@timber-js/app 0.2.0-alpha.134 → 0.2.0-alpha.135

package/src/plugins/cache.ts

@@ -0,0 +1,180 @@
+/**
+ * timber-cache-transform — Vite plugin that injects stable callsite IDs
+ * into `cache()` calls imported from `@timber-js/app/cache`.
+ *
+ * Without this plugin, cache keys use a process-local counter (fnIdCounter)
+ * which is unstable across cold starts in serverless/multi-instance
+ * deployments. With a shared CacheHandler (Redis/KV), colliding counters
+ * cause cache key poisoning — serving one route's cached data to another.
+ *
+ * The plugin transforms:
+ *   cache(fn, opts)  →  cache(fn, opts, "stable-id")
+ *
+ * where stable-id = fnv1a(relativeModulePath + ":cache:" + callIndex).
+ *
+ * See TIM-997, design/06-caching.md §"Cache Key Security".
+ */
+
+import { relative } from 'node:path';
+import MagicString from 'magic-string';
+import { parseAst } from 'vite';
+import type { Plugin } from 'vite';
+import type { PluginContext } from '../plugin-context.js';
+import { fnv1aHash } from '../cache/fast-hash.js';
+
+const CACHE_MODULE_SOURCES = new Set(['@timber-js/app/cache', 'timber/cache']);
+
+interface PositionedNode {
+  type: string;
+  start: number;
+  end: number;
+  [key: string]: unknown;
+}
+
+interface IdentifierNode extends PositionedNode {
+  type: 'Identifier';
+  name: string;
+}
+
+interface ImportDeclarationNode extends PositionedNode {
+  type: 'ImportDeclaration';
+  source: { value: string };
+  specifiers: Array<
+    PositionedNode & {
+      type: string;
+      local: IdentifierNode;
+      imported?: IdentifierNode;
+    }
+  >;
+}
+
+interface CallExpressionNode extends PositionedNode {
+  type: 'CallExpression';
+  callee: PositionedNode;
+  arguments: PositionedNode[];
+}
+
+interface ProgramNode extends PositionedNode {
+  type: 'Program';
+  body: PositionedNode[];
+}
+
+/**
+ * Find the local binding name(s) for `cache` imported from the cache module.
+ */
+function findCacheBindings(program: ProgramNode): Set<string> {
+  const bindings = new Set<string>();
+  for (const stmt of program.body) {
+    if (stmt.type !== 'ImportDeclaration') continue;
+    const decl = stmt as unknown as ImportDeclarationNode;
+    if (!CACHE_MODULE_SOURCES.has(decl.source.value)) continue;
+    for (const spec of decl.specifiers) {
+      if (spec.type !== 'ImportSpecifier') continue;
+      const importedName = spec.imported?.name ?? spec.local.name;
+      if (importedName === 'cache') {
+        bindings.add(spec.local.name);
+      }
+    }
+  }
+  return bindings;
+}
+
+/**
+ * Recursively walk AST nodes to find cache() call expressions.
+ *
+ * cache() is typically called at module scope, but we also handle calls
+ * inside functions/blocks for completeness.
+ */
+function findCacheCallSites(
+  node: PositionedNode,
+  cacheBindings: Set<string>,
+  results: CallExpressionNode[]
+): void {
+  if (node.type === 'CallExpression') {
+    const call = node as unknown as CallExpressionNode;
+    if (
+      call.callee.type === 'Identifier' &&
+      cacheBindings.has((call.callee as IdentifierNode).name) &&
+      call.arguments.length === 2
+    ) {
+      results.push(call);
+    }
+  }
+  for (const key of Object.keys(node)) {
+    if (key === 'type' || key === 'start' || key === 'end') continue;
+    const val = node[key];
+    if (val && typeof val === 'object') {
+      if (Array.isArray(val)) {
+        for (const item of val) {
+          if (item && typeof item === 'object' && typeof item.type === 'string') {
+            findCacheCallSites(item as PositionedNode, cacheBindings, results);
+          }
+        }
+      } else if (typeof (val as PositionedNode).type === 'string') {
+        findCacheCallSites(val as PositionedNode, cacheBindings, results);
+      }
+    }
+  }
+}
+
+/**
+ * Generate a stable callsite ID from a module path and call index.
+ *
+ * The ID is an FNV-1a hash of the relative module path + call index,
+ * providing a deterministic identifier that is:
+ * - Stable across cold starts of the same build
+ * - Unique across different modules
+ * - Unique across multiple cache() calls within the same module
+ */
+function generateStableId(relativeModulePath: string, callIndex: number): string {
+  return fnv1aHash(`${relativeModulePath}:cache:${callIndex}`);
+}
+
+export function timberCacheTransform(ctx: PluginContext): Plugin {
+  return {
+    name: 'timber-cache-transform',
+
+    transform(code, id) {
+      if (!code.includes('@timber-js/app/cache') && !code.includes('timber/cache')) return;
+      // Skip node_modules (don't transform third-party code)
+      if (id.includes('node_modules')) return;
+
+      let program: ProgramNode;
+      try {
+        program = parseAst(code, { lang: 'tsx' }) as unknown as ProgramNode;
+      } catch {
+        return;
+      }
+
+      const cacheBindings = findCacheBindings(program);
+      if (cacheBindings.size === 0) return;
+
+      const callSites: CallExpressionNode[] = [];
+      findCacheCallSites(program, cacheBindings, callSites);
+      if (callSites.length === 0) return;
+
+      // Sort by position in file for deterministic call indices
+      callSites.sort((a, b) => a.start - b.start);
+
+      const root = ctx.root || process.cwd();
+      const relPath = relative(root, id);
+      const s = new MagicString(code);
+
+      for (let i = 0; i < callSites.length; i++) {
+        const call = callSites[i];
+        const stableId = generateStableId(relPath, i);
+        // Insert the stable ID as the 3rd argument just before the closing ')'
+        const insertPos = call.end - 1;
+        s.appendLeft(insertPos, `, "${stableId}"`);
+      }
+
+      return {
+        code: s.toString(),
+        map: s.generateMap({ hires: 'boundary' }),
+      };
+    },
+  };
+}
+
+// Exported for testing
+export { generateStableId };

