@reckona/mreact-router 0.0.66 → 0.0.68

package/src/routes.ts

@@ -0,0 +1,362 @@
+import { readdir } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { createNativeRouteMatcher } from "./native-route-matcher.js";
+import {
+  appFileConventionForRootFilename,
+  type AppFileConvention,
+} from "./file-conventions.js";
+
+export interface ScanAppRoutesOptions {
+  appDir: string;
+}
+
+export type AppRoute = AppAssetRoute | AppMetadataRoute | PageRoute | ServerRoute;
+
+export interface PageRoute {
+  kind: "page";
+  path: string;
+  file: string;
+  segments: RouteSegment[];
+}
+
+export interface ServerRoute {
+  kind: "server";
+  path: string;
+  file: string;
+  segments: RouteSegment[];
+}
+
+export interface AppMetadataRoute {
+  convention: AppFileConvention;
+  kind: "metadata";
+  path: string;
+  file: string;
+  segments: RouteSegment[];
+}
+
+export interface AppAssetRoute {
+  convention: AppFileConvention;
+  kind: "asset";
+  path: string;
+  file: string;
+  segments: RouteSegment[];
+}
+
+export type RouteSegment =
+  | { kind: "static"; value: string }
+  | { kind: "dynamic"; name: string }
+  | { kind: "catch-all"; name: string };
+
+export interface MatchedRoute {
+  route: AppRoute;
+  params: Record<string, readonly string[] | string>;
+}
+
+export interface RouteMatcher {
+  match(pathname: string): MatchedRoute | undefined;
+}
+
+export async function scanAppRoutes(
+  options: ScanAppRoutesOptions,
+): Promise<AppRoute[]> {
+  const files = await collectRouteFiles(options.appDir);
+
+  return files
+    .map((file): AppRoute => {
+      const relativeFile = relative(options.appDir, file);
+      const convention = appFileConventionForRelativeFile(relativeFile);
+      if (convention !== undefined) {
+        return {
+          convention: convention.convention,
+          file,
+          kind: convention.kind,
+          path: convention.path,
+          segments: segmentsFromPath(convention.path),
+        };
+      }
+
+      const kind = relativeFile.endsWith("route.ts") ? "server" : "page";
+      const routePath = routePathFromRelativeFile(relativeFile);
+      const segments = segmentsFromPath(routePath);
+
+      return { kind, path: routePath, file, segments };
+    })
+    .sort(compareRouteListEntries);
+}
+
+export function matchRoute(
+  routes: readonly AppRoute[],
+  pathname: string,
+): MatchedRoute | undefined {
+  return createRouteMatcher(routes).match(pathname);
+}
+
+export function createRouteMatcher(routes: readonly AppRoute[]): RouteMatcher {
+  const sortedRoutes = [...routes].sort(compareRoutes);
+  const nativeMatcher = createNativeRouteMatcher(sortedRoutes);
+
+  if (nativeMatcher !== undefined) {
+    return nativeMatcher;
+  }
+
+  return {
+    match(pathname) {
+      return matchSortedRoutes(sortedRoutes, pathname);
+    },
+  };
+}
+
+function matchSortedRoutes(
+  routes: readonly AppRoute[],
+  pathname: string,
+): MatchedRoute | undefined {
+  const normalized = normalizePath(pathname);
+  const pathnameSegments = normalized === "/" ? [] : normalized.slice(1).split("/");
+
+  for (const route of routes) {
+    const catchAllIndex = route.segments.findIndex(
+      (segment) => segment.kind === "catch-all",
+    );
+
+    if (catchAllIndex === -1 && route.segments.length !== pathnameSegments.length) {
+      continue;
+    }
+
+    if (catchAllIndex !== -1 && pathnameSegments.length < catchAllIndex + 1) {
+      continue;
+    }
+
+    const params: Record<string, readonly string[] | string> = {};
+    let matched = true;
+
+    for (const [index, segment] of route.segments.entries()) {
+      const value = pathnameSegments[index];
+
+      if (value === undefined) {
+        matched = false;
+        break;
+      }
+
+      if (segment.kind === "static" && segment.value !== value) {
+        matched = false;
+        break;
+      }
+
+      if (segment.kind === "dynamic") {
+        const decoded = safeDecodeURIComponent(value);
+        if (decoded === undefined) {
+          // Malformed percent-encoding -- treat as non-match rather than
+          // letting URIError escape and produce a 500 (Issue 072).
+          matched = false;
+          break;
+        }
+        params[segment.name] = decoded;
+      }
+
+      if (segment.kind === "catch-all") {
+        const suffixSegments = route.segments.slice(index + 1);
+        const catchAllEnd = pathnameSegments.length - suffixSegments.length;
+
+        if (catchAllEnd <= index) {
+          matched = false;
+          break;
+        }
+
+        const decodedParts: string[] = [];
+        let decodeOk = true;
+        for (const part of pathnameSegments.slice(index, catchAllEnd)) {
+          const decoded = safeDecodeURIComponent(part);
+          if (decoded === undefined) {
+            decodeOk = false;
+            break;
+          }
+          decodedParts.push(decoded);
+        }
+        if (!decodeOk) {
+          matched = false;
+          break;
+        }
+        params[segment.name] = decodedParts;
+
