@rsc-kit/core 0.9.0 → 0.10.0

package/dist/host.js

@@ -13,11 +13,12 @@
 //
 //   const rsc = createRscHandler({ engine, manifest, assets })
 //   Bun.serve({ fetch: (req) => rsc(req).then((r) => r ?? new Response('', { status: 404 })) })
-import { matchIntercept, matchRoute, retentionKey, sharedDepth } from './routing.js';
+import { allowFor, matchApiRoute, matchIntercept, matchRoute, retentionKey, sharedDepth } from './routing.js';
 import { pathKey, patternKey } from './prerender.js';
+import { apiKey } from './apiPrerender.js';
 import { withRevalidation } from './revalidate.js';
 export { revalidate } from './revalidate.js';
-import { withRedirect } from './redirect.js';
+import { currentNotFound, withRedirect } from './redirect.js';
 import { withCache } from './cache.js';
 import { withRequest, withResponseDraft } from './request.js';
 export { redirect } from './redirect.js';
@@ -315,6 +316,22 @@ export function createRscHandler(options) {
             }
             return await handleAction(request, url);
         }
+        // Api routes first. A url is one or the other, and a page that shares a
+        // path with a route.ts would otherwise win by accident of ordering.
+        const api = matchApiRoute(routes, url.pathname);
+        if (api && engine.handleApiRoute) {
+            // The guards above it run first, exactly as they would for a page in the
+            // same directory. A route.ts is colocated with the pages it belongs
+            // with, so adding one under a guarded path must not open a way around
+            // the guard.
+            const refused = await refuseApiUnlessAllowed(request, api);
+            if (refused)
+                return refused;
+            const stored = await frozenApi(request, url, api);
+            if (stored)
+                return stored;
+            return await engine.handleApiRoute(api.route.name, request, api.params, allowFor(api.route));
+        }
         if (request.method === 'GET' && url.pathname === HEADER.queryPath) {
             // Same check as an action, for a smaller reason: a cross-origin page
             // cannot read this answer — CORS sees to that — but it can still cause
@@ -407,6 +424,14 @@ export function createRscHandler(options) {
                     const refused = taken();
                     if (refused)
                         return redirectResponse(refused, false);
+                    // The page said this url names nothing. Null rather than a rendered
+                    // 404: null is already how this host says "not mine", and the caller
+                    // in front answers it with not-found.tsx and the right status. One
+                    // path, so a page that calls notFound() and a url that matched no
+                    // route are indistinguishable to whoever is asking — which is the
+                    // point of a 404.
+                    if (currentNotFound())
+                        return null;
                     // A guard refusing is not a failed render. Without this a visitor
                     // who may not see the page gets a 500, which reads as the
                     // application being broken rather than them being turned away —
@@ -420,6 +445,12 @@ export function createRscHandler(options) {
                 const early = taken();
                 if (early)
                     return redirectResponse(early, false);
+                // Above every boundary, so the shell resolving means the page did not
+                // refuse itself. Deeper than that and the shell is already on the wire
+                // — the digest carries it to the boundary instead, and the status
+                // stays 200 because the status line has gone.
+                if (currentNotFound())
+                    return null;
                 return new Response(appendLateRedirect(htmlStream, taken), {
                     headers: withVersion({
                         'Content-Type': HTML_TYPE,
@@ -447,6 +478,10 @@ export function createRscHandler(options) {
                 const refused = taken();
                 if (refused)
                     return redirectResponse(refused, true);
+                // Same answer the document path gives, so a client navigating to a
+                // url and a browser loading it fresh agree about whether it exists.
+                if (currentNotFound())
+                    return null;
                 // A payload request is guarded exactly as the document is. Narrowing
                 // a request must never narrow what is checked.
                 const status = refusalStatus(error);
@@ -493,6 +528,50 @@ export function createRscHandler(options) {
      * not cacheable by a shared cache at all, so handing one to an edge that
      * exists to cache things is an invitation to a mistake nobody would see.
      */
+    /**
+     * The answer the build stored for this route, if it stored one.
+     *
+     * Three conditions, each closing a way the stored answer could be wrong:
+     *
+     * GET or HEAD, because a stored answer to a POST is a stored answer to
+     * something that was meant to happen once.