package/src/routing/link-codegen.ts

@@ -45,15 +45,15 @@ export function buildResolvedPattern(route: RouteEntry): string | null {
   const parts = route.urlPath.split('/');
   const templateParts = parts.map((part) => {
     if (part.startsWith('[[...') && part.endsWith(']]')) {
-      // Optional catch-all — matches any trailing path
+      // eslint-disable-next-line no-template-curly-in-string -- codegen output
       return '${string}';
     }
     if (part.startsWith('[...') && part.endsWith(']')) {
-      // Catch-all — matches one or more segments
+      // eslint-disable-next-line no-template-curly-in-string -- codegen output
       return '${string}';
     }
     if (part.startsWith('[') && part.endsWith(']')) {
-      // Dynamic segment
+      // eslint-disable-next-line no-template-curly-in-string -- codegen output
       return '${string}';
     }
     return part;
@@ -118,8 +118,10 @@ export function formatLinkCatchAllOverloads(): string[] {
 
   // ExternalHref inlined here rather than referenced as an exported
   // alias so the generated .d.ts stands alone without source imports.
+  /* eslint-disable no-template-curly-in-string -- codegen output */
   const externalHref =
     '`http://${string}` | `https://${string}` | `mailto:${string}` | `tel:${string}` | `ftp://${string}` | `//${string}` | `#${string}` | `?${string}`';
+  /* eslint-enable no-template-curly-in-string */
 
   lines.push('  // Typed Link overloads — catch-all (block 2 / emitted second)');
   lines.push('  interface LinkFunction {');

package/src/schema-bridge.ts

@@ -109,8 +109,9 @@ export function isCodec(value: unknown): value is Codec<unknown> {
 export function fromSchema<T>(schema: StandardSchemaV1<T>): Codec<T> {
   return {
     parse(value: string | string[] | undefined): T {
-      // For array inputs, take the last value (consistent with URLSearchParams.get())
-      const input = Array.isArray(value) ? value[value.length - 1] : value;
+      // For array inputs (duplicate query keys), use the first value.
+      // Browsers and URLSearchParams.get() return the first occurrence.
+      const input = Array.isArray(value) ? value[0] : value;
 
