@solidjs/start 2.0.5 → 2.0.6

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @solidjs/start
 
+## 2.0.6
+
+### Patch Changes
+
+- a4ed2a4: Stop `client-only` from failing the build for lazily imported client components.
+
+  A module that imported `client-only` and was loaded through `clientOnly(() => import(...))` failed the server build, even though it only ever runs in the browser. The server build resolves every dynamic import to emit its chunk, so it resolved the `client-only` module and rejected it, though that module never runs on the server. `client-only` no longer fails the build. `server-only` is unchanged and still fails a client build.
+
+- 048f5a9: Stop a no-JS server function POST from returning a 500 when the body is not a form.
+
+  A POST to a server function without the client runtime, carrying an empty body or a non-form content type, left a value that is not a `FormData` as the last argument. Building the flash cookie called `.entries()` on it and threw, and the error handler rethrew the same way, so the request failed with a 500. The response is now the normal redirect, and the flash cookie is best effort so it can no longer take down the error path.
+
+- 59e7dc7: Make reading server function streams safer and faster.
+
+  - A malformed chunk after the first one is now logged instead of causing an unhandled promise rejection. On hosts that do not catch unhandled rejections, one bad request could stop the server process.
+  - The stream is cancelled when a chunk cannot be read or parsed.
+  - Chunk headers are now checked strictly, and a server rejects chunks over 64MB that a client sends.
+  - Large payloads that arrive in many small pieces are read in linear time. A 16MB chunk read in 16KB pieces took about 2 seconds and now takes about 30ms.
+
+- d34acf5: Require seroval and seroval-plugins 1.6.8 or newer.
+- d34acf5: Send `Cache-Control: no-store` on server function responses by default.
+
+  Server function responses, including calls made with GET, carried no `Cache-Control`, so a shared cache configured to store them could serve one caller's result to another. Every response from the server function handler now defaults to `no-store`: results, errors, redirects, no-JS redirects, raw `Response` passthroughs, and the handler's own refusals. A `Cache-Control` the function sets itself, on a returned `Response` or on the event's response headers, is kept as is, and a `304` is never given one.
+
+- d34acf5: Reject cross-site server function requests.
+
+  A `"use server"` function could be invoked from another site with the visitor's cookies, over a GET or a form POST, because the request's origin was not checked. Requests to server functions are now allowed only from the same origin or same site. The check trusts the `Sec-Fetch-Site` header and falls back to comparing `Origin` against the request host, so a page on another site receives a `403` instead of running the function. Same-origin calls, user-initiated navigations, and no-JS form submissions are unaffected. A separate origin that needs to call your backend should use an API route with explicit CORS.
+
+- 9d3cbec: Report server functions that cannot work instead of compiling them into broken output.
+
+  - A `"use server"` function that reads a variable from an enclosing function now fails the build. The function is moved to the top level of its module, so the variable is not in scope when it runs.
+  - The same check covers `this` and `arguments` in an arrow function, `super`, and private class members.
+  - A `"use server"` directive in an object or class method now fails the build. It was ignored before, which shipped the method body and the modules it imports to the browser.
+  - A `"use server"` string that is not the first statement of a module or a function body now logs a warning. It has no effect there.
+  - An export a `"use server"` module cannot serve now logs a warning that names it. These exports are still left out of the client build.
+  - A `"use server"` module can now export an anonymous default function. Both `export default async () => {}` and `export default async function () {}` work.
+  - Server function ids are now built from the names a function is nested under, such as `Page.load`, instead of the order the functions appear in. An id no longer changes when another server function is added to the same file, and two functions that share a name are told apart by the names around them. Production ids stay opaque.
+  - Server functions are now compiled in `.mts` and `.cts` files.
+  - Build errors now point at the full path of the file, not just its name.
+
+- d34acf5: Treat a server function request with `Origin: null` and no `Sec-Fetch-Site` as cross-site.
+
+  Browsers send `Origin: null` from opaque origins, such as sandboxed iframes and some cross-origin redirect chains. When `Sec-Fetch-Site` was absent, the handler skipped the `Origin` comparison for that value and allowed the request. It is now refused with a `403`. Requests that carry neither header, such as those from non-browser clients, are still allowed.
+
+- d34acf5: Settle server function values that are still waiting on the stream when its body ends.
+
+  A seroval body can reference a promise or stream that a later frame settles. If the body ended before that frame arrived, the value stayed pending forever, so a server function awaiting such an argument never answered. A malformed later frame also surfaced as an unhandled rejection. When the body ends or fails, every promise still waiting on it now rejects (with the failure, or with "Server function stream ended unexpectedly.") and every open stream errors. Decoded promises that nobody awaits no longer report unhandled rejections; code that awaits them still sees the rejection.
+
 ## 2.0.5
 
