@solidjs/web 2.0.0-rc.5 → 2.0.0-rc.6

package/server-functions/dist/server.cjs

@@ -2,6 +2,16 @@
 
 var solidJs = require('solid-js');
 
+const COMPOSED_BODY_FRAMING = /*#__PURE__*/new Set(["content-length", "content-encoding", "transfer-encoding"]);
+function isHttpNavigationTarget(target) {
+  try {
+    const protocol = new URL(target, "http://base.invalid").protocol;
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
 const ENVELOPE = Symbol.for("solid.ResponseEnvelope");
 function isResponseEnvelope(value) {
   return !!(value && typeof value === "object" && value[ENVELOPE]);
@@ -536,7 +546,8 @@ function copyInitHeaders(init) {
   for (const cookie of init.getSetCookie()) headers.append("Set-Cookie", cookie);
   return headers;
 }
-const STUB_GAP_FILL_EXCLUDED = /*#__PURE__*/new Set([ERROR_HEADER, BODY_FORMAT_HEADER, SINGLE_FLIGHT_HEADER, REVALIDATE_HEADER, REDIRECT_HEADER, "Location"].map(header => header.toLowerCase()));
+const STUB_GAP_FILL_EXCLUDED = /*#__PURE__*/new Set([ERROR_HEADER, BODY_FORMAT_HEADER, SINGLE_FLIGHT_HEADER, REVALIDATE_HEADER, REDIRECT_HEADER, "Location",
+...COMPOSED_BODY_FRAMING].map(header => header.toLowerCase()));
 function fillsStubGap(key, headers, response) {
   if (key === "set-cookie" || STUB_GAP_FILL_EXCLUDED.has(key)) return false;
   if (response.body === null && (key === "content-type" || key === "content-length")) return false;
@@ -696,6 +707,52 @@ function provideEvent(event, fn) {
   if (ctx) return ctx.run(event, fn);
   throw new Error("No request event provider. Configure one with configureServerFunctionsServer({ provideEvent }).");
 }
+function scopeDeferredResult(value, scope) {
+  if (value === null || typeof value !== "object" && typeof value !== "function") return value;
+  const promised = scope(() => nativePromise(value));
+  if (promised) {
+    return promised.then(result => scope(() => scopeDeferredResult(result, scope)));
+  }
+  if (typeof ReadableStream !== "undefined" && value instanceof ReadableStream) {
+    let reader;
+    return new ReadableStream({
+      async pull(controller) {
+        try {
+          const step = await scope(() => {
+            if (!reader) reader = value.getReader();
+            return reader.read();
+          });
+          if (step.done) controller.close();else controller.enqueue(step.value);
+        } catch (error) {
+          controller.error(error);
+        }
+      },
+      cancel(reason) {
+        return scope(() => reader ? reader.cancel(reason) : value.cancel(reason));
+      }
+    }, {
+      highWaterMark: 0
+    });
+  }
+  const scopedIterator = symbol => ({
+    [symbol]() {
+      const iterator = scope(() => value[symbol]());
+      return new Proxy(iterator, {
+        get(target, property) {
+          const member = Reflect.get(target, property, target);
+          return typeof member === "function" && (property === "next" || property === "return" || property === "throw") ? (...args) => scope(() => member.apply(target, args)) : member;
+        }
+      });
+    }
+  });
+  if (typeof value[Symbol.asyncIterator] === "function") {
+    return scopedIterator(Symbol.asyncIterator);
+  }
+  if (typeof value[Symbol.iterator] === "function" && !Array.isArray(value) && !(value instanceof Map) && !(value instanceof Set) && !ArrayBuffer.isView(value)) {
+    return scopedIterator(Symbol.iterator);
+  }
+  return value;
+}
 const REGISTRATIONS = new Map();
 const METHODS = new Map();
 const INVOCATIONS = new WeakMap();
@@ -793,7 +850,8 @@ function createServerReference({
         id
       });
       evt.serverOnly = true;
-      const result = provideEvent(evt, () => {
+      const scope = run => provideEvent(evt, run);
+      let result = provideEvent(evt, () => {
         const run = () => fn.apply(thisArg, args);
         return config.wrapInvocation ? config.wrapInvocation(run, {
           id,
@@ -802,19 +860,20 @@ function createServerReference({
           direct: true
         }) : run();
       });
+      result = scopeDeferredResult(result, scope);
       const transform = config.transformDirectResult;
