@timber-js/app 0.2.0-alpha.207 → 0.2.0-alpha.209

package/src/server/action-handler.ts

@@ -20,12 +20,13 @@ import {
   renderToReadableStream,
 } from '../rsc-runtime/rsc.ts';
 
-import { validateCsrf, type CsrfConfig } from './csrf.ts';
-import { isDenySignal, isRedirectSignal } from './primitives.ts';
+import { validateCsrf, csrfRejectionResponse, type CsrfConfig } from './csrf.ts';
+import { isDenySignal, isRedirectSignal } from './signal-identity.ts';
 import { executeAction, type RevalidateRenderer } from './actions.ts';
 import { runWithRequestContext, setMutableCookieContext } from './request-context.ts';
+import { runOutsideReactCacheScope, runWithReactCacheScope } from './react-cache-scope.ts';
 import { getSetCookieHeaders, getCookiesForSsr } from './cookie-context.ts';
-import { handleActionError } from './action-client.ts';
+import { ActionError, handleActionError } from './action-client.ts';
 import { enforceBodyLimits, enforceFieldLimit, type BodyLimitsConfig } from './body-limits.ts';
 import { parseFormData } from './form-data.ts';
 import {
@@ -36,8 +37,9 @@ import {
 } from './sensitive-fields.ts';
 import type { FormFlashData } from './form-flash.ts';
 import { checkVersionSkew, applyReloadHeaders } from './version-skew.ts';
-import { logActionError } from './logger.ts';
-import { withTimeout, RenderTimeoutError } from './render-timeout.ts';
+import { logActionError, swallow } from './logger.ts';
+import { fireOnRequestError } from './pipeline-helpers.ts';
+import { withTimeout, RenderTimeoutError, DEFAULT_RENDER_TIMEOUT_MS } from './render-timeout.ts';
 import { canonicalize } from './canonicalize.ts';
 import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
@@ -105,10 +107,11 @@ export function isActionRequest(req: Request): boolean {
  *
  *   - `cookies`: the post-action read-your-own-writes view of the cookie
  *     jar, as the same `Map<string, string>` shape used by the request
- *     context's `parsedCookies`. The rerender dispatcher seeds this map
- *     directly into the rerender request context via `seedRequestCookies`,
- *     bypassing any string round-trip through a `Cookie:` header. The
- *     direct-Map seed eliminates the value-smuggling primitive that the
+ *     context's `parsedCookies`. The rerender dispatcher passes this map to
+ *     the pipeline's re-entry, which makes it the rerender request
+ *     context's cookies, bypassing any string round-trip through a
+ *     `Cookie:` header. The
+ *     direct Map eliminates the value-smuggling primitive that the
  *     previous `cookieHeader: string` shape carried — see
  *     ONGOING_SECURITY.md H-3 (TIM-868) and TIM-837.
  */
@@ -152,7 +155,7 @@ export async function handleActionRequest(
   // future entry point that bypasses the wrapper. See LOCAL-773.
   const csrfResult = validateCsrf(req, config.csrf);
   if (!csrfResult.ok) {
-    return new Response(null, { status: csrfResult.status });
+    return csrfRejectionResponse(req, csrfResult);
   }
 
   // Body size limits — reject oversized requests before parsing.
@@ -167,47 +170,174 @@ export async function handleActionRequest(
 
   // Run inside request context so getHeaders(), getCookies() work in actions.
   // Actions are a mutable context — they can set cookies (design/29-cookies.md).
-  return runWithRequestContext(req, async () => {
-    setMutableCookieContext(true);
-    const actionId = req.headers.get('x-rsc-action');
-
-    let result: Response | FormRerender | null;
-    if (actionId) {
-      // With-JS path: client sent action ID in header, args in body
-      result = await handleRscAction(req, actionId, config);
-    } else {
-      // No-JS path: form POST with React's hidden action fields
-      result = await handleFormAction(req, config);
-    }
+  //
+  // ...and outside any React.cache scope: dispatch runs inside the pipeline's
+  // request scope (after proxy.ts), and runWithRequestContext would open
+  // another. An action reads, writes cookies, and mutates, so a memoized read
+  // would go stale mid-action — React.cache in an action does not dedupe,
+  // same as stock React and Next.js (TIM-1529 D2). The revalidation render
+  // below re-enters its own fresh scope explicitly.
+  return runWithRequestContext(req, () =>
+    runOutsideReactCacheScope(async () => {
+      setMutableCookieContext(true);
+      const actionId = req.headers.get('x-rsc-action');
+
+      let result: Response | FormRerender | null;
+      if (actionId) {
+        // With-JS path: client sent action ID in header, args in body
+        result = await handleRscAction(req, actionId, config);
+      } else {
+        // No-JS path: form POST with React's hidden action fields
+        result = await handleFormAction(req, config);
+      }
 