 ### Patch Changes

package/dist/config/boundary-modules.d.ts

@@ -1,14 +1,20 @@
 import type { Plugin } from "vite";
 /**
- * Supports `server-only` and `client-only` marker modules (#2162): importing
- * `server-only` from a client module (or `client-only` from a server module)
- * fails at resolve time; in the allowed environment the marker resolves to an
- * empty module.
+ * Supports the `server-only` and `client-only` marker modules (#2162).
  *
- * Start's own server-only entry points (`@solidjs/start/http`,
- * `@solidjs/start/middleware`) import `server-only` themselves, so pulling
- * them into the client bundle fails loudly instead of shipping server code to
- * the browser, where it crashed hydration and broke unrelated actions/forms
- * with no diagnostic (https://github.com/solidjs/solid-start/issues/2068).
+ * `server-only` imported from a client module fails the build at resolve time.
+ * A client module that reaches server-only code is always a mistake and must
+ * never bundle. Start's own server-only entry points (`@solidjs/start/http`,
+ * `@solidjs/start/middleware`) import `server-only` themselves, so pulling them
+ * into the client bundle fails loudly instead of shipping server code to the
+ * browser (https://github.com/solidjs/solid-start/issues/2068).
+ *
+ * `client-only` cannot be enforced the same way. The server build resolves
+ * every dynamic import to emit its chunk, so a module reached only through
+ * `clientOnly(() => import(...))` is resolved by the server build even though
+ * it never runs on the server. Failing the build there is a false positive
+ * that breaks the client-only lazy pattern, so `client-only` resolves to an
+ * empty module in both environments. Client-only code that does reach the
+ * server runtime still fails there on its own (e.g. a missing `window`).
  */
 export declare function boundaryModules(): Plugin;

package/dist/config/boundary-modules.js

@@ -1,15 +1,21 @@
-const VIRTUAL_ID = "\0solid-start:boundary-modules:id";
+const EMPTY_ID = "\0solid-start:boundary-modules:empty";
 /**
- * Supports `server-only` and `client-only` marker modules (#2162): importing
- * `server-only` from a client module (or `client-only` from a server module)
- * fails at resolve time; in the allowed environment the marker resolves to an
- * empty module.
+ * Supports the `server-only` and `client-only` marker modules (#2162).
  *
- * Start's own server-only entry points (`@solidjs/start/http`,
- * `@solidjs/start/middleware`) import `server-only` themselves, so pulling
- * them into the client bundle fails loudly instead of shipping server code to
- * the browser, where it crashed hydration and broke unrelated actions/forms
- * with no diagnostic (https://github.com/solidjs/solid-start/issues/2068).
+ * `server-only` imported from a client module fails the build at resolve time.
+ * A client module that reaches server-only code is always a mistake and must
+ * never bundle. Start's own server-only entry points (`@solidjs/start/http`,
+ * `@solidjs/start/middleware`) import `server-only` themselves, so pulling them
+ * into the client bundle fails loudly instead of shipping server code to the
+ * browser (https://github.com/solidjs/solid-start/issues/2068).
+ *
+ * `client-only` cannot be enforced the same way. The server build resolves
+ * every dynamic import to emit its chunk, so a module reached only through
+ * `clientOnly(() => import(...))` is resolved by the server build even though
+ * it never runs on the server. Failing the build there is a false positive
+ * that breaks the client-only lazy pattern, so `client-only` resolves to an
+ * empty module in both environments. Client-only code that does reach the
+ * server runtime still fails there on its own (e.g. a missing `window`).
  */
 export function boundaryModules() {
     return {
@@ -17,25 +23,22 @@ export function boundaryModules() {
         enforce: "pre",
         resolveId(id, importer, { ssr }) {
             if (id === "server-only") {
-                if (!ssr)
+                if (!ssr) {
                     this.error(`Attempt to import 'server-only' in a client module: ${importer}. ` +
                         `Code that uses this module must run only on the server: mark it with ` +
                         `"use server", or make sure it is only imported by server code.`);
+                }
+                return EMPTY_ID;
             }
-            else if (id === "client-only") {
-                if (ssr)
-                    this.error(`Attempt to import 'client-only' in a server module: ${importer}. ` +
-                        `Code that uses this module must run only in the browser: make sure it ` +
-                        `is only imported by client code (e.g. wrap components with clientOnly()).`);
-            }
-            else {
-                return null;
+            if (id === "client-only") {
+                return EMPTY_ID;
             }
-            return VIRTUAL_ID;
+            return null;
         },
         load(id) {
-            if (id === VIRTUAL_ID)
+            if (id === EMPTY_ID) {
                 return "export {}";
+            }
         },
     };
 }

