@reckona/mreact-router 0.0.202 → 0.0.204

package/src/serve.ts

@@ -1,4 +1,5 @@
 import type { Server } from "node:http";
+import type { DehydrateOptions } from "@reckona/mreact-query";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import type { BuiltPrerenderedRoute } from "./build.js";
@@ -22,10 +23,7 @@ import {
   loadBuiltServerModuleArtifacts,
   loadBuiltServerModuleArtifactsForRequest,
 } from "./built-server-module-artifacts.js";
-import {
-  type AppRoute,
-  type MatchedRoute,
-} from "./routes.js";
+import { type AppRoute, type MatchedRoute } from "./routes.js";
 import type { AppRouterServerActionOptions } from "./actions.js";
 import type { AppRouterImportPolicy } from "./import-policy.js";
 import {
@@ -43,24 +41,21 @@ import {
   traceContextFromRequest,
   type RouterInstrumentation,
 } from "./trace.js";
-import {
-  bytesResponse,
-  htmlResponse,
-} from "./http.js";
-import {
-  emitRouterLog,
-  logDurationMs,
-  logNow,
-  type AppRouterLogger,
-} from "./logger.js";
+import { bytesResponse, htmlResponse } from "./http.js";
+import { emitRouterLog, logDurationMs, logNow, type AppRouterLogger } from "./logger.js";
 import { startNodeRequestServer } from "./node-server.js";
 import { builtAppRuntimePreloadPlan } from "./preload-policy.js";
 import { normalizeRoutePath } from "./route-path.js";
-import type { HttpUpgradeHandler } from "./upgrade.js";
+import type { HttpUpgradeOriginPolicy, ManagedHttpUpgradeHandler } from "./upgrade.js";
 import {
   isCurrentPrerenderedRoute,
   isVisitorDependentResponse,
+  mergePrerenderedNavigationHtml,
+  protectNonceBearingResponse,
   PRERENDERED_ROUTE_SCHEMA_VERSION,
+  replayedPrerenderedRouteHeaders,
+  storedPrerenderedRouteHeaders,
+  validatedPrerenderedNavigationHtml,
 } from "./prerender-entry.js";
 
 interface BuiltRuntimeCacheEntry {
@@ -99,6 +94,7 @@ let warnedImplicitHostTrust = false;
  * Configures rendering a request against a built app-router output directory.
  */
 export interface RenderBuiltAppRequestOptions {
+  dehydrateOptions?: DehydrateOptions | undefined;
   outDir: string;
   importPolicy?: AppRouterImportPolicy | undefined;
   instrumentation?: RouterInstrumentation | undefined;
@@ -156,6 +152,7 @@ export interface BuiltAppRuntimePreloadStrategy {
  * Configures the Node HTTP server used to serve a built app-router output.
  */
 export interface StartServerOptions {
+  dehydrateOptions?: DehydrateOptions | undefined;
   outDir: string;
   port: number;
   hostname?: string;
@@ -163,7 +160,11 @@ export interface StartServerOptions {
   // a generic "Internal Server Error" body and logs the stack to stderr
   // via console.error. Issue 071: stack traces must never end up in
   // production responses.
-  errorHandler?: (error: unknown) => { body: string; status: number; headers?: Record<string, string> };
+  errorHandler?: (error: unknown) => {
+    body: string;
+    status: number;
+    headers?: Record<string, string>;
+  };
   // When set, an incoming Host header that does not exactly match one of
   // the listed values is replaced with the configured hostname/port for
   // origin reconstruction. Use this in front of public deployments to
@@ -180,7 +181,13 @@ export interface StartServerOptions {
   routeCache?: AppRouterCache | undefined;
   serverActions?: AppRouterServerActionOptions | undefined;
   sinkStrategy?: ResponseSinkStrategy;
-  onUpgrade?: HttpUpgradeHandler | undefined;
+  onUpgrade?: ManagedHttpUpgradeHandler | undefined;
+  /** Maximum time to wait for application-owned upgrade sockets during shutdown. */
+  upgradeCloseTimeoutMs?: number | undefined;
+  /** Maximum time an asynchronous upgrade handler may leave ownership undecided. */
+  upgradeDecisionTimeoutMs?: number | undefined;
+  /** Origin policy for application HTTP upgrades. Defaults to exact same-origin validation. */
+  upgradeOriginPolicy?: HttpUpgradeOriginPolicy | undefined;
   /**
    * Trusts the first `X-Forwarded-Proto` value when the socket is not TLS.
    *
@@ -219,7 +226,7 @@ export function warnIfImplicitHostTrust(options: {
 
