@reckona/mreact-router 0.0.202 → 0.0.204

package/src/logger.ts

@@ -27,7 +27,9 @@ export type AppRouterLogEvent =
   | AppRouterRequestErrorLogEvent
   | AppRouterRequestTimingLogEvent
   | AppRouterRenderTimingLogEvent
-  | AppRouterCspInlineNonceWarningLogEvent;
+  | AppRouterCspInlineNonceWarningLogEvent
+  | AppRouterUpgradeErrorLogEvent
+  | AppRouterUpgradeRejectedLogEvent;
 
 /**
  * Logs the start of an app-router request.
@@ -63,6 +65,29 @@ export interface AppRouterRequestErrorLogEvent {
   type: "router:request:error";
 }
 
+/**
+ * Logs a failed or timed-out HTTP upgrade handler.
+ */
+export interface AppRouterUpgradeErrorLogEvent {
+  durationMs: number;
+  error: AppRouterLogError;
+  method: string;
+  path: string;
+  runtime: "node";
+  type: "router:upgrade:error";
+}
+
+/**
+ * Logs an HTTP upgrade rejected before application ownership.
+ */
+export interface AppRouterUpgradeRejectedLogEvent {
+  method: string;
+  path: string;
+  reason: "disallowed-origin" | "malformed-origin" | "missing-origin" | "opaque-origin";
+  runtime: "node";
+  type: "router:upgrade:rejected";
+}
+
 /**
  * Logs per-phase timings for a complete app-router request.
  */
@@ -116,7 +141,12 @@ export function emitRouterLog(
   level: AppRouterLogLevel,
   event: AppRouterLogEvent,
 ): void {
-  const sink = logger?.[level];
+  let sink: AppRouterLogger[AppRouterLogLevel];
+  try {
+    sink = logger?.[level];
+  } catch {
+    return;
+  }
 
   if (sink === undefined) {
     return;
@@ -176,15 +206,22 @@ export function logDurationMs(startedAt: number): number {
 }
 
 export function logError(error: unknown): AppRouterLogError {
-  if (error instanceof Error) {
+  try {
+    if (error instanceof Error) {
+      return {
+        message: String(error.message),
+        name: String(error.name),
+      };
+    }
+
     return {
-      message: error.message,
-      name: error.name,
+      message: String(error),
+      name: "Error",
+    };
+  } catch {
+    return {
+      message: "Unknown non-coercible error",
+      name: "Error",
     };
   }
-
-  return {
-    message: String(error),
-    name: "Error",
-  };
 }

package/src/metadata.ts

@@ -4,10 +4,10 @@ import {
 } from "@reckona/mreact-shared/html-escape";
 import {
   isDangerousHtmlAttribute,
+  isUnsafeMetaRefreshContent,
   isUnsafeUrlAttribute,
 } from "@reckona/mreact-shared/url-safety";
 import { contentSecurityPolicy } from "./csp.js";
-import type { AppFileConvention } from "./file-conventions.js";
 import type { AppRoute } from "./routes.js";
 import { routeSecurityHeaders } from "./security-headers.js";
 import type {
@@ -28,6 +28,13 @@ const DEFAULT_HTML_RESPONSE_HEADERS = Object.freeze({
   "content-type": "text/html; charset=utf-8",
 });
 
+export interface FileConventionMetadataTemplate {
+  appleIconPath?: string | undefined;
+  iconPath?: string | undefined;
+  openGraphImageFallbackPath?: string | undefined;
+  openGraphImageRoutePath?: string | undefined;
+}
+
 export function mergeRouteMetadata(metadata: readonly RouteMetadata[]): RouteMetadata | undefined {
   if (metadata.length === 0) {
     return undefined;
@@ -67,23 +74,64 @@ export function applyFileConventionMetadata(
   filename: string,
   params: RouteParams,
 ): RouteMetadata | undefined {
-  const next: RouteMetadata = metadata === undefined ? {} : { ...metadata };
+  return applyFileConventionMetadataTemplate(
+    metadata,
+    fileConventionMetadataTemplate(routes, filename),
+    params,
+  );
+}
+
+export function fileConventionMetadataTemplate(
+  routes: readonly AppRoute[],
+  filename: string,
+): FileConventionMetadataTemplate {
+  const pageRoute = routes.find((route) => route.kind === "page" && route.file === filename);
   const iconRoute = routes.find((route) => route.kind === "asset" && route.convention === "icon");
   const appleIconRoute = routes.find(
     (route) => route.kind === "asset" && route.convention === "apple-icon",
   );
-  const openGraphImagePath = fileConventionMetadataRoutePath(
-    routes,
-    filename,
-    params,
-    "opengraph-image",
+  const openGraphImageRoutes = routes.filter(
+    (route) =>
+      (route.kind === "asset" || route.kind === "metadata") &&
+      route.convention === "opengraph-image",
   );
+  const expectedOpenGraphImagePath =
+    pageRoute === undefined
+      ? undefined
+      : pageRoute.path === "/"
+        ? "/opengraph-image"
+        : `${pageRoute.path}/opengraph-image`;
 
