@tanstack/start-server-core 1.143.8 → 1.143.12

package/src/server-functions-handler.ts

@@ -1,62 +1,57 @@
-import { isNotFound } from '@tanstack/router-core'
+import { isNotFound, isRedirect } from '@tanstack/router-core'
 import invariant from 'tiny-invariant'
 import {
   TSS_FORMDATA_CONTEXT,
   X_TSS_RAW_RESPONSE,
   X_TSS_SERIALIZED,
   getDefaultSerovalPlugins,
+  safeObjectMerge,
 } from '@tanstack/start-client-core'
 import { fromJSON, toCrossJSONAsync, toCrossJSONStream } from 'seroval'
 import { getResponse } from './request-response'
 import { getServerFnById } from './getServerFnById'
+import type { Plugin as SerovalPlugin } from 'seroval'
 
-let regex: RegExp | undefined = undefined
+// Cache serovalPlugins at module level to avoid repeated calls
+let serovalPlugins: Array<SerovalPlugin<any, any>> | undefined = undefined
+
+// Known FormData 'Content-Type' header values - module-level constant
+const FORM_DATA_CONTENT_TYPES = [
+  'multipart/form-data',
+  'application/x-www-form-urlencoded',
+]
+
+// Maximum payload size for GET requests (1MB)
+const MAX_PAYLOAD_SIZE = 1_000_000
 
 export const handleServerAction = async ({
   request,
   context,
+  serverFnId,
 }: {
   request: Request
   context: any
+  serverFnId: string
 }) => {
   const controller = new AbortController()
   const signal = controller.signal
   const abort = () => controller.abort()
   request.signal.addEventListener('abort', abort)
 
-  if (regex === undefined) {
-    regex = new RegExp(`${process.env.TSS_SERVER_FN_BASE}([^/?#]+)`)
-  }
-
   const method = request.method
-  const url = new URL(request.url, 'http://localhost:3000')
-  // extract the serverFnId from the url as host/_serverFn/:serverFnId
-  // Define a regex to match the path and extract the :thing part
-
-  // Execute the regex
-  const match = url.pathname.match(regex)
-  const serverFnId = match ? match[1] : null
-  const search = Object.fromEntries(url.searchParams.entries()) as {
-    payload?: any
-    createServerFn?: boolean
-  }
-
-  const isCreateServerFn = 'createServerFn' in search
-
-  if (typeof serverFnId !== 'string') {
-    throw new Error('Invalid server action param for serverFnId: ' + serverFnId)
-  }
+  const methodLower = method.toLowerCase()
+  const url = new URL(request.url)
 
   const action = await getServerFnById(serverFnId, { fromClient: true })
 
-  // Known FormData 'Content-Type' header values
-  const formDataContentTypes = [
-    'multipart/form-data',
-    'application/x-www-form-urlencoded',
-  ]
+  const isServerFn = request.headers.get('x-tsr-serverFn') === 'true'
+
+  // Initialize serovalPlugins lazily (cached at module level)
+  if (!serovalPlugins) {
+    serovalPlugins = getDefaultSerovalPlugins()
+  }
 
   const contentType = request.headers.get('Content-Type')
-  const serovalPlugins = getDefaultSerovalPlugins()
 
   function parsePayload(payload: any) {
     const parsedPayload = fromJSON(payload, { plugins: serovalPlugins })
@@ -65,16 +60,16 @@ export const handleServerAction = async ({
 
   const response = await (async () => {
     try {
-      let result = await (async () => {
+      let res = await (async () => {
         // FormData
         if (
-          formDataContentTypes.some(
+          FORM_DATA_CONTENT_TYPES.some(
             (type) => contentType && contentType.includes(type),
           )
         ) {
           // We don't support GET requests with FormData payloads... that seems impossible
           invariant(
-            method.toLowerCase() !== 'get',
+            methodLower !== 'get',
             'GET requests with FormData payloads are not supported',
           )
           const formData = await request.formData()
@@ -95,30 +90,40 @@ export const handleServerAction = async ({
                 typeof deserializedContext === 'object' &&
                 deserializedContext
               ) {
-                params.context = { ...context, ...deserializedContext }
+                params.context = safeObjectMerge(
+                  context,
+                  deserializedContext as Record<string, unknown>,
+                )
+              }
+            } catch (e) {
+              // Log warning for debugging but don't expose to client
+              if (process.env.NODE_ENV === 'development') {
+                console.warn('Failed to parse FormData context:', e)
               }
-            } catch {}
+            }
           }
 
