@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.211

package/src/server/action-handler.ts

@@ -18,19 +18,30 @@ import {
   decodeReply,
   decodeAction,
   renderToReadableStream,
-} from '#/rsc-runtime/rsc.js';
-
-import { validateCsrf, type CsrfConfig } from './csrf.js';
-import { executeAction, type RevalidateRenderer } from './actions.js';
+} from '../rsc-runtime/rsc.ts';
+
+import { validateCsrf, csrfRejectionResponse, type CsrfConfig } from './csrf.ts';
+import { isDenySignal, isRedirectSignal } from './signal-identity.ts';
+import { executeAction, type RevalidateRenderer } from './actions.ts';
+import { runWithRequestContext, setMutableCookieContext } from './request-context.ts';
+import { runOutsideReactCacheScope, runWithReactCacheScope } from './react-cache-scope.ts';
+import { getSetCookieHeaders, getCookiesForSsr } from './cookie-context.ts';
+import { ActionError, handleActionError } from './action-client.ts';
+import { enforceBodyLimits, enforceFieldLimit, type BodyLimitsConfig } from './body-limits.ts';
+import { parseFormData } from './form-data.ts';
 import {
-  runWithRequestContext,
-  setMutableCookieContext,
-  getSetCookieHeaders,
-} from './request-context.js';
-import { handleActionError } from './action-client.js';
-import { enforceBodyLimits, enforceFieldLimit, type BodyLimitsConfig } from './body-limits.js';
-import { parseFormData } from './form-data.js';
-import type { FormFlashData } from './form-flash.js';
+  stripSensitiveFields,
+  resolveSensitivePredicate,
+  getGlobalSensitiveFieldsConfig,
+  type SensitiveFieldsOption,
+} from './sensitive-fields.ts';
+import type { FormFlashData } from './form-flash.ts';
+import { checkVersionSkew, applyReloadHeaders } from './version-skew.ts';
+import { logActionError, swallow } from './logger.ts';
+import { fireOnRequestError } from './pipeline-helpers.ts';
+import { withTimeout, RenderTimeoutError, DEFAULT_RENDER_TIMEOUT_MS } from './render-timeout.ts';
+import { canonicalize } from './canonicalize.ts';
+import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
 // ─── Types ────────────────────────────────────────────────────────────────
 
@@ -42,12 +53,14 @@ export interface ActionDispatchConfig {
   revalidateRenderer?: RevalidateRenderer;
   /** Body size limits (from timber.config.ts). */
   bodyLimits?: BodyLimitsConfig;
+  /**
+   * Override the sensitive-field deny-list for the no-JS form POST path.
+   * Defaults to the global `forms.stripSensitiveFields` from `timber.config.ts`.
+   * See `SensitiveFieldsOption` in `./sensitive-fields.ts` and TIM-816.
+   */
+  sensitiveFields?: SensitiveFieldsOption;
 }
 
-// ─── Constants ────────────────────────────────────────────────────────────
-
-const RSC_CONTENT_TYPE = 'text/x-component';
-
 // ─── Detection ────────────────────────────────────────────────────────────
 
 /**
@@ -57,6 +70,12 @@ const RSC_CONTENT_TYPE = 'text/x-component';
  * - With JS: POST with `x-rsc-action` header (client callServer dispatch)
  * - Without JS: POST with form data containing `$ACTION_REF` or `$ACTION_KEY`
  *   (React's progressive enhancement hidden fields)
+ *
+ * **Important:** This function returns true for ANY POST with a form
+ * Content-Type, including non-action POSTs to route.ts API handlers.
+ * The caller (rsc-entry/action-dispatcher.ts) MUST check the matched route type
+ * before entering the action path — route.ts matches skip action detection
+ * entirely so their body is not pre-parsed. See TIM-870.
  */
 export function isActionRequest(req: Request): boolean {
   if (req.method !== 'POST') return false;
@@ -75,9 +94,31 @@ export function isActionRequest(req: Request): boolean {
 