-    // Apply cookie jar to action responses.
-    //
-    // For Response results we append Set-Cookie directly. For FormRerender
-    // signals we snapshot the headers here, before this ALS scope exits, so
-    // the caller can apply them to the rerender pipeline's response (which
-    // runs in its own request-context scope with a fresh cookie jar).
-    // See LOCAL-740 — without this snapshot, cookies set inside a no-JS
-    // form action that returns validation errors are silently dropped.
-    if (result instanceof Response) {
-      for (const value of getSetCookieHeaders()) {
-        result.headers.append('Set-Cookie', value);
+      // Apply cookie jar to action responses.
+      //
+      // For Response results we append Set-Cookie directly. For FormRerender
+      // signals we snapshot the headers here, before this ALS scope exits, so
+      // the caller can apply them to the rerender pipeline's response (which
+      // runs in its own request-context scope with a fresh cookie jar).
+      // See LOCAL-740 — without this snapshot, cookies set inside a no-JS
+      // form action that returns validation errors are silently dropped.
+      if (result instanceof Response) {
+        for (const value of getSetCookieHeaders()) {
+          result.headers.append('Set-Cookie', value);
+        }
+      } else if (result && 'rerender' in result) {
+        result.setCookieHeaders = getSetCookieHeaders();
+        // Snapshot the post-action RYW cookie state as a Map so the rerender
+        // dispatcher can hand it to the rerender request context directly,
+        // with no string round-trip. See TIM-837
+        // and ONGOING_SECURITY.md H-3 (TIM-868). `getCookiesForSsr` already
+        // returns a defensive copy, so the rerender scope cannot mutate the
+        // snapshot through this reference.
+        result.cookies = getCookiesForSsr();
       }
-    } else if (result && 'rerender' in result) {
-      result.setCookieHeaders = getSetCookieHeaders();
-      // Snapshot the post-action RYW cookie state as a Map so the rerender
-      // dispatcher can seed it directly into the rerender request context
-      // via `seedRequestCookies`, with no string round-trip. See TIM-837
-      // and ONGOING_SECURITY.md H-3 (TIM-868). `getCookiesForSsr` already
-      // returns a defensive copy, so the rerender scope cannot mutate the
-      // snapshot through this reference.
-      result.cookies = getCookiesForSsr();
-    }
-    return result;
-  });
+      return result;
+    })
+  );
 }
 