       if (transform && result && typeof result.then === "function") {
-        return result.then(value => transform(value, {
+        return result.then(value => scopeDeferredResult(transform(value, {
           id,
           args,
           event: evt
-        }));
+        }), scope));
       }
-      return transform ? transform(result, {
+      return transform ? scopeDeferredResult(transform(result, {
         id,
         args,
         event: evt
-      }) : result;
+      }), scope) : result;
     }
   });
   return proxy;
@@ -880,22 +939,58 @@ function assertDecodeDepth(value) {
     level = next;
   }
 }
+const UNSAFE_ARGUMENT_KEYS = ["__proto__", "constructor", "prototype"];
+function stripUnsafeArgumentKeys(value) {
+  const stack = [value];
+  const seen = new Set();
+  while (stack.length) {
+    const v = stack.pop();
+    if (v === null || typeof v !== "object" || seen.has(v)) continue;
+    seen.add(v);
+    for (const key of UNSAFE_ARGUMENT_KEYS) {
+      delete v[key];
+    }
+    for (const key of Object.keys(v)) stack.push(v[key]);
+    if (v instanceof Map) {
+      for (const [k, entry] of v) stack.push(k, entry);
+    } else if (v instanceof Set) {
+      for (const member of v) stack.push(member);
+    }
+  }
+  return value;
+}
 async function bufferBodyWithin(request, limit) {
-  const reader = request.clone().body.getReader();
+  const reader = request.body.getReader();
+  const signal = request.signal;
   const chunks = [];
   let total = 0;
-  for (;;) {
-    const {
-      done,
-      value
-    } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > limit) {
-      reader.cancel().catch(() => {});
-      return null;
+  const onAbort = () => {
+    reader.cancel(signal.reason).catch(() => {});
+  };
+  if (signal.aborted) onAbort();else signal.addEventListener("abort", onAbort, {
+    once: true
+  });
+  try {
+    for (;;) {
+      const {
+        done,
+        value
+      } = await reader.read();
+      if (signal.aborted) throw signal.reason;
+      if (done) break;
+      total += value.byteLength;
+      if (total > limit) {
+        reader.cancel().catch(() => {});
+        return null;
+      }
+      chunks.push(value);
     }
-    chunks.push(value);
+  } catch (error) {
+    reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+    reader.releaseLock();
   }
   const body = new Uint8Array(total);
   let offset = 0;
@@ -922,6 +1017,7 @@ async function parseArguments(request, url, scripted, codec) {
     if (!Array.isArray(result)) {
       throw new TypeError("Server function arguments must encode an array");
     }
+    stripUnsafeArgumentKeys(result);
     for (const arg of result) {
       parsed.push(arg);
     }
@@ -935,9 +1031,12 @@ async function parseArguments(request, url, scripted, codec) {
       if (!Array.isArray(decoded)) {
         throw new TypeError("Server function arguments must encode an array");
       }
-      return decoded;
+      return stripUnsafeArgumentKeys(decoded);
     }
     if (decoded === undefined) {
+      if (bodyFormat === null && (await request.clone().arrayBuffer()).byteLength === 0) {
+        return parsed;
+      }
       throw new TypeError("Server function body carries no usable encoding");
     }
     parsed.push(decoded);
@@ -1038,7 +1137,7 @@ function foldSetCookies(headers, setCookies) {
 }
 function mergeResponseHeaders(target, source) {
   source.forEach((value, key) => {
-    if (key !== "set-cookie") target.append(key, value);
+    if (key !== "set-cookie" && !COMPOSED_BODY_FRAMING.has(key)) target.append(key, value);
   });
   if (source.getSetCookie) {
     for (const cookie of source.getSetCookie()) target.append("Set-Cookie", cookie);
@@ -1055,10 +1154,6 @@ function maskRedirect(headers, response, requestUrl) {
   headers.delete("Location");
 }
 const BOUNDED_COMPOSED_HEADERS = [REDIRECT_HEADER, "Location", REVALIDATE_HEADER];
-function refusedTargetScheme(target) {
-  const match = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.exec(target);
-  return match !== null && !/^https?:$/i.test(match[0]);