 // ─── Handler ──────────────────────────────────────────────────────────────
 
-/** Signal from handleFormAction to re-render the page with flash data instead of redirecting. */
+/**
+ * Signal from handleFormAction to re-render the page with flash data instead of redirecting.
+ *
+ * Carries two cookie-related snapshots taken before the action's ALS scope
+ * exits, so the rerender pipeline (which establishes its own fresh cookie
+ * jar from the original request) doesn't lose the action's mutations:
+ *
+ *   - `setCookieHeaders`: serialized Set-Cookie headers to append to the
+ *     final HTML response. Without this, cookies set inside the action are
+ *     silently dropped from the response. See TIM-836 (LOCAL-740).
+ *
+ *   - `cookies`: the post-action read-your-own-writes view of the cookie
+ *     jar, as the same `Map<string, string>` shape used by the request
+ *     context's `parsedCookies`. The rerender dispatcher passes this map to
+ *     the pipeline's re-entry, which makes it the rerender request
+ *     context's cookies, bypassing any string round-trip through a
+ *     `Cookie:` header. The
+ *     direct Map eliminates the value-smuggling primitive that the
+ *     previous `cookieHeader: string` shape carried — see
+ *     ONGOING_SECURITY.md H-3 (TIM-868) and TIM-837.
+ */
 export interface FormRerender {
   rerender: FormFlashData;
+  setCookieHeaders: string[];
+  cookies: Map<string, string>;
 }
 
 /**
@@ -90,10 +131,32 @@ export async function handleActionRequest(
   req: Request,
   config: ActionDispatchConfig
 ): Promise<Response | FormRerender | null> {
+  // Version skew detection — reject actions from stale clients (TIM-446).
+  // On mismatch, return a structured RSC error response that the client
+  // handles by showing a brief "App updated" message and reloading.
+  const skewCheck = checkVersionSkew(req);
+  if (!skewCheck.ok) {
+    const reloadHeaders = new Headers({
+      'Content-Type': RSC_CONTENT_TYPE,
+    });
+    applyReloadHeaders(reloadHeaders);
+    // Return the reload signal as an RSC stream so createFromFetch can
+    // decode it. The client checks X-Timber-Reload before processing.
+    const rscStream = renderToReadableStream({ _versionSkew: true });
+    return new Response(rscStream, { status: 200, headers: reloadHeaders });
+  }
+
   // CSRF validation — reject cross-origin mutation requests.
+  //
+  // Defense-in-depth: the pipeline's CSRF gate (`csrfGate`) already checks
+  // every unsafe-method request before dispatch reaches here, so this call
+  // is a no-op on the happy path. It is intentionally retained so that
+  // handleActionRequest remains safe to call from any entry point that
+  // bypasses the gate — and it never applies the per-route exemption, which
+  // is for route.ts only. See LOCAL-773, TIM-1543.
   const csrfResult = validateCsrf(req, config.csrf);
   if (!csrfResult.ok) {
-    return new Response(null, { status: csrfResult.status });
+    return csrfRejectionResponse(req, csrfResult);
   }
 
   // Body size limits — reject oversized requests before parsing.
@@ -106,33 +169,176 @@ export async function handleActionRequest(
     return new Response(null, { status: limitsResult.status });
   }
 
-  // Run inside request context so headers(), cookies() work in actions.
+  // Run inside request context so getHeaders(), getCookies() work in actions.
   // Actions are a mutable context — they can set cookies (design/29-cookies.md).
-  return runWithRequestContext(req, async () => {
-    setMutableCookieContext(true);
-    const actionId = req.headers.get('x-rsc-action');
-
-    let result: Response | FormRerender | null;
-    if (actionId) {
-      // With-JS path: client sent action ID in header, args in body
-      result = await handleRscAction(req, actionId, config);
-    } else {
-      // No-JS path: form POST with React's hidden action fields
-      result = await handleFormAction(req, config);
-    }
+  //
+  // ...and outside any React.cache scope: dispatch runs inside the pipeline's
+  // request scope (after proxy.ts), and runWithRequestContext would open
+  // another. An action reads, writes cookies, and mutates, so a memoized read
+  // would go stale mid-action — React.cache in an action does not dedupe,
+  // same as stock React and Next.js (TIM-1529 D2). The revalidation render
+  // below re-enters its own fresh scope explicitly.
+  return runWithRequestContext(req, () =>
+    runOutsideReactCacheScope(async () => {
+      setMutableCookieContext(true);
+      const actionId = req.headers.get('x-rsc-action');
+
+      let result: Response | FormRerender | null;
+      if (actionId) {
+        // With-JS path: client sent action ID in header, args in body
+        result = await handleRscAction(req, actionId, config);
+      } else {
+        // No-JS path: form POST with React's hidden action fields
+        result = await handleFormAction(req, config);
+      }
 
