@rsc-kit/core 0.30.39 → 0.30.43

package/dist/host.js

@@ -18,6 +18,8 @@ import { PARAM_PLACEHOLDER, pathKey, patternKey } from "./prerender.js";
 import { apiKey } from "./apiPrerender.js";
 import { hostPath, hostSegment, routableHost } from "./hostRouting.js";
 import { withRevalidation } from "./revalidate.js";
+import { withoutPayloadKey } from "./js/payloadKey.js";
+import { cachingFor, finishCacheable, noteReadsSoFar } from "./pageCache.js";
 /**
  * @internal For a host adapter that embeds the engine. An app imports this
  * from `@rsc-kit/core/revalidate`.
@@ -56,19 +58,19 @@ function saidNotFound(request, route) {
  * nearest not-found.tsx above it.
  */
 export function notFoundRouteOf(request) {
-    return notFoundFrom.get(request);
+    return notFoundFrom.get(withoutPayloadKey(request));
 }
 /** Whether a page or guard of this app answered the request with notFound(). */
 export function pageSaidNotFound(request) {
-    return notFoundRequests.has(request);
+    return notFoundRequests.has(withoutPayloadKey(request));
 }
 export { revalidate } from "./revalidate.js";
 import { isCrawler } from "./crawler.js";
 import { inlineFlight, inlineFlightStart } from "./inlineFlight.js";
 import { currentNotFound, withRedirect } from "./redirect.js";
 import { compressed } from "./compress.js";
-import { withCache } from "./cache.js";
-import { takeAfterWork, withRequest, withResponseDraft, withUrl } from "./request.js";
+import { setCacheBuild, withCache } from "./cache.js";
+import { notFoundRowSent, renderAsNobody, takeAfterWork, withRequest, withResponseDraft, withUrl } from "./request.js";
 import { criticalAssetsOf, linkHeader, mergeAssets } from "./earlyHints.js";
 /**
  * @internal For a host adapter that embeds the engine. An app imports this
@@ -141,11 +143,18 @@ function isNavigation(request) {
 function afterFormPost(to) {
     return { ...to, status: 303 };
 }
-function redirectResponse(to, isPayloadRequest) {
+function redirectResponse(to, isPayloadRequest, revalidated = []) {
     if (isPayloadRequest) {
         return new Response(null, {
             status: 204,
-            headers: { [HEADER.redirect]: to.location, Vary: VARY_ON_RSC },
+            headers: {
+                [HEADER.redirect]: to.location,
+                Vary: VARY_ON_RSC,
+                // What an action that redirected also revalidated - see
+                // followActionRedirect. Without it the client cannot tell a redirect
+                // that changed what a layout reads from one that did not.
+                ...(revalidated.length ? { [HEADER.revalidate]: revalidated.join(",") } : {}),
+            },
         });
     }
     return new Response(null, {
@@ -262,28 +271,36 @@ function refusalMessage(error) {
     return typeof message === "string" && message !== "" ? message : "Refused.";
 }
 /**
- * Whether a browser was told it could post this action.
+ * Whether a request that changes something came from this site.
  *
- * Defence in depth, not the only defence. An action already requires the
- * X-RSC-Action header, which makes a cross-origin post a non-simple request —
- * so the browser must preflight it, and nothing here answers a preflight. A
- * browser can be tricked into sending cookies; it cannot be tricked into
- * sending a header it does not know. This is the belt to that pair of braces,
- * and it is what Next does for server actions.
+ * Asked of an action, a query, a form posted to a page, and every POST, PUT,
+ * PATCH or DELETE a route.ts answers - the last having had no check at all, so
+ * a handler reading cookies() could be posted to from any site with the
+ * visitor's. The rule is Go's http.CrossOriginProtection, and what Laravel 13
+ * asks before it looks at a CSRF token:
  *
- * Compared against X-Forwarded-Host first, because a proxied deployment is the
- * normal one: the backend forwards the name the visitor typed, while Host is
- * this process on loopback. Comparing against Host alone would reject every
- * legitimate action that arrived through a proxy — a check that only fires on
- * correct requests is worse than none.
+ *   1. Sec-Fetch-Site: same-origin (or none - typed in the address bar) passes.
+ *      The browser sets it and a page cannot, and every browser has since 2023.
