@skgo/sveltekit-adapter 0.5.0 → 0.9.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@skgo/sveltekit-adapter",
-	"version": "0.5.0",
+	"version": "0.9.5",
 	"description": "SvelteKit adapter for skgo: builds a frontend that a Go binary renders and answers",
 	"keywords": [
 		"adapter",
@@ -33,6 +33,7 @@
 		"skgo-adapter/app-server.js",
 		"skgo-adapter/entry.js",
 		"skgo-adapter/env.js",
+		"skgo-adapter/generated.js",
 		"skgo-adapter/identity.js",
 		"skgo-adapter/polyfill.js"
 	],

package/skgo-adapter/entry.js

@@ -219,6 +219,7 @@ function node_data(node) {
 }
 
 function build_props(req, url) {
+	const form = req.form ? devalue.parse(req.form, decoders) : null;
 	const page = {
 		error: req.error ?? null,
 		params: req.params ?? {},
@@ -226,7 +227,7 @@ function build_props(req, url) {
 		status: req.status ?? 200,
 		url,
 		data: {},
-		form: req.form ?? null,
+		form,
 		shallow: null,
 		state: {}
 	};
@@ -239,7 +240,7 @@ function build_props(req, url) {
 	const props = new Props({
 		page,
 		tree: new RenderNode(components[branch[0].node], undefined),
-		form: req.form ?? null,
+		form,
 		error: req.error ?? undefined
 	});
 
@@ -417,4 +418,4 @@ globalThis.__skgo_render = function (req_json) {
 // A liveness check Go calls once, when it puts a fresh runtime into the pool.
 globalThis.__skgo_ping = function () {
 	return 'ok';
-};
+};

package/skgo-adapter/generated.js

@@ -0,0 +1,118 @@
+/**
+ * The shape `skgo generate` promises in `skgo.remotes.json`, checked without a
+ * SvelteKit build around it.
+ *
+ * The adapter refuses a manifest it cannot read before it copies anything into
+ * the build, and the Go module refuses a build whose manifest does not match
+ * what it answers. The checks live here, apart from the adapter entry and its
+ * kit imports, so they can be exercised directly: the paths they validate are
+ * `.ts` in a TypeScript app and `.js` in a JavaScript one, and both are
+ * first-class.
+ *
+ * @param {any} parsed the parsed contents of `skgo.remotes.json`
+ * @returns {{ remotes: string[], loads: string[], actions: string[], endpoints: Record<string, string[]> }}
+ */
+export function validateGenerated(parsed) {
+	if (!Array.isArray(parsed.remotes)) {
+		throw new Error(
+			'skgo: skgo.remotes.json has no `remotes` array. Run `go generate ./...` before building the frontend.'
+		);
+	}
+	for (const id of parsed.remotes) {
+		if (typeof id !== 'string' || !/^[^/]+\/[^/]+$/.test(id)) {
+			throw new Error(
+				`skgo: skgo.remotes.json lists ${JSON.stringify(id)}, which is not a <hash>/<name> id.`
+			);
+		}
+	}
+	if (!Array.isArray(parsed.loads)) {
+		throw new Error(
+			'skgo: skgo.remotes.json has no `loads` array. Run `go generate ./...` before building the frontend.'
+		);
+	}
+	for (const module of parsed.loads) {
+		if (typeof module !== 'string' || !/\/\+(page|layout)\.server\.(ts|js)$/.test(module)) {
+			throw new Error(
+				`skgo: skgo.remotes.json lists ${JSON.stringify(module)}, which is not a +page.server.(ts|js) or +layout.server.(ts|js) path.`
+			);
+		}
+	}
+	if (!Array.isArray(parsed.actions)) {
+		throw new Error('skgo: skgo.remotes.json has no `actions` array. Run `go generate ./...` before building the frontend.');
+	}
+	for (const module of parsed.actions) {
+		if (typeof module !== 'string' || !/\/\+page\.server\.(ts|js)$/.test(module)) {
+			throw new Error(`skgo: skgo.remotes.json lists ${JSON.stringify(module)}, which is not a +page.server.(ts|js) action path.`);
+		}
+	}
+	if (typeof parsed.endpoints !== 'object' || parsed.endpoints === null || Array.isArray(parsed.endpoints)) {
+		throw new Error(
+			'skgo: skgo.remotes.json has no `endpoints` object. Run `go generate ./...` before building the frontend.'
+		);
+	}
+	for (const [id, methods] of Object.entries(parsed.endpoints)) {
+		if (!id.startsWith('/') || !Array.isArray(methods) || methods.length === 0) {
+			throw new Error(
+				`skgo: skgo.remotes.json maps ${JSON.stringify(id)} to ${JSON.stringify(methods)}, which is not a route id and its methods.`
+			);
+		}
+	}
+	return { remotes: parsed.remotes, loads: parsed.loads, actions: parsed.actions, endpoints: parsed.endpoints };
+}
+
+/**
+ * The check for server routes, against the one place kit reports what it
+ * compiled: `builder.routes[].api.methods`, which kit derives by importing each
+ * built `+server.js` and reading its exports
+ * (packages/kit/src/core/postbuild/analyse.js, `analyse_endpoint`). A `fallback`
+ * export travels there as `'*'`, and `skgo generate` writes the same spelling,
+ * so the two lists are compared literally.
+ *
+ * It lives here rather than in the adapter entry so it can be exercised without
+ * a SvelteKit build around it, exactly as `validateGenerated` is. That is what
+ * lets a test prove it accepts `QUERY` and `'*'` and still refuses a mismatch.
+ *
+ * This is the check that makes a hand-written `+server.ts` fail the build rather
+ * than 404 in the browser: kit would compile it, Go would never have been told
+ * about it, and the route would answer nothing.
+ *
+ * @param {{ routes: Array<{ id: string, api: { methods: string[] } }> }} builder
+ * @param {Record<string, string[]>} declared
+ * @returns {Map<string, string[]>} the methods kit compiled, per route id
+ */
+export function checkEndpoints(builder, declared) {
+	/** @type {Map<string, string[]>} */
+	const built = new Map();
+	for (const route of builder.routes) {
+		if (route.api.methods.length > 0) built.set(route.id, [...route.api.methods].sort());
+	}
+
+	/** @type {string[]} */
+	const problems = [];
+	for (const [id, methods] of Object.entries(declared)) {
+		const compiled = built.get(id);
+		if (!compiled) {
+			problems.push(`  generated but not compiled: ${methods.join(', ')} ${id}`);
+			continue;
+		}
+		const want = [...methods].sort().join(', ');
+		const got = compiled.join(', ');
+		if (want !== got) {
+			problems.push(`  ${id}: Go answers ${want}, the built +server module exports ${got}`);
+		}
+	}
+	for (const [id, methods] of built) {
+		if (!(id in declared)) {
+			problems.push(`  compiled but not generated: ${methods.join(', ')} ${id}`);
+		}
+	}
+
+	if (problems.length) {
+		throw new Error(
+			'skgo: skgo.remotes.json does not describe the server routes kit just compiled.\n' +
+				problems.join('\n') +
+				'\n  Every server route is written in Go. Run `go generate ./...`.'
+		);
+	}
+	return built;
+}