-    // Apply cookie jar to action responses
-    if (result instanceof Response) {
-      for (const value of getSetCookieHeaders()) {
-        result.headers.append('Set-Cookie', value);
+      // Apply cookie jar to action responses.
+      //
+      // For Response results we append Set-Cookie directly. For FormRerender
+      // signals we snapshot the headers here, before this ALS scope exits, so
+      // the caller can apply them to the rerender pipeline's response (which
+      // runs in its own request-context scope with a fresh cookie jar).
+      // See LOCAL-740 — without this snapshot, cookies set inside a no-JS
+      // form action that returns validation errors are silently dropped.
+      if (result instanceof Response) {
+        for (const value of getSetCookieHeaders()) {
+          result.headers.append('Set-Cookie', value);
+        }
+      } else if (result && 'rerender' in result) {
+        result.setCookieHeaders = getSetCookieHeaders();
+        // Snapshot the post-action RYW cookie state as a Map so the rerender
+        // dispatcher can hand it to the rerender request context directly,
+        // with no string round-trip. See TIM-837
+        // and ONGOING_SECURITY.md H-3 (TIM-868). `getCookiesForSsr` already
+        // returns a defensive copy, so the rerender scope cannot mutate the
+        // snapshot through this reference.
+        result.cookies = getCookiesForSsr();
       }
-    }
-    return result;
-  });
+      return result;
+    })
+  );
 }
 