-}
 function enforceComposedHeaderInvariants(response) {
   for (const name of BOUNDED_COMPOSED_HEADERS) {
     const value = response.headers.get(name);
@@ -1068,7 +1163,7 @@ function enforceComposedHeaderInvariants(response) {
     }
     if (name === REVALIDATE_HEADER) continue;
     const target = name === REDIRECT_HEADER ? value.slice(value.indexOf(" ") + 1) : value;
-    if (refusedTargetScheme(target)) {
+    if (!isHttpNavigationTarget(target)) {
       return refuseComposedHeader(response, name, `${name} response header refused: non-http(s) navigation target`, DEV ? `The ${name} response header carries a navigation target with a non-http(s) ` + `scheme ("${target.slice(0, 64)}"). A javascript: target is same-origin script ` + `execution in any integration that navigates to it, so only http(s) and ` + `relative targets leave this transport. If the target came from request data ` + `(?next= and friends), validate it against your own origin before redirecting.` : null);
     }
   }
@@ -1196,14 +1291,11 @@ function guardFailures(value, state) {
         top.next.add(guarded);
         if (guarded !== original) top.changed = true;
       } else if (guarded !== original || top.accessorRead === i) {
-        Object.defineProperty(top.next, items[i], top.accessorRead === i ? {
-          enumerable: true,
-          configurable: true,
+        Object.defineProperty(top.next, items[i], {
+          value: guarded,
           writable: true,
-          value: guarded
-        } : {
-          ...top.descriptors[items[i]],
-          value: guarded
+          configurable: true,
+          enumerable: top.descriptors[items[i]].enumerable
         });
         top.changed = true;
       }
@@ -1238,6 +1330,9 @@ class Frame {
     this.pendingKey = undefined;
   }
 }
+function guardOperation(state, run) {
+  return state.scope ? state.scope(run) : run();
+}
 function enterGuard(value, state) {
   if (value === null || typeof value !== "object") return value;
   if (state.seen.has(value)) {
@@ -1252,7 +1347,7 @@ function enterGuard(value, state) {
       if (finished) return;
       finished = true;
       try {
-        const cancelled = reader ? reader.cancel() : value.cancel();
+        const cancelled = guardOperation(state, () => reader ? reader.cancel() : value.cancel());
         if (cancelled && typeof cancelled.then === "function") cancelled.then(undefined, () => {});
       } catch {}
     };
@@ -1264,19 +1359,19 @@ function enterGuard(value, state) {
             controller.close();
             return;
           }
-          if (!reader) reader = value.getReader();
+          if (!reader) reader = guardOperation(state, () => value.getReader());
           const {
             done,
             value: chunk
-          } = await reader.read();
-          done ? controller.close() : controller.enqueue(guardFailures(chunk, state));
+          } = await guardOperation(state, () => reader.read());
+          done ? controller.close() : controller.enqueue(guardOperation(state, () => guardFailures(chunk, state)));
         } catch (error) {
-          controller.error(sanitizeServerError(error));
+          controller.error(guardOperation(state, () => sanitizeServerError(error)));
         }
       },
       cancel(reason) {
         finished = true;
-        return reader ? reader.cancel(reason) : value.cancel(reason);
+        return guardOperation(state, () => reader ? reader.cancel(reason) : value.cancel(reason));
       }
     });
     if (gate) gate.onOpen(close);
@@ -1284,9 +1379,10 @@ function enterGuard(value, state) {
     return guardedStream;
   }
   if (typeof value.then === "function") {
-    const guardedPromise = Promise.resolve(value).then(resolved => guardFailures(resolved, state), error => {
-      throw sanitizeServerError(error);
+    const guardedPromise = Promise.resolve(value).then(resolved => guardOperation(state, () => guardFailures(resolved, state)), error => {
+      throw guardOperation(state, () => sanitizeServerError(error));
     });
+    guardedPromise.catch(() => {});