           return await action(params, signal)
         }
 
         // Get requests use the query string
-        if (method.toLowerCase() === 'get') {
-          invariant(
-            isCreateServerFn,
-            'expected GET request to originate from createServerFn',
-          )
-          // By default the payload is the search params
-          let payload: any = search.payload
+        if (methodLower === 'get') {
+          // Get payload directly from searchParams
+          const payloadParam = url.searchParams.get('payload')
+          // Reject oversized payloads to prevent DoS
+          if (payloadParam && payloadParam.length > MAX_PAYLOAD_SIZE) {
+            throw new Error('Payload too large')
+          }
           // If there's a payload, we should try to parse it
-          payload = payload ? parsePayload(JSON.parse(payload)) : {}
-          payload.context = { ...context, ...payload.context }
+          const payload: any = payloadParam
+            ? parsePayload(JSON.parse(payloadParam))
+            : {}
+          payload.context = safeObjectMerge(context, payload.context)
           // Send it through!
           return await action(payload, signal)
         }
 
-        if (method.toLowerCase() !== 'post') {
+        if (methodLower !== 'post') {
           throw new Error('expected POST method')
         }
 
@@ -127,144 +132,115 @@ export const handleServerAction = async ({
           jsonPayload = await request.json()
         }
 
-        // If this POST request was created by createServerFn,
-        // its payload  will be the only argument
-        if (isCreateServerFn) {
-          const payload = jsonPayload ? parsePayload(jsonPayload) : {}
-          payload.context = { ...payload.context, ...context }
-          return await action(payload, signal)
-        }
-
-        // Otherwise, we'll spread the payload. Need to
-        // support `use server` functions that take multiple
-        // arguments.
-        return await action(...jsonPayload)
+        const payload = jsonPayload ? parsePayload(jsonPayload) : {}
+        payload.context = safeObjectMerge(payload.context, context)
+        return await action(payload, signal)
       })()
 
-      // Any time we get a Response back, we should just
-      // return it immediately.
-      if (result.result instanceof Response) {
-        result.result.headers.set(X_TSS_RAW_RESPONSE, 'true')
-        return result.result
-      }
-
-      // If this is a non createServerFn request, we need to
-      // pull out the result from the result object
-      if (!isCreateServerFn) {
-        result = result.result
+      const unwrapped = res.result || res.error
 
-        // The result might again be a response,
-        // and if it is, return it.
-        if (result instanceof Response) {
-          return result
-        }
+      if (isNotFound(res)) {
+        res = isNotFoundResponse(res)
       }
 
-      // TODO: RSCs Where are we getting this package?
-      // if (isValidElement(result)) {
-      //   const { renderToPipeableStream } = await import(
-      //     // @ts-expect-error
-      //     'react-server-dom/server'
-      //   )
-
-      //   const pipeableStream = renderToPipeableStream(result)
-
-      //   setHeaders(event, {
-      //     'Content-Type': 'text/x-component',
-      //   } as any)
-
-      //   sendStream(event, response)
-      //   event._handled = true
-
-      //   return new Response(null, { status: 200 })
-      // }
-
-      if (isNotFound(result)) {
-        return isNotFoundResponse(result)
+      if (!isServerFn) {
+        return unwrapped
       }
 