 // ─── With-JS Action ───────────────────────────────────────────────────────
 
+/**
+ * Log an action error and report it to `onRequestError` as phase
+ * `'action'`. An `ActionError` is not reported: it is an outcome the
+ * action chose to return, not an unhandled error.
+ */
+async function reportActionError(req: Request, error: unknown): Promise<void> {
+  logActionError({ method: req.method, path: new URL(req.url).pathname, error });
+  if (error instanceof ActionError) return;
+  await fireOnRequestError(error, req, 'action');
+}
+
+/**
+ * Report errors the action survived after its body returned — from
+ * `executeAction`'s revalidation, or from serializing the revalidated tree.
+ * Each is logged where it was caught; this is its one `onRequestError`
+ * report, as phase `'action'`. Errors that are not reportable (a
+ * signal a revalidated page threw, an abort) and anything
+ * after the request aborted are skipped by the same rule as a page render.
+ */
+async function reportRevalidationErrors(req: Request, errors: readonly unknown[]): Promise<void> {
+  for (const error of errors) {
+    await fireOnRequestError(error, req, 'action').catch((hookError: unknown) =>
+      swallow(hookError, 'onRequestError could not be called')
+    );
+  }
+}
+
+/**
+ * Answer an action request that failed before the action ran with a bare
+ * status, never a 200 action-error payload: a fabricated action id must not
+ * look like an action that ran (tests/e2e/security.test.ts). Either way it
+ * is logged and reported to `onRequestError` as phase `'action'` (TIM-1537).
+ *
+ * The status is chosen by what failed, not by matching error messages:
+ * - **400**: the request is wrong in a way the handler can see for itself.
+ *   The body will not parse or decode, or the reference resolves to
+ *   something that is not a function.
+ * - **500**: loading the action module failed. plugin-rsc rejects the same
+ *   way for an unknown reference and for a real module that fails to import
+ *   or evaluate, and the second is a server fault, so the load failure keeps
+ *   the 5xx it had before this change. The no-JS path cannot make this
+ *   split (`decodeAction` decodes and loads in one call) and answers 400;
+ *   see `handleFormAction`.
+ */
+async function rejectActionRequest(
+  req: Request,
+  error: unknown,
+  status: 400 | 500
+): Promise<Response> {
+  await reportActionError(req, error);
+  return new Response(null, { status });
+}
+
+/**
+ * The no-JS answer to an action error: re-render the page with the error as
+ * flash data. `handleActionError` produces `{ serverError }` for an
+ * ActionError and `{ serverError: { code: 'INTERNAL_ERROR' } }` otherwise.
+ */
+function errorRerender(error: unknown, submittedValues: Record<string, unknown>): FormRerender {
+  return {
+    rerender: { ...handleActionError(error), submittedValues },
+    // Filled in by handleActionRequest before the ALS scope exits.
+    setCookieHeaders: [],
+    cookies: new Map(),
+  };
+}
+
+/**
+ * Load the action by reference ID and decode its args from the request body
+ * (RSC wire format). Returns a Response for a request that fails before the
+ * action can run: see `rejectActionRequest` for the status, and the field
+ * limit for its own.
+ */
+async function decodeRscActionCall(
+  req: Request,
+  actionId: string,
+  config: ActionDispatchConfig
+): Promise<{ actionFn: (...args: unknown[]) => Promise<unknown>; args: unknown[] } | Response> {
+  let loaded: unknown;
+  try {
+    loaded = await loadServerAction(actionId);
+  } catch (error) {
+    return rejectActionRequest(req, error, 500);
+  }
+  if (typeof loaded !== 'function') {
+    // The module loaded but has no such export: a reference the client made up.
+    return rejectActionRequest(req, new Error(`Unknown server action "${actionId}"`), 400);
+  }
+  const actionFn = loaded as (...args: unknown[]) => Promise<unknown>;
+
+  let decoded: unknown;
+  try {
+    const contentType = req.headers.get('Content-Type') ?? '';
+    if (contentType.includes('multipart/form-data')) {
+      // FormData-based args (file uploads, etc.)
+      const formData = await req.formData();
+      // Enforce field count limit after parsing FormData.
+      const fieldResult = enforceFieldLimit(formData, config.bodyLimits ?? {});
+      if (!fieldResult.ok) {
+        return new Response(null, { status: fieldResult.status });
+      }
+      decoded = await decodeReply(formData);
+    } else {
+      // Text-based args
+      decoded = await decodeReply(await req.text());
+    }
+  } catch (error) {
+    return rejectActionRequest(req, error, 400);
+  }
+  // The client always encodes an argument list. Anything else would fail
+  // when `executeAction` spreads it, inside the action's own catch, and
+  // come back as a 200 INTERNAL_ERROR for what is the caller's mistake.
+  if (!Array.isArray(decoded)) {
+    return rejectActionRequest(req, new Error('Server action body is not an argument list'), 400);
+  }
+  return { actionFn, args: decoded };
+}
+
 /**
  * Handle an RSC action request (JavaScript enabled).
  *
@@ -144,27 +350,10 @@ async function handleRscAction(
   actionId: string,
   config: ActionDispatchConfig
 ): Promise<Response> {
-  // Load the server action function by reference ID
-  const actionFn = (await loadServerAction(actionId)) as (...args: unknown[]) => Promise<unknown>;
-
-  // Decode the args from the request body (RSC wire format)
-  const contentType = req.headers.get('Content-Type') ?? '';
-  let args: unknown[];
-
-  if (contentType.includes('multipart/form-data')) {
-    // FormData-based args (file uploads, etc.)
-    const formData = await req.formData();
-    // Enforce field count limit after parsing FormData.
-    const fieldResult = enforceFieldLimit(formData, config.bodyLimits ?? {});
-    if (!fieldResult.ok) {
-      return new Response(null, { status: fieldResult.status });
-    }
-    args = (await decodeReply(formData)) as unknown[];
-  } else {
-    // Text-based args
-    const body = await req.text();
-    args = (await decodeReply(body)) as unknown[];
-  }
+  // A request that fails before the action runs is answered here, not a
+  // rejection that escapes into the pipeline (TIM-1537).
+  const call = await decodeRscActionCall(req, actionId, config);
+  if (call instanceof Response) return call;
 
   // Execute the action with revalidation tracking.
   // Errors are caught here so raw 'use server' functions (not using
@@ -172,12 +361,17 @@ async function handleRscAction(
   // of leaking stack traces as 500s.
   let result;
   try {
-    result = await executeAction(actionFn, args, {
+    const requestUrl = new URL(req.url);
+    // Canonicalize the request pathname so it matches the decoded form
+    // that revalidationPathMatches uses on the target side.
+    const canonical = canonicalize(requestUrl.pathname, true);
+    result = await executeAction(call.actionFn, call.args, {
       renderer: config.revalidateRenderer,
+      requestPathname: canonical.ok ? canonical.pathname : requestUrl.pathname,
+      requestSearch: requestUrl.search,
     });
   } catch (error) {
-    // Log full error server-side for debugging
-    console.error('[timber] server action error:', error);
+    await reportActionError(req, error);
 