       // Try parsing the raw value
       const result = validateSync(schema, input);

package/src/server/action-client.ts

@@ -510,26 +510,38 @@ function logValidationFailure(errors: ValidationErrors): void {
  * Returns validation errors keyed by field name, or null if all files are ok.
  */
 function validateFileSizes(input: Record<string, unknown>, limit: number): ValidationErrors | null {
-  const errors: ValidationErrors = {};
   const limitKb = Math.round(limit / 1024);
   const limitLabel =
     limit >= 1024 * 1024 ? `${Math.round(limit / (1024 * 1024))}MB` : `${limitKb}KB`;
 
-  for (const [key, value] of Object.entries(input)) {
-    if (value instanceof File && value.size > limit) {
-      errors[key] = [
-        `File "${value.name}" (${formatSize(value.size)}) exceeds the ${limitLabel} limit`,
-      ];
-    } else if (Array.isArray(value)) {
-      const oversized = value.filter((item) => item instanceof File && item.size > limit);
-      if (oversized.length > 0) {
-        errors[key] = oversized.map(
-          (f: File) => `File "${f.name}" (${formatSize(f.size)}) exceeds the ${limitLabel} limit`
-        );
+  const errors: ValidationErrors = {};
+
+  function walk(obj: Record<string, unknown>, prefix: string): void {
+    for (const [key, value] of Object.entries(obj)) {
+      const path = prefix ? `${prefix}.${key}` : key;
+      if (value instanceof File && value.size > limit) {
+        errors[path] = [
+          `File "${value.name}" (${formatSize(value.size)}) exceeds the ${limitLabel} limit`,
+        ];
+      } else if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          const item = value[i];
+          const itemPath = `${path}[${i}]`;
+          if (item instanceof File && item.size > limit) {
+            (errors[itemPath] ??= []).push(
+              `File "${item.name}" (${formatSize(item.size)}) exceeds the ${limitLabel} limit`
+            );
+          } else if (typeof item === 'object' && item !== null && !(item instanceof File)) {
+            walk(item as Record<string, unknown>, itemPath);
+          }
+        }
+      } else if (typeof value === 'object' && value !== null && !(value instanceof File)) {
+        walk(value as Record<string, unknown>, path);
       }
     }
   }
 
+  walk(input, '');
   return Object.keys(errors).length > 0 ? errors : null;
 }
 
@@ -545,7 +557,13 @@ function stripFiles(value: unknown): Record<string, unknown> | undefined {
   for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
     if (v instanceof File) continue;
     if (Array.isArray(v)) {
-      result[k] = v.filter((item) => !(item instanceof File));
+      result[k] = v
+        .filter((item) => !(item instanceof File))
+        .map((item) =>
+          typeof item === 'object' && item !== null && !(item instanceof File)
+            ? (stripFiles(item) ?? {})
+            : item
+        );
     } else if (typeof v === 'object' && v !== null && !(v instanceof File)) {
       result[k] = stripFiles(v) ?? {};
     } else {

package/src/server/actions.ts

@@ -15,7 +15,7 @@
  */
 
 import { getCacheHandler } from '../cache/handler-store';
-import { RedirectSignal } from './primitives';
+import { DenySignal, RedirectSignal } from './primitives';
 import { withSpan } from './tracing';
 import { revalidationAls, type RevalidationState } from './als-registry.js';
 