+        for (let suffixIndex = 0; suffixIndex < suffixSegments.length; suffixIndex += 1) {
+          const suffixSegment = suffixSegments[suffixIndex];
+          const suffixValue = pathnameSegments[catchAllEnd + suffixIndex];
+
+          if (suffixSegment === undefined || suffixValue === undefined) {
+            matched = false;
+            break;
+          }
+
+          if (suffixSegment.kind === "static" && suffixSegment.value !== suffixValue) {
+            matched = false;
+            break;
+          }
+
+          if (suffixSegment.kind === "dynamic") {
+            const decoded = safeDecodeURIComponent(suffixValue);
+            if (decoded === undefined) {
+              matched = false;
+              break;
+            }
+            params[suffixSegment.name] = decoded;
+          }
+
+          if (suffixSegment.kind === "catch-all") {
+            matched = false;
+            break;
+          }
+        }
+
+        break;
+      }
+    }
+
+    if (matched) {
+      return { route, params };
+    }
+  }
+
+  return undefined;
+}
+
+// Issue 072: attacker-supplied path segments / cookie values can include
+// malformed percent escapes (e.g. `%ZZ`, `%E0`). Catch the URIError so a
+// single bad byte cannot turn every request into a 500 + stack-leaking
+// response.
+export function safeDecodeURIComponent(value: string): string | undefined {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return undefined;
+  }
+}
+
+async function collectRouteFiles(directory: string, rootDirectory = directory): Promise<string[]> {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const files: string[] = [];
+
+  for (const entry of entries) {
+    const path = join(directory, entry.name);
+
+    if (entry.isDirectory()) {
+      files.push(...(await collectRouteFiles(path, rootDirectory)));
+      continue;
+    }
+
+    if (
+      entry.isFile() &&
+      (entry.name === "page.tsx" ||
+        entry.name === "page.mreact.tsx" ||
+        entry.name === "route.ts" ||
+        appFileConventionForRelativeFile(relative(rootDirectory, path)) !== undefined)
+    ) {
+      files.push(path);
+    }
+  }
+
+  return files;
+}
+
+function appFileConventionForRelativeFile(
+  relativeFile: string,
+): ReturnType<typeof appFileConventionForRootFilename> {
+  const parts = relativeFile.split(sep);
+  const filename = parts.at(-1);
+
+  if (filename === undefined) {
+    return undefined;
+  }
+
+  const convention = appFileConventionForRootFilename(filename);
+
+  if (convention === undefined) {
+    return undefined;
+  }
+
+  if (parts.length === 1) {
+    return convention;
+  }
+
+  if (convention.kind !== "metadata" || convention.convention !== "opengraph-image") {
+    return undefined;
+  }
+
+  const routeParts = parts
+    .slice(0, -1)
+    .filter((part) => !isRouteGroup(part))
+    .map((part) => (part.startsWith("$") ? `:${part.slice(1)}` : part));
+  const conventionPath = convention.path.startsWith("/")
+    ? convention.path.slice(1)
+    : convention.path;
+
+  return {
+    ...convention,
+    path: normalizePath(`/${[...routeParts, conventionPath].join("/")}`),
+  };
+}
+
+function routePathFromRelativeFile(relativeFile: string): string {
+  const parts = relativeFile.split(sep);
+  const routeParts = parts
+    .slice(0, -1)
+    .filter((part) => !isRouteGroup(part))
+    .map((part) => (part.startsWith("$") ? `:${part.slice(1)}` : part));
+
+  return normalizePath(`/${routeParts.join("/")}`);
+}
+
+function segmentsFromPath(path: string): RouteSegment[] {
+  return path === "/"
+    ? []
+    : path
+        .slice(1)
+        .split("/")
+        .map((part) =>
+          part.startsWith(":...")
+            ? { kind: "catch-all", name: part.slice(4) }
+            : part.startsWith(":")
+              ? { kind: "dynamic", name: part.slice(1) }
+              : { kind: "static", value: part },
+        );
+}
+
+function normalizePath(path: string): string {
+  const withoutTrailing = path.length > 1 ? path.replace(/\/+$/, "") : path;
+
+  return withoutTrailing === "" ? "/" : withoutTrailing;
+}
+
+function isRouteGroup(part: string): boolean {
+  return part.startsWith("(") && part.endsWith(")");
+}
+
+function compareRoutes(a: AppRoute, b: AppRoute): number {
+  const scoreDelta = routeScore(b) - routeScore(a);
+
+  return scoreDelta === 0 ? a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind) : scoreDelta;
+}
+
+function compareRouteListEntries(a: AppRoute, b: AppRoute): number {
+  return routeListKey(a.path).localeCompare(routeListKey(b.path)) ||
+    a.kind.localeCompare(b.kind);
+}
+
+function routeListKey(path: string): string {
+  return path === "/"
+    ? ""
+    : path.replaceAll("/:...", "/zzzz-catch-all-").replaceAll("/:", "/zzzz-dynamic-");
+}
+
+function routeScore(route: AppRoute): number {
+  return route.segments.reduce((score, segment) => {
+    if (segment.kind === "static") {
+      return score + 100;
+    }
+
+    if (segment.kind === "dynamic") {
+      return score + 10;
+    }
+
+    return score;
+  }, route.segments.length);
+}

