@timber-js/app 0.2.0-alpha.167 → 0.2.0-alpha.169

package/src/server/pipeline.ts

@@ -238,6 +238,29 @@ export interface PipelineConfig {
      */
     match?: RouteMatch
   ) => Response | Promise<Response>;
+
+  /**
+   * Server action dispatch — called after proxy.ts runs for POST requests
+   * that look like server actions. Returns a Response if the request was
+   * handled as an action, or null to fall through to normal routing.
+   *
+   * `canonicalPath` is the already-decoded canonical pathname — the same
+   * value that `handleRequest` and `matchRoute` use. Do NOT re-derive it
+   * from `req.url` (which re-encodes).
+   *
+   * The `reenter` parameter is the full pipeline function (including proxy,
+   * ALS, tracing) for the no-JS validation rerender path — the synthetic
+   * GET flows through the complete pipeline.
+   *
+   * Moved into the pipeline (TIM-1213) so proxy.ts runs on action POSTs,
+   * matching the design doc contract: "proxy.ts runs on every request,
+   * no exclusions."
+   */
+  dispatchAction?: (
+    req: Request,
+    canonicalPath: string,
+    reenter: (req: Request) => Promise<Response>
+  ) => Promise<Response | null>;
 }
 
 // ─── Pipeline ──────────────────────────────────────────────────────────────
@@ -265,7 +288,11 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
   // Logged with each request for diagnosing resource contention.
   let activeRequests = 0;
 
-  return async (req: Request): Promise<Response> => {
+  // Self-reference for re-entry — the no-JS validation rerender path
+  // passes a synthetic GET back through the full pipeline (including
+  // proxy, ALS, tracing). The inner closure captures `pipelineFn` by
+  // name; by the time it's invoked, the const binding is initialized.
+  const pipelineFn = async (req: Request): Promise<Response> => {
     const url = new URL(req.url);
     const method = req.method;
     const path = url.pathname;
@@ -325,6 +352,24 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                 canonicalReq = new Request(canonicalUrl.toString(), req);
               }
 
+              // Build the inner handler — runs after proxy, before route
+              // matching. Checks for server action POSTs and dispatches them
+              // without entering the route match → middleware → render chain.
+              // Falls through to handleRequest for normal route handling.
+              // TIM-1213: action dispatch is now INSIDE the pipeline so
+              // proxy.ts runs on every request, including action POSTs.
+              const innerHandler = async (): Promise<Response> => {
+                if (config.dispatchAction) {
+                  const actionResult = await config.dispatchAction(
+                    canonicalReq,
+                    canonicalPath,
+                    pipelineFn
+                  );
+                  if (actionResult) return actionResult;
+                }
+                return handleRequest(config, canonicalReq, method, canonicalPath, true);
+              };
+
               let result: Response;
               if (proxyResolver) {
                 const outcome = await runProxyPhase(
@@ -332,7 +377,8 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                   proxyResolver,
                   canonicalReq,
                   method,
-                  canonicalPath
+                  canonicalPath,
+                  innerHandler
                 );
                 result = await outcomeToResponse(config, outcome, {
                   req: canonicalReq,
@@ -340,7 +386,7 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                   path: canonicalPath,
                 });
               } else {
-                result = await handleRequest(config, canonicalReq, method, canonicalPath, true);
+                result = await innerHandler();
               }
 
               // Set response status on the root span before it ends —
@@ -427,4 +473,6 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
       });
     });
   };
+
+  return pipelineFn;
 }

package/src/server/route-element-builder.ts

@@ -408,6 +408,7 @@ export async function buildRouteElement(
   // Skip OG auto-linking when the user already declared images in metadata.
   // See design/16-metadata.md §"Auto-Linking"
   const hasUserOgImage = Boolean(resolvedMetadata.openGraph?.images);
+  const hasUserTwitterImage = Boolean(resolvedMetadata.twitter?.images);
   const requestUrl = new URL(req.url);
   const requestPathname = requestUrl.pathname;
   // In dev mode, use the request origin so OG URLs resolve to localhost.
@@ -427,7 +428,7 @@ export async function buildRouteElement(
       if (!convention) continue;
       // Non-nestable routes only auto-link from root
       if (!convention.nestable && segment.urlPath !== '/') continue;
-      // Skip auto-linking if user already declared the image in metadata
+      // Skip auto-linking entirely if user declared openGraph.images (covers both og + twitter)
       if (convention.type === 'opengraph-image' && hasUserOgImage) continue;
       // Build the href using the actual request path (not the pattern with [param]).
       // For nestable routes, the metadata route sits under the same resolved path
@@ -450,6 +451,14 @@ export async function buildRouteElement(
         href = new URL(href, ogBase).toString();
       }
       for (const autoLink of getMetadataRouteAutoLink(convention.type, href)) {
+        // Skip auto-linked twitter:image when user declared twitter.images
+        if (
+          hasUserTwitterImage &&
+          autoLink.tag === 'meta' &&
+          'name' in autoLink &&
+          autoLink.name === 'twitter:image'
+        )
+          continue;
         if (autoLink.tag === 'link') {
           const attrs: Record<string, string> = { rel: autoLink.rel, href: autoLink.href };
           if (autoLink.type) attrs.type = autoLink.type;

