@reckona/mreact-router 0.0.203 → 0.0.205

package/src/actions.ts

@@ -8,6 +8,7 @@ import {
 } from "@reckona/mreact-compiler";
 import {
   createServerActionHandler,
+  ensureServerActionReplayStoreContract,
   type ServerActionHandlerOptions,
   type ServerActionReplayClaim,
   type ServerActionRegistry,
@@ -19,7 +20,7 @@ import { bundleRouterModule, type RouterCompatBuildApi } from "./bundle-pipeline
 import { type AppRouterCache, withRouteCacheContext } from "./cache.js";
 import { fileImportMetaUrlPlugin, importAppRouterSourceModule } from "./module-runner.js";
 import { createAppRouterImportPolicyPlugin, type AppRouterImportPolicy } from "./import-policy.js";
-import { cookies, type RequestCookies } from "./navigation.js";
+import { cookies, isSafeInternalRedirect, type RequestCookies } from "./navigation.js";
 export {
   createFormCsrfToken,
   formCsrfCookie,
@@ -72,6 +73,7 @@ const actionTokenSecret = configuredActionTokenSecret(process.env.MREACT_SERVER_
 // traffic does not trip false-positive 409s.
 const DEFAULT_REPLAY_TTL_MS = 10 * 60 * 1000;
 const DEFAULT_REPLAY_MAX_ENTRIES = 50_000;
+const DEFAULT_REPLAY_MINIMUM_RETENTION_MS = 60_000;
 const DEFAULT_ACTION_BODY_MAX_BYTES = 10 * 1024 * 1024;
 const DEFAULT_ACTION_FORM_MAX_FIELDS = 1_000;
 let warnedUnrestrictedServerActions = false;
@@ -115,30 +117,59 @@ function configuredActionTokenSecret(value: string | undefined): string {
 class BoundedReplayStore {
   private readonly entries = new Map<
     string,
-    { state: "in-flight" } | { state: "completed"; expiresAt: number }
+    | { state: "in-flight"; leaseExpiresAt: number }
+    | { state: "completed"; expiresAt: number; protectedUntil: number }
   >();
+  private capacityWarningActive = false;
+  private warnedLeaseReclamation = false;
+  private readonly minimumRetentionMs: number;
 
   constructor(
     private readonly ttlMs: number,
     private readonly maxEntries: number,
-  ) {}
+  ) {
+    this.minimumRetentionMs = Math.min(ttlMs, DEFAULT_REPLAY_MINIMUM_RETENTION_MS);
+  }
 
   claim(value: string): ServerActionReplayClaim {
+    const now = Date.now();
+    if (this.entries.size < this.maxEntries) {
+      this.capacityWarningActive = false;
+    }
+
     const existing = this.entries.get(value);
-    if (existing?.state === "completed" && existing.expiresAt < Date.now()) {
+    if (existing?.state === "completed" && existing.expiresAt <= now) {
+      this.entries.delete(value);
+    } else if (existing?.state === "in-flight" && existing.leaseExpiresAt <= now) {
       this.entries.delete(value);
+      this.warnLeaseReclamation();
     }
 
     if (this.entries.has(value)) return { status: "replay" };
     if (this.entries.size >= this.maxEntries) {
-      const now = Date.now();
+      this.warnCapacity();
+      let reclaimableCompletedKey: string | undefined;
       for (const [key, entry] of this.entries) {
-        if (entry.state === "completed" && entry.expiresAt < now) this.entries.delete(key);
+        if (
+          (entry.state === "completed" && entry.expiresAt <= now) ||
+          (entry.state === "in-flight" && entry.leaseExpiresAt <= now)
+        ) {
+          this.entries.delete(key);
+        } else if (
+          reclaimableCompletedKey === undefined &&
+          entry.state === "completed" &&
+          entry.protectedUntil <= now
+        ) {
+          reclaimableCompletedKey = key;
+        }
+      }
+      if (this.entries.size >= this.maxEntries && reclaimableCompletedKey !== undefined) {
+        this.entries.delete(reclaimableCompletedKey);
       }
       if (this.entries.size >= this.maxEntries) return { status: "capacity-exceeded" };
     }
 