+ *   2. An Origin listed in trustedOrigins passes.
+ *   3. Any other Sec-Fetch-Site - same-site, cross-site - is refused.
+ *   4. Without one, Origin is compared with the host, X-Forwarded-Host first.
+ *   5. With neither, the caller is not a browser - a webhook, a server - and
+ *      passes: there is no visitor's cookie to have been tricked into sending.
  *
- * No Origin at all is allowed through. It is absent on same-origin requests in
- * some browsers and on anything that is not a browser, and refusing those would
- * break server-to-server callers to catch an attacker who is already blocked by
- * the preflight.
+ * Compared against X-Forwarded-Host before Host, because a proxied deployment
+ * is the normal one: the backend forwards the name the visitor typed, while
+ * Host is this process on loopback. Comparing against Host alone would refuse
+ * every legitimate post that arrived through a proxy.
  */
-export function actionOriginAllowed(request, url) {
+export function originAllowed(request, url, trusted = []) {
+    const site = request.headers.get("sec-fetch-site");
+    if (site === "same-origin" || site === "none")
+        return true;
     const origin = request.headers.get("origin");
+    if (origin && trusted.includes(origin.toLowerCase()))
+        return true;
+    if (site)
+        return false;
     if (!origin)
         return true;
     const expected = request.headers.get("x-forwarded-host") ??
@@ -293,10 +310,27 @@ export function actionOriginAllowed(request, url) {
         return new URL(origin).host === expected;
     }
     catch {
-        // An Origin that is not a url is not one this can vouch for.
+        // "null" - a sandboxed iframe, a redirected cross-site post - and anything
+        // else that is not a url is not one this can vouch for.
         return false;
     }
 }
+/** trustedOrigins as Origin headers spell them, or a thrown error naming the bad one. */
+function trustedOriginsOf(origins) {
+    return (origins ?? []).map((origin) => {
+        let parsed = null;
+        try {
+            parsed = new URL(origin);
+        }
+        catch { }
+        if (!parsed || parsed.origin === "null" || parsed.origin !== origin.replace(/\/$/, "").toLowerCase()) {
+            throw new Error(`[rsc-kit] trustedOrigins: ${JSON.stringify(origin)} is not an origin. ` +
+                "Write the scheme and host as a browser sends them, with no path: 'https://app.example.com'.");
+        }
+        return parsed.origin;
+    });
+}
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 const DEFAULT_MAX_ACTION_BODY = 8 * 1024 * 1024;
 /** A form post whose body passed the ceiling: answered 413, never rendered. */
 const TOO_LARGE = Symbol("too large");
@@ -446,9 +480,12 @@ export function createRscHandler(options) {
     // own. Resolved on the first request: the engine reads it from a build
     // product it only has at runtime.
     let version = engine.buildId ? undefined : options.version;
+    // Told to the cache once, so answers kept across requests are this build's.
+    let cacheBuildSet = false;
     // The edge contract's marker, as the build left it beside the pages - see edgeMarker.
     let edgeMarkerRead = null;
     const maxActionBody = options.maxActionBody ?? DEFAULT_MAX_ACTION_BODY;
+    const trustedOrigins = trustedOriginsOf(options.trustedOrigins);
     const compress = options.compress ?? true;
     // Annotated rather than inferred: the narrowing below is lost inside the
     // closures that use it, and every one of them runs after the throw.
@@ -594,7 +631,7 @@ export function createRscHandler(options) {
             return null;
         if (!matchPage(routes, url))
             return null;
-        if (!actionOriginAllowed(request, url))
+        if (!originAllowed(request, url, trustedOrigins))
             return null;
         // Through the same ceiling as an action. This path is reached with no
         // guard and no session - any page url - and formData() reads whatever
@@ -639,19 +676,39 @@ export function createRscHandler(options) {
     return async function handle(request) {
         if (version === undefined && engine.buildId)
             version = await engine.buildId();
+        if (!cacheBuildSet) {
+            setCacheBuild(version);
+            cacheBuildSet = true;
+        }
         if (!signingChecked) {
             assertSigningSecret();
             signingChecked = true;
         }
+        // A page that exports revalidate is judged as it arrived - its ?_rsc=
+        // key is part of check 1 - and answered for as the app sees it.