     // Return structured error response — ActionError gets its code/data,
     // unexpected errors get sanitized { code: 'INTERNAL_ERROR' }
@@ -188,6 +382,9 @@ async function handleRscAction(
       headers: { 'Content-Type': RSC_CONTENT_TYPE },
     });
   }
+  // Outside the try: the action succeeded, and a failure to report its
+  // revalidation must not turn it into an action error.
+  await reportRevalidationErrors(req, result.revalidationErrors);
 
   // Handle redirect — encode in RSC stream for client-side SPA navigation.
   // The client detects X-Timber-Redirect and calls router.navigate() instead
@@ -198,13 +395,14 @@ async function handleRscAction(
       _status: result.redirectStatus ?? 302,
     };
     const rscStream = renderToReadableStream(redirectPayload);
-    return new Response(rscStream, {
-      status: 200,
-      headers: {
-        'Content-Type': RSC_CONTENT_TYPE,
-        'X-Timber-Redirect': result.redirectTo,
-      },
-    });
+    const redirectHeaders: Record<string, string> = {
+      'Content-Type': RSC_CONTENT_TYPE,
+      'X-Timber-Redirect': result.redirectTo,
+    };
+    if (result.onlyOtherPagesNamed) {
+      redirectHeaders['X-Timber-Invalidated'] = '1';
+    }
+    return new Response(rscStream, { status: 200, headers: redirectHeaders });
   }
 
   // Render the action result as an RSC stream.
@@ -215,24 +413,137 @@ async function handleRscAction(
     'Content-Type': RSC_CONTENT_TYPE,
   };
 