   warnedImplicitHostTrust = true;
   console.error(
-    "[mreact] Host header trust is implicit because neither allowedHosts nor hostPolicy is configured. Set allowedHosts for public deployments, hostPolicy: \"strict\" to reject unlisted Host headers, or hostPolicy: \"trusted-proxy\" when a trusted reverse proxy normalizes Host.",
+    '[mreact] Host header trust is implicit because neither allowedHosts nor hostPolicy is configured. Set allowedHosts for public deployments, hostPolicy: "strict" to reject unlisted Host headers, or hostPolicy: "trusted-proxy" when a trusted reverse proxy normalizes Host.',
   );
 }
 
@@ -255,6 +262,7 @@ export async function createBuiltRequestRuntime(
       emitBuiltRequestStart(renderOptions.instrumentation, request);
       const response = await renderBuiltAppRequestWithRuntime({
         ...renderOptions,
+        dehydrateOptions: renderOptions.dehydrateOptions ?? runtime.dehydrateOptions,
         instrumentation: withoutBuiltRequestInstrumentation(renderOptions.instrumentation),
         importPolicy:
           renderOptions.importPolicy === undefined
@@ -400,8 +408,11 @@ function withoutBuiltRequestInstrumentation(
     return undefined;
   }
 
-  const { onRequestEnd: _onRequestEnd, onRequestStart: _onRequestStart, ...remaining } =
-    instrumentation;
+  const {
+    onRequestEnd: _onRequestEnd,
+    onRequestStart: _onRequestStart,
+    ...remaining
+  } = instrumentation;
   return remaining;
 }
 
@@ -465,22 +476,15 @@ async function renderBuiltAppRequestWithRuntime(
   // no middleware at all. Otherwise a middleware that gates access (auth,
   // geo blocking, maintenance mode) would be bypassed for exactly the routes
   // it is most often used to protect.
-  if (
-    !options.runtime.hasMiddleware &&
-    (request.method === "GET" || request.method === "HEAD")
-  ) {
+  if (!options.runtime.hasMiddleware && (request.method === "GET" || request.method === "HEAD")) {
     // Sync fast path when no external prerender store is configured (the
     // common case): skip the Promise wrap that `readPrerenderedRoute`
     // would otherwise introduce just to satisfy the async signature.
     const prerendered =
       options.prerenderStore === undefined
         ? options.runtime.prerenderedRoutes.get(normalizedPath)
-        : await readPrerenderedRoute(
-            options.runtime,
-            normalizedPath,
-            options.prerenderStore,
-          );
-    const prerenderedResponse = prerenderedRouteResponse(prerendered, request.method);
+        : await readPrerenderedRoute(options.runtime, normalizedPath, options.prerenderStore);
+    const prerenderedResponse = prerenderedRouteResponse(prerendered, request);
 
     if (prerenderedResponse !== undefined) {
       return prerenderedResponse;
@@ -503,19 +507,12 @@ async function renderBuiltAppRequestWithRuntime(
   // Middleware apps resolve prerendered HTML here instead, so that a
   // middleware response or rewrite is honoured before the stored HTML is
   // served. The lookup uses the post-middleware path.
-  if (
-    options.runtime.hasMiddleware &&
-    (request.method === "GET" || request.method === "HEAD")
-  ) {
+  if (options.runtime.hasMiddleware && (request.method === "GET" || request.method === "HEAD")) {
     const prerendered =
       options.prerenderStore === undefined
         ? options.runtime.prerenderedRoutes.get(normalizedPath)
-        : await readPrerenderedRoute(
-            options.runtime,
-            normalizedPath,
-            options.prerenderStore,
-          );
-    const prerenderedResponse = prerenderedRouteResponse(prerendered, request.method);
+        : await readPrerenderedRoute(options.runtime, normalizedPath, options.prerenderStore);
+    const prerenderedResponse = prerenderedRouteResponse(prerendered, request);
 
     if (prerenderedResponse !== undefined) {
       emitBuiltRenderTiming(options, request, timing, prerenderedResponse.status);
@@ -540,34 +537,34 @@ async function renderBuiltAppRequestWithRuntime(
     requestUrl: new URL(request.url),
   });
 
