@reckona/mreact-router 0.0.203 → 0.0.205

package/src/serve.ts

@@ -23,10 +23,7 @@ import {
   loadBuiltServerModuleArtifacts,
   loadBuiltServerModuleArtifactsForRequest,
 } from "./built-server-module-artifacts.js";
-import {
-  type AppRoute,
-  type MatchedRoute,
-} from "./routes.js";
+import { type AppRoute, type MatchedRoute } from "./routes.js";
 import type { AppRouterServerActionOptions } from "./actions.js";
 import type { AppRouterImportPolicy } from "./import-policy.js";
 import {
@@ -44,26 +41,21 @@ import {
   traceContextFromRequest,
   type RouterInstrumentation,
 } from "./trace.js";
-import {
-  bytesResponse,
-  htmlResponse,
-} from "./http.js";
-import {
-  emitRouterLog,
-  logDurationMs,
-  logNow,
-  type AppRouterLogger,
-} from "./logger.js";
+import { bytesResponse, htmlResponse } from "./http.js";
+import { emitRouterLog, logDurationMs, logNow, type AppRouterLogger } from "./logger.js";
 import { startNodeRequestServer } from "./node-server.js";
 import { builtAppRuntimePreloadPlan } from "./preload-policy.js";
 import { normalizeRoutePath } from "./route-path.js";
-import type { HttpUpgradeHandler } from "./upgrade.js";
+import type { HttpUpgradeOriginPolicy, ManagedHttpUpgradeHandler } from "./upgrade.js";
 import {
   isCurrentPrerenderedRoute,
   isVisitorDependentResponse,
+  mergePrerenderedNavigationHtml,
+  protectNonceBearingResponse,
   PRERENDERED_ROUTE_SCHEMA_VERSION,
   replayedPrerenderedRouteHeaders,
   storedPrerenderedRouteHeaders,
+  validatedPrerenderedNavigationHtml,
 } from "./prerender-entry.js";
 
 interface BuiltRuntimeCacheEntry {
@@ -168,7 +160,11 @@ export interface StartServerOptions {
   // a generic "Internal Server Error" body and logs the stack to stderr
   // via console.error. Issue 071: stack traces must never end up in
   // production responses.
-  errorHandler?: (error: unknown) => { body: string; status: number; headers?: Record<string, string> };
+  errorHandler?: (error: unknown) => {
+    body: string;
+    status: number;
+    headers?: Record<string, string>;
+  };
   // When set, an incoming Host header that does not exactly match one of
   // the listed values is replaced with the configured hostname/port for
   // origin reconstruction. Use this in front of public deployments to
@@ -185,7 +181,13 @@ export interface StartServerOptions {
   routeCache?: AppRouterCache | undefined;
   serverActions?: AppRouterServerActionOptions | undefined;
   sinkStrategy?: ResponseSinkStrategy;
-  onUpgrade?: HttpUpgradeHandler | undefined;
+  onUpgrade?: ManagedHttpUpgradeHandler | undefined;
+  /** Maximum time to wait for application-owned upgrade sockets during shutdown. */
+  upgradeCloseTimeoutMs?: number | undefined;
+  /** Maximum time an asynchronous upgrade handler may leave ownership undecided. */
+  upgradeDecisionTimeoutMs?: number | undefined;
+  /** Origin policy for application HTTP upgrades. Defaults to exact same-origin validation. */
+  upgradeOriginPolicy?: HttpUpgradeOriginPolicy | undefined;
   /**
    * Trusts the first `X-Forwarded-Proto` value when the socket is not TLS.
    *
@@ -224,7 +226,7 @@ export function warnIfImplicitHostTrust(options: {
 
   warnedImplicitHostTrust = true;
   console.error(
-    "[mreact] Host header trust is implicit because neither allowedHosts nor hostPolicy is configured. Set allowedHosts for public deployments, hostPolicy: \"strict\" to reject unlisted Host headers, or hostPolicy: \"trusted-proxy\" when a trusted reverse proxy normalizes Host.",
+    '[mreact] Host header trust is implicit because neither allowedHosts nor hostPolicy is configured. Set allowedHosts for public deployments, hostPolicy: "strict" to reject unlisted Host headers, or hostPolicy: "trusted-proxy" when a trusted reverse proxy normalizes Host.',
   );
 }
 
