request): Response | undefin
   }
 }
 
-function validateFormNonce(
-  formData: FormData,
+async function claimFormNonce(
+  nonce: string,
   replayStore: ServerActionReplayStore,
-): Response | undefined {
-  const nonce = stringFormValue(formData.get(formFieldNonce));
-
-  if (nonce === undefined || nonce.length === 0) {
-    return jsonResponse({ ok: false, error: "Missing server action nonce." }, 400);
+): Promise<Extract<Awaited<ReturnType<ServerActionReplayStore["claim"]>>, { status: "claimed" }> | Response> {
+  let claim: Awaited<ReturnType<ServerActionReplayStore["claim"]>>;
+  try {
+    claim = await replayStore.claim(nonce);
+  } catch {
+    return replayStoreUnavailableResponse();
   }
-
-  if (replayStore.has(nonce)) {
+  if (claim.status === "replay") {
     return jsonResponse({ ok: false, error: "Server action nonce was already used." }, 409);
   }
+  if (claim.status === "capacity-exceeded") return replayStoreUnavailableResponse();
+  return claim;
+}
 
-  replayStore.add(nonce);
-  return undefined;
+function replayStoreUnavailableResponse(): Response {
+  return new Response(
+    JSON.stringify({ ok: false, error: "Server action replay protection is unavailable." }),
+    { status: 503, headers: { "content-type": "application/json", "retry-after": "1" } },
+  );
 }
 
 function cleanActionFormData(formData: FormData): FormData {

package/src/adapters/cloudflare.ts

@@ -10,6 +10,7 @@ import {
   isQueryClientScopeUnavailableError,
   runWithQueryClient,
   type DehydratedQueryClient,
+  type DehydrateOptions,
   type QueryAsyncStorage,
   type QueryClient,
 } from "@reckona/mreact-query";
@@ -38,6 +39,8 @@ import { routeSecurityHeaders } from "../security-headers.js";
 import type { AppRouterPrerenderStore } from "../serve.js";
 import { emitRouterDevtoolsEvent } from "./devtools.js";
 import { escapeHtmlAttribute, escapeHtmlText } from "@reckona/mreact-shared/html-escape";
+import { isCurrentPrerenderedRoute, replayedPrerenderedRouteHeaders } from "../prerender-entry.js";
+import { hasNavigationRouteMarker } from "../navigation-marker.js";
 
 /** Re-exports build manifest contracts used by Cloudflare handlers. */
 export type {
@@ -290,6 +293,7 @@ export type CloudflareRouteModuleRegistry<Env = unknown> = Record<
  * Configures the Cloudflare route module renderer.
  */
 export interface CloudflareRouteModuleRendererOptions<Env = unknown> {
+  dehydrateOptions?: DehydrateOptions | undefined;
   document?:
     | ((
         context: CloudflareRouteModuleComponentProps<unknown, Env> & {
@@ -470,7 +474,38 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
     if (middlewareResult.type === "response") {
       return middlewareResult.response;
     }
-    request = middlewareResult.request;
+
+    if (middlewareResult.request !== request) {
+      // The route was matched against the pre-middleware URL, so a rewrite has
+      // to re-match: otherwise the rewritten path would still render the module
+      // the visitor asked for, which is the module a rewrite is often used to
+      // keep them away from. The built runtime re-matches the same way.
+      request = middlewareResult.request;
+      const rematched = matchCloudflareRoute(
+        sortedCloudflareRoutes(context.serverManifest),
+        new URL(request.url).pathname,
+      );
+
+      if (rematched === undefined) {
+        return new Response("Not Found", { status: 404 });
+      }
+
+      context = { ...context, params: rematched.params, route: rematched.route };
+    }
+
+    // Middleware apps skip the prerendered fast path in `handleCloudflareRequest`
+    // so that access gates run first, so the stored HTML is resolved here
+    // instead, against the post-middleware path.
+    const prerendered = prerenderedResponse(
+      context.serverManifest.prerenderedRoutes,
+      normalizeRoutePath(new URL(request.url).pathname),
+      request,
+      isCloudflareNavigationRequest(request),
+    );
+
+    if (prerendered !== undefined) {
+      return prerendered;
+    }
 
     if (context.route.kind !== "server" && isCloudflareNavigationRequest(request)) {
       return cloudflareDocumentReloadNavigationResponse();
@@ -567,6 +602,16 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
     );
 
     if (rendered instanceof Response) {
+      if (
+        (
+          pageModule as CloudflareRouteModule<unknown, Env> & {
+            __mreactSecurityHeadersApplied?: boolean | undefined;
+          }
+        ).__mreactSecurityHeadersApplied === true
+      ) {
+        return rendered;
+      }
+
       return withDefaultSecurityHeaders(rendered, request, metadata);
     }
 