@@ -178,11 +178,28 @@ export async function executeAction(
       revalidation = await config.renderer(path);
     } catch (renderError) {
       if (renderError instanceof RedirectSignal) {
-        // Revalidation triggered a redirect (e.g., session expired)
+        // Revalidation triggered a redirect (e.g., session expired,
+        // middleware on the target path called `redirect()`).
         redirectTo = renderError.location;
         redirectStatus = renderError.status;
+      } else if (renderError instanceof DenySignal) {
+        // Target path's middleware/access denied this user.
+        //
+        // Dropping the revalidation here is the security boundary added
+        // in TIM-996: without this branch, a DenySignal would fall into
+        // the `console.error` path AND the element tree would have
+        // already been built and serialized — leaking a privileged RSC
+        // payload to the action submitter. By the time the signal
+        // surfaces, the renderer has thrown BEFORE building the tree,
+        // so we simply drop `revalidation` and ship the action result
+        // alone. The action itself still succeeded.
+        console.error(
+          `[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`
+        );
       } else {
-        // Log but don't fail the action — revalidation is best-effort
+        // Log but don't fail the action — revalidation is best-effort.
+        // Includes input-validation rejections from the renderer
+        // (e.g., revalidatePath('//evil.com/admin')).
         console.error('[timber] revalidatePath render failed:', renderError);
       }
     }

package/src/server/body-limits.ts

@@ -53,6 +53,9 @@ export function parseBodySize(size: string): number {
   }
 }
 
+/** Strict integer pattern: one or more digits, nothing else. */
+const STRICT_INTEGER_RE = /^\d+$/;
+
 /** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
 export function enforceBodyLimits(
   req: Request,
@@ -66,11 +69,16 @@ export function enforceBodyLimits(
     return { ok: false, status: 411 };
   }
 
-  const bodySize = Number.parseInt(contentLength, 10);
-  if (Number.isNaN(bodySize)) {
+  // Reject malformed values: multiple values ("100, 999999"), negative numbers,
+  // floats ("100.5"), or non-numeric strings. parseInt would silently parse
+  // the first number from "100, 999999" as 100, letting the real body through.
+  const trimmed = contentLength.trim();
+  if (!STRICT_INTEGER_RE.test(trimmed)) {
     return { ok: false, status: 411 };
   }
 
+  const bodySize = Number.parseInt(trimmed, 10);
+
   const limit = resolveLimit(kind, config);
   return bodySize <= limit ? { ok: true } : { ok: false, status: 413 };
 }

package/src/server/cookie-context.ts

@@ -14,7 +14,11 @@
 
 import { requestContextAls, type RequestContextStore } from './als-registry.js';
 import { isDebug } from './debug.js';
-import { assertValidCookieName, assertValidCookieValue } from '../cookies/validation.js';
+import {
+  assertValidCookieName,
+  assertValidCookieValue,
+  assertValidCookieOptions,
+} from '../cookies/validation.js';
 import {
   parseCookieHeader,
   parseSetCookie,
@@ -27,7 +31,7 @@ import {
 // `getCookies()`. The pure shared module lives in `cookies/validation.ts`
 // so the client `useCookie` hook can use the same checks without pulling
 // in the server ALS code.
-export { assertValidCookieName, assertValidCookieValue };
+export { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions };
 
 // ─── Public API ───────────────────────────────────────────────────────────
 
@@ -137,6 +141,7 @@ export function getCookieJar(): RequestCookies {
       const { raw: _raw, ...attributeOptions } = options ?? {};
       void _raw;
       const opts = { ...DEFAULT_COOKIE_OPTIONS, ...attributeOptions };
+      assertValidCookieOptions(opts);
       store.cookieJar.set(name, { name, value: wireValue, options: opts });
       // Read-your-own-writes: store the DECODED logical value so that
       // subsequent `cookies().get(name)` in the same request returns

package/src/server/cookie-parsing.ts

@@ -33,7 +33,7 @@ export function parseCookieHeader(header: string): Map<string, string> {
     if (eqIndex === -1) continue;
     const name = pair.slice(0, eqIndex).trim();
     const value = pair.slice(eqIndex + 1).trim();
-    if (name) {
+    if (name && !map.has(name)) {
       map.set(name, safeDecodeCookieValue(value));
     }
   }

package/src/server/csrf.ts

@@ -28,12 +28,36 @@ const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
 // ─── Implementation ───────────────────────────────────────────────────────
 