-  await applyBuiltPrerenderInvalidations(
-    options.runtime,
-    response,
-    options.prerenderStore,
-  );
+  await applyBuiltPrerenderInvalidations(options.runtime, response, options.prerenderStore);
 
-  return options.sinkStrategy === "buffer"
-    ? await materializeResponseAsBuffer(response)
-    : response;
+  return options.sinkStrategy === "buffer" ? await materializeResponseAsBuffer(response) : response;
 }
 
 function prerenderedRouteResponse(
   prerendered: BuiltPrerenderedRoute | undefined,
-  method: string,
+  request: Request,
 ): Response | undefined {
   if (!isCurrentPrerenderedRoute(prerendered)) {
     return undefined;
   }
 
-  if (method === "HEAD") {
+  const navigation = request.headers.get("x-mreact-navigation") === "1";
+  const html = navigation ? validatedPrerenderedNavigationHtml(prerendered) : prerendered.html;
+  if (html === undefined) {
+    return undefined;
+  }
+
+  if (request.method === "HEAD") {
     return new Response(null, {
-      headers: prerendered.headers,
+      headers: replayedPrerenderedRouteHeaders(prerendered, request),
       status: prerendered.status,
     });
   }
 
-  return htmlResponse(prerendered.html, {
-    headers: prerendered.headers,
+  return htmlResponse(html, {
+    headers: replayedPrerenderedRouteHeaders(prerendered, request),
     status: prerendered.status,
   });
 }
@@ -662,7 +659,7 @@ async function applyBuiltAppResponseHook(
     request: options.request,
   });
 
-  return hooked instanceof Response ? hooked : response;
+  return protectNonceBearingResponse(hooked instanceof Response ? hooked : response);
 }
 
 async function materializeResponseAsBuffer(response: Response): Promise<Response> {
@@ -707,8 +704,12 @@ export async function startServer(
     port: options.port,
     resolveHost: resolveRequestHost,
     trustForwardedProto: options.trustForwardedProto,
+    upgradeCloseTimeoutMs: options.upgradeCloseTimeoutMs,
+    upgradeDecisionTimeoutMs: options.upgradeDecisionTimeoutMs,
+    upgradeOriginPolicy: options.upgradeOriginPolicy,
     render: (request) =>
       runtime.render(request, {
+        dehydrateOptions: options.dehydrateOptions,
         instrumentation: options.instrumentation,
         logger: options.logger,
         onResponse: options.onResponse,
@@ -927,6 +928,7 @@ function builtRenderAppRequestOptions(
     clientScripts: options.runtime.clientScripts,
     clientStylesByFile: options.runtime.clientStylesByFile,
     clientStyles: options.runtime.clientStyles,
+    dehydrateOptions: options.dehydrateOptions,
     importPolicy: {
       ...options.importPolicy,
       allowedSourceDirs: options.runtime.allowedSourceDirs,
@@ -960,7 +962,9 @@ function builtRenderAppRequestOptions(
 
 function mergeBuiltServerActionOptions(
   options: AppRouterServerActionOptions | undefined,
-  allowedActions: readonly { moduleId: string; exportName: string; inferred?: boolean }[] | undefined,
+  allowedActions:
+    | readonly { moduleId: string; exportName: string; inferred?: boolean }[]
+    | undefined,
 ): AppRouterServerActionOptions | undefined {
   if (allowedActions === undefined) {
     return options;
@@ -976,7 +980,9 @@ async function renderAndCachePrerenderWithLock(
   options: RenderBuiltAppRequestOptions & { runtime: BuiltRuntime },
   path: string,
 ): Promise<Response> {
-  const existing = options.runtime.prerenderLocks.get(path);
+  const lockKey =
+    options.request.headers.get("x-mreact-navigation") === "1" ? `${path}\0navigation` : path;
+  const existing = options.runtime.prerenderLocks.get(lockKey);
 
   if (existing !== undefined) {
     const result = await existing;
@@ -988,12 +994,12 @@ async function renderAndCachePrerenderWithLock(
   }
 
   const task = runPrerenderRegeneration(options, path);
-  options.runtime.prerenderLocks.set(path, task);
+  options.runtime.prerenderLocks.set(lockKey, task);
 
   try {
     return cloneResponse((await task).response);
   } finally {
-    options.runtime.prerenderLocks.delete(path);
+    options.runtime.prerenderLocks.delete(lockKey);
   }
 }
 