     state.seen.set(value, guardedPromise);
     return guardedPromise;
   }
@@ -1295,13 +1391,13 @@ function enterGuard(value, state) {
     const gate = state.gate;
     const guardedIterable = {
       [Symbol.asyncIterator]() {
-        const iterator = source[Symbol.asyncIterator]();
+        const iterator = guardOperation(state, () => source[Symbol.asyncIterator]());
         let finished = false;
         const close = () => {
           if (finished) return;
           finished = true;
           try {
-            const returned = iterator.return && iterator.return();
+            const returned = iterator.return && guardOperation(state, () => iterator.return());
             if (returned && typeof returned.then === "function") returned.then(undefined, () => {});
           } catch {}
         };
@@ -1309,17 +1405,17 @@ function enterGuard(value, state) {
         const step = () => finished ? Promise.resolve({
           done: true,
           value: undefined
-        }) : iterator.next().then(step => {
+        }) : guardOperation(state, () => iterator.next()).then(step => {
           if (step.done) {
             finished = true;
             return step;
           }
           return {
             done: false,
-            value: guardFailures(step.value, state)
+            value: guardOperation(state, () => guardFailures(step.value, state))
           };
         }, error => {
-          throw sanitizeServerError(error);
+          throw guardOperation(state, () => sanitizeServerError(error));
         });
         return {
           next: () => finished || !gate || gate.wantsMore() ? step() : gate.awaitDemand().then(step),
@@ -1336,6 +1432,11 @@ function enterGuard(value, state) {
     state.seen.set(value, guardedIterable);
     return guardedIterable;
   }
+  if (state.scope && typeof value[Symbol.iterator] === "function" && !Array.isArray(value) && !(value instanceof Map) && !(value instanceof Set) && !ArrayBuffer.isView(value)) {
+    const scopedIterable = scopeDeferredResult(value, state.scope);
+    state.seen.set(value, scopedIterable);
+    return scopedIterable;
+  }
   if (Array.isArray(value)) {
     const next = value.slice();
     state.seen.set(value, next);
@@ -1359,16 +1460,20 @@ function enterGuard(value, state) {
     return value;
   }
   const descriptors = Object.getOwnPropertyDescriptors(value);
+  for (const key of Object.keys(descriptors)) {
+    descriptors[key].configurable = true;
+    if ("value" in descriptors[key]) descriptors[key].writable = true;
+  }
   const next = Object.create(prototype, descriptors);
   state.seen.set(value, next);
-  return new Frame(OBJECT, value, next, Object.keys(descriptors), descriptors);
+  return new Frame(OBJECT, value, next, Object.keys(value), descriptors);
 }
 function keepGuarded(value, next, changed, state) {
   if (changed || state.cyclic.has(value)) return next;
   state.seen.set(value, value);
   return value;
 }
-function serializeResponseStream(value, codecOptions, signal) {
+function serializeResponseStream(value, codecOptions, signal, scope) {
   let closed = false;
   let streamController = null;
   let demandWaiters = null;
@@ -1387,11 +1492,13 @@ function serializeResponseStream(value, codecOptions, signal) {
       if (closed) close();else sourceClosers.add(close);
     }
   };
-  value = guardFailures(value, {
+  const guardState = {
     seen: new WeakMap(),
     cyclic: new WeakSet(),
-    gate
-  });
+    gate,
+    scope
+  };
+  value = guardOperation(guardState, () => guardFailures(value, guardState));
   let cancelSerialize = null;
   let onAbort = null;
   const finishSource = () => {
@@ -1472,14 +1579,14 @@ function serializeResponseStream(value, codecOptions, signal) {
     }
   });
 }
-function serializedResponse(value, headers, codec, signal) {
+function serializedResponse(value, headers, codec, signal, scope) {
   headers.set(BODY_FORMAT_HEADER, BodyFormat.Serialized);
   headers.set("Content-Type", "text/plain");
-  return new Response(serializeResponseStream(value, codec, signal), {