 // ─── With-JS Action ───────────────────────────────────────────────────────
 
+/**
+ * Log an action error and report it to `onRequestError` as phase
+ * `'action'`. An `ActionError` is not reported: it is an outcome the
+ * action chose to return, not an unhandled error.
+ */
+async function reportActionError(req: Request, error: unknown): Promise<void> {
+  logActionError({ method: req.method, path: new URL(req.url).pathname, error });
+  if (error instanceof ActionError) return;
+  await fireOnRequestError(error, req, 'action');
+}
+
+/**
+ * Report errors the action survived after its body returned — from
+ * `executeAction`'s revalidation, or from serializing the revalidated tree.
+ * Each is logged where it was caught; this is its one `onRequestError`
+ * report, as phase `'action'`. Errors that are not reportable (a
+ * signal a revalidated page threw, an abort) and anything
+ * after the request aborted are skipped by the same rule as a page render.
+ */
+async function reportRevalidationErrors(req: Request, errors: readonly unknown[]): Promise<void> {
+  for (const error of errors) {
+    await fireOnRequestError(error, req, 'action').catch((hookError: unknown) =>
+      swallow(hookError, 'onRequestError could not be called')
+    );
+  }
+}
+
+/**
+ * Answer an action request that failed before the action ran with a bare
+ * status, never a 200 action-error payload: a fabricated action id must not
+ * look like an action that ran (tests/e2e/security.test.ts). Either way it
+ * is logged and reported to `onRequestError` as phase `'action'` (TIM-1537).
+ *
+ * The status is chosen by what failed, not by matching error messages:
+ * - **400**: the request is wrong in a way the handler can see for itself.
+ *   The body will not parse or decode, or the reference resolves to
+ *   something that is not a function.
+ * - **500**: loading the action module failed. plugin-rsc rejects the same
+ *   way for an unknown reference and for a real module that fails to import
+ *   or evaluate, and the second is a server fault, so the load failure keeps
+ *   the 5xx it had before this change. The no-JS path cannot make this
+ *   split (`decodeAction` decodes and loads in one call) and answers 400;
+ *   see `handleFormAction`.
+ */
+async function rejectActionRequest(
+  req: Request,
+  error: unknown,
+  status: 400 | 500
+): Promise<Response> {
+  await reportActionError(req, error);
+  return new Response(null, { status });
+}
+
+/**
+ * The no-JS answer to an action error: re-render the page with the error as
+ * flash data. `handleActionError` produces `{ serverError }` for an
+ * ActionError and `{ serverError: { code: 'INTERNAL_ERROR' } }` otherwise.
+ */
+function errorRerender(error: unknown, submittedValues: Record<string, unknown>): FormRerender {
+  return {
+    rerender: { ...handleActionError(error), submittedValues },
+    // Filled in by handleActionRequest before the ALS scope exits.
+    setCookieHeaders: [],
+    cookies: new Map(),
+  };
+}
+
+/**
+ * Load the action by reference ID and decode its args from the request body
+ * (RSC wire format). Returns a Response for a request that fails before the
+ * action can run: see `rejectActionRequest` for the status, and the field
+ * limit for its own.
+ */
+async function decodeRscActionCall(
+  req: Request,
+  actionId: string,
+  config: ActionDispatchConfig
+): Promise<{ actionFn: (...args: unknown[]) => Promise<unknown>; args: unknown[] } | Response> {
+  let loaded: unknown;
+  try {
+    loaded = await loadServerAction(actionId);
+  } catch (error) {
+    return rejectActionRequest(req, error, 500);
+  }
+  if (typeof loaded !== 'function') {
+    // The module loaded but has no such export: a reference the client made up.
+    return rejectActionRequest(req, new Error(`Unknown server action "${actionId}"`), 400);
+  }
+  const actionFn = loaded as (...args: unknown[]) => Promise<unknown>;
+
+  let decoded: unknown;
+  try {
+    const contentType = req.headers.get('Content-Type') ?? '';
+    if (contentType.includes('multipart/form-data')) {
+      // FormData-based args (file uploads, etc.)
+      const formData = await req.formData();
+      // Enforce field count limit after parsing FormData.
+      const fieldResult = enforceFieldLimit(formData, config.bodyLimits ?? {});
+      if (!fieldResult.ok) {
+        return new Response(null, { status: fieldResult.status });
+      }
+      decoded = await decodeReply(formData);
+    } else {
+      // Text-based args
+      decoded = await decodeReply(await req.text());
+    }
+  } catch (error) {
+    return rejectActionRequest(req, error, 400);
+  }
+  // The client always encodes an argument list. Anything else would fail
+  // when `executeAction` spreads it, inside the action's own catch, and
+  // come back as a 200 INTERNAL_ERROR for what is the caller's mistake.
+  if (!Array.isArray(decoded)) {
+    return rejectActionRequest(req, new Error('Server action body is not an argument list'), 400);
+  }
+  return { actionFn, args: decoded };
+}
+
 /**
  * Handle an RSC action request (JavaScript enabled).
  *
@@ -219,27 +349,10 @@ async function handleRscAction(
   actionId: string,
   config: ActionDispatchConfig
 ): Promise<Response> {
-  // Load the server action function by reference ID
-  const actionFn = (await loadServerAction(actionId)) as (...args: unknown[]) => Promise<unknown>;
-
-  // Decode the args from the request body (RSC wire format)
-  const contentType = req.headers.get('Content-Type') ?? '';
-  let args: unknown[];
-
-  if (contentType.includes('multipart/form-data')) {
-    // FormData-based args (file uploads, etc.)
-    const formData = await req.formData();
-    // Enforce field count limit after parsing FormData.
-    const fieldResult = enforceFieldLimit(formData, config.bodyLimits ?? {});
-    if (!fieldResult.ok) {
-      return new Response(null, { status: fieldResult.status });
-    }
-    args = (await decodeReply(formData)) as unknown[];
-  } else {
-    // Text-based args
-    const body = await req.text();
-    args = (await decodeReply(body)) as unknown[];
-  }
+  // A request that fails before the action runs is answered here, not a
+  // rejection that escapes into the pipeline (TIM-1537).
+  const call = await decodeRscActionCall(req, actionId, config);
+  if (call instanceof Response) return call;
 
