@timber-js/app 0.2.0-alpha.133 → 0.2.0-alpha.135

package/dist/server/internal.js

@@ -3,10 +3,10 @@ import { a as warnRedirectInSuspense, c as warnSuspenseWrappingChildren, i as wa
 import { i as getMetadataRouteServePath, n as classifyMetadataRoute, r as getMetadataRouteAutoLink, t as METADATA_ROUTE_CONVENTIONS } from "../_chunks/metadata-routes-DESG8uk5.js";
 import { n as classifyUrlSegment } from "../_chunks/segment-classify-BjfuctV2.js";
 import { a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, h as swallow, i as logMiddlewareShortCircuit, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest } from "../_chunks/logger-CMd9P1xQ.js";
-import { C as setMatchedSegmentPath, E as getCookie, O as getSetCookieHeaders, S as runWithRequestContext, T as setSegmentParams, _ as getHeader, b as getSegmentParams, c as DenySignal, d as RenderError, g as applyRequestHeaderOverlay, l as RedirectSignal, n as executeAction, o as coerce, r as isRscActionRequest, t as buildNoJsResponse, w as setMutableCookieContext, x as markResponseFlushed, y as getSearchParams } from "../_chunks/actions-BNhpxrnV.js";
+import { C as setMatchedSegmentPath, E as getCookie, O as getSetCookieHeaders, S as runWithRequestContext, T as setSegmentParams, _ as getHeader, b as getSegmentParams, c as DenySignal, d as RenderError, g as applyRequestHeaderOverlay, l as RedirectSignal, n as executeAction, o as coerce, r as isRscActionRequest, t as buildNoJsResponse, w as setMutableCookieContext, x as markResponseFlushed, y as getSearchParams } from "../_chunks/actions-CHFblsdT.js";
 import "../client/error-boundary.js";
-import { n as toBracketKey } from "../_chunks/resolve-schema-DU2nbVOi.js";
-import "../_chunks/segment-context-Bg0pFbLT.js";
+import { n as toBracketKey } from "../_chunks/resolve-schema-D3CbcdCW.js";
+import "../_chunks/segment-context-BnxoPSFQ.js";
 import { readFile } from "node:fs/promises";
 import "node:crypto";
 import React, { createElement } from "react";
@@ -1621,6 +1621,7 @@ function escapeXml(str) {
 * followed by '/' or be an exact match.
 */
 function hasSegmentPrefix(pathname, prefix) {
+	if (prefix === "/") return true;
 	if (!pathname.startsWith(prefix)) return false;
 	return pathname.length === prefix.length || pathname[prefix.length] === "/";
 }
@@ -1830,7 +1831,7 @@ async function runProxyPhase(config, getProxy, req, method, path) {
 	const detailed = config.serverTiming === "detailed";
 	try {
 		const proxyExport = await getProxy();
-		const proxyFn = () => runProxy(proxyExport, req, () => handleRequest(config, req, method, path));
+		const proxyFn = () => runProxy(proxyExport, req, () => handleRequest(config, req, method, path, true));
 		return {
 			kind: "response",
 			phase: "proxy",
@@ -1944,16 +1945,23 @@ async function runRenderPhase(config, req, match, responseHeaders, requestHeader
 *
 * Used both as the top-level entry (when no proxy.ts is configured) and as
 * the `next()` continuation passed to `runProxy()`.
+*
+* @param pathIsCanonical When true, `path` has already been canonicalized by
+*   `createPipeline` — skip re-canonicalization to prevent double-decode.
+*   When false (default), runs canonicalize as a safety net for direct callers.