 /**
- * Validate the Origin header against the request's Host.
+ * Derive the request's scheme from trusted sources.
+ *
+ * Priority:
+ * 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
+ * 2. Request URL protocol
+ *
+ * Falls back to 'https' (fail closed) if neither is available.
+ */
+function deriveRequestScheme(req: Request): string {
+  const forwarded = req.headers.get('X-Forwarded-Proto');
+  if (forwarded) {
+    const proto = forwarded.split(',')[0].trim().toLowerCase();
+    if (proto === 'http' || proto === 'https') return proto;
+  }
+
+  try {
+    return new URL(req.url).protocol.replace(':', '');
+  } catch {
+    return 'https';
+  }
+}
+
+/**
+ * Validate the Origin header against the request's full origin
+ * (scheme + host + port).
  *
  * For mutation methods (POST, PUT, PATCH, DELETE):
  * - If `csrf: false`, skip validation.
  * - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
- * - Otherwise, Origin's host must match the request's Host header.
+ * - Otherwise, Origin must match the derived request origin.
  *
  * Safe methods (GET, HEAD, OPTIONS) always pass.
  */
@@ -67,13 +91,22 @@ export function validateCsrf(req: Request, config: CsrfConfig): CsrfResult {
     return { ok: false, status: 403 };
   }
 
-  // Extract hostname from Origin URL and compare to Host header
-  let originHost: string;
+  // Compare full origins (scheme + host + port) using URL.origin for
+  // canonical port normalization (e.g. https://x:443 → https://x).
+  let originOrigin: string;
+  try {
+    originOrigin = new URL(origin).origin;
+  } catch {
+    return { ok: false, status: 403 };
+  }
+
+  const scheme = deriveRequestScheme(req);
+  let expectedOrigin: string;
   try {
-    originHost = new URL(origin).host;
+    expectedOrigin = new URL(`${scheme}://${host}`).origin;
   } catch {
     return { ok: false, status: 403 };
   }
 
-  return originHost === host ? { ok: true } : { ok: false, status: 403 };
+  return originOrigin === expectedOrigin ? { ok: true } : { ok: false, status: 403 };
 }

package/src/server/html-injector-core.ts

@@ -309,7 +309,7 @@ export class FlightInjectorCore {
     errorSignal?: AbortSignal
   ) {
     this.rscReader = rscStream.getReader();
-    this.timeoutMs = renderTimeoutMs ?? 30_000;
+    this.timeoutMs = (renderTimeoutMs ?? 30_000) || 120_000;
     this.errorSignal = errorSignal;
     this.machine = createMachine<FlightInjectionState, FlightInjectionEvent>({
       initial: { phase: 'init' },
@@ -373,10 +373,11 @@ export class FlightInjectorCore {
         // Guard each read with a timeout so a permanently hung RSC stream
         // eventually aborts. See design/02 §"Streaming Constraints".
         const readPromise = this.rscReader.read();
-        const { done, value } =
-          this.timeoutMs > 0
-            ? await withTimeout(readPromise, this.timeoutMs, 'RSC stream read timed out')
-            : await readPromise;
+        const { done, value } = await withTimeout(
+          readPromise,
+          this.timeoutMs,
+          'RSC stream read timed out'
+        );
 
         if (done) {
           this.machine.send({ type: 'PULL_DONE' });

package/src/server/html-injectors.ts

@@ -201,16 +201,19 @@ export function createInlinedRscStream(
 ): ReadableStream<Uint8Array> {
   const rscReader = rscStream.getReader();
   const decoder = new TextDecoder('utf-8', { fatal: true });
-  const timeoutMs = renderTimeoutMs ?? 30_000;
+  // When renderTimeoutMs is 0 ("disabled"), enforce a safety ceiling
+  // so a stalled RSC stream can't hang the connection forever.
+  const timeoutMs = (renderTimeoutMs ?? 30_000) || 120_000;
 