@@ -260,6 +262,7 @@ export async function createBuiltRequestRuntime(
       emitBuiltRequestStart(renderOptions.instrumentation, request);
       const response = await renderBuiltAppRequestWithRuntime({
         ...renderOptions,
+        dehydrateOptions: renderOptions.dehydrateOptions ?? runtime.dehydrateOptions,
         instrumentation: withoutBuiltRequestInstrumentation(renderOptions.instrumentation),
         importPolicy:
           renderOptions.importPolicy === undefined
@@ -405,8 +408,11 @@ function withoutBuiltRequestInstrumentation(
     return undefined;
   }
 
-  const { onRequestEnd: _onRequestEnd, onRequestStart: _onRequestStart, ...remaining } =
-    instrumentation;
+  const {
+    onRequestEnd: _onRequestEnd,
+    onRequestStart: _onRequestStart,
+    ...remaining
+  } = instrumentation;
   return remaining;
 }
 
@@ -470,21 +476,14 @@ async function renderBuiltAppRequestWithRuntime(
   // no middleware at all. Otherwise a middleware that gates access (auth,
   // geo blocking, maintenance mode) would be bypassed for exactly the routes
   // it is most often used to protect.
-  if (
-    !options.runtime.hasMiddleware &&
-    (request.method === "GET" || request.method === "HEAD")
-  ) {
+  if (!options.runtime.hasMiddleware && (request.method === "GET" || request.method === "HEAD")) {
     // Sync fast path when no external prerender store is configured (the
     // common case): skip the Promise wrap that `readPrerenderedRoute`
     // would otherwise introduce just to satisfy the async signature.
     const prerendered =
       options.prerenderStore === undefined
         ? options.runtime.prerenderedRoutes.get(normalizedPath)
-        : await readPrerenderedRoute(
-            options.runtime,
-            normalizedPath,
-            options.prerenderStore,
-          );
+        : await readPrerenderedRoute(options.runtime, normalizedPath, options.prerenderStore);
     const prerenderedResponse = prerenderedRouteResponse(prerendered, request);
 
     if (prerenderedResponse !== undefined) {
@@ -508,18 +507,11 @@ async function renderBuiltAppRequestWithRuntime(
   // Middleware apps resolve prerendered HTML here instead, so that a
   // middleware response or rewrite is honoured before the stored HTML is
   // served. The lookup uses the post-middleware path.
-  if (
-    options.runtime.hasMiddleware &&
-    (request.method === "GET" || request.method === "HEAD")
-  ) {
+  if (options.runtime.hasMiddleware && (request.method === "GET" || request.method === "HEAD")) {
     const prerendered =
       options.prerenderStore === undefined
         ? options.runtime.prerenderedRoutes.get(normalizedPath)
-        : await readPrerenderedRoute(
-            options.runtime,
-            normalizedPath,
-            options.prerenderStore,
-          );
+        : await readPrerenderedRoute(options.runtime, normalizedPath, options.prerenderStore);
     const prerenderedResponse = prerenderedRouteResponse(prerendered, request);
 
     if (prerenderedResponse !== undefined) {
@@ -545,15 +537,9 @@ async function renderBuiltAppRequestWithRuntime(
     requestUrl: new URL(request.url),
   });
 
-  await applyBuiltPrerenderInvalidations(
-    options.runtime,
-    response,
-    options.prerenderStore,
-  );
+  await applyBuiltPrerenderInvalidations(options.runtime, response, options.prerenderStore);
 
-  return options.sinkStrategy === "buffer"
-    ? await materializeResponseAsBuffer(response)
-    : response;
+  return options.sinkStrategy === "buffer" ? await materializeResponseAsBuffer(response) : response;
 }
 
 function prerenderedRouteResponse(
@@ -565,7 +551,7 @@ function prerenderedRouteResponse(
   }
 
   const navigation = request.headers.get("x-mreact-navigation") === "1";
-  const html = navigation ? prerendered.navigationHtml : prerendered.html;
+  const html = navigation ? validatedPrerenderedNavigationHtml(prerendered) : prerendered.html;
   if (html === undefined) {
     return undefined;
   }
@@ -673,7 +659,7 @@ async function applyBuiltAppResponseHook(
     request: options.request,
   });
 
