npm - @reckona/mreact-router - Versions diffs - 0.0.97 → 0.0.99 - Mend

@reckona/mreact-router 0.0.97 → 0.0.99

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (92) hide show

package/README.md +4 -0
package/dist/actions.d.ts +7 -0
package/dist/actions.d.ts.map +1 -1
package/dist/actions.js +26 -2
package/dist/actions.js.map +1 -1
package/dist/adapters/aws-lambda.d.ts.map +1 -1
package/dist/adapters/aws-lambda.js +10 -7
package/dist/adapters/aws-lambda.js.map +1 -1
package/dist/build.d.ts +38 -1
package/dist/build.d.ts.map +1 -1
package/dist/build.js +1087 -304
package/dist/build.js.map +1 -1
package/dist/bundle-pipeline.d.ts +7 -0
package/dist/bundle-pipeline.d.ts.map +1 -1
package/dist/bundle-pipeline.js +121 -87
package/dist/bundle-pipeline.js.map +1 -1
package/dist/cache.d.ts.map +1 -1
package/dist/cache.js +10 -8
package/dist/cache.js.map +1 -1
package/dist/cli-options.d.ts +1 -0
package/dist/cli-options.d.ts.map +1 -1
package/dist/cli-options.js +16 -0
package/dist/cli-options.js.map +1 -1
package/dist/cli.js +1 -0
package/dist/cli.js.map +1 -1
package/dist/client.d.ts +6 -1
package/dist/client.d.ts.map +1 -1
package/dist/client.js +113 -8
package/dist/client.js.map +1 -1
package/dist/csrf.d.ts.map +1 -1
package/dist/csrf.js +7 -3
package/dist/csrf.js.map +1 -1
package/dist/http.d.ts.map +1 -1
package/dist/http.js +18 -1
package/dist/http.js.map +1 -1
package/dist/import-policy.d.ts.map +1 -1
package/dist/import-policy.js +7 -3
package/dist/import-policy.js.map +1 -1
package/dist/index.d.ts +4 -3
package/dist/index.d.ts.map +1 -1
package/dist/index.js.map +1 -1
package/dist/link.d.ts +5 -2
package/dist/link.d.ts.map +1 -1
package/dist/link.js +92 -3
package/dist/link.js.map +1 -1
package/dist/logger.d.ts +7 -1
package/dist/logger.d.ts.map +1 -1
package/dist/logger.js.map +1 -1
package/dist/module-runner.d.ts +2 -0
package/dist/module-runner.d.ts.map +1 -1
package/dist/module-runner.js +1 -0
package/dist/module-runner.js.map +1 -1
package/dist/native-route-matcher.d.ts +2 -1
package/dist/native-route-matcher.d.ts.map +1 -1
package/dist/native-route-matcher.js +13 -2
package/dist/native-route-matcher.js.map +1 -1
package/dist/render.d.ts.map +1 -1
package/dist/render.js +117 -2
package/dist/render.js.map +1 -1
package/dist/route-source.d.ts +4 -4
package/dist/route-source.d.ts.map +1 -1
package/dist/route-source.js +8 -8
package/dist/route-source.js.map +1 -1
package/dist/route-styles.d.ts +6 -0
package/dist/route-styles.d.ts.map +1 -1
package/dist/route-styles.js +10 -1
package/dist/route-styles.js.map +1 -1
package/dist/serve.d.ts +5 -0
package/dist/serve.d.ts.map +1 -1
package/dist/serve.js +7 -4
package/dist/serve.js.map +1 -1
package/package.json +11 -11
package/src/actions.ts +42 -2
package/src/adapters/aws-lambda.ts +33 -16
package/src/build.ts +1578 -397
package/src/bundle-pipeline.ts +136 -88
package/src/cache.ts +13 -8
package/src/cli-options.ts +20 -0
package/src/cli.ts +1 -0
package/src/client.ts +145 -14
package/src/csrf.ts +8 -3
package/src/http.ts +21 -1
package/src/import-policy.ts +8 -3
package/src/index.ts +5 -0
package/src/link.ts +129 -8
package/src/logger.ts +9 -1
package/src/module-runner.ts +4 -0
package/src/native-route-matcher.ts +13 -2
package/src/render.ts +177 -2
package/src/route-source.ts +8 -8
package/src/route-styles.ts +17 -1
package/src/serve.ts +11 -6