+     *
+     * No query string. The build answered the bare url, and a route that reads
+     * the query would answer differently for every one — so rather than trying
+     * to detect that during the probe, anything carrying a query goes to the
+     * route itself. A stored answer is for the url it was stored for.
+     *
+     * No middleware. A guarded route answers differently depending on who is
+     * asking, which is the point of the guard; one stored answer served to
+     * everyone is how a guard is quietly removed. The build refuses to store one
+     * for the same reason, so this is the second of two locks on the same door.
+     */
+    async function frozenApi(request, url, api) {
+        if (!options.prerendered)
+            return null;
+        if (request.method !== 'GET' && request.method !== 'HEAD')
+            return null;
+        if (url.search)
+            return null;
+        if (api.route.middleware.length > 0)
+            return null;
+        const stored = await options.prerendered(apiKey(url.pathname));
+        if (stored === null)
+            return null;
+        let frozen;
+        try {
+            frozen = JSON.parse(stored);
+        }
+        catch {
+            // A file this host wrote and cannot read back is a bug, not a request
+            // to answer badly. Falling through runs the route, which is correct.
+            return null;
+        }
+        return new Response(request.method === 'HEAD' ? null : frozen.body, {
+            status: frozen.status,
+            headers: withVersion(Object.fromEntries(frozen.headers)),
+        });
+    }
     async function servePprShell(request, url, read) {
         if (request.method !== 'GET' && request.method !== 'HEAD')
             return null;
@@ -868,6 +947,56 @@ export function createRscHandler(options) {
             }),
         });
     }
+    /**
+     * Run an api route's middleware, and answer instead of it if one refuses.
+     *
+     * Separate from the page version because the answer is different. A caller
+     * that is not a browser gets a status rather than a redirect to a login page
+     * it cannot render — a fetch would follow the 302 and hand back the login
+     * HTML as though it were the api's answer.
+     */
+    async function refuseApiUnlessAllowed(request, api) {
+        if (!(api.route.middleware?.length ?? 0))
+            return null;
+        // A route that declares middleware and an engine that cannot run it is not
+        // "no middleware" — it is a check that silently does not happen.
+        if (!engine.runRouteMiddleware) {
+            return new Response('This route declares middleware, and the engine cannot run it. ' +
+                'Rebuild the app against the current @rsc-kit/core.', { status: 500 });
+        }
+        return await withRedirect(async (taken) => {
+            try {
+                await engine.runRouteMiddleware(api.route.name, api.params);
+            }
+            catch (error) {
+                // A redirect is a refusal here. Where it was going is told rather than
+                // followed, so a client can decide for itself.
+                const redirected = taken();
+                if (redirected) {
+                    return new Response('Unauthorized', {
+                        status: 401,
+                        headers: { 'X-RSC-Redirect': redirected.location },
+                    });
+                }
+                // A visitor who may not use this endpoint has not caused a server
+                // error, and answering 500 makes a guarded route indistinguishable
+                // from a broken one. Null means the middleware threw something that is
+                // not a refusal, which is a real fault and says so.
+                const status = refusalStatus(error);
+                if (status === null)
+                    throw error;
+                return new Response(status === 401 ? 'Unauthorized' : 'Forbidden', { status });
+            }
+            const redirected = taken();
+            if (redirected) {
+                return new Response('Unauthorized', {
+                    status: 401,
+                    headers: { 'X-RSC-Redirect': redirected.location },
+                });
+            }
+            return null;
+        });
+    }
     async function handleQuery(request, url) {
         if (!engine.handleQuery)
             return null;
@@ -894,6 +1023,15 @@ export function createRscHandler(options) {
         // Unknown id and registered-but-not-a-query are the same answer on purpose.
         if (!answered)
             return new Response('No such query', { status: 404 });
+        // The read refused. Answered as a status with the message in the body, so
+        // the fetcher rejects with something a person can read — a failure rendered
+        // into a 200 would reach the browser as React's opaque error instead.
+        if (!('stream' in answered)) {
+            return new Response(JSON.stringify({ message: answered.message, errors: answered.errors }), {
+                status: answered.status,
+                headers: withVersion({ 'Content-Type': 'application/json', 'Cache-Control': PER_CLIENT }),
+            });
+        }
         return new Response(answered.stream, {
             headers: withVersion({
                 'Content-Type': FLIGHT_TYPE,