   // Execute the action with revalidation tracking.
   // Errors are caught here so raw 'use server' functions (not using
@@ -251,14 +364,13 @@ async function handleRscAction(
     // Canonicalize the request pathname so it matches the decoded form
     // that revalidationPathMatches uses on the target side.
     const canonical = canonicalize(requestUrl.pathname, true);
-    result = await executeAction(actionFn, args, {
+    result = await executeAction(call.actionFn, call.args, {
       renderer: config.revalidateRenderer,
       requestPathname: canonical.ok ? canonical.pathname : requestUrl.pathname,
       requestSearch: requestUrl.search,
     });
   } catch (error) {
-    // Log full error server-side for debugging
-    logActionError({ method: req.method, path: new URL(req.url).pathname, error });
+    await reportActionError(req, error);
 
     // Return structured error response — ActionError gets its code/data,
     // unexpected errors get sanitized { code: 'INTERNAL_ERROR' }
@@ -269,6 +381,9 @@ async function handleRscAction(
       headers: { 'Content-Type': RSC_CONTENT_TYPE },
     });
   }
+  // Outside the try: the action succeeded, and a failure to report its
+  // revalidation must not turn it into an action error.
+  await reportRevalidationErrors(req, result.revalidationErrors);
 
   // Handle redirect — encode in RSC stream for client-side SPA navigation.
   // The client detects X-Timber-Redirect and calls router.navigate() instead
@@ -322,31 +437,46 @@ async function handleRscAction(
       | { kind: 'redirect'; location: string; status: number }
       | { kind: 'error' }
       | undefined;
-    const rscStream = renderToReadableStream(revalidationPayload, {
-      signal: req.signal,
-      onError(error: unknown) {
-        // ??= keeps the first signal (shallowest AccessGate in top-down render).
-        if (isDenySignal(error)) {
-          serializationSignal ??= { kind: 'deny', status: error.status };
-        } else if (isRedirectSignal(error)) {
-          serializationSignal ??= {
-            kind: 'redirect',
-            location: error.location,
-            status: error.status,
-          };
-        } else {
-          console.error('[timber] revalidation serialization error:', error);
-          serializationSignal ??= { kind: 'error' };
-        }
-      },
-    });
+    const serializationErrors: unknown[] = [];
+    //
+    // Rendered in the scope the revalidation middleware ran in, not this
+    // request context's: the action body read through that one before it
+    // mutated, and the revalidated tree must see post-mutation values
+    // (TIM-1529).
+    const rscStream = runWithReactCacheScope(
+      () =>
+        renderToReadableStream(revalidationPayload, {
+          signal: req.signal,
+          onError(error: unknown) {
+            // ??= keeps the first signal (shallowest AccessGate in top-down render).
+            if (isDenySignal(error)) {
+              serializationSignal ??= { kind: 'deny', status: error.status };
+            } else if (isRedirectSignal(error)) {
+              serializationSignal ??= {
+                kind: 'redirect',
+                location: error.location,
+                status: error.status,
+              };
+            } else {
+              console.error('[timber] revalidation serialization error:', error);
+              serializationErrors.push(error);
+              serializationSignal ??= { kind: 'error' };
+            }
+          },
+        }),
+      result.revalidation.reactCacheScope
+    );
 
     // Drain the stream to detect any signals before committing the response.
     // Timeout-guarded: the element tree may contain async server components
     // with stalled fetches. 30s matches the default renderTimeoutMs.
+    // Not readAllBytesWithDeadline: this timeout is per read, not one
+    // overall deadline; the loop stops at the first chunk after onError
+    // records a signal (the payload is dropped then); and the catch below
+    // branches on RenderTimeoutError, which the helper does not throw.
     const reader = rscStream.getReader();
     const chunks: Uint8Array[] = [];
-    const drainTimeoutMs = 30_000;
+    const drainTimeoutMs = DEFAULT_RENDER_TIMEOUT_MS;
     try {
       for (;;) {
         const { done, value } = await withTimeout(
@@ -365,12 +495,17 @@ async function handleRscAction(
       reader.cancel().catch(() => {});
       if (drainError instanceof RenderTimeoutError) {
         console.error('[timber] revalidatePath dropped — stream drain timed out');
+        // A revalidated tree that never finished rendering is a failure,
+        // even though the action result still ships.
+        await reportRevalidationErrors(req, [...serializationErrors, drainError]);
         const fallbackStream = renderToReadableStream(result.actionResult);
         return new Response(fallbackStream, { status: 200, headers });
       }
+      await reportRevalidationErrors(req, serializationErrors);
       throw drainError;
     }
 