-  return hooked instanceof Response ? hooked : response;
+  return protectNonceBearingResponse(hooked instanceof Response ? hooked : response);
 }
 
 async function materializeResponseAsBuffer(response: Response): Promise<Response> {
@@ -718,6 +704,9 @@ export async function startServer(
     port: options.port,
     resolveHost: resolveRequestHost,
     trustForwardedProto: options.trustForwardedProto,
+    upgradeCloseTimeoutMs: options.upgradeCloseTimeoutMs,
+    upgradeDecisionTimeoutMs: options.upgradeDecisionTimeoutMs,
+    upgradeOriginPolicy: options.upgradeOriginPolicy,
     render: (request) =>
       runtime.render(request, {
         dehydrateOptions: options.dehydrateOptions,
@@ -973,7 +962,9 @@ function builtRenderAppRequestOptions(
 
 function mergeBuiltServerActionOptions(
   options: AppRouterServerActionOptions | undefined,
-  allowedActions: readonly { moduleId: string; exportName: string; inferred?: boolean }[] | undefined,
+  allowedActions:
+    | readonly { moduleId: string; exportName: string; inferred?: boolean }[]
+    | undefined,
 ): AppRouterServerActionOptions | undefined {
   if (allowedActions === undefined) {
     return options;
@@ -990,9 +981,7 @@ async function renderAndCachePrerenderWithLock(
   path: string,
 ): Promise<Response> {
   const lockKey =
-    options.request.headers.get("x-mreact-navigation") === "1"
-      ? `${path}\0navigation`
-      : path;
+    options.request.headers.get("x-mreact-navigation") === "1" ? `${path}\0navigation` : path;
   const existing = options.runtime.prerenderLocks.get(lockKey);
 
   if (existing !== undefined) {
@@ -1019,9 +1008,7 @@ async function runPrerenderRegeneration(
   path: string,
 ): Promise<{ response: Response; shareable: boolean }> {
   const lockKey =
-    options.request.headers.get("x-mreact-navigation") === "1"
-      ? `${path}\0navigation`
-      : path;
+    options.request.headers.get("x-mreact-navigation") === "1" ? `${path}\0navigation` : path;
   const regenerate = async () => {
     const stored = await readPrerenderedRoute(options.runtime, path, options.prerenderStore);
     const storedResponse = prerenderedRouteResponse(stored, options.request);
@@ -1128,7 +1115,13 @@ async function cacheRegeneratedPrerenderedRoute(
           status: response.status,
           ...(strictTransportSecurity === undefined ? {} : { strictTransportSecurity }),
         }
-      : { ...existing, navigationHtml: body };
+      : mergePrerenderedNavigationHtml(existing, body);
+  if (entry === existing) {
+    return htmlResponse(body, {
+      headers: response.headers,
+      status: response.status,
+    });
+  }
   runtime.prerenderedRoutes.set(path, entry);
   await store?.set(path, entry);
 

package/src/session.ts

@@ -1,4 +1,4 @@
-import { deleteCookie, parseCookieHeader, setCookie } from "./cookies.js";
+import { deleteCookie, parseCookieHeader, serializeCookie, setCookie } from "./cookies.js";
 
 /**
  * Stores session data and expiration metadata for one session id.
@@ -43,32 +43,54 @@ const DEFAULT_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
 const SESSION_COOKIE_DEV = "mreact.session";
 const SESSION_COOKIE_PROD = "__Host-mreact.session";
 
-function isProduction(): boolean {
-  return process.env.NODE_ENV === "production";
+function usesHardenedCookieDefaults(): boolean {
+  const nodeEnv = typeof process === "undefined" ? undefined : process["env"]?.["NODE_ENV"];
+  return nodeEnv !== "development" && nodeEnv !== "test";
 }
 