package/dist/render.js CHANGED Viewed

@@ -683,6 +683,13 @@ async function renderAppRequestInternal(options) {
                     vitePlugins: options.vitePlugins,
                 });
                 html = injectHeadMetadata(html, metadata);
+                warnIfCspNonceWouldBlockInlineTags({
+                    html,
+                    logger: options.logger,
+                    metadata,
+                    request: options.request,
+                    serverModuleCacheVersion: options.serverModuleCacheVersion,
+                });
                 html = injectAuthSessionClaims(html, originalAnalysis.authIncludesClaims ? currentAuthClaims() : undefined);
                 html = injectQueryState(html, dehydrate(queryClient));
                 const response = withOptionalActionCookie(htmlResponse(`<!DOCTYPE html>${clientNavigationHeadTags({
@@ -897,6 +904,13 @@ async function renderAppRequestInternal(options) {
         finishRenderTimingPhase(timing, phaseStartedAt, "metadataMs");
         phaseStartedAt = renderTimingPhaseStartedAt(timing);
         html = injectHeadMetadata(html, metadata);
+        warnIfCspNonceWouldBlockInlineTags({
+            html,
+            logger: options.logger,
+            metadata,
+            request: options.request,
+            serverModuleCacheVersion: options.serverModuleCacheVersion,
+        });
         html = injectAuthSessionClaims(html, originalAnalysis.authIncludesClaims ? currentAuthClaims() : undefined);
         html = injectQueryState(html, dehydrate(queryClient));
         const response = withOptionalActionCookie(htmlResponse(`<!DOCTYPE html>${clientNavigationHeadTags({
@@ -1513,6 +1527,7 @@ export async function bundleMiddlewareModuleCode(options) {
         code: options.code,
         filename: options.file,
         platform: "node",
+        root: options.importPolicy?.projectRoot,
         plugins: [
             fileImportMetaUrlPlugin(),
             createAppRouterImportPolicyPlugin({
@@ -2633,13 +2648,113 @@ function hasGenerateMetadataExport(code) {
 function usesRuntimeCacheControl(code) {
     return /\bcacheControl\s*\(/.test(code);
 }
+function warnIfCspNonceWouldBlockInlineTags(options) {
+    if (options.serverModuleCacheVersion !== undefined ||
+        process.env.NODE_ENV === "production" ||
+        options.metadata?.csp?.disable === true ||
+        options.metadata?.csp?.directives === undefined ||
+        !/<(?:script|style)\b/i.test(options.html)) {
+        return;
+    }
+    const scriptNonces = cspDirectiveNonces(options.metadata.csp, "script-src");
+    const styleNonces = cspDirectiveNonces(options.metadata.csp, "style-src");
+    if (scriptNonces.size === 0 && styleNonces.size === 0) {
+        return;
+    }
+    for (const tag of inlineCspTags(options.html)) {
+        if (tag.name === "script") {
+            if (scriptNonces.size > 0 &&
+                !scriptHasExternalSourceOrInertType(tag.attributes) &&
+                tag.content.trim() !== "" &&
+                !tagHasMatchingNonce(tag.attributes, scriptNonces)) {
+                warnCspInlineNonceMismatch(options, "script-src", "script");
+            }
+            continue;
+        }
+        if (styleNonces.size > 0 &&
+            tag.content.trim() !== "" &&
+            !tagHasMatchingNonce(tag.attributes, styleNonces)) {
+            warnCspInlineNonceMismatch(options, "style-src", "style");
+        }
+    }
+}
+function warnCspInlineNonceMismatch(options, directive, tag) {
+    const message = tag === "script"