-      const response = getResponse()
-      let nonStreamingBody: any = undefined
-
-      if (result !== undefined) {
-        // first run without the stream in case `result` does not need streaming
-        let done = false as boolean
-        const callbacks: {
-          onParse: (value: any) => void
-          onDone: () => void
-          onError: (error: any) => void
-        } = {
-          onParse: (value) => {
-            nonStreamingBody = value
-          },
-          onDone: () => {
-            done = true
-          },
-          onError: (error) => {
-            throw error
-          },
+      if (unwrapped instanceof Response) {
+        if (isRedirect(unwrapped)) {
+          return unwrapped
         }
-        toCrossJSONStream(result, {
-          refs: new Map(),
-          plugins: serovalPlugins,
-          onParse(value) {
-            callbacks.onParse(value)
-          },
-          onDone() {
-            callbacks.onDone()
-          },
-          onError: (error) => {
-            callbacks.onError(error)
-          },
-        })
-        if (done) {
-          return new Response(
-            nonStreamingBody ? JSON.stringify(nonStreamingBody) : undefined,
-            {
-              status: response.status,
-              statusText: response.statusText,
-              headers: {
-                'Content-Type': 'application/json',
-                [X_TSS_SERIALIZED]: 'true',
+        unwrapped.headers.set(X_TSS_RAW_RESPONSE, 'true')
+        return unwrapped
+      }
+
+      return serializeResult(res)
+
+      function serializeResult(res: unknown): Response {
+        let nonStreamingBody: any = undefined
+
+        const alsResponse = getResponse()
+        if (res !== undefined) {
+          // first run without the stream in case `result` does not need streaming
+          let done = false as boolean
+          const callbacks: {
+            onParse: (value: any) => void
+            onDone: () => void
+            onError: (error: any) => void
+          } = {
+            onParse: (value) => {
+              nonStreamingBody = value
+            },
+            onDone: () => {
+              done = true
+            },
+            onError: (error) => {
+              throw error
+            },
+          }
+          toCrossJSONStream(res, {
+            refs: new Map(),
+            plugins: serovalPlugins,
+            onParse(value) {
+              callbacks.onParse(value)
+            },
+            onDone() {
+              callbacks.onDone()
+            },
+            onError: (error) => {
+              callbacks.onError(error)
+            },
+          })
+          if (done) {
+            return new Response(
+              nonStreamingBody ? JSON.stringify(nonStreamingBody) : undefined,
+              {
+                status: alsResponse.status,
+                statusText: alsResponse.statusText,
+                headers: {
+                  'Content-Type': 'application/json',
+                  [X_TSS_SERIALIZED]: 'true',
+                },
               },
+            )
+          }
+
+          // not done yet, we need to stream
+          const encoder = new TextEncoder()
+          const stream = new ReadableStream({
+            start(controller) {
+              callbacks.onParse = (value) =>
+                controller.enqueue(encoder.encode(JSON.stringify(value) + '\n'))
+              callbacks.onDone = () => {
+                try {
+                  controller.close()
+                } catch (error) {
+                  controller.error(error)
+                }
+              }
+              callbacks.onError = (error) => controller.error(error)
+              // stream the initial body
+              if (nonStreamingBody !== undefined) {
+                callbacks.onParse(nonStreamingBody)
+              }
             },
-          )
+          })
+          return new Response(stream, {
+            status: alsResponse.status,
+            statusText: alsResponse.statusText,
+            headers: {
+              'Content-Type': 'application/x-ndjson',
+              [X_TSS_SERIALIZED]: 'true',
+            },
+          })
         }
 
-        // not done yet, we need to stream
-        const encoder = new TextEncoder()
-        const stream = new ReadableStream({
-          start(controller) {
-            callbacks.onParse = (value) =>
-              controller.enqueue(encoder.encode(JSON.stringify(value) + '\n'))
-            callbacks.onDone = () => {
-              try {
-                controller.close()
-              } catch (error) {
-                controller.error(error)
-              }
-            }
-            callbacks.onError = (error) => controller.error(error)
-            // stream the initial body
-            if (nonStreamingBody !== undefined) {
-              callbacks.onParse(nonStreamingBody)
-            }
-          },
-        })
-        return new Response(stream, {
-          status: response.status,
-          statusText: response.statusText,
-          headers: {
-            'Content-Type': 'application/x-ndjson',
-            [X_TSS_SERIALIZED]: 'true',
-          },
+        return new Response(undefined, {
+          status: alsResponse.status,
+          statusText: alsResponse.statusText,
         })
       }
-
-      return new Response(undefined, {
-        status: response.status,
-        statusText: response.statusText,
-      })
     } catch (error: any) {
       if (error instanceof Response) {
         return error