+    await reportRevalidationErrors(req, serializationErrors);
     if (serializationSignal) {
       if (serializationSignal.kind === 'redirect') {
         const redirectPayload = {
@@ -399,7 +534,10 @@ async function handleRscAction(
     // Clean serialization — return the buffered bytes with revalidation header.
     headers['X-Timber-Revalidation'] = '1';
     const buffered = concatUint8Arrays(chunks);
-    return new Response(buffered.buffer as ArrayBuffer, { status: 200, headers });
+    return new Response(buffered.buffer as ArrayBuffer, {
+      status: 200,
+      headers,
+    });
   }
 
   const rscStream = renderToReadableStream(result.actionResult);
@@ -440,7 +578,13 @@ async function handleFormAction(
   // Clone before consuming — if this turns out not to be a server action form,
   // we return null and the original request body must remain readable for
   // downstream route handlers. Clone is cheap (shares the body buffer until read).
-  const formData = await req.clone().formData();
+  // A body that will not parse is a bad request (TIM-1537).
+  let formData: FormData;
+  try {
+    formData = await req.clone().formData();
+  } catch (error) {
+    return rejectActionRequest(req, error, 400);
+  }
 
   // Enforce field count limit after parsing FormData.
   const fieldResult = enforceFieldLimit(formData, config.bodyLimits ?? {});
@@ -461,37 +605,36 @@ async function handleFormAction(
   // decodeAction resolves the action function from the form data's hidden fields.
   // Returns null when no $ACTION_REF_/$ACTION_ID_ fields are present — meaning
   // this is a regular form POST, not a React server action.
-  const actionFn = (await decodeAction(formData)) as
-    | ((...args: unknown[]) => Promise<unknown>)
-    | null;
+  // Execute the action — no additional args needed (form data is already bound).
+  // Errors are caught to prevent stack traces from leaking in the response.
+  let actionFn: ((...args: unknown[]) => Promise<unknown>) | null;
+  try {
+    actionFn = (await decodeAction(formData)) as ((...args: unknown[]) => Promise<unknown>) | null;
+  } catch (error) {
+    // decodeAction both decodes the form's `$ACTION_REF_` metadata and loads
+    // the module, and React does not say which failed. On a no-JS POST that
+    // metadata is written by React into the form, so a failure is almost
+    // always a forged or truncated request: 400. A module that genuinely
+    // fails to import also breaks the RSC render of the page holding the
+    // form, which surfaces it as a 500 there.
+    return rejectActionRequest(req, error, 400);
+  }
   if (!actionFn) {
     return null;
   }
 
-  // Execute the action — no additional args needed (form data is already bound).
-  // Errors are caught to prevent stack traces from leaking in the response.
   let result;
   try {
     result = await executeAction(actionFn, [], {
       renderer: config.revalidateRenderer,
     });
   } catch (error) {
-    logActionError({ method: req.method, path: new URL(req.url).pathname, error });
-
-    // Return the error as flash data for re-render.
-    // handleActionError produces { serverError } for ActionErrors
-    // and { serverError: { code: 'INTERNAL_ERROR' } } for unexpected errors.
-    const errorResult = handleActionError(error);
-    return {
-      rerender: {
-        ...errorResult,
-        submittedValues,
-      },
-      // Filled in by handleActionRequest before the ALS scope exits.
-      setCookieHeaders: [],
-      cookies: new Map(),
-    };
+    await reportActionError(req, error);
+    return errorRerender(error, submittedValues);
   }
+  // Outside the try: the action succeeded, and a failure to report its
+  // revalidation must not turn it into an action error.
+  await reportRevalidationErrors(req, result.revalidationErrors);
 
   // Handle redirect from the action (e.g. redirect() called in the action body)
   if (result.redirectTo) {