@reckona/mreact-router 0.0.201 → 0.0.203

package/dist/adapters/cloudflare.js

@@ -9,6 +9,8 @@ import { validateRouteMetadata } from "../metadata.js";
 import { routeSecurityHeaders } from "../security-headers.js";
 import { emitRouterDevtoolsEvent } from "./devtools.js";
 import { escapeHtmlAttribute, escapeHtmlText } from "@reckona/mreact-shared/html-escape";
+import { isCurrentPrerenderedRoute, replayedPrerenderedRouteHeaders } from "../prerender-entry.js";
+import { hasNavigationRouteMarker } from "../navigation-marker.js";
 const clientPrefix = "/_mreact/client/";
 const cloudflareMiddlewareRouteModuleKey = "__middleware__";
 const defaultPrerenderCacheOrigin = "https://mreact.local";
@@ -81,7 +83,25 @@ export function createCloudflareRouteModuleRenderer(options) {
         if (middlewareResult.type === "response") {
             return middlewareResult.response;
         }
-        request = middlewareResult.request;
+        if (middlewareResult.request !== request) {
+            // The route was matched against the pre-middleware URL, so a rewrite has
+            // to re-match: otherwise the rewritten path would still render the module
+            // the visitor asked for, which is the module a rewrite is often used to
+            // keep them away from. The built runtime re-matches the same way.
+            request = middlewareResult.request;
+            const rematched = matchCloudflareRoute(sortedCloudflareRoutes(context.serverManifest), new URL(request.url).pathname);
+            if (rematched === undefined) {
+                return new Response("Not Found", { status: 404 });
+            }
+            context = { ...context, params: rematched.params, route: rematched.route };
+        }
+        // Middleware apps skip the prerendered fast path in `handleCloudflareRequest`
+        // so that access gates run first, so the stored HTML is resolved here
+        // instead, against the post-middleware path.
+        const prerendered = prerenderedResponse(context.serverManifest.prerenderedRoutes, normalizeRoutePath(new URL(request.url).pathname), request, isCloudflareNavigationRequest(request));
+        if (prerendered !== undefined) {
+            return prerendered;
+        }
         if (context.route.kind !== "server" && isCloudflareNavigationRequest(request)) {
             return cloudflareDocumentReloadNavigationResponse();
         }
@@ -152,6 +172,9 @@ export function createCloudflareRouteModuleRenderer(options) {
         }
         const metadata = await runWithCloudflareQueryClient(queryClient, () => resolveCloudflareRouteMetadata([pageModule], props));
         if (rendered instanceof Response) {
+            if (pageModule.__mreactSecurityHeadersApplied === true) {
+                return rendered;
+            }
             return withDefaultSecurityHeaders(rendered, request, metadata);
         }
         const modulePreload = cloudflareModulePreloadTag(context.clientManifest, context.route.path);
@@ -170,7 +193,7 @@ export function createCloudflareRouteModuleRenderer(options) {
                 body,
                 modulePreload,
             }));
-        const documentedWithQueryState = await injectCloudflareQueryState(documented, dehydrate(queryClient));
+        const documentedWithQueryState = await injectCloudflareQueryState(documented, dehydrate(queryClient, options.dehydrateOptions));
         return withDefaultSecurityHeaders(documentedWithQueryState instanceof Response
             ? documentedWithQueryState
             : new Response(documentedWithQueryState, {
@@ -237,6 +260,7 @@ async function runWithCloudflareQueryClient(queryClient, fn) {
         if (isQueryClientScopeUnavailableError(error)) {
             installQueryAsyncStorage(cloudflareQueryClientStorage);
             cloudflareQueryClientFallbackInstalled = true;
+            console.warn('[mreact] Cloudflare AsyncLocalStorage is unavailable. Enable the "nodejs_compat" compatibility flag; rendering is serialized until native request-local storage is available.');
             return await runWithSerializedCloudflareQueryClient(queryClient, fn);
         }
         throw error;
@@ -245,6 +269,10 @@ async function runWithCloudflareQueryClient(queryClient, fn) {
 const cloudflareQueryClientStorage = createCloudflareQueryClientStorage();
 let cloudflareQueryClientFallbackQueue = Promise.resolve();
 let cloudflareQueryClientFallbackInstalled = false;
+export function __resetCloudflareQueryClientFallbackForTesting() {
+    cloudflareQueryClientFallbackQueue = Promise.resolve();
+    cloudflareQueryClientFallbackInstalled = false;
+}
 async function runWithSerializedCloudflareQueryClient(queryClient, fn) {
     const previous = cloudflareQueryClientFallbackQueue;
     let releaseCurrent;
@@ -605,7 +633,13 @@ async function handleCloudflareRequest(options, request, env, context) {
         });
         return assetResponse;
     }
-    const staticResponse = prerenderedResponse(options.serverManifest.prerenderedRoutes, normalizeRoutePath(url.pathname), request.method, isCloudflareNavigationRequest(request));
+    // Prerendered HTML may only short-circuit `render` when the app has no
+    // middleware. Middleware runs inside `render`, so serving stored HTML here
+    // would bypass auth, geo blocking and maintenance gates for exactly the
+    // routes they are most often used to protect.