-  if (iconRoute !== undefined && next.icons?.icon === undefined) {
-    next.icons = { ...next.icons, icon: iconRoute.path };
+  return {
+    ...(appleIconRoute === undefined ? {} : { appleIconPath: appleIconRoute.path }),
+    ...(iconRoute === undefined ? {} : { iconPath: iconRoute.path }),
+    ...(openGraphImageRoutes.find((route) => route.path === "/opengraph-image") === undefined
+      ? {}
+      : { openGraphImageFallbackPath: "/opengraph-image" }),
+    ...(expectedOpenGraphImagePath === undefined ||
+    openGraphImageRoutes.find((route) => route.path === expectedOpenGraphImagePath) === undefined
+      ? {}
+      : { openGraphImageRoutePath: expectedOpenGraphImagePath }),
+  };
+}
+
+export function applyFileConventionMetadataTemplate(
+  metadata: RouteMetadata | undefined,
+  template: FileConventionMetadataTemplate,
+  params: RouteParams,
+): RouteMetadata | undefined {
+  const next: RouteMetadata = metadata === undefined ? {} : { ...metadata };
+  const openGraphImagePath =
+    (template.openGraphImageRoutePath === undefined
+      ? undefined
+      : concreteRoutePath(template.openGraphImageRoutePath, params)) ??
+    template.openGraphImageFallbackPath;
+
+  if (template.iconPath !== undefined && next.icons?.icon === undefined) {
+    next.icons = { ...next.icons, icon: template.iconPath };
   }
-  if (appleIconRoute !== undefined && next.icons?.apple === undefined) {
-    next.icons = { ...next.icons, apple: appleIconRoute.path };
+  if (template.appleIconPath !== undefined && next.icons?.apple === undefined) {
+    next.icons = { ...next.icons, apple: template.appleIconPath };
   }
   if (
     openGraphImagePath !== undefined &&
@@ -268,33 +316,6 @@ export function serializeSitemap(entries: readonly SitemapEntry[]): string {
   return `<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">${urls}</urlset>`;
 }
 
-function fileConventionMetadataRoutePath(
-  routes: readonly AppRoute[],
-  filename: string,
-  params: RouteParams,
-  convention: AppFileConvention,
-): string | undefined {
-  const pageRoute = routes.find((route) => route.kind === "page" && route.file === filename);
-  const candidateRoutes = routes.filter(
-    (route) =>
-      (route.kind === "asset" || route.kind === "metadata") &&
-      route.convention === convention,
-  );
-
-  if (pageRoute !== undefined) {
-    const expectedPath = pageRoute.path === "/" ? `/${convention}` : `${pageRoute.path}/${convention}`;
-    const routeLocal = candidateRoutes.find((route) => route.path === expectedPath);
-    const routeLocalPath =
-      routeLocal === undefined ? undefined : concreteRoutePath(routeLocal.path, params);
-
-    if (routeLocalPath !== undefined) {
-      return routeLocalPath;
-    }
-  }
-
-  return candidateRoutes.find((route) => route.path === `/${convention}`)?.path;
-}
-
 function concreteRoutePath(path: string, params: RouteParams): string | undefined {
   const segments = path === "/" ? [] : path.slice(1).split("/");
   const concrete: string[] = [];
@@ -695,7 +716,9 @@ function validateOptionalHeadMetadata(value: unknown, path: string): void {
       typeof head.nonce !== "boolean" &&
       typeof head.nonce !== "string"
     ) {
-      throw new Error(`Invalid metadata field ${descriptorPath}.nonce: expected string or boolean.`);
+      throw new Error(
+        `Invalid metadata field ${descriptorPath}.nonce: expected string or boolean.`,
+      );
     }
     if (head.attrs !== undefined) {
       assertPlainMetadataObject(head.attrs, `${descriptorPath}.attrs`);
@@ -713,6 +736,7 @@ function validateOptionalHeadMetadata(value: unknown, path: string): void {
         }
       }
     }
+    validateMetaRefreshHeadDescriptor(head, descriptorPath);
     validateUnknownJsonMetadataFields(
       descriptor as Record<string, unknown>,
       descriptorPath,
@@ -721,6 +745,36 @@ function validateOptionalHeadMetadata(value: unknown, path: string): void {
   });
 }
 