@@ -591,7 +636,7 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
           );
     const documentedWithQueryState = await injectCloudflareQueryState(
       documented,
-      dehydrate(queryClient),
+      dehydrate(queryClient, options.dehydrateOptions),
     );
 
     return withDefaultSecurityHeaders(
@@ -690,6 +735,9 @@ async function runWithCloudflareQueryClient<T>(
     if (isQueryClientScopeUnavailableError(error)) {
       installQueryAsyncStorage(cloudflareQueryClientStorage);
       cloudflareQueryClientFallbackInstalled = true;
+      console.warn(
+        '[mreact] Cloudflare AsyncLocalStorage is unavailable. Enable the "nodejs_compat" compatibility flag; rendering is serialized until native request-local storage is available.',
+      );
       return await runWithSerializedCloudflareQueryClient(queryClient, fn);
     }
 
@@ -701,6 +749,11 @@ const cloudflareQueryClientStorage = createCloudflareQueryClientStorage();
 let cloudflareQueryClientFallbackQueue: Promise<void> = Promise.resolve();
 let cloudflareQueryClientFallbackInstalled = false;
 
+export function __resetCloudflareQueryClientFallbackForTesting(): void {
+  cloudflareQueryClientFallbackQueue = Promise.resolve();
+  cloudflareQueryClientFallbackInstalled = false;
+}
+
 async function runWithSerializedCloudflareQueryClient<T>(
   queryClient: QueryClient,
   fn: () => T,
@@ -1193,12 +1246,18 @@ async function handleCloudflareRequest<Env>(
     return assetResponse;
   }
 
-  const staticResponse = prerenderedResponse(
-    options.serverManifest.prerenderedRoutes,
-    normalizeRoutePath(url.pathname),
-    request.method,
-    isCloudflareNavigationRequest(request),
-  );
+  // Prerendered HTML may only short-circuit `render` when the app has no
+  // middleware. Middleware runs inside `render`, so serving stored HTML here
+  // would bypass auth, geo blocking and maintenance gates for exactly the
+  // routes they are most often used to protect.
+  const staticResponse = builtServerManifestHasMiddleware(options.serverManifest)
+    ? undefined
+    : prerenderedResponse(
+        options.serverManifest.prerenderedRoutes,
+        normalizeRoutePath(url.pathname),
+        request,
+        isCloudflareNavigationRequest(request),
+      );
 
   if (staticResponse !== undefined) {
     emitRouterDevtoolsEvent({
@@ -1319,28 +1378,54 @@ function cacheControlHasDirective(cacheControl: string | null, directive: string
   return cacheControl.split(",").some((part) => part.trim().toLowerCase() === normalizedDirective);
 }
 
+// `serverManifest.files` is keyed on paths relative to the project root, so a
+// default `src/app` project stores the middleware as "src/app/middleware.ts".
+// This mirrors `hasMiddleware` in built-runtime.ts, which resolves the same two
+// names against the routes directory.
+function builtServerManifestHasMiddleware(manifest: {
+  files: Record<string, string>;
+  routesDir?: string | undefined;
+}): boolean {
+  const routesDir = (manifest.routesDir ?? "").replaceAll("\\", "/").replace(/\/+$/, "");
+  const prefix = routesDir === "" ? "" : `${routesDir}/`;
+
+  return (
+    manifest.files[`${prefix}middleware.ts`] !== undefined ||
+    manifest.files[`${prefix}middleware.mreact.ts`] !== undefined
+  );
+}
+
 function prerenderedResponse(
   prerenderedRoutes: Record<string, BuiltPrerenderedRoute> | undefined,
   path: string,
-  method: string,
+  request: Request,
   isNavigation: boolean,
 ): Response | undefined {
-  if (method !== "GET" && method !== "HEAD") {
+  if (request.method !== "GET" && request.method !== "HEAD") {
     return undefined;
   }
 
   const prerendered = prerenderedRoutes?.[path];
+  const candidateNavigationHtml = prerendered?.navigationHtml;
 
-  if (prerendered === undefined) {
+  if (!isCurrentPrerenderedRoute(prerendered)) {
+    if (
+      isNavigation &&
+      typeof candidateNavigationHtml === "string" &&
+      !hasNavigationRouteMarker(candidateNavigationHtml)
+    ) {
+      return cloudflareDocumentReloadNavigationResponse();
+    }
     return undefined;
   }
 
-  if (isNavigation && !prerendered.html.includes("data-mreact-route-id")) {
+  const html = isNavigation ? prerendered.navigationHtml : prerendered.html;
+  if (html === undefined) {
     return cloudflareDocumentReloadNavigationResponse();
   }
 
-  return new Response(method === "HEAD" ? null : prerendered.html, {
-    headers: prerendered.headers,
+  return new Response(request.method === "HEAD" ? null : html, {
+    headers: replayedPrerenderedRouteHeaders(prerendered, request),
     status: prerendered.status,
   });
 }
@@ -1351,7 +1436,7 @@ function cloudflareRouteRequiresModule(route: AppRoute, manifest: BuiltServerMan
     route.kind === "server" ||
     (route.kind === "page" &&
       (route.segments.some((segment) => segment.kind !== "static") ||
-        manifest.prerenderedRoutes?.[route.path] === undefined))
+        !isCurrentPrerenderedRoute(manifest.prerenderedRoutes?.[route.path])))
   );
 }
 