@@ -1001,15 +1007,15 @@ async function runPrerenderRegeneration(
   options: RenderBuiltAppRequestOptions & { runtime: BuiltRuntime },
   path: string,
 ): Promise<{ response: Response; shareable: boolean }> {
+  const lockKey =
+    options.request.headers.get("x-mreact-navigation") === "1" ? `${path}\0navigation` : path;
   const regenerate = async () => {
     const stored = await readPrerenderedRoute(options.runtime, path, options.prerenderStore);
+    const storedResponse = prerenderedRouteResponse(stored, options.request);
 
-    if (stored !== undefined) {
+    if (storedResponse !== undefined) {
       return {
-        response: htmlResponse(stored.html, {
-          headers: stored.headers,
-          status: stored.status,
-        }),
+        response: storedResponse,
         shareable: true,
       };
     }
@@ -1018,7 +1024,10 @@ async function runPrerenderRegeneration(
     // render that depended on this visitor's request headers must not become
     // one; it is returned to the caller without being stored. The signal starts
     // closed so that a render which never reports back is not stored either.
-    const renderSignals = { headerDependent: () => true };
+    const renderSignals = {
+      headerDependent: () => true,
+      strictTransportSecurity: () => undefined as string | undefined,
+    };
     const response = await renderBuiltDynamicResponse({ ...options, renderSignals });
 
     if (!response.ok) {
@@ -1039,21 +1048,34 @@ async function runPrerenderRegeneration(
       };
     }
 
+    const navigation = options.request.headers.get("x-mreact-navigation") === "1";
+    if (navigation && stored === undefined) {
+      return {
+        response: htmlResponse(body, {
+          headers: response.headers,
+          status: response.status,
+        }),
+        shareable: false,
+      };
+    }
+
     return {
       response: await cacheRegeneratedPrerenderedRoute(
-          options.runtime,
-          path,
-          body,
-          response,
-          options.prerenderStore,
-        ),
+        options.runtime,
+        path,
+        body,
+        response,
+        renderSignals.strictTransportSecurity(),
+        options.prerenderStore,
+        navigation ? stored : undefined,
+      ),
       shareable: true,
     };
   };
 
   return options.prerenderStore?.withLock === undefined
     ? await regenerate()
-    : await options.prerenderStore.withLock(path, regenerate);
+    : await options.prerenderStore.withLock(lockKey, regenerate);
 }
 
 async function applyBuiltPrerenderInvalidations(
@@ -1079,19 +1101,27 @@ async function cacheRegeneratedPrerenderedRoute(
   path: string,
   body: string,
   response: Response,
+  strictTransportSecurity: string | undefined,
   store: AppRouterPrerenderStore | undefined,
+  existing?: BuiltPrerenderedRoute | undefined,
 ): Promise<Response> {
-  const headers: Record<string, string> = {};
-
-  response.headers.forEach((value, key) => {
-    headers[key] = value;
-  });
-  const entry: BuiltPrerenderedRoute = {
-    headers,
-    html: body,
-    schemaVersion: PRERENDERED_ROUTE_SCHEMA_VERSION,
-    status: response.status,
-  };
+  const headers = storedPrerenderedRouteHeaders(response.headers);
+  const entry: BuiltPrerenderedRoute =
+    existing === undefined
+      ? {
+          headers,
+          html: body,
+          schemaVersion: PRERENDERED_ROUTE_SCHEMA_VERSION,
+          status: response.status,
+          ...(strictTransportSecurity === undefined ? {} : { strictTransportSecurity }),
+        }
+      : mergePrerenderedNavigationHtml(existing, body);
+  if (entry === existing) {
+    return htmlResponse(body, {
+      headers: response.headers,
+      status: response.status,
+    });
+  }
   runtime.prerenderedRoutes.set(path, entry);
   await store?.set(path, entry);
 

package/src/session.ts

@@ -1,4 +1,4 @@
-import { deleteCookie, parseCookieHeader, setCookie } from "./cookies.js";
+import { deleteCookie, parseCookieHeader, serializeCookie, setCookie } from "./cookies.js";
 
 /**
  * Stores session data and expiration metadata for one session id.
@@ -43,32 +43,54 @@ const DEFAULT_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
 const SESSION_COOKIE_DEV = "mreact.session";
 const SESSION_COOKIE_PROD = "__Host-mreact.session";
 
-function isProduction(): boolean {
-  return process.env.NODE_ENV === "production";
+function usesHardenedCookieDefaults(): boolean {
+  const nodeEnv = typeof process === "undefined" ? undefined : process["env"]?.["NODE_ENV"];
+  return nodeEnv !== "development" && nodeEnv !== "test";
 }
 