-  let payload: unknown;
+  // TIM-1454: Tell the client that revalidatePath named only other pages. A
+  // flag, not a path list: the client evicts every cached payload either
+  // way (TIM-1461).
+  if (result.onlyOtherPagesNamed) {
+    headers['X-Timber-Invalidated'] = '1';
+  }
+
   if (result.revalidation) {
     // Wrapper object — Next.js-style pattern: action result + element tree
     // serialized together so React Flight handles both in one stream.
-    payload = {
+    const revalidationPayload = {
       _action: result.actionResult,
-      _tree: result.revalidation.element,
+      // The payload root, not a bare tree: it carries the revalidated
+      // route's params too, and the client publishes them (TIM-1297).
+      _tree: result.revalidation.payload,
     };
-    headers['X-Timber-Revalidation'] = '1';
-    // Forward head elements as JSON so the client can update <head>.
-    if (result.revalidation.headElements.length > 0) {
-      headers['X-Timber-Head'] = JSON.stringify(result.revalidation.headElements);
+
+    // TIM-1366: access.ts deny signals fire during serialization (inside
+    // AccessGate during renderToReadableStream), not during buildRouteElement.
+    // Buffer the stream and track errors so we can drop the revalidation
+    // cleanly instead of shipping a broken flight stream. Access runs
+    // exactly once — during the real render — preserving TIM-1363.
+    let serializationSignal:
+      | { kind: 'deny'; status: number }
+      | { kind: 'redirect'; location: string; status: number }
+      | { kind: 'error' }
+      | undefined;
+    const serializationErrors: unknown[] = [];
+    //
+    // Rendered in the scope the revalidation middleware ran in, not this
+    // request context's: the action body read through that one before it
+    // mutated, and the revalidated tree must see post-mutation values
+    // (TIM-1529).
+    const rscStream = runWithReactCacheScope(
+      () =>
+        renderToReadableStream(revalidationPayload, {
+          signal: req.signal,
+          onError(error: unknown) {
+            // ??= keeps the first signal (shallowest AccessGate in top-down render).
+            if (isDenySignal(error)) {
+              serializationSignal ??= { kind: 'deny', status: error.status };
+            } else if (isRedirectSignal(error)) {
+              serializationSignal ??= {
+                kind: 'redirect',
+                location: error.location,
+                status: error.status,
+              };
+            } else {
+              console.error('[timber] revalidation serialization error:', error);
+              serializationErrors.push(error);
+              serializationSignal ??= { kind: 'error' };
+            }
+          },
+        }),
+      result.revalidation.reactCacheScope
+    );
+
+    // Drain the stream to detect any signals before committing the response.
+    // Timeout-guarded: the element tree may contain async server components
+    // with stalled fetches. 30s matches the default renderTimeoutMs.
+    // Not readAllBytesWithDeadline: this timeout is per read, not one
+    // overall deadline; the loop stops at the first chunk after onError
+    // records a signal (the payload is dropped then); and the catch below
+    // branches on RenderTimeoutError, which the helper does not throw.
+    const reader = rscStream.getReader();
+    const chunks: Uint8Array[] = [];
+    const drainTimeoutMs = DEFAULT_RENDER_TIMEOUT_MS;
+    try {
+      for (;;) {
+        const { done, value } = await withTimeout(
+          reader.read(),
+          drainTimeoutMs,
+          'revalidation stream drain timed out'
+        );
+        if (done) break;
+        chunks.push(value);
+        if (serializationSignal) {
+          reader.cancel().catch(() => {});
+          break;
+        }
+      }
+    } catch (drainError) {
+      reader.cancel().catch(() => {});
+      if (drainError instanceof RenderTimeoutError) {
+        console.error('[timber] revalidatePath dropped — stream drain timed out');
+        // A revalidated tree that never finished rendering is a failure,
+        // even though the action result still ships.
+        await reportRevalidationErrors(req, [...serializationErrors, drainError]);
+        const fallbackStream = renderToReadableStream(result.actionResult);
+        return new Response(fallbackStream, { status: 200, headers });
+      }
+      await reportRevalidationErrors(req, serializationErrors);
+      throw drainError;
     }
-  } else {
-    payload = result.actionResult;
+
+    await reportRevalidationErrors(req, serializationErrors);
+    if (serializationSignal) {
+      if (serializationSignal.kind === 'redirect') {
+        const redirectPayload = {
+          _redirect: serializationSignal.location,
+          _status: serializationSignal.status,
+        };
+        const redirectStream = renderToReadableStream(redirectPayload);
+        return new Response(redirectStream, {
+          status: 200,
+          headers: {
+            'Content-Type': RSC_CONTENT_TYPE,
+            'X-Timber-Redirect': serializationSignal.location,
+          },
+        });
+      }
+      // Deny or render error: drop the revalidation tree, ship the action result alone.
+      if (serializationSignal.kind === 'deny') {
+        console.error(
+          `[timber] revalidatePath dropped — access denied during render (status ${serializationSignal.status})`
+        );
+      }
+      const fallbackStream = renderToReadableStream(result.actionResult);
+      return new Response(fallbackStream, { status: 200, headers });
+    }
+
+    // Clean serialization — return the buffered bytes with revalidation header.
+    headers['X-Timber-Revalidation'] = '1';
+    const buffered = concatUint8Arrays(chunks);
+    return new Response(buffered.buffer as ArrayBuffer, {
+      status: 200,
+      headers,
+    });
   }
 
-  const rscStream = renderToReadableStream(payload);
+  const rscStream = renderToReadableStream(result.actionResult);
 
   return new Response(rscStream, {
     status: 200,
@@ -240,6 +551,20 @@ async function handleRscAction(
   });
 }
 
+// ─── Helpers ─────────────────────────────────────────────────────────────
+
+function concatUint8Arrays(chunks: Uint8Array[]): Uint8Array {
+  let total = 0;
+  for (const c of chunks) total += c.byteLength;
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.byteLength;
+  }
+  return out;
+}
+
 // ─── No-JS Form Action ───────────────────────────────────────────────────
 
 /**
@@ -256,7 +581,13 @@ async function handleFormAction(
   // Clone before consuming — if this turns out not to be a server action form,
   // we return null and the original request body must remain readable for
   // downstream route handlers. Clone is cheap (shares the body buffer until read).
-  const formData = await req.clone().formData();
+  // A body that will not parse is a bad request (TIM-1537).
+  let formData: FormData;
+  try {
+    formData = await req.clone().formData();
+  } catch (error) {
+    return rejectActionRequest(req, error, 400);
+  }
 
   // Enforce field count limit after parsing FormData.
   const fieldResult = enforceFieldLimit(formData, config.bodyLimits ?? {});
@@ -264,48 +595,49 @@ async function handleFormAction(
     return new Response(null, { status: fieldResult.status });
   }
 