@@ -1368,6 +1453,23 @@ function normalizeCloudflareRouteModulePath(path: string): string {
   return withoutPrefix.replace(/\.(?:mjs|js|ts|tsx)$/, "");
 }
 
+// The manifest is the same object across requests, so a rewrite-heavy app pays
+// for the specificity sort once rather than on every rewritten request.
+const sortedRoutesByManifest = new WeakMap<BuiltServerManifest, readonly AppRoute[]>();
+
+function sortedCloudflareRoutes(manifest: BuiltServerManifest): readonly AppRoute[] {
+  const cached = sortedRoutesByManifest.get(manifest);
+
+  if (cached !== undefined) {
+    return cached;
+  }
+
+  const sorted = [...manifest.routes].sort(compareCloudflareRoutes);
+  sortedRoutesByManifest.set(manifest, sorted);
+
+  return sorted;
+}
+
 function matchCloudflareRoute(
   routes: readonly AppRoute[],
   pathname: string,
@@ -1550,7 +1652,7 @@ function cloudflareHydrationMarkerParts(options: {
   const propsJson = escapeScriptJson(
     JSON.stringify({
       params: options.params,
-      request: { url: options.request.url },
+      request: { url: new URL(options.request.url).pathname },
       data: options.data,
     }),
   );

package/src/adapters/node.ts

@@ -14,6 +14,7 @@ import {
 } from "../logger.js";
 import type { AppRouterResponseHook } from "../render.js";
 import type { RouterInstrumentation } from "../trace.js";
+import { resolveNodeRequestProtocol } from "../node-server.js";
 
 /** Re-exports cache contracts used by Node handlers. */
 export type { AppRouterCache, AppRouterCacheEntry } from "../cache.js";
@@ -92,6 +93,13 @@ export interface NodeRequestHandlerOptions {
   routeCache?: AppRouterCache | undefined;
   serverActions?: AppRouterServerActionOptions | undefined;
   sinkStrategy?: ResponseSinkStrategy | undefined;
+  /**
+   * Trusts the first `X-Forwarded-Proto` value when the socket is not TLS.
+   *
+   * Defaults to `false`. Enable only behind a proxy that overwrites the header
+   * and prevents untrusted clients from reaching the Node listener directly.
+   */
+  trustForwardedProto?: boolean | undefined;
 }
 
 /**
@@ -126,7 +134,12 @@ export function createNodeRequestHandler(options: NodeRequestHandlerOptions): No
         hostPolicy: options.hostPolicy,
         rawHost: incoming.headers.host,
       });
-      const request = nodeRequestToWebRequest(incoming, `http://${host}`);
+      const protocol = resolveNodeRequestProtocol({
+        encrypted: (incoming.socket as { encrypted?: boolean }).encrypted === true,
+        forwardedProto: incoming.headers["x-forwarded-proto"],
+        trustForwardedProto: options.trustForwardedProto,
+      });
+      const request = nodeRequestToWebRequest(incoming, `${protocol}://${host}`);
       const logFields = requestLogFields(request, "node");
       emitRouterLog(options.logger, "info", {
         ...logFields,

package/src/adapters/static.ts

@@ -1,6 +1,7 @@
 import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import type { BuiltPrerenderedRoute, BuiltServerManifest } from "../build.js";
+import { isCurrentPrerenderedRoute } from "../prerender-entry.js";
 
 /**
  * Configures static export from a built app-router output directory.
@@ -32,17 +33,29 @@ export async function exportStaticApp(options: StaticExportOptions): Promise<Sta
   ) as { publicAssets?: readonly string[] };
   const prerenderedRoutes = manifest.prerenderedRoutes ?? {};
   const routes = [...(options.paths ?? Object.keys(prerenderedRoutes))].sort();
-
-  await rm(options.exportDir, { force: true, recursive: true });
-  await mkdir(options.exportDir, { recursive: true });
-
-  for (const route of routes) {
+  const entries = routes.map((route): readonly [string, BuiltPrerenderedRoute] => {
+    routeToHtmlFile(options.exportDir, route);
     const entry = prerenderedRoutes[route];
 
     if (entry === undefined) {
       throw new Error(`Cannot export non-prerendered route: ${route}`);
     }
 
+    if (!isCurrentPrerenderedRoute(entry)) {
+      throw new Error(`Cannot export invalid prerendered route: ${route}`);
+    }
+
+    if (entry.status < 200 || entry.status >= 300) {
+      throw new Error(`Cannot export route ${route} with status ${entry.status}.`);
+    }
+
+    return [route, entry];
+  });
+
+  await rm(options.exportDir, { force: true, recursive: true });
+  await mkdir(options.exportDir, { recursive: true });
+
+  for (const [route, entry] of entries) {
     await writePrerenderedRoute(options.exportDir, route, entry);
   }