@reckona/mreact-router 0.0.202 → 0.0.204

package/src/actions.ts

@@ -8,7 +8,9 @@ import {
 } from "@reckona/mreact-compiler";
 import {
   createServerActionHandler,
+  ensureServerActionReplayStoreContract,
   type ServerActionHandlerOptions,
+  type ServerActionReplayClaim,
   type ServerActionRegistry,
   type ServerActionReplayStore,
   type ServerActionRequestReference,
@@ -18,7 +20,7 @@ import { bundleRouterModule, type RouterCompatBuildApi } from "./bundle-pipeline
 import { type AppRouterCache, withRouteCacheContext } from "./cache.js";
 import { fileImportMetaUrlPlugin, importAppRouterSourceModule } from "./module-runner.js";
 import { createAppRouterImportPolicyPlugin, type AppRouterImportPolicy } from "./import-policy.js";
-import { cookies, type RequestCookies } from "./navigation.js";
+import { cookies, isSafeInternalRedirect, type RequestCookies } from "./navigation.js";
 export {
   createFormCsrfToken,
   formCsrfCookie,
@@ -71,6 +73,7 @@ const actionTokenSecret = configuredActionTokenSecret(process.env.MREACT_SERVER_
 // traffic does not trip false-positive 409s.
 const DEFAULT_REPLAY_TTL_MS = 10 * 60 * 1000;
 const DEFAULT_REPLAY_MAX_ENTRIES = 50_000;
+const DEFAULT_REPLAY_MINIMUM_RETENTION_MS = 60_000;
 const DEFAULT_ACTION_BODY_MAX_BYTES = 10 * 1024 * 1024;
 const DEFAULT_ACTION_FORM_MAX_FIELDS = 1_000;
 let warnedUnrestrictedServerActions = false;
@@ -112,48 +115,114 @@ function configuredActionTokenSecret(value: string | undefined): string {
 }
 
 class BoundedReplayStore {
-  private readonly entries = new Map<string, number>();
+  private readonly entries = new Map<
+    string,
+    | { state: "in-flight"; leaseExpiresAt: number }
+    | { state: "completed"; expiresAt: number; protectedUntil: number }
+  >();
+  private capacityWarningActive = false;
+  private warnedLeaseReclamation = false;
+  private readonly minimumRetentionMs: number;
 
   constructor(
     private readonly ttlMs: number,
     private readonly maxEntries: number,
-  ) {}
+  ) {
+    this.minimumRetentionMs = Math.min(ttlMs, DEFAULT_REPLAY_MINIMUM_RETENTION_MS);
+  }
+
+  claim(value: string): ServerActionReplayClaim {
+    const now = Date.now();
+    if (this.entries.size < this.maxEntries) {
+      this.capacityWarningActive = false;
+    }
 
-  has(value: string): boolean {
-    const expiresAt = this.entries.get(value);
-    if (expiresAt === undefined) return false;
-    if (expiresAt < Date.now()) {
+    const existing = this.entries.get(value);
+    if (existing?.state === "completed" && existing.expiresAt <= now) {
       this.entries.delete(value);
-      return false;
+    } else if (existing?.state === "in-flight" && existing.leaseExpiresAt <= now) {
+      this.entries.delete(value);
+      this.warnLeaseReclamation();
     }
-    return true;
-  }
 