-    const entry = { state: "in-flight" as const };
+    const entry = { state: "in-flight" as const, leaseExpiresAt: now + this.ttlMs };
     this.entries.set(value, entry);
     let finalized = false;
     return {
@@ -147,16 +178,51 @@ class BoundedReplayStore {
         if (finalized) return;
         finalized = true;
         if (this.entries.get(value) === entry) {
-          this.entries.set(value, { state: "completed", expiresAt: Date.now() + this.ttlMs });
+          const completedAt = Date.now();
+          this.entries.delete(value);
+          this.entries.set(value, {
+            state: "completed",
+            expiresAt: completedAt + this.ttlMs,
+            protectedUntil: completedAt + this.minimumRetentionMs,
+          });
         }
       },
     };
   }
 
+  // Exposed for tests; not part of the ServerActionReplayStore interface.
+  clear(): void {
+    this.entries.clear();
+    this.capacityWarningActive = false;
+    this.warnedLeaseReclamation = false;
+  }
+
   // Exposed for tests; not part of the ServerActionReplayStore interface.
   size(): number {
     return this.entries.size;
   }
+
+  private warnCapacity(): void {
+    if (this.capacityWarningActive) return;
+    this.capacityWarningActive = true;
+    let completed = 0;
+    let inFlight = 0;
+    for (const entry of this.entries.values()) {
+      if (entry.state === "completed") completed += 1;
+      else inFlight += 1;
+    }
+    console.error(
+      `mreact-router: default server action replay store reached capacity (size=${this.entries.size}, maxEntries=${this.maxEntries}, completed=${completed}, inFlight=${inFlight}, minimumRetentionMs=${this.minimumRetentionMs}). Completed claims remain exact through minimumRetentionMs and may be reclaimed under pressure afterward; expired in-flight leases may also be reclaimed. Applications requiring exact protection for the full action lifetime and retention window must use a shared replay store.`,
+    );
+  }
+
+  private warnLeaseReclamation(): void {
+    if (this.warnedLeaseReclamation) return;
+    this.warnedLeaseReclamation = true;
+    console.error(
+      `mreact-router: default server action replay store reclaimed an expired in-flight claim after leaseMs=${this.ttlMs}; exact duplicate-execution protection no longer applies to that abandoned claim.`,
+    );
+  }
 }
 
 const usedFormActionNonces = new BoundedReplayStore(
@@ -168,7 +234,7 @@ const usedFormActionNonces = new BoundedReplayStore(
 // so tests can drive its eviction semantics directly. Not part of the
 // public surface (prefixed with `__`).
 export function __clearDefaultReplayStore(): void {
-  (usedFormActionNonces as unknown as { entries: Map<string, number> }).entries.clear();
+  usedFormActionNonces.clear();
 }
 
 export function __readDefaultReplayStore(): BoundedReplayStore {
@@ -795,8 +861,9 @@ function sameOriginRefererPath(request: Request): string | undefined {
     const requestUrl = new URL(request.url);
     const refererUrl = new URL(referer, requestUrl);
 
-    return refererUrl.origin === requestUrl.origin
-      ? `${refererUrl.pathname}${refererUrl.search}`
+    const location = `${refererUrl.pathname}${refererUrl.search}`;
+    return refererUrl.origin === requestUrl.origin && isSafeInternalRedirect(location)
+      ? location
       : undefined;
   } catch {
     return undefined;
@@ -1497,6 +1564,9 @@ async function claimFormNonce(
   replayStore: ServerActionReplayStore,
 ): Promise<Extract<Awaited<ReturnType<ServerActionReplayStore["claim"]>>, { status: "claimed" }> | Response> {
   let claim: Awaited<ReturnType<ServerActionReplayStore["claim"]>>;
+  if (!ensureServerActionReplayStoreContract(replayStore)) {
+    return replayStoreUnavailableResponse();
+  }
   try {
     claim = await replayStore.claim(nonce);
   } catch {