-function defaultCookieName(): string {
-  return isProduction() ? SESSION_COOKIE_PROD : SESSION_COOKIE_DEV;
-}
-
-function sessionCookieOptions(options: SessionCookieOptions = {}) {
-  const production = isProduction();
-
-  return {
+function resolveSessionCookie(options: SessionCookieOptions = {}) {
+  const hardened = usesHardenedCookieDefaults();
+  const cookieOptions = {
     httpOnly: true,
     maxAge: options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS,
-    path: production ? "/" : options.path ?? "/",
+    path: options.path ?? "/",
     sameSite: options.sameSite ?? "Lax",
-    secure: options.secure ?? production,
+    secure: options.secure ?? hardened,
   } as const;
+  const canUseHostPrefix = cookieOptions.secure && cookieOptions.path === "/";
+
+  return {
+    name:
+      options.cookieName ??
+      (hardened && canUseHostPrefix ? SESSION_COOKIE_PROD : SESSION_COOKIE_DEV),
+    options: cookieOptions,
+  };
 }
 
-function readSessionId(
-  request: Request,
-  options: SessionCookieOptions = {},
-): string | undefined {
+function validateResolvedSessionCookie(cookie: ReturnType<typeof resolveSessionCookie>): void {
+  serializeCookie(cookie.name, "", cookie.options);
+}
+
+function assertMutableResponseHeaders(response: Response): void {
+  const probeName = "x-mreact-session-header-probe";
+  const previous = response.headers.get(probeName);
+
+  try {
+    response.headers.set(probeName, "1");
+    if (previous === null) {
+      response.headers.delete(probeName);
+    } else {
+      response.headers.set(probeName, previous);
+    }
+  } catch (cause) {
+    throw new TypeError("Session helpers require a Response with mutable headers.", { cause });
+  }
+}
+
+function readSessionId(request: Request, options: SessionCookieOptions = {}): string | undefined {
+  const cookie = resolveSessionCookie(options);
   const values = parseCookieHeader(request.headers.get("cookie"));
-  return values.get(options.cookieName ?? defaultCookieName());
+  return values.get(cookie.name);
 }
 
 function createSessionId(): string {
@@ -208,6 +230,9 @@ export async function createSession<TData>(
 ): Promise<SessionRecord<TData>> {
   const now = Date.now();
   const maxAgeSeconds = options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;
+  const cookie = resolveSessionCookie({ ...options, maxAgeSeconds });
+  validateResolvedSessionCookie(cookie);
+  assertMutableResponseHeaders(response);
   const record: SessionRecord<TData> = {
     createdAt: now,
     data,
@@ -216,9 +241,7 @@ export async function createSession<TData>(
   };
 
   await store.set(record);
-  setCookie(response, options.cookieName ?? defaultCookieName(), record.id, {
-    ...sessionCookieOptions({ ...options, maxAgeSeconds }),
-  });
+  setCookie(response, cookie.name, record.id, cookie.options);
 
   return record;
 }
@@ -232,16 +255,22 @@ export async function destroySession<TData>(
   store: SessionStore<TData>,
   options: SessionCookieOptions = {},
 ): Promise<void> {
+  const cookie = resolveSessionCookie(options);
+  validateResolvedSessionCookie({
+    name: cookie.name,
+    options: { ...cookie.options, maxAge: 0 },
+  });
+  assertMutableResponseHeaders(response);
   const id = readSessionId(request, options);
 
   if (id !== undefined) {
     await store.delete(id);
   }
 
-  deleteCookie(response, options.cookieName ?? defaultCookieName(), {
-    path: isProduction() ? "/" : options.path ?? "/",
-    sameSite: options.sameSite ?? "Lax",
-    secure: options.secure ?? isProduction(),
+  deleteCookie(response, cookie.name, {
+    path: cookie.options.path,
+    sameSite: cookie.options.sameSite,
+    secure: cookie.options.secure,
   });
 }
 
@@ -256,6 +285,8 @@ export async function rotateSession<TData>(
   store: SessionStore<TData>,
   options: SessionCookieOptions = {},
 ): Promise<SessionRecord<TData> | undefined> {
+  validateResolvedSessionCookie(resolveSessionCookie(options));
+  assertMutableResponseHeaders(response);
   const current = await getSession(request, store, options);
 
   if (current === undefined) {