-  add(value: string): void {
-    const now = Date.now();
+    if (this.entries.has(value)) return { status: "replay" };
     if (this.entries.size >= this.maxEntries) {
-      const oldest = this.entries.entries().next().value;
-      if (oldest !== undefined) {
-        const [key, expiresAt] = oldest;
-        this.entries.delete(key);
-        if (expiresAt < now) {
-          while (this.entries.size >= this.maxEntries) {
-            const nextOldest = this.entries.entries().next().value;
-            if (nextOldest === undefined || nextOldest[1] >= now) {
-              break;
-            }
-            this.entries.delete(nextOldest[0]);
-          }
+      this.warnCapacity();
+      let reclaimableCompletedKey: string | undefined;
+      for (const [key, entry] of this.entries) {
+        if (
+          (entry.state === "completed" && entry.expiresAt <= now) ||
+          (entry.state === "in-flight" && entry.leaseExpiresAt <= now)
+        ) {
+          this.entries.delete(key);
+        } else if (
+          reclaimableCompletedKey === undefined &&
+          entry.state === "completed" &&
+          entry.protectedUntil <= now
+        ) {
+          reclaimableCompletedKey = key;
         }
       }
+      if (this.entries.size >= this.maxEntries && reclaimableCompletedKey !== undefined) {
+        this.entries.delete(reclaimableCompletedKey);
+      }
+      if (this.entries.size >= this.maxEntries) return { status: "capacity-exceeded" };
     }
-    this.entries.set(value, now + this.ttlMs);
+
+    const entry = { state: "in-flight" as const, leaseExpiresAt: now + this.ttlMs };
+    this.entries.set(value, entry);
+    let finalized = false;
+    return {
+      status: "claimed",
+      finalize: () => {
+        if (finalized) return;
+        finalized = true;
+        if (this.entries.get(value) === entry) {
+          const completedAt = Date.now();
+          this.entries.delete(value);
+          this.entries.set(value, {
+            state: "completed",
+            expiresAt: completedAt + this.ttlMs,
+            protectedUntil: completedAt + this.minimumRetentionMs,
+          });
+        }
+      },
+    };
+  }
+
+  // Exposed for tests; not part of the ServerActionReplayStore interface.
+  clear(): void {
+    this.entries.clear();
+    this.capacityWarningActive = false;
+    this.warnedLeaseReclamation = false;
   }
 
   // Exposed for tests; not part of the ServerActionReplayStore interface.
   size(): number {
     return this.entries.size;
   }
+
+  private warnCapacity(): void {
+    if (this.capacityWarningActive) return;
+    this.capacityWarningActive = true;
+    let completed = 0;
+    let inFlight = 0;
+    for (const entry of this.entries.values()) {
+      if (entry.state === "completed") completed += 1;
+      else inFlight += 1;
+    }
+    console.error(
+      `mreact-router: default server action replay store reached capacity (size=${this.entries.size}, maxEntries=${this.maxEntries}, completed=${completed}, inFlight=${inFlight}, minimumRetentionMs=${this.minimumRetentionMs}). Completed claims remain exact through minimumRetentionMs and may be reclaimed under pressure afterward; expired in-flight leases may also be reclaimed. Applications requiring exact protection for the full action lifetime and retention window must use a shared replay store.`,
+    );
+  }
+
+  private warnLeaseReclamation(): void {
+    if (this.warnedLeaseReclamation) return;
+    this.warnedLeaseReclamation = true;
+    console.error(
+      `mreact-router: default server action replay store reclaimed an expired in-flight claim after leaseMs=${this.ttlMs}; exact duplicate-execution protection no longer applies to that abandoned claim.`,
+    );
+  }
 }
 
 const usedFormActionNonces = new BoundedReplayStore(
@@ -165,7 +234,7 @@ const usedFormActionNonces = new BoundedReplayStore(
 // so tests can drive its eviction semantics directly. Not part of the
 // public surface (prefixed with `__`).
 export function __clearDefaultReplayStore(): void {
-  (usedFormActionNonces as unknown as { entries: Map<string, number> }).entries.clear();
+  usedFormActionNonces.clear();
 }
 
 export function __readDefaultReplayStore(): BoundedReplayStore {
@@ -456,7 +525,7 @@ async function dispatchServerActionRequestWithoutCacheContext(options: {
         : { allowedActions: jsonAllowedServerActions(options.serverActions.allowedActions) }),
       csrf: { cookieName: serverActionCookieName() },
       maxBodyBytes: options.serverActions?.maxBodyBytes ?? DEFAULT_ACTION_BODY_MAX_BYTES,
-      replayProtection: { seen: replayStore },
+      replayProtection: { store: replayStore },
     });
 
     return handle(options.request);
@@ -528,15 +597,6 @@ async function dispatchServerActionRequestWithoutCacheContext(options: {
     return jsonResponse({ ok: false, error: "Unknown server action." }, 404);
   }
 