+    const staticResponse = builtServerManifestHasMiddleware(options.serverManifest)
+        ? undefined
+        : prerenderedResponse(options.serverManifest.prerenderedRoutes, normalizeRoutePath(url.pathname), request, isCloudflareNavigationRequest(request));
     if (staticResponse !== undefined) {
         emitRouterDevtoolsEvent({
             method: request.method,
@@ -690,19 +724,36 @@ function cacheControlHasDirective(cacheControl, directive) {
     const normalizedDirective = directive.toLowerCase();
     return cacheControl.split(",").some((part) => part.trim().toLowerCase() === normalizedDirective);
 }
-function prerenderedResponse(prerenderedRoutes, path, method, isNavigation) {
-    if (method !== "GET" && method !== "HEAD") {
+// `serverManifest.files` is keyed on paths relative to the project root, so a
+// default `src/app` project stores the middleware as "src/app/middleware.ts".
+// This mirrors `hasMiddleware` in built-runtime.ts, which resolves the same two
+// names against the routes directory.
+function builtServerManifestHasMiddleware(manifest) {
+    const routesDir = (manifest.routesDir ?? "").replaceAll("\\", "/").replace(/\/+$/, "");
+    const prefix = routesDir === "" ? "" : `${routesDir}/`;
+    return (manifest.files[`${prefix}middleware.ts`] !== undefined ||
+        manifest.files[`${prefix}middleware.mreact.ts`] !== undefined);
+}
+function prerenderedResponse(prerenderedRoutes, path, request, isNavigation) {
+    if (request.method !== "GET" && request.method !== "HEAD") {
         return undefined;
     }
     const prerendered = prerenderedRoutes?.[path];
-    if (prerendered === undefined) {
+    const candidateNavigationHtml = prerendered?.navigationHtml;
+    if (!isCurrentPrerenderedRoute(prerendered)) {
+        if (isNavigation &&
+            typeof candidateNavigationHtml === "string" &&
+            !hasNavigationRouteMarker(candidateNavigationHtml)) {
+            return cloudflareDocumentReloadNavigationResponse();
+        }
         return undefined;
     }
-    if (isNavigation && !prerendered.html.includes("data-mreact-route-id")) {
+    const html = isNavigation ? prerendered.navigationHtml : prerendered.html;
+    if (html === undefined) {
         return cloudflareDocumentReloadNavigationResponse();
     }
-    return new Response(method === "HEAD" ? null : prerendered.html, {
-        headers: prerendered.headers,
+    return new Response(request.method === "HEAD" ? null : html, {
+        headers: replayedPrerenderedRouteHeaders(prerendered, request),
         status: prerendered.status,
     });
 }
@@ -711,7 +762,7 @@ function cloudflareRouteRequiresModule(route, manifest) {
         route.kind === "server" ||
         (route.kind === "page" &&
             (route.segments.some((segment) => segment.kind !== "static") ||
-                manifest.prerenderedRoutes?.[route.path] === undefined)));
+                !isCurrentPrerenderedRoute(manifest.prerenderedRoutes?.[route.path]))));
 }
 function cloudflareRouteGlobKeyMatchesRoute(key, routeFile) {
     const normalizedKey = normalizeCloudflareRouteModulePath(key);
@@ -722,6 +773,18 @@ function normalizeCloudflareRouteModulePath(path) {
     const withoutPrefix = path.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
     return withoutPrefix.replace(/\.(?:mjs|js|ts|tsx)$/, "");
 }
+// The manifest is the same object across requests, so a rewrite-heavy app pays
+// for the specificity sort once rather than on every rewritten request.
+const sortedRoutesByManifest = new WeakMap();
+function sortedCloudflareRoutes(manifest) {
+    const cached = sortedRoutesByManifest.get(manifest);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const sorted = [...manifest.routes].sort(compareCloudflareRoutes);
+    sortedRoutesByManifest.set(manifest, sorted);
+    return sorted;
+}
 function matchCloudflareRoute(routes, pathname) {
     const normalizedPath = normalizeRoutePath(pathname);
     const pathSegments = normalizedPath === "/" ? [] : normalizedPath.slice(1).split("/");
@@ -852,7 +915,7 @@ function cloudflareHydrationMarkerParts(options) {
     const escapedRouteId = escapeHtmlAttribute(routeId);
     const propsJson = escapeScriptJson(JSON.stringify({
         params: options.params,
-        request: { url: options.request.url },
+        request: { url: new URL(options.request.url).pathname },
         data: options.data,
     }));
     const clientReferencesJson = route.clientReferenceManifest === undefined || route.clientReferenceManifest.length === 0