package/skgo-adapter.js

@@ -12,6 +12,7 @@ import { basename, dirname, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { gojaDevEnvironment, gojaEnvironment, nodeTable, SSR_TARGET } from './skgo-adapter/env.js';
 import { identity } from './skgo-adapter/identity.js';
+import { checkEndpoints, validateGenerated } from './skgo-adapter/generated.js';
 
 // Which skgo this adapter is: the version this package was published at, and a
 // fingerprint taken over its own files. The Go that reads the manifest below
@@ -40,10 +41,11 @@ const KIT_COMPONENTS = join(
  *
  * It also carries the remote-function ids and the server-load module paths
  * forward. `skgo generate` writes `skgo.remotes.json` beside this file when it
- * emits the `.remote.ts` modules and the `+*.server.ts` stubs; the adapter
- * checks that kit really compiled those modules and copies the lists into the
- * build, so the Go binary can refuse to serve a frontend that was built from a
- * different set of Go functions than it answers.
+ * emits the `.remote.ts`/`.remote.js` modules and the `+*.server.ts`/
+ * `+*.server.js` stubs; the adapter checks that kit really compiled those
+ * modules and copies the lists into the build, so the Go binary can refuse to
+ * serve a frontend that was built from a different set of Go functions than it
+ * answers.
  *
  * @param {{ out?: string, precompress?: boolean }} [options]
  * @returns {import('@sveltejs/kit').Adapter}
@@ -73,7 +75,7 @@ export default function skgo({ out = 'build', precompress = true } = {}) {
 
 			const nodes = await readNodes(builder, source, kit);
 			const serverIds = nodes.map((node) => node.server);
-			checkServerLoads(serverIds, generated.loads);
+			checkServerLoads(serverIds, generated.loads, generated.actions);
 
 			const endpoints = checkEndpoints(builder, generated.endpoints);
 