package/src/runtime-cache.ts

@@ -0,0 +1,8 @@
+import { routerModuleRunnerRuntimeCacheStats } from "./module-runner.js";
+import { routerRenderRuntimeCacheStats } from "./render.js";
+import type { RouterRuntimeCacheStat } from "./cache-stats.js";
+export type { RouterRuntimeCacheStat } from "./cache-stats.js";
+
+export function getRouterRuntimeCacheStats(): RouterRuntimeCacheStat[] {
+  return [...routerRenderRuntimeCacheStats(), ...routerModuleRunnerRuntimeCacheStats()];
+}

package/src/runtime-state.ts

@@ -0,0 +1,37 @@
+type RuntimeGlobal = typeof globalThis & Record<string, unknown>;
+type RuntimeStateRoot = Record<string, unknown>;
+
+const namespace = "__mreactRouterRuntimeState";
+
+export function getServerRuntimeState<TState extends object>(
+  key: string,
+  create: () => TState,
+): TState {
+  const global = globalThis as RuntimeGlobal;
+  const root = getOrCreateRoot(global);
+  const existing = root[key];
+
+  if (existing !== undefined) {
+    return existing as TState;
+  }
+
+  const state = create();
+  root[key] = state;
+  return state;
+}
+
+function getOrCreateRoot(global: RuntimeGlobal): RuntimeStateRoot {
+  const existing = global[namespace];
+
+  if (isRuntimeGlobal(existing)) {
+    return existing;
+  }
+
+  const root: RuntimeStateRoot = {};
+  global[namespace] = root;
+  return root;
+}
+
+function isRuntimeGlobal(value: unknown): value is RuntimeStateRoot {
+  return typeof value === "object" && value !== null;
+}