package/src/server/rsc-entry/action-middleware-runner.ts

@@ -1,21 +1,21 @@
 /**
- * Middleware-on-actions runner — runs the matched route's `middleware.ts`
- * chain for an action POST inside its own `runWithRequestContext` scope
- * and returns a `MiddlewareOutcome` value the dispatcher can translate.
+ * Middleware runner for revalidation — runs a route's `middleware.ts`
+ * chain inside its own `runWithRequestContext` scope and returns a
+ * `MiddlewareOutcome` value the caller can translate.
  *
- * Lifted out of `wrap-action-dispatch.ts` (TIM-853) so the dispatcher
- * can be read top-to-bottom without scrolling past the chain runner. The
- * function is intentionally a free function (not a closure over deps)
- * so it can be unit-tested in isolation. It does not import virtual
- * modules and does not call into the action handler — it owns exactly
- * the "run middleware once" step and nothing else.
+ * Used by the revalidation renderer (TIM-996) to run the TARGET route's
+ * middleware before building the revalidated element tree, ensuring that
+ * `revalidatePath('/admin')` from a public action honors admin's auth.
  *
- * Failure modes are encoded as outcome variants rather than thrown so the
- * caller never has to wrap this in try/catch. The only thrown errors are
- * truly unexpected (programmer bugs) and propagate naturally.
+ * NOT used for action dispatch itself — per-segment middleware does not
+ * run on action POSTs (TIM-1134). Actions are dispatched by action ID,
+ * not route segment, so `proxy.ts` and `createActionClient({ middleware })`
+ * are the correct auth mechanisms.
  *
- * See TIM-871 for the full design rationale (closing the
- * CVE-2025-29927-class bug where actions silently bypass middleware).
+ * The function is intentionally a free function (not a closure over deps)
+ * so it can be unit-tested in isolation. Failure modes are encoded as
+ * outcome variants rather than thrown so the caller never has to wrap
+ * this in try/catch.
  */
 
 import { getCookiesForSsr, getSetCookieHeaders } from '../cookie-context.js';

package/src/server/rsc-entry/index.ts

@@ -43,7 +43,7 @@ import { loadCdnPurgeHandler } from 'virtual:timber-cache-handler';
 // @ts-expect-error — virtual module provided by timber-routing plugin
 import globalSchemaCodecs from 'virtual:timber-schema';
 
-import { wrapPipelineWithActionDispatch } from './wrap-action-dispatch.js';
+import { wrapPipelineWithActionDispatch, buildActionDispatcher } from './wrap-action-dispatch.js';
 import type { BodyLimitsConfig } from '../body-limits.js';
 import type { BuildManifest } from '../build-manifest.js';
 import { resolveLogMode } from '../../dev-tools/logger.js';
@@ -199,6 +199,8 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     | { disabled: boolean; enableHMRInDev: boolean }
     | undefined;
   const clientJsDisabled = clientJsConfig?.disabled ?? false;
+  const clientSegmentCache =
+    ((runtimeConfig as Record<string, unknown>).clientSegmentCache as boolean) ?? false;
   const clientBootstrap = buildClientScripts({
     ...runtimeConfig,
     clientJavascript: clientJsConfig ?? { disabled: false, enableHMRInDev: false },
@@ -295,6 +297,7 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
         {
           clientBootstrap,
           clientJsDisabled,
+          clientSegmentCache,
           rootSegment: manifest.root,
           buildManifest: typedBuildManifest,
           globalError: manifest.globalError,
@@ -386,19 +389,36 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     // and no user-authored sitemap exists at the app root.
     // See design/16-metadata.md §"Auto-generated Sitemap"
     autoSitemapHandler: createAutoSitemapHandler(manifest.root, runtimeConfig),
+
+    // Server action dispatch — runs after proxy.ts, before route matching
+    // (TIM-1213). Moved into the pipeline so proxy.ts runs on action POSTs,
+    // matching the design doc: "proxy.ts runs on every request, no exclusions."
+    // Per-segment `middleware.ts` does NOT run on action POSTs (TIM-1134).
+    dispatchAction: buildActionDispatcher({
+      csrfConfig: {
+        csrf: runtimeConfig.csrf,
+        allowedOrigins: (runtimeConfig as Record<string, unknown>).allowedOrigins as
+          | string[]
+          | undefined,
+      },
+      bodyLimits: (runtimeConfig as Record<string, unknown>).limits as BodyLimitsConfig['limits'],
+      sensitiveFields: formsConfig?.stripSensitiveFields,
+      matchRoute,
+      buildRevalidateRenderer: createRevalidateRendererFactory({
+        matchRoute,
+        coerceSegmentParams,
+        buildManifest: buildManifest as BuildManifest,
+      }),
+    }),
   };
 
   const pipeline = createPipeline(pipelineConfig);
 