package/dist/directives/compile.d.ts

@@ -4,6 +4,8 @@ export interface CompileResult {
     valid: boolean;
     code: string;
     map: babel.BabelFileResult["map"];
+    /** Problems that do not stop the compile, reported to the caller. */
+    warnings: string[];
 }
-export type CompileOptions = Omit<StateContext, "count" | "hash" | "imports" | "valid">;
+export type CompileOptions = Omit<StateContext, "count" | "names" | "hash" | "imports" | "valid" | "warnings">;
 export declare function compile(id: string, code: string, options: CompileOptions): Promise<CompileResult>;

package/dist/directives/compile.js

@@ -1,13 +1,14 @@
 import * as babel from "@babel/core";
-import path from "node:path";
 import { directivesPlugin } from "./plugin.js";
 import xxHash32 from "./xxhash32.js";
 export async function compile(id, code, options) {
     const context = {
         ...options,
         valid: false,
+        warnings: [],
         hash: xxHash32(id).toString(16),
         count: 0,
+        names: new Map(),
         imports: new Map(),
     };
     const pluginOption = [directivesPlugin, context];
@@ -22,7 +23,8 @@ export async function compile(id, code, options) {
         parserOpts: {
             plugins,
         },
-        filename: path.basename(id),
+        // The full path, so diagnostics point at the file the user edits.
+        filename: id,
         ast: false,
         sourceMaps: true,
         configFile: false,
@@ -34,6 +36,7 @@ export async function compile(id, code, options) {
             valid: context.valid,
             code: result.code || "",
             map: result.map,
+            warnings: context.warnings,
         };
     }
     throw new Error("invariant");

package/dist/directives/get-hierarchical-name.d.ts

@@ -0,0 +1,2 @@
+import type { NodePath } from "@babel/core";
+export declare function getHierarchicalName(path: NodePath): string;