-  // Check if this is actually a React server action form.
-  // If there's no $ACTION_REF_* or $ACTION_KEY, it's a regular form POST
-  // that should be handled by the route's route handler, not here.
-  // React uses `$ACTION_REF_` + identifierPrefix — since we don't set one,
-  // the suffix is empty. Check for any key starting with $ACTION_REF_ or $ACTION_ID_.
-  const allKeys = [...formData.keys()];
-  const hasActionField = allKeys.some(
-    (k) => k.startsWith('$ACTION_REF_') || k.startsWith('$ACTION_ID_')
-  );
-  if (!hasActionField && !formData.has('$ACTION_KEY')) {
-    return null;
-  }
-
   // Capture submitted values for re-render on validation failure.
-  // Parse before decodeAction consumes the FormData.
-  const submittedValues = parseFormData(formData);
+  // Parse before decodeAction consumes the FormData, then strip sensitive
+  // fields (passwords, tokens, CVV, etc.) so they are never rendered back
+  // into the HTML as `defaultValue` attributes. See TIM-816.
+  const sensitivePredicate = resolveSensitivePredicate(
+    config.sensitiveFields,
+    getGlobalSensitiveFieldsConfig()
+  );
+  const submittedValues = stripSensitiveFields(parseFormData(formData), sensitivePredicate);
 
   // decodeAction resolves the action function from the form data's hidden fields.
-  // It returns a bound function with the form data already applied.
-  const actionFn = (await decodeAction(formData)) as (...args: unknown[]) => Promise<unknown>;
-
+  // Returns null when no $ACTION_REF_/$ACTION_ID_ fields are present — meaning
+  // this is a regular form POST, not a React server action.
   // Execute the action — no additional args needed (form data is already bound).
   // Errors are caught to prevent stack traces from leaking in the response.
+  let actionFn: ((...args: unknown[]) => Promise<unknown>) | null;
+  try {
+    actionFn = (await decodeAction(formData)) as ((...args: unknown[]) => Promise<unknown>) | null;
+  } catch (error) {
+    // decodeAction both decodes the form's `$ACTION_REF_` metadata and loads
+    // the module, and React does not say which failed. On a no-JS POST that
+    // metadata is written by React into the form, so a failure is almost
+    // always a forged or truncated request: 400. A module that genuinely
+    // fails to import also breaks the RSC render of the page holding the
+    // form, which surfaces it as a 500 there.
+    return rejectActionRequest(req, error, 400);
+  }
+  if (!actionFn) {
+    return null;
+  }
+
   let result;
   try {
     result = await executeAction(actionFn, [], {
       renderer: config.revalidateRenderer,
     });
   } catch (error) {
-    console.error('[timber] server action error:', error);
-
-    // Return the error as flash data for re-render.
-    // handleActionError produces { serverError } for ActionErrors
-    // and { serverError: { code: 'INTERNAL_ERROR' } } for unexpected errors.
-    const errorResult = handleActionError(error);
-    return {
-      rerender: {
-        ...errorResult,
-        submittedValues,
-      },
-    };
+    await reportActionError(req, error);
+    return errorRerender(error, submittedValues);
   }
+  // Outside the try: the action succeeded, and a failure to report its
+  // revalidation must not turn it into an action error.
+  await reportRevalidationErrors(req, result.revalidationErrors);
 
   // Handle redirect from the action (e.g. redirect() called in the action body)
   if (result.redirectTo) {
@@ -321,5 +653,19 @@ async function handleFormAction(
   // This handles both success ({ data }) and validation failure
   // ({ validationErrors, submittedValues }) — the form is the single source of truth.
   const actionResult = result.actionResult as FormFlashData;
-  return { rerender: actionResult };
+
+  // Defense-in-depth: strip sensitive fields from `actionResult.submittedValues`
+  // even if the action already built it. `createActionClient` strips internally,
+  // but raw `'use server'` functions that manually return `{ submittedValues }`
+  // are not covered by the inner strip. See TIM-816.
+  if (actionResult && actionResult.submittedValues) {
+    actionResult.submittedValues = stripSensitiveFields(
+      actionResult.submittedValues,
+      sensitivePredicate
+    );
+  }
+
+  // setCookieHeaders + cookies are filled in by handleActionRequest before
+  // the ALS scope exits.
+  return { rerender: actionResult, setCookieHeaders: [], cookies: new Map() };
 }