+function validateMetaRefreshHeadDescriptor(head: RouteHeadDescriptor, path: string): void {
+  if (head.tag !== "meta" || head.attrs === undefined) {
+    return;
+  }
+
+  const attrs = Object.entries(head.attrs);
+  const hasRefresh = attrs.some(([name, value]) => {
+    const canonicalName = name.toLowerCase();
+    return (
+      (canonicalName === "http-equiv" || canonicalName === "httpequiv") &&
+      typeof value === "string" &&
+      value.toLowerCase() === "refresh"
+    );
+  });
+
+  if (!hasRefresh) {
+    return;
+  }
+
+  for (const [name, value] of attrs) {
+    if (
+      name.toLowerCase() === "content" &&
+      typeof value === "string" &&
+      isUnsafeMetaRefreshContent("refresh", value)
+    ) {
+      throw new Error(`Invalid metadata field ${path}.attrs.${name}: unsafe refresh URL value.`);
+    }
+  }
+}
+
 function validateHeadAttribute(name: string, value: unknown, path: string): void {
   if (!isSafeHeadAttributeName(name)) {
     throw new Error(`Invalid metadata field ${path}: expected safe HTML attribute name.`);
@@ -728,7 +782,9 @@ function validateHeadAttribute(name: string, value: unknown, path: string): void
 
   const canonicalName = name.toLowerCase();
   if (canonicalName.startsWith("on") || isDangerousHtmlAttribute(canonicalName)) {
-    throw new Error(`Invalid metadata field ${path}: event and dangerous attributes are not allowed.`);
+    throw new Error(
+      `Invalid metadata field ${path}: event and dangerous attributes are not allowed.`,
+    );
   }
 
   if (typeof value === "string" && isUnsafeUrlAttribute(canonicalName, value)) {
@@ -866,20 +922,24 @@ function validateOptionalViewportMetadata(value: unknown, path: string): void {
 }
 
 function validateUnknownMetadataFields(metadata: RouteMetadata, path: string): void {
-  validateUnknownJsonMetadataFields(metadata as Record<string, unknown>, path, new Set([
-    "alternates",
-    "csp",
-    "description",
-    "head",
-    "icons",
-    "lang",
-    "openGraph",
-    "robots",
-    "security",
-    "themeColor",
-    "title",
-    "viewport",
-  ]));
+  validateUnknownJsonMetadataFields(
+    metadata as Record<string, unknown>,
+    path,
+    new Set([
+      "alternates",
+      "csp",
+      "description",
+      "head",
+      "icons",
+      "lang",
+      "openGraph",
+      "robots",
+      "security",
+      "themeColor",
+      "title",
+      "viewport",
+    ]),
+  );
 }
 
 function validateUnknownJsonMetadataFields(
@@ -911,12 +971,13 @@ function validateJsonSerializableMetadata(value: unknown, path: string): void {
     return;
   }
 
-  throw new Error(
-    `Invalid metadata field ${path}: expected a JSON-serializable value.`,
-  );
+  throw new Error(`Invalid metadata field ${path}: expected a JSON-serializable value.`);
 }
 
-function assertPlainMetadataObject(value: unknown, path: string): asserts value is Record<string, unknown> {
+function assertPlainMetadataObject(
+  value: unknown,
+  path: string,
+): asserts value is Record<string, unknown> {
   if (!isPlainMetadataObject(value)) {
     throw new Error(`Invalid metadata field ${path}: expected object.`);
   }
@@ -938,7 +999,9 @@ function openGraphImages(openGraph: RouteMetadata["openGraph"]): readonly string
     );
   }
 
-  return openGraph?.image === undefined ? [] : [metadataImageUrl(openGraph.image, "openGraph.image")];
+  return openGraph?.image === undefined
+    ? []
+    : [metadataImageUrl(openGraph.image, "openGraph.image")];
 }
 
 function metadataImageUrl(value: MetadataImage | MetadataScalar, path: string): string {
@@ -950,7 +1013,9 @@ function metadataImageUrl(value: MetadataImage | MetadataScalar, path: string):
     return metadataString(value.url, `${path}.url`);
   }
 
-  throw new Error(`Invalid metadata field ${path}: expected string, number, boolean, or object with url.`);
+  throw new Error(
+    `Invalid metadata field ${path}: expected string, number, boolean, or object with url.`,
+  );
 }
 
 function robotsContent(robots: NonNullable<RouteMetadata["robots"]>): string {