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       try {
         const readPromise = rscReader.read();
-        const { done, value } =
-          timeoutMs > 0
-            ? await withTimeout(readPromise, timeoutMs, 'RSC stream read timed out')
-            : await readPromise;
+        const { done, value } = await withTimeout(
+          readPromise,
+          timeoutMs,
+          'RSC stream read timed out'
+        );
         if (done) {
           controller.close();
           return;

package/src/server/pipeline.ts

@@ -338,17 +338,26 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
               // separately for the same URL. Without this, a shared cache may
               // serve an RSC Flight payload to a browser expecting HTML (or
               // vice versa). See GHSA-wfc6-r584-vfw7, design/13-security.md.
+              //
+              // Vary: X-Timber-URL — intercepting route responses depend on
+              // the source URL, so caches must store them separately.
+              const varyTokens = ['Accept'];
+              if (config.interceptionRewrites?.length) {
+                varyTokens.push('X-Timber-URL');
+              }
               const existingVary = result.headers.get('Vary');
-              if (!existingVary) {
-                result.headers.set('Vary', 'Accept');
-              } else {
-                const tokens = existingVary
-                  .toLowerCase()
-                  .split(',')
-                  .map((t) => t.trim());
-                if (!tokens.includes('accept')) {
-                  result.headers.set('Vary', `${existingVary}, Accept`);
-                }
+              const existingTokens = existingVary
+                ? existingVary
+                    .toLowerCase()
+                    .split(',')
+                    .map((t) => t.trim())
+                : [];
+              const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
+              if (newTokens.length > 0) {
+                result.headers.set(
+                  'Vary',
+                  existingVary ? `${existingVary}, ${newTokens.join(', ')}` : newTokens.join(', ')
+                );
               }
 
               // Append Server-Timing header based on configured mode.

package/src/server/primitives.ts

@@ -240,6 +240,9 @@ export class RedirectSignal extends Error {
 /** Pattern matching absolute URLs: http(s):// or protocol-relative // */
 const ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
 
+// eslint-disable-next-line no-control-regex -- must match all C0 controls to prevent bypass
+const REDIRECT_CONTROL_CHARS_RE = /[\x00-\x1f]/g;
+
 /**
  * Options for redirect() — alternative to passing a bare status code.
  */
@@ -300,7 +303,14 @@ export function redirect(path: string, statusOrOptions?: number | RedirectOption
   if (status < 300 || status > 399) {
     throw new Error(`redirect() requires a 3xx status code, got ${status}.`);
   }
-  if (ABSOLUTE_URL_RE.test(path)) {
+  // Strip C0 control characters and trim whitespace before checking — browsers
+  // do this during URL resolution, so " \thttp://evil.com" resolves as absolute.
+  // Normalize for validation only: strip C0 controls, trim, then replace backslashes
+  // with forward slashes. Browsers normalize \ → / during URL resolution, so
+  // "/\evil.com" becomes "//evil.com" (protocol-relative open redirect).
+  const cleaned = path.replace(REDIRECT_CONTROL_CHARS_RE, '').trimStart().replaceAll('\\', '/');
+
+  if (ABSOLUTE_URL_RE.test(cleaned)) {
     throw new Error(
       `redirect() only accepts relative URLs. Got absolute URL: "${path}". ` +
         'Use redirectExternal(url, allowList) for external redirects.'

package/src/server/route-element-builder.ts

@@ -67,10 +67,12 @@ function replaceOutermostSegmentOutlet(
   const props = element.props as Record<string, unknown>;
   if (element.type === AccessGate && props.children) {
     const inner = replaceOutermostSegmentOutlet(props.children as React.ReactElement, replacement);
+    /* eslint-disable react/no-children-prop -- createElement API */
     return createElement(element.type as React.FunctionComponent<Record<string, unknown>>, {
       ...props,
       children: inner,
     });
+    /* eslint-enable react/no-children-prop */
   }
   return element;
 }

package/src/server/rsc-entry/error-renderer.ts

@@ -152,10 +152,11 @@ function getLayoutsForErrorFile(
  */
 function toSerializableError(error: unknown): SerializableError {
   const err = error instanceof Error ? error : new Error(String(error));
+  const devMode = isDevMode();
   return {
-    message: err.message,
-    name: err.name,
-    ...(isDevMode() && err.stack ? { stack: err.stack } : {}),
+    message: devMode ? err.message : 'An unexpected error occurred.',
+    name: devMode ? err.name : 'Error',
+    ...(devMode && err.stack ? { stack: err.stack } : {}),
   };
 }