-  // Wrap the pipeline to enforce CSRF at the request boundary and intercept
-  // server action requests. By default, the wrapper also runs the matched
-  // route's `middleware.ts` chain on action POSTs, so authentication, rate
-  // limiting, tenant isolation, and request-header injection apply to
-  // actions just like they do to page renders. See TIM-871 and
-  // design/08-forms-and-actions.md §"Middleware for Server Actions".
-  //
-  // CSRF validation lives in the wrapper (not inside the action handler) so
-  // it covers route.ts API handlers as well as server actions. See LOCAL-773.
+  // Wrap the pipeline to enforce CSRF at the request boundary.
+  // CSRF validation lives in the wrapper (not inside the pipeline) so it
+  // runs before proxy.ts and covers every unsafe-method request. Server
+  // action dispatch has moved into the pipeline (TIM-1213) so proxy.ts
+  // runs on action POSTs. See LOCAL-773.
   const csrfConfig = {
     csrf: runtimeConfig.csrf,
     allowedOrigins: (runtimeConfig as Record<string, unknown>).allowedOrigins as
@@ -406,38 +426,8 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
       | undefined,
   };
 
-  const actionsConfig = (runtimeConfig as Record<string, unknown>).actions as
-    | { runMiddleware?: boolean }
-    | undefined;
-
   const handler = wrapPipelineWithActionDispatch(pipeline, {
     csrfConfig,
-    bodyLimits: (runtimeConfig as Record<string, unknown>).limits as BodyLimitsConfig['limits'],
-    sensitiveFields: formsConfig?.stripSensitiveFields,
-    matchRoute,
-    coerceSegmentParams,
-    renderDenyFallback: pipelineConfig.renderDenyFallback,
-    runMiddleware: actionsConfig?.runMiddleware,
-    // Thread the pipeline's `stripTrailingSlash` setting into the wrapper
-    // so its canonicalization step (applied before `matchRoute` for
-    // action POSTs) matches the page pipeline exactly. Defaults to `true`
-    // both here and inside the wrapper.
-    stripTrailingSlash: pipelineConfig.stripTrailingSlash,
-    // Revalidation renderer — runs the target route's `middleware.ts`
-    // chain BEFORE building the element tree so a server action that
-    // revalidates a protected path honors that path's auth, tenant
-    // isolation, and request-header injection. Closes the silent-bypass
-    // bug where `revalidatePath('/admin')` from a public action would
-    // serialize the admin RSC tree without ever consulting admin's
-    // middleware. Also validates the user-supplied `path` as a local
-    // root-relative URL to reject `revalidatePath('//evil.com/admin')`
-    // and similar scheme/authority injections. See TIM-996 and
-    // design/08-forms-and-actions.md §"revalidatePath()".
-    buildRevalidateRenderer: createRevalidateRendererFactory({
-      matchRoute,
-      coerceSegmentParams,
-      buildManifest: buildManifest as BuildManifest,
-    }),
   });
 
   return { handler, pipelineConfig };

package/src/server/rsc-entry/render-route.ts

@@ -57,6 +57,7 @@ import { callSsr } from './ssr-bridge.js';
 export interface RenderRouteDeps {
   clientBootstrap: ClientBootstrapConfig;
   clientJsDisabled: boolean;
+  clientSegmentCache: boolean;
   rootSegment: ManifestSegmentNode;
   buildManifest: BuildManifest;
   globalError?: { load: () => Promise<unknown>; filePath: string };
@@ -95,7 +96,8 @@ export async function renderRoute(
   // skips re-rendering those layouts for a smaller, faster RSC payload.
   // Only used for RSC requests — HTML requests always get a full render.
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
-  const clientStateTree = isRscPayloadRequest(req) ? parseClientStateTree(req) : null;
+  const clientStateTree =
+    deps.clientSegmentCache && isRscPayloadRequest(req) ? parseClientStateTree(req) : null;
 
   // Build the React element tree — runs access checks eagerly to gate
   // metadata resolution (TIM-1027), then loads modules and resolves