+        ? "mreact router: CSP script-src uses a nonce, but an inline <script> without a matching nonce will be blocked. Add the script through metadata.head with nonce: true, move it to an external script, or remove script-src for this route."
+        : "mreact router: CSP style-src uses a nonce, but an inline <style> without a matching nonce will be blocked. Add the style through metadata.head with nonce: true, move it to an external stylesheet, or remove style-src for this route.";
+    if (options.logger === undefined) {
+        console.warn(message);
+        return;
+    }
+    emitRouterLog(options.logger, "warn", {
+        directive,
+        path: new URL(options.request.url).pathname,
+        tag,
+        type: "router:csp:inline-nonce-warning",
+    });
+}
+function cspDirectiveNonces(csp, directive) {
+    const values = csp.directives?.[directive];
+    const nonces = new Set();
+    if (values !== undefined && csp.nonce !== undefined) {
+        nonces.add(csp.nonce);
+    }
+    for (const value of Array.isArray(values) ? values : values === undefined ? [] : [values]) {
+        const match = /^'nonce-([^']+)'$/.exec(value);
+        if (match?.[1] !== undefined) {
+            nonces.add(match[1]);
+        }
+    }
+    return nonces;
+}
+function inlineCspTags(html) {
+    const tags = [];
+    const pattern = /<(script|style)\b([^>]*)>([\s\S]*?)<\/\1>/gi;
+    let match;
+    while ((match = pattern.exec(html)) !== null) {
+        const name = match[1]?.toLowerCase();
+        if (name !== "script" && name !== "style") {
+            continue;
+        }
+        tags.push({
+            attributes: parseTagAttributes(match[2] ?? ""),
+            content: match[3] ?? "",
+            name,
+        });
+    }
+    return tags;
+}
+function parseTagAttributes(source) {
+    const attributes = new Map();
+    const pattern = /([^\s=/>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+    let match;
+    while ((match = pattern.exec(source)) !== null) {
+        const name = match[1]?.toLowerCase();
+        if (name === undefined) {
+            continue;
+        }
+        attributes.set(name, match[2] ?? match[3] ?? match[4] ?? "");
+    }
+    return attributes;
+}
+function scriptHasExternalSourceOrInertType(attributes) {
+    if (attributes.has("src")) {
+        return true;
+    }
+    const type = attributes.get("type")?.trim().toLowerCase();
+    return type === "application/json" || type === "application/ld+json";
+}
+function tagHasMatchingNonce(attributes, expectedNonces) {
+    const nonce = attributes.get("nonce");
+    return nonce !== undefined && expectedNonces.has(nonce);
+}
 function injectQueryState(html, state) {
     if (state.queries.length === 0) {
         return html;
     }
     const script = `<script type="application/json" id="${__MREACT_QUERY_STATE_SCRIPT_ID}">${escapeJsonForHtml(JSON.stringify(state))}</script>`;
     return /<\/body>/i.test(html)
-        ? html.replace(/<\/body>/i, `${script}</body>`)
+        ? html.replace(/<\/body>/i, () => `${script}</body>`)
         : `${html}${script}`;
 }
 function injectAuthSessionClaims(html, claims) {
@@ -2648,7 +2763,7 @@ function injectAuthSessionClaims(html, claims) {
     }
     const script = `<script type="application/json" id="${authSessionScriptId}">${escapeJsonForHtml(JSON.stringify(claims))}</script>`;
     return /<\/body>/i.test(html)
-        ? html.replace(/<\/body>/i, `${script}</body>`)
+        ? html.replace(/<\/body>/i, () => `${script}</body>`)
         : `${html}${script}`;
 }
 function authIncludesClaims(code) {