+  return new Response(serializeResponseStream(value, codec, signal, scope), {
     headers
   });
 }
-function encodeResult(value, headers, status, codec, signal) {
+function encodeResult(value, headers, status, codec, signal, scope) {
   if (NULL_BODY_STATUSES.has(status)) {
     if (value === undefined || value === null) {
       headers.set(BODY_FORMAT_HEADER, BodyFormat.Void);
@@ -1490,7 +1597,7 @@ function encodeResult(value, headers, status, codec, signal) {
     }
     const error = new Error(`Server function answered status ${status}, which forbids a response body, with a value. ` + `Return respond(undefined, { status: ${status} }) for a bodiless answer, or drop the ` + `status to send the value.`);
     headers.set(ERROR_HEADER, encodeErrorHeaderValue(error.message));
-    return encodeResult(error, headers, 500, codec, signal);
+    return encodeResult(error, headers, 500, codec, signal, scope);
   }
   const direct = getHeadersAndBody(value);
   if (direct) {
@@ -1510,10 +1617,12 @@ function encodeResult(value, headers, status, codec, signal) {
     });
   }
   try {
-    if (isJSONSafe(value)) {
+    const jsonSafe = scope ? scope(() => isJSONSafe(value)) : isJSONSafe(value);
+    if (jsonSafe) {
       headers.set(BODY_FORMAT_HEADER, BodyFormat.Json);
       headers.set("Content-Type", "application/json");
-      return new Response(JSON.stringify(value), {
+      const body = scope ? scope(() => JSON.stringify(value)) : JSON.stringify(value);
+      return new Response(body, {
         status,
         headers
       });
@@ -1521,7 +1630,7 @@ function encodeResult(value, headers, status, codec, signal) {
   } catch {
   }
   try {
-    const response = serializedResponse(value, headers, codec, signal);
+    const response = serializedResponse(value, headers, codec, signal, scope);
     return status === 200 ? response : new Response(response.body, {
       status,
       headers
@@ -1619,8 +1728,17 @@ function forbiddenResponse() {
     }
   }));
 }
+function nativePromise(value) {
+  if (value instanceof Promise) return value;
+  try {
+    if (Object.prototype.toString.call(value) === "[object Promise]") return Promise.prototype.then.call(value, value => value);
+  } catch {}
+}
 async function handleServerFunctionRequest(request, options = {}) {
-  const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
+  const codec = {
+    ...(options.codec !== undefined ? options.codec : getServerFunctionsCodec())
+  };
+  codec.serializeErrorStacks ??= DEV;
   const url = new URL(request.url);
   const method = request.method;
   const address = resolveAddress(url);
@@ -1679,7 +1797,15 @@ async function handleServerFunctionRequest(request, options = {}) {
       return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
     }
     if (!(declared > 0)) {
-      const bounded = await bufferBodyWithin(request, bodySizeLimit);
+      let bounded;
+      try {
+        bounded = await bufferBodyWithin(request, bodySizeLimit);
+      } catch {
+        const response = new Response(DEV ? "Malformed server function arguments" : null, {
+          status: 400
+        });
+        return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+      }
       if (bounded === null) {
         const response = new Response(DEV ? "Server function request body exceeds the configured bodySizeLimit" : null, {
           status: 413
@@ -1689,16 +1815,30 @@ async function handleServerFunctionRequest(request, options = {}) {
       request = bounded;
     }
   }
-  let event = options.createEvent ? options.createEvent(request) : {
-    request,
-    locals: {}
-  };
-  if (typeof event?.then === "function") event = await event;
+  let event;
+  try {
+    event = options.createEvent ? options.createEvent(request) : {
+      request,
+      locals: {}
+    };
+    const promised = nativePromise(event);
+    if (promised) event = await promised;
+  } catch (error) {
+    const safe = sanitizeServerError(error);
+    const message = safe instanceof Error ? safe.message : String(safe);
+    const headers = new Headers();