-  const nonceResponse = validateFormNonce(
-    formData,
-    options.serverActions?.replayStore ?? usedFormActionNonces,
-  );
-
-  if (nonceResponse !== undefined) {
-    return nonceResponse;
-  }
-
   let registry: ServerActionRegistry;
   try {
     registry = await loadServerActionRegistry({
@@ -570,24 +630,40 @@ async function dispatchServerActionRequestWithoutCacheContext(options: {
     return authorizationResponse;
   }
 
+  const replayClaim = await claimFormNonce(
+    nonce,
+    options.serverActions?.replayStore ?? usedFormActionNonces,
+  );
+  if (replayClaim instanceof Response) return replayClaim;
+
+  let actionResponse: Response | undefined;
+  let actionError: unknown;
   try {
     const value = await action(actionFormData, createServerActionContext(options.request));
 
     if (value instanceof Response) {
-      return value;
+      actionResponse = value;
+    } else if (value === undefined || value === null) {
+      actionResponse = redirectToFormReferer(options.request);
+    } else {
+      actionResponse = jsonResponse({ ok: true, value }, 200);
     }
-
-    if (value === undefined || value === null) {
-      return redirectToFormReferer(options.request);
-    }
-
-    return jsonResponse({ ok: true, value }, 200);
   } catch (error) {
-    return jsonResponse(
-      { ok: false, error: error instanceof Error ? error.message : String(error) },
-      500,
-    );
+    actionError = error;
+  }
+
+  try {
+    await replayClaim.finalize();
+  } catch {
+    return replayStoreUnavailableResponse();
   }
+
+  return actionError === undefined
+    ? actionResponse!
+    : jsonResponse(
+        { ok: false, error: actionError instanceof Error ? actionError.message : String(actionError) },
+        500,
+      );
 }
 
 function createServerActionContext(request: Request): ServerActionContext {
@@ -785,8 +861,9 @@ function sameOriginRefererPath(request: Request): string | undefined {
     const requestUrl = new URL(request.url);
     const refererUrl = new URL(referer, requestUrl);
 
-    return refererUrl.origin === requestUrl.origin
-      ? `${refererUrl.pathname}${refererUrl.search}`
+    const location = `${refererUrl.pathname}${refererUrl.search}`;
+    return refererUrl.origin === requestUrl.origin && isSafeInternalRedirect(location)
+      ? location
       : undefined;
   } catch {
     return undefined;
@@ -1482,22 +1559,31 @@ function validateServerActionRequestOrigin(request: Request): Response | undefin
   }
 }
 
-function validateFormNonce(
-  formData: FormData,
+async function claimFormNonce(
+  nonce: string,
   replayStore: ServerActionReplayStore,
-): Response | undefined {
-  const nonce = stringFormValue(formData.get(formFieldNonce));
-
-  if (nonce === undefined || nonce.length === 0) {
-    return jsonResponse({ ok: false, error: "Missing server action nonce." }, 400);
+): Promise<Extract<Awaited<ReturnType<ServerActionReplayStore["claim"]>>, { status: "claimed" }> | Response> {
+  let claim: Awaited<ReturnType<ServerActionReplayStore["claim"]>>;
+  if (!ensureServerActionReplayStoreContract(replayStore)) {
+    return replayStoreUnavailableResponse();
   }
-
-  if (replayStore.has(nonce)) {
+  try {
+    claim = await replayStore.claim(nonce);
+  } catch {
+    return replayStoreUnavailableResponse();
+  }
+  if (claim.status === "replay") {
     return jsonResponse({ ok: false, error: "Server action nonce was already used." }, 409);
   }
+  if (claim.status === "capacity-exceeded") return replayStoreUnavailableResponse();
+  return claim;
+}
 
-  replayStore.add(nonce);
-  return undefined;
+function replayStoreUnavailableResponse(): Response {
+  return new Response(
+    JSON.stringify({ ok: false, error: "Server action replay protection is unavailable." }),
+    { status: 503, headers: { "content-type": "application/json", "retry-after": "1" } },
+  );
 }
 
 function cleanActionFormData(formData: FormData): FormData {