 */
-async function handleRequest(config, req, method, path) {
+async function handleRequest(config, req, method, path, pathIsCanonical) {
 	const stripTrailingSlash = config.stripTrailingSlash ?? true;
-	const url = new URL(req.url);
-	const result = canonicalize(url.pathname, stripTrailingSlash);
-	if (!result.ok) {
-		if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${result.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
-		return new Response(null, { status: result.status });
+	let canonicalPathname;
+	if (pathIsCanonical) canonicalPathname = path;
+	else {
+		const result = canonicalize(path, stripTrailingSlash);
+		if (!result.ok) {
+			if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${path} — responding with ${result.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
+			return new Response(null, { status: result.status });
+		}
+		canonicalPathname = result.pathname;
 	}
-	const canonicalPathname = result.pathname;
 	if (config.matchMetadataRoute) {
 		const metaMatch = config.matchMetadataRoute(canonicalPathname);
 		if (metaMatch) try {
@@ -2033,7 +2041,7 @@ async function handleRequest(config, req, method, path) {
 		}
 	}
 	if (!match) {
-		if (isDebug()) console.warn(`[timber] No route matched for pathname: ${canonicalPathname}\n  Raw URL: ${url.pathname}\n  Method: ${method}`);
+		if (isDebug()) console.warn(`[timber] No route matched for pathname: ${canonicalPathname}\n  Input path: ${path}\n  Method: ${method}`);
 		if (config.renderNoMatch) {
 			const responseHeaders = new Headers();
 			return cloneWithMutableHeaders(await config.renderNoMatch(req, responseHeaders));
@@ -2136,8 +2144,14 @@ function createPipeline(config) {
 							method,
 							path: canonicalPath
 						});
-						else result = await handleRequest(config, canonicalReq, method, canonicalPath);
+						else result = await handleRequest(config, canonicalReq, method, canonicalPath, true);
 						await setSpanAttribute("http.response.status_code", result.status);
+						const varyTokens = ["Accept"];
+						if (config.interceptionRewrites?.length) varyTokens.push("X-Timber-URL");
+						const existingVary = result.headers.get("Vary");
+						const existingTokens = existingVary ? existingVary.toLowerCase().split(",").map((t) => t.trim()) : [];
+						const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
+						if (newTokens.length > 0) result.headers.set("Vary", existingVary ? `${existingVary}, ${newTokens.join(", ")}` : newTokens.join(", "));
 						if (serverTiming === "detailed") {
 							const timingHeader = getServerTimingHeader();
 							if (timingHeader) result.headers.set("Server-Timing", timingHeader);
@@ -2844,12 +2858,34 @@ var SAFE_METHODS = new Set([
 	"OPTIONS"
 ]);
 /**
-* Validate the Origin header against the request's Host.
+* Derive the request's scheme from trusted sources.
+*
+* Priority:
+* 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
+* 2. Request URL protocol
+*
+* Falls back to 'https' (fail closed) if neither is available.
+*/
+function deriveRequestScheme(req) {
+	const forwarded = req.headers.get("X-Forwarded-Proto");
+	if (forwarded) {
+		const proto = forwarded.split(",")[0].trim().toLowerCase();
+		if (proto === "http" || proto === "https") return proto;
+	}
+	try {
+		return new URL(req.url).protocol.replace(":", "");
+	} catch {
+		return "https";
+	}
+}
+/**
+* Validate the Origin header against the request's full origin
+* (scheme + host + port).
 *
 * For mutation methods (POST, PUT, PATCH, DELETE):
 * - If `csrf: false`, skip validation.
 * - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
-* - Otherwise, Origin's host must match the request's Host header.
+* - Otherwise, Origin must match the derived request origin.
 *
 * Safe methods (GET, HEAD, OPTIONS) always pass.
 */
@@ -2870,16 +2906,26 @@ function validateCsrf(req, config) {
 		ok: false,
 		status: 403
 	};
-	let originHost;
+	let originOrigin;
+	try {
+		originOrigin = new URL(origin).origin;
+	} catch {
+		return {
+			ok: false,
+			status: 403
+		};
+	}
+	const scheme = deriveRequestScheme(req);
+	let expectedOrigin;
 	try {
-		originHost = new URL(origin).host;
+		expectedOrigin = new URL(`${scheme}://${host}`).origin;
 	} catch {
 		return {
 			ok: false,
 			status: 403
 		};
 	}
-	return originHost === host ? { ok: true } : {
+	return originOrigin === expectedOrigin ? { ok: true } : {
 		ok: false,
 		status: 403
 	};
@@ -2909,6 +2955,8 @@ function parseBodySize(size) {
 		default: throw new Error(`Unknown size unit: "${unit}"`);
 	}
 }
+/** Strict integer pattern: one or more digits, nothing else. */
+var STRICT_INTEGER_RE = /^\d+$/;
 /** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
 function enforceBodyLimits(req, kind, config) {
 	const contentLength = req.headers.get("Content-Length");
@@ -2916,12 +2964,12 @@ function enforceBodyLimits(req, kind, config) {
 		ok: false,
 		status: 411
 	};
-	const bodySize = Number.parseInt(contentLength, 10);
-	if (Number.isNaN(bodySize)) return {
+	const trimmed = contentLength.trim();
+	if (!STRICT_INTEGER_RE.test(trimmed)) return {
 		ok: false,
 		status: 411
 	};
-	return bodySize <= resolveLimit(kind, config) ? { ok: true } : {
+	return Number.parseInt(trimmed, 10) <= resolveLimit(kind, config) ? { ok: true } : {
 		ok: false,
 		status: 413
 	};