+        const arrived = request;
+        request = withoutPayloadKey(request);
+        const page = matchPage(routes, new URL(request.url));
+        const caching = cachingFor(arrived, page?.route.revalidate);
+        if (caching && (page?.route.hostMiddleware?.length ?? 0) > 0)
+            caching.refused ??= "host-middleware";
         return await withRequest(request, () => withCache(() => 
         // Open for the whole request and sealed the moment an answer exists,
         // so middleware — which runs before any rendering — can put headers on
         // it, and a component, which runs after, is told why it cannot.
         withResponseDraft(async ({ taken, seal }) => {
-            const response = await route(request);
+            if (caching)
+                renderAsNobody();
+            const rendered = await route(request);
             seal();
-            if (!response)
+            if (!rendered) {
+                // The page said notFound(): the entry in front renders the 404
+                // in a scope of its own, and needs what this one read.
+                if (caching)
+                    noteReadsSoFar(caching);
                 return null;
+            }
+            let response = rendered;
             const collected = taken();
             // Under whatever the answer already has, and before the middleware's,
             // so a page or a middleware that asked for its own value keeps it.
@@ -673,6 +730,14 @@ export function createRscHandler(options) {
             for (const cookie of collected.getSetCookie()) {
                 response.headers.append("Set-Cookie", cookie);
             }
+            // A page a shared cache may keep, rendered whole and judged. Not a
+            // stored answer: that one was frozen for nobody, and says so.
+            if (caching && !servedFrom.has(response)) {
+                const hints = hinted.get(response);
+                response = await finishCacheable(request, response, caching, () => pageSaidNotFound(request) || notFoundRowSent());
+                if (hints)
+                    hinted.set(response, hints);
+            }
             // How this answer was served - the header a developer reads in the
             // Network tab, the way X-Nextjs-Cache is. Always: it names no
             // product, and a CDN rule or a check can key on it.
@@ -760,7 +825,7 @@ export function createRscHandler(options) {
                 return asset;
         }
         if (request.method === "POST" && url.pathname === HEADER.actionPath) {
-            if (!actionOriginAllowed(request, url)) {
+            if (!originAllowed(request, url, trustedOrigins)) {
                 return new Response("Cross-origin action", { status: 403 });
             }
             return await handleAction(request, url);
@@ -777,6 +842,12 @@ export function createRscHandler(options) {
                 return stored;
         }
         if (api && engine.handleApiRoute) {
+            // A route.ts that changes something is a form any site could post to
+            // with the visitor's cookies, and nothing else here stands in the way:
+            // no custom header, so no preflight. Refused before its guards run.
+            if (!SAFE_METHODS.has(request.method) && !originAllowed(request, url, trustedOrigins)) {
+                return new Response("Cross-origin request", { status: 403 });
+            }
             // The guards above it run first, exactly as they would for a page in the
             // same directory. A route.ts is colocated with the pages it belongs
             // with, so adding one under a guarded path must not open a way around
@@ -810,7 +881,7 @@ export function createRscHandler(options) {
             // cannot read this answer — CORS sees to that — but it can still cause
             // the read to run with the visitor's cookies. A query is side-effect
             // free by contract, so this is depth rather than the only defence.
-            if (!actionOriginAllowed(request, url)) {
+            if (!originAllowed(request, url, trustedOrigins)) {
                 return new Response("Cross-origin query", { status: 403 });
             }
             return await handleQuery(request, url);
@@ -1961,13 +2032,20 @@ export function createRscHandler(options) {
         // already knows how to read.
         return await withRedirect(async (redirected) => {
             let stream;
+            let marked = () => [];
             try {
-                ({ stream } = await withRevalidation((taken) => engine.handleAction(actionId, body, contentType, page, taken)));
+                ({ stream } = await withRevalidation((taken) => {
+                    marked = taken;
+                    return engine.handleAction(actionId, body, contentType, page, taken);
+                }));
             }
             catch (error) {
                 const to = redirected();
+                // What it revalidated before redirecting goes with the redirect:
+                // dropped, revalidate('all') then redirect() left every layout as it
+                // was, and the one way to ask for them did nothing.
                 if (to)
-                    return redirectResponse(to, true);
+                    return redirectResponse(to, true, marked());
                 throw error;
             }
             return new Response(stream, {