package/src/security-headers.ts

@@ -0,0 +1,134 @@
+import type { RouteSecurityHeaders } from "./types.js";
+
+const DEFAULT_SECURITY_HEADERS = Object.freeze({
+  "permissions-policy": "camera=(), microphone=(), geolocation=()",
+  "referrer-policy": "strict-origin-when-cross-origin",
+  "x-content-type-options": "nosniff",
+});
+
+export function routeSecurityHeaders(options: {
+  request: Request;
+  security: RouteSecurityHeaders | undefined;
+}): Record<string, string> {
+  const headers: Record<string, string> = { ...DEFAULT_SECURITY_HEADERS };
+  const security = options.security;
+
+  if (security?.contentTypeOptions === null) {
+    delete headers["x-content-type-options"];
+  } else {
+    headers["x-content-type-options"] = validateHeaderValue(
+      security?.contentTypeOptions ?? "nosniff",
+    );
+  }
+
+  if (security?.referrerPolicy === null) {
+    delete headers["referrer-policy"];
+  } else {
+    headers["referrer-policy"] = validateHeaderValue(
+      security?.referrerPolicy ?? "strict-origin-when-cross-origin",
+    );
+  }
+
+  if (security?.permissionsPolicy === null) {
+    delete headers["permissions-policy"];
+  } else {
+    const permissionsPolicy = serializePermissionsPolicy(security?.permissionsPolicy);
+    if (permissionsPolicy === undefined) {
+      delete headers["permissions-policy"];
+    } else {
+      headers["permissions-policy"] = permissionsPolicy;
+    }
+  }
+
+  if (security?.frameOptions === null) {
+    delete headers["x-frame-options"];
+  } else if (security?.frameOptions !== undefined) {
+    headers["x-frame-options"] = validateHeaderValue(security.frameOptions);
+  }
+
+  if (
+    options.request.url.startsWith("https://") &&
+    security?.hsts !== undefined &&
+    security.hsts !== false &&
+    security.hsts !== null
+  ) {
+    headers["strict-transport-security"] = serializeHsts(security.hsts);
+  }
+
+  return headers;
+}
+
+function serializeHsts(hsts: NonNullable<RouteSecurityHeaders["hsts"]>): string {
+  if (hsts === false) {
+    throw new TypeError("Invalid security header value for hsts.");
+  }
+
+  const maxAge = Math.trunc(hsts.maxAge);
+  if (!Number.isFinite(maxAge) || maxAge < 0) {
+    throw new TypeError("Invalid security header value for hsts.maxAge.");
+  }
+
+  const parts = [`max-age=${maxAge}`];
+  if (hsts.includeSubDomains === true) {
+    parts.push("includeSubDomains");
+  }
+  if (hsts.preload === true) {
+    parts.push("preload");
+  }
+
+  return parts.join("; ");
+}
+
+function serializePermissionsPolicy(
+  policy: NonNullable<RouteSecurityHeaders["permissionsPolicy"]> | undefined,
+): string | undefined {
+  if (policy === undefined) {
+    return DEFAULT_SECURITY_HEADERS["permissions-policy"];
+  }
+
+  const directives: string[] = [];
+  for (const [directive, allowlist] of Object.entries(policy)) {
+    if (allowlist === null || allowlist === undefined) {
+      continue;
+    }
+
+    validateToken(directive, "permissionsPolicy directive");
+    for (const value of allowlist) {
+      validatePermissionAllowlistValue(value);
+    }
+    directives.push(`${directive}=(${allowlist.join(" ")})`);
+  }
+
+  return directives.length === 0 ? undefined : directives.join(", ");
+}
+
+function validateHeaderValue(value: string): string {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x1f || code === 0x7f) {
+      throw new TypeError(`Invalid security header value: ${JSON.stringify(value)}`);
+    }
+  }
+
+  return value;
+}
+
+function validateToken(value: string, label: string): void {
+  if (!/^[A-Za-z][A-Za-z0-9-]*$/.test(value)) {
+    throw new TypeError(`Invalid security header value for ${label}: ${JSON.stringify(value)}`);
+  }
+}
+
+function validatePermissionAllowlistValue(value: string): void {
+  if (value === "self" || value === "*" || /^[A-Za-z][A-Za-z0-9+.-]*:$/.test(value)) {
+    return;
+  }
+
+  if (/^https:\/\/[A-Za-z0-9.-]+(?::[0-9]+)?$/.test(value)) {
+    return;
+  }
+
+  throw new TypeError(
+    `Invalid security header value for permissionsPolicy allowlist: ${JSON.stringify(value)}`,
+  );
+}