package/dist/directives/get-hierarchical-name.js

@@ -0,0 +1,104 @@
+import * as t from "@babel/types";
+/**
+ * The names a function is nested under, from the top of the module down, joined
+ * with a dot. `Page.load` for a `load` declared inside `Page`.
+ *
+ * Server function ids are built from this instead of the order the functions
+ * appear in. An id then stays the same when another function is added to the
+ * file, and two functions that share a name are still told apart by the names
+ * around them.
+ */
+const ANONYMOUS = "anonymous";
+function getKeyName(node, computed) {
+    if (computed) {
+        return undefined;
+    }
+    switch (node.type) {
+        case "Identifier":
+            return node.name;
+        case "PrivateName":
+            return node.id.name;
+        case "StringLiteral":
+            return node.value;
+        case "NumericLiteral":
+            return String(node.value);
+        default:
+            return undefined;
+    }
+}
+function getSegment(path, child) {
+    const node = path.node;
+    switch (node.type) {
+        case "VariableDeclarator":
+            return t.isIdentifier(node.id) ? node.id.name : undefined;
+        case "FunctionDeclaration":
+        case "ClassDeclaration":
+        case "ClassExpression":
+            return node.id?.name;
+        case "FunctionExpression":
+            if (node.id) {
+                return node.id.name;
+            }
+            return path.parentPath && getSegment(path.parentPath, path) ? undefined : ANONYMOUS;
+        case "ObjectProperty":
+            return getKeyName(node.key, node.computed);
+        case "ObjectMethod":
+        case "ClassMethod":
+            return getKeyName(node.key, node.computed ?? false);
+        case "ClassPrivateMethod":
+            return getKeyName(node.key, false);
+        case "ClassProperty":
+            // Only the initializer belongs to the property.
+            return child.node === node.value ? getKeyName(node.key, node.computed ?? false) : undefined;
+        case "ClassPrivateProperty":
+            return child.node === node.value ? getKeyName(node.key, false) : undefined;
+        case "ExportDefaultDeclaration":
+            return "default";
+        case "AssignmentExpression":
+            return t.isIdentifier(node.left) ? node.left.name : undefined;
+        case "ArrowFunctionExpression":
+            // An enclosing function that nothing names still has to separate what is
+            // inside it from what is beside it.
+            return path.parentPath && getSegment(path.parentPath, path) ? undefined : ANONYMOUS;
+        default:
+            return undefined;
+    }
+}
+function isFunctionBoundary(node) {
+    switch (node.type) {
+        case "ArrowFunctionExpression":
+        case "FunctionExpression":
+        case "FunctionDeclaration":
+        case "ObjectMethod":
+        case "ClassMethod":
+        case "ClassPrivateMethod":
+        case "StaticBlock":
+            return true;
+        default:
+            return false;
+    }
+}
+export function getHierarchicalName(path) {
+    const segments = [];
+    let child = path;
+    let current = path.parentPath;
+    while (current && !t.isProgram(current.node)) {
+        // Nothing named this function before another function encloses it, so it
+        // is an anonymous function inside that one.
+        if (segments.length === 0 && isFunctionBoundary(current.node)) {
+            segments.push(ANONYMOUS);
+        }
+        const segment = getSegment(current, child);
+        // A named function expression assigned to a variable of the same name
+        // would otherwise repeat itself.
+        if (segment && segment !== segments[segments.length - 1]) {
+            segments.push(segment);
+        }
+        child = current;
+        current = current.parentPath;
+    }
+    if (segments.length === 0) {
+        return ANONYMOUS;
+    }
+    return segments.reverse().join(".");
+}

package/dist/directives/index.js

@@ -2,8 +2,9 @@ import { createFilter, } from "vite";
 import fg from "fast-glob";
 import { compile } from "./compile.js";
 import xxHash32 from "./xxhash32.js";
-const DEFAULT_INCLUDE = "src/**/*.{jsx,tsx,ts,js,mjs,cjs}";
-const DEFAULT_EXCLUDE = "node_modules/**/*.{jsx,tsx,ts,js,mjs,cjs}";
+const EXTENSIONS = "{jsx,tsx,ts,js,mjs,cjs,mts,cts}";
+const DEFAULT_INCLUDE = `src/**/*.${EXTENSIONS}`;
+const DEFAULT_EXCLUDE = `node_modules/**/*.${EXTENSIONS}`;
 const DIRECTIVE = "use server";
 // Dev-only virtual module used by fns/handler.ts to lazily resolve a server
 // function id back to its owning module when the function was never evaluated
@@ -184,6 +185,9 @@ export function serverFunctionsPlugin(options) {
                     mode,
                     env,
                 });
+                for (const warning of result.warnings) {
+                    this.warn(warning);
+                }
                 if (result.valid) {
                     const preloader = preload[mode];
                     if (preloader) {

package/dist/directives/plugin.d.ts

@@ -7,8 +7,11 @@ export interface StateContext {
     directive: string;
     hash: string;
     count: number;
+    /** How many times each name path has been used, to keep ids unique. */
+    names: Map<string, number>;
     imports: Map<string, t.Identifier>;
     valid: boolean;
+    warnings: string[];
     definitions: {
         register: ImportDefinition;
         clone: ImportDefinition;