-function defaultCookieName(): string {
-  return isProduction() ? SESSION_COOKIE_PROD : SESSION_COOKIE_DEV;
-}
-
-function sessionCookieOptions(options: SessionCookieOptions = {}) {
-  const production = isProduction();
-
-  return {
+function resolveSessionCookie(options: SessionCookieOptions = {}) {
+  const hardened = usesHardenedCookieDefaults();
+  const cookieOptions = {
     httpOnly: true,
     maxAge: options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS,
-    path: production ? "/" : options.path ?? "/",
+    path: options.path ?? "/",
     sameSite: options.sameSite ?? "Lax",
-    secure: options.secure ?? production,
+    secure: options.secure ?? hardened,
   } as const;
+  const canUseHostPrefix = cookieOptions.secure && cookieOptions.path === "/";
+
+  return {
+    name:
+      options.cookieName ??
+      (hardened && canUseHostPrefix ? SESSION_COOKIE_PROD : SESSION_COOKIE_DEV),
+    options: cookieOptions,
+  };
 }
 
-function readSessionId(
-  request: Request,
-  options: SessionCookieOptions = {},
-): string | undefined {
+function validateResolvedSessionCookie(cookie: ReturnType<typeof resolveSessionCookie>): void {
+  serializeCookie(cookie.name, "", cookie.options);
+}
+
+function assertMutableResponseHeaders(response: Response): void {
+  const probeName = "x-mreact-session-header-probe";
+  const previous = response.headers.get(probeName);
+
+  try {
+    response.headers.set(probeName, "1");
+    if (previous === null) {
+      response.headers.delete(probeName);
+    } else {
+      response.headers.set(probeName, previous);
+    }
+  } catch (cause) {
+    throw new TypeError("Session helpers require a Response with mutable headers.", { cause });
+  }
+}
+
+function readSessionId(request: Request, options: SessionCookieOptions = {}): string | undefined {
+  const cookie = resolveSessionCookie(options);
   const values = parseCookieHeader(request.headers.get("cookie"));
-  return values.get(options.cookieName ?? defaultCookieName());
+  return values.get(cookie.name);
 }
 
 function createSessionId(): string {
@@ -208,6 +230,9 @@ export async function createSession<TData>(
 ): Promise<SessionRecord<TData>> {
   const now = Date.now();
   const maxAgeSeconds = options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;
+  const cookie = resolveSessionCookie({ ...options, maxAgeSeconds });
+  validateResolvedSessionCookie(cookie);
+  assertMutableResponseHeaders(response);
   const record: SessionRecord<TData> = {
     createdAt: now,
     data,
@@ -216,9 +241,7 @@ export async function createSession<TData>(
   };
 
   await store.set(record);
-  setCookie(response, options.cookieName ?? defaultCookieName(), record.id, {
-    ...sessionCookieOptions({ ...options, maxAgeSeconds }),
-  });
+  setCookie(response, cookie.name, record.id, cookie.options);
 
   return record;
 }
@@ -232,16 +255,22 @@ export async function destroySession<TData>(
   store: SessionStore<TData>,
   options: SessionCookieOptions = {},
 ): Promise<void> {
+  const cookie = resolveSessionCookie(options);
+  validateResolvedSessionCookie({
+    name: cookie.name,
+    options: { ...cookie.options, maxAge: 0 },
+  });
+  assertMutableResponseHeaders(response);
   const id = readSessionId(request, options);
 
   if (id !== undefined) {
     await store.delete(id);
   }
 
-  deleteCookie(response, options.cookieName ?? defaultCookieName(), {
-    path: isProduction() ? "/" : options.path ?? "/",
-    sameSite: options.sameSite ?? "Lax",
-    secure: options.secure ?? isProduction(),
+  deleteCookie(response, cookie.name, {
+    path: cookie.options.path,
+    sameSite: cookie.options.sameSite,
+    secure: cookie.options.secure,
   });
 }
 
@@ -256,6 +285,8 @@ export async function rotateSession<TData>(
   store: SessionStore<TData>,
   options: SessionCookieOptions = {},
 ): Promise<SessionRecord<TData> | undefined> {
+  validateResolvedSessionCookie(resolveSessionCookie(options));
+  assertMutableResponseHeaders(response);
   const current = await getSession(request, store, options);
 
   if (current === undefined) {