@vigla/kit 0.0.0-stage → 0.1.1

package/src/server/csp.ts

@@ -0,0 +1,166 @@
+import type { CspConfig, CspDirectives } from '../types/csp.ts';
+import { base64, sha256 } from '../shared/hash.ts';
+import { escapeHtml } from '../shared/escape.ts';
+import * as errors from './errors.ts';
+
+const keywords = new Set([
+	'self',
+	'unsafe-eval',
+	'unsafe-hashes',
+	'unsafe-inline',
+	'none',
+	'strict-dynamic',
+	'report-sample',
+	'report-sha256',
+	'report-sha384',
+	'report-sha512',
+	'wasm-unsafe-eval',
+	'trusted-types-eval',
+	'unsafe-allow-redirects',
+	'unsafe-webtransport-hashes',
+	'script'
+]);
+type Sources = Record<string, string[] | boolean | undefined>;
+
+class Policy {
+	readonly #directives: Sources;
+	readonly #added = new Map<string, Set<string>>();
+	readonly script: boolean;
+	readonly style: boolean;
+
+	constructor(directives: CspDirectives, dev: boolean) {
+		this.#directives = { ...directives };
+		if (dev) {
+			for (const key of ['style-src', 'style-src-attr', 'style-src-elem']) {
+				const value =
+					this.#directives[key] ??
+					(key === 'style-src' ? this.#directives['default-src'] : undefined);
+				if (Array.isArray(value) && !value.includes('unsafe-inline'))
+					this.#directives[key] = [
+						...value.filter((source) => !/^(nonce|sha\d+)-/.test(source)),
+						'unsafe-inline'
+					];
+			}
+		}
+		this.script = ['script-src', 'script-src-elem'].some((key) => this.#needs(key));
+		this.style =
+			!dev && ['style-src', 'style-src-attr', 'style-src-elem'].some((key) => this.#needs(key));
+	}
+
+	#needs(key: string): boolean {
+		const value =
+			this.#directives[key] ??
+			(key === 'script-src' || key === 'style-src' ? this.#directives['default-src'] : undefined);
+		return (
+			Array.isArray(value) &&
+			(!value.includes('unsafe-inline') ||
+				(key.startsWith('script') && value.includes('strict-dynamic')))
+		);
+	}
+
+	add(kind: 'script' | 'style', source: string): void {
+		if (kind === 'style' && !this.style) return;
+		const keys =
+			kind === 'script'
+				? ['script-src', 'script-src-elem']
+				: ['style-src', 'style-src-attr', 'style-src-elem'];
+		for (const key of keys) {
+			if (!this.#needs(key)) continue;
+			const values = this.#added.get(key) ?? new Set<string>();
+			if (key === 'style-src-elem')
+				values.add('sha256-9OlNO0DNEeaVzHL4RZwCLsBHA8WBQ8toBp/4F5XV2nc=');
+			values.add(source);
+			this.#added.set(key, values);
+		}
+	}
+
+	header(meta = false): string {
+		const values: Sources = { ...this.#directives };
+		for (const [key, added] of this.#added) {
+			const base =
+				values[key] ?? (key === 'script-src' || key === 'style-src' ? values['default-src'] : []);
+			values[key] = [...new Set([...(Array.isArray(base) ? base : []), ...added])];
+		}
+		return Object.entries(values)
+			.flatMap(([name, value]) => {
+				if (!value || (meta && ['frame-ancestors', 'report-uri', 'sandbox'].includes(name)))
+					return [];
+				return [
+					[
+						name,
+						...(Array.isArray(value)
+							? value.map((source) =>
+									keywords.has(source) || /^(nonce|sha\d+)-/.test(source) ? `'${source}'` : source
+								)
+							: [])
+					].join(' ')
+				];
+			})
+			.join('; ');
+	}
+}
+
+export class Csp {
+	readonly nonce = base64(crypto.getRandomValues(new Uint8Array(16)));
+	readonly #enforced: Policy;
+	readonly #report: Policy;
+	readonly hashes: boolean;
+
+	constructor(config: CspConfig, prerender: boolean, dev: boolean) {
+		if (prerender && config.mode === 'nonce') errors.prerender_nonce();
+		this.hashes = config.mode === 'hash' || ((config.mode ?? 'auto') === 'auto' && prerender);
+		this.#enforced = new Policy(config.directives ?? {}, dev);
+		this.#report = new Policy(config.reportOnly ?? {}, dev);
+		if (
+			Object.values(config.reportOnly ?? {}).some(Boolean) &&
+			!config.reportOnly?.['report-uri']?.length &&
+			!config.reportOnly?.['report-to']?.length
+		)
+			errors.csp_report_only_missing_report();
+	}
+
+	get scriptNonce(): boolean {
+		return !this.hashes && (this.#enforced.script || this.#report.script);
+	}
+	get styleNonce(): boolean {
+		return !this.hashes && (this.#enforced.style || this.#report.style);
+	}
+	get scriptHash(): boolean {
+		return this.hashes && (this.#enforced.script || this.#report.script);
+	}
+
+	async script(content: string): Promise<void> {
+		if (!this.#enforced.script && !this.#report.script) return;
+		const source = this.hashes ? `sha256-${await sha256(content)}` : `nonce-${this.nonce}`;
+		this.#enforced.add('script', source);
+		this.#report.add('script', source);
+	}
+
+	scriptHashes(hashes: readonly string[]): void {
+		for (const hash of hashes) {
+			this.#enforced.add('script', hash);
+			this.#report.add('script', hash);
+		}
+	}
+
+	async style(content: string): Promise<void> {
+		if (!this.#enforced.style && !this.#report.style) return;
+		const source = this.hashes ? `sha256-${await sha256(content)}` : `nonce-${this.nonce}`;
+		this.#enforced.add('style', source);
+		this.#report.add('style', source);
+	}
+
+	apply(headers: Headers): void {
+		const enforced = this.#enforced.header();
+		const report = this.#report.header();
+		if (enforced) headers.set('content-security-policy', enforced);
+		if (report) headers.set('content-security-policy-report-only', report);
+	}
+
+	meta(): string {
+		const value = this.#enforced.header(true);
+		return value
+			? `<meta http-equiv="content-security-policy" content="${escapeHtml(value, true)}">`
+			: '';
+	}
+}