@@ -128,12 +130,15 @@ export default function skgo({ out = 'build', precompress = true } = {}) {
 						appDir: builder.config.appDir,
 						base: builder.config.paths.base,
 						version: builder.config.version.name,
+						trustedOrigins: builder.config.csrf.trustedOrigins,
 						// One entry per node, positionally: the vite-root-relative
 						// path of its `+*.server.ts`, or "" for a node that has
 						// none. It is how Go finds the load that answers a slot of
 						// a route's branch, and it is the same key kit itself
 						// records in the node module it builds.
 						nodes: serverIds,
+						loads: generated.loads,
+						actions: [...new Set(generated.actions)].sort(),
 						ssr: describeSSR(builder, kit, nodes),
 						routes: kit._.routes.map((/** @type {any} */ route) => ({
 							id: route.id,
@@ -197,9 +202,10 @@ export default function skgo({ out = 'build', precompress = true } = {}) {
  *
  * A missing or shapeless file is a failure, not an empty list: an adapter that
  * quietly compares nothing to nothing reports success for an app whose two
- * halves were never checked against each other.
+ * halves were never checked against each other. The shape checks themselves
+ * live in `skgo-adapter/generated.js`, beside the paths they validate.
  *
- * @returns {{ remotes: string[], loads: string[], endpoints: Record<string, string[]> }}
+ * @returns {{ remotes: string[], loads: string[], actions: string[], endpoints: Record<string, string[]> }}
  */
 function readGenerated() {
 	let raw;
@@ -210,97 +216,7 @@ function readGenerated() {
 			'skgo: skgo.remotes.json is missing. Run `go generate ./...` before building the frontend.'
 		);
 	}
-	const parsed = JSON.parse(raw);
-	if (!Array.isArray(parsed.remotes)) {
-		throw new Error(
-			'skgo: skgo.remotes.json has no `remotes` array. Run `go generate ./...` before building the frontend.'
-		);
-	}
-	for (const id of parsed.remotes) {
-		if (typeof id !== 'string' || !/^[^/]+\/[^/]+$/.test(id)) {
-			throw new Error(
-				`skgo: skgo.remotes.json lists ${JSON.stringify(id)}, which is not a <hash>/<name> id.`
-			);
-		}
-	}
-	if (!Array.isArray(parsed.loads)) {
-		throw new Error(
-			'skgo: skgo.remotes.json has no `loads` array. Run `go generate ./...` before building the frontend.'
-		);
-	}
-	for (const module of parsed.loads) {
-		if (typeof module !== 'string' || !/\/\+(page|layout)\.server\.ts$/.test(module)) {
-			throw new Error(
-				`skgo: skgo.remotes.json lists ${JSON.stringify(module)}, which is not a +page.server.ts or +layout.server.ts path.`
-			);
-		}
-	}
-	if (typeof parsed.endpoints !== 'object' || parsed.endpoints === null || Array.isArray(parsed.endpoints)) {
-		throw new Error(
-			'skgo: skgo.remotes.json has no `endpoints` object. Run `go generate ./...` before building the frontend.'
-		);
-	}
-	for (const [id, methods] of Object.entries(parsed.endpoints)) {
-		if (!id.startsWith('/') || !Array.isArray(methods) || methods.length === 0) {
-			throw new Error(
-				`skgo: skgo.remotes.json maps ${JSON.stringify(id)} to ${JSON.stringify(methods)}, which is not a route id and its methods.`
-			);
-		}
-	}
-	return { remotes: parsed.remotes, loads: parsed.loads, endpoints: parsed.endpoints };
-}
-
-/**
- * The same check for server routes, against the one place kit reports what it
- * compiled: `builder.routes[].api.methods`, which kit derives by importing each
- * built `+server.js` and reading its exports
- * (packages/kit/src/core/postbuild/analyse.js, `analyse_endpoint`). A `fallback`
- * export travels there as `'*'`, and `skgo generate` writes the same spelling,
- * so the two lists are compared literally.
- *
- * This is the check that makes a hand-written `+server.ts` fail the build rather
- * than 404 in the browser: kit would compile it, Go would never have been told
- * about it, and the route would answer nothing.
- *
- * @param {import('@sveltejs/kit').Builder} builder
- * @param {Record<string, string[]>} declared
- * @returns {Map<string, string[]>} the methods kit compiled, per route id
- */
-function checkEndpoints(builder, declared) {
-	/** @type {Map<string, string[]>} */
-	const built = new Map();
-	for (const route of builder.routes) {
-		if (route.api.methods.length > 0) built.set(route.id, [...route.api.methods].sort());
-	}
-
-	/** @type {string[]} */
-	const problems = [];
-	for (const [id, methods] of Object.entries(declared)) {
-		const compiled = built.get(id);
-		if (!compiled) {
-			problems.push(`  generated but not compiled: ${methods.join(', ')} ${id}`);
-			continue;
-		}
-		const want = [...methods].sort().join(', ');
-		const got = compiled.join(', ');
-		if (want !== got) {
-			problems.push(`  ${id}: Go answers ${want}, the built +server.ts exports ${got}`);
-		}
-	}
-	for (const [id, methods] of built) {
-		if (!(id in declared)) {
-			problems.push(`  compiled but not generated: ${methods.join(', ')} ${id}`);
-		}
-	}
-
-	if (problems.length) {
-		throw new Error(
-			'skgo: skgo.remotes.json does not describe the server routes kit just compiled.\n' +
-				problems.join('\n') +
-				'\n  Every server route is written in Go. Run `go generate ./...`.'
-		);
-	}
-	return built;
+	return validateGenerated(JSON.parse(raw));
 }
 
 /**
@@ -740,10 +656,11 @@ function* walk(dir) {
  *
  * @param {string[]} nodes
  * @param {string[]} loads
+ * @param {string[]} actions
  */
-function checkServerLoads(nodes, loads) {
+function checkServerLoads(nodes, loads, actions) {
 	const built = new Set(nodes.filter(Boolean));
-	const declared = new Set(loads);
+	const declared = new Set([...loads, ...actions]);
 
 	const missing = [...declared].filter((id) => !built.has(id));
 	const extra = [...built].filter((id) => !declared.has(id));