+    headers.set(ERROR_HEADER, boundedErrorHeaderValue(message));
+    const response = scripted ? encodeResult(safe, headers, 500, codec, request.signal) : new Response(DEV ? message : null, {
+      status: 500
+    });
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
   const refuseCommitted = raw => {
     const response = commitEventResponse(raw, event);
     return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   };
   const provide = options.provideEvent || provideEvent;
+  const scope = run => provide(event, run);
   const flightHook = options.collectFlightData !== undefined ? options.collectFlightData : config.collectFlightData;
   const transformResult = options.transformResult !== undefined ? options.transformResult : config.transformResult;
   const wrapInvocation = options.wrapInvocation !== undefined ? options.wrapInvocation : config.wrapInvocation;
@@ -1749,7 +1889,8 @@ async function handleServerFunctionRequest(request, options = {}) {
   const headers = new Headers();
   const dispatch = async () => {
     try {
-      let result = await provide(event, async () => {
+      let invocations = 0;
+      const invokeOnce = async () => {
         INVOCATIONS.set(event, {
           id: functionId
         });
@@ -1761,7 +1902,16 @@ async function handleServerFunctionRequest(request, options = {}) {
           request,
           direct: false
         }) : run();
+      };
+      let result = await provide(event, () => {
+        if (++invocations > 1) {
+          throw new Error("provideEvent invoked the server function callback more than once: a second " + "invocation would commit the call's side effects twice. The hook must call " + "fn exactly once and return its result.");
+        }
+        return invokeOnce();
       });
+      if (invocations !== 1) {
+        throw new Error(invocations === 0 ? "provideEvent returned without invoking the server function callback: the call " + "would have answered as a void success without running the function. The hook " + "must call fn exactly once and return its result." : "provideEvent invoked the server function callback more than once: a second " + "invocation would commit the call's side effects twice. The hook must call " + "fn exactly once and return its result.");
+      }
       if (transformResult) {
         result = await transformResult(event, result, flightContext);
       }
@@ -1815,10 +1965,10 @@ async function handleServerFunctionRequest(request, options = {}) {
       if (!scripted) {
         if (handleNoJS) return handleNoJS(result ?? metadata, request, parsed);
         if (result instanceof Response) return result;
-        return encodeResult(result, headers, status, codec, request.signal);
+        return encodeResult(result, headers, status, codec, request.signal, scope);
       }
       if (status === 304) warnScripted304(functionId);
-      return encodeResult(result, headers, status, codec, request.signal);
+      return encodeResult(result, headers, status, codec, request.signal, scope);
     } catch (x) {
       const respondThrown = value => {
         const safe = sanitizeServerError(value);
@@ -1831,7 +1981,7 @@ async function handleServerFunctionRequest(request, options = {}) {
         }
         const error = safe instanceof Error ? safe.message : typeof safe === "string" ? safe : "true";
         headers.set(ERROR_HEADER, boundedErrorHeaderValue(error));
-        return encodeResult(safe, headers, 500, codec, request.signal);
+        return encodeResult(safe, headers, 500, codec, request.signal, scope);
       };
       if (x instanceof Response || isResponseEnvelope(x)) {
         if (transformResult) {
@@ -1895,7 +2045,7 @@ async function handleServerFunctionRequest(request, options = {}) {
           if (x instanceof Response) return x;
         }
         if (scripted && status === 304) warnScripted304(functionId);
-        return encodeResult(x, headers, status, codec, request.signal);
+        return encodeResult(x, headers, status, codec, request.signal, scope);
       }
       return respondThrown(x);
     }