package/src/server/csrf.ts

@@ -0,0 +1,28 @@
+import { isForm } from '../shared/http.ts';
+import type { ServerCsrf, ServerPaths } from '../types/internal/server.ts';
+
+export function csrfResponse(
+	request: Request,
+	remote: boolean,
+	csrf: ServerCsrf,
+	paths: ServerPaths
+): Response | null {
+	if (!remote && !csrf.checkOrigin) return null;
+	const origin = request.headers.get('origin');
+	const self = paths.origin || new URL(request.url).origin;
+	const forbidden = remote
+		? request.method !== 'GET' && origin !== self
+		: ['POST', 'PUT', 'PATCH', 'DELETE'].includes(request.method) &&
+			(!request.headers.has('content-type') || isForm(request)) &&
+			origin !== self &&
+			(!origin || !csrf.trustedOrigins.includes(origin));
+	if (!forbidden) return null;
+	const message = remote
+		? 'Cross-site remote requests are forbidden'
+		: `Cross-site ${request.method} form submissions are forbidden`;
+	const json = remote || request.headers.get('accept') === 'application/json';
+	return new Response(json ? JSON.stringify({ message }) : message, {
+		status: 403,
+		headers: { 'content-type': json ? 'application/json' : 'text/plain' }
+	});
+}

package/src/server/data.ts

@@ -0,0 +1,237 @@
+import { stringify, uneval } from 'devalue';
+import { getAbortSignal } from 'vigla';
+import type {
+	DataErrorNode,
+	DataNode,
+	DataSkippedNode,
+	SerializedUses
+} from '../types/internal/data.ts';
+import type { RequestStore, ServerDataNode, Uses } from '../types/internal/server.ts';
+import type { PageBranch } from '../types/internal/routes.ts';
+import type { Server } from './index.ts';
+import { encoders } from '../shared/serialization.ts';
+import { escapeJson } from '../shared/escape.ts';
+import { Redirect } from '../shared/outcomes.ts';
+import { serverLoad } from './load.ts';
+import { handleError } from './failure.ts';
+import { Chunks, streamText } from './stream.ts';
+import { versionHeader } from './headers.ts';
+import * as errors from './errors.ts';
+import { identity } from '../shared/identity.ts';
+
+export function serializedUses(uses: Uses): SerializedUses {
+	const value: SerializedUses = {};
+	if (uses.dependencies.size) value.dependencies = [...uses.dependencies];
+	if (uses.params.size) value.params = [...uses.params];
+	if (uses.search_params.size) value.search_params = [...uses.search_params];
+	if (uses.parent) value.parent = 1;
+	if (uses.route) value.route = 1;
+	if (uses.url) value.url = 1;
+	return value;
+}
+
+export interface SerializedData {
+	data: string;
+	chunks: AsyncIterable<string> | null;
+}
+
+type DataResult = ServerDataNode | DataErrorNode | DataSkippedNode | null;
+
+export class DataSerializer {
+	readonly #server: Server;
+	readonly #store: RequestStore;
+	readonly #html: boolean;
+	readonly #namespace: string;
+	readonly #chunks: Chunks<string>;
+	#id = 1;
+
+	constructor(server: Server, store: RequestStore, html: boolean, namespace = '') {
+		this.#server = server;
+		this.#store = store;
+		this.#html = html;
+		this.#namespace = namespace;
+		this.#chunks = new Chunks(store.owner.run(() => getAbortSignal()));
+	}
+
+	#promise(value: any): number | undefined {
+		if (!value || typeof value.then !== 'function') return undefined;
+		const id = this.#id++;
+		this.#chunks.add(
+			Promise.resolve(value)
+				.then(
+					(data) => ({ data, error: undefined }),
+					async (error) => ({
+						data: undefined,
+						error: await handleError(this.#store, error)
+					})
+				)
+				.then(async (result) => {
+					let data: string;
+					try {
+						data = this.#value(
+							this.#html
+								? result.error
+									? [, result.error]
+									: [result.data]
+								: (result.error ?? result.data)
+						);
+					} catch (cause) {
+						let failure: unknown;
+						try {
+							errors.load_promise_not_serializable(
+								{ id: this.#store.event.route.id ?? '' },
+								{ cause }
+							);
+						} catch (error) {
+							failure = error;
+						}
+						result