@reckona/mreact-router 0.0.203 → 0.0.205

package/src/prerender-entry.ts

@@ -1,8 +1,11 @@
 import type { BuiltPrerenderedRoute } from "./build.js";
+import { responseHeadersContainCspNonce } from "./csp.js";
 import { hasNavigationRouteMarker } from "./navigation-marker.js";
 
 export const PRERENDERED_ROUTE_SCHEMA_VERSION = 4;
 
+const validatedNavigationHtmlByEntry = new WeakMap<object, string | null>();
+
 export function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerenderedRoute {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return false;
@@ -17,9 +20,6 @@ export function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerend
     !hasStoredHstsHeader(entry.headers) &&
     isCanonicalHstsHeader(entry.strictTransportSecurity) &&
     typeof entry.html === "string" &&
-    (entry.navigationHtml === undefined ||
-      (typeof entry.navigationHtml === "string" &&
-        hasNavigationRouteMarker(entry.navigationHtml))) &&
     typeof entry.status === "number" &&
     Number.isInteger(entry.status) &&
     entry.status >= 100 &&
@@ -27,6 +27,39 @@ export function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerend
   );
 }
 
+/**
+ * Returns a navigation variant only after validating its route marker.
+ *
+ * Stored entries are stable objects during a runtime's lifetime, so the
+ * marker scan is cached by identity. Document requests never call this
+ * function and therefore never inspect navigation HTML.
+ */
+export function validatedPrerenderedNavigationHtml(
+  entry: BuiltPrerenderedRoute,
+): string | undefined {
+  const cached = validatedNavigationHtmlByEntry.get(entry);
+  if (cached !== undefined) {
+    return cached === null ? undefined : cached;
+  }
+
+  const candidate = entry.navigationHtml;
+  const validated =
+    typeof candidate === "string" && hasNavigationRouteMarker(candidate) ? candidate : null;
+  validatedNavigationHtmlByEntry.set(entry, validated);
+  return validated === null ? undefined : validated;
+}
+
+/**
+ * Adds a regenerated navigation variant only when it satisfies the marker
+ * contract. Invalid navigation output must not replace a valid document.
+ */
+export function mergePrerenderedNavigationHtml(
+  entry: BuiltPrerenderedRoute,
+  navigationHtml: string,
+): BuiltPrerenderedRoute {
+  return hasNavigationRouteMarker(navigationHtml) ? { ...entry, navigationHtml } : entry;
+}
+
 function hasStoredHstsHeader(headers: Record<string, string>): boolean {
   try {
     return new Headers(headers).has("strict-transport-security");
@@ -47,6 +80,21 @@ export function isVisitorDependentResponse(response: Response): boolean {
   return isVisitorDependentHeaders(response.headers);
 }
 
+export function protectNonceBearingResponse(response: Response): Response {
+  if (!responseHeadersContainCspNonce(response.headers)) {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+  headers.set("cache-control", "private, no-store");
+  headers.set("x-mreact-cache", "DYNAMIC");
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
 export function storedPrerenderedRouteHeaders(headers: Headers): Record<string, string> {
   const stored: Record<string, string> = {};
 
@@ -114,6 +162,7 @@ function isVisitorDependentHeaders(headers: Headers): boolean {
   return (
     headers.get("x-mreact-cache")?.toUpperCase() === "DYNAMIC" ||
     headers.has("set-cookie") ||
+    responseHeadersContainCspNonce(headers) ||
     hasVisitorDependentVary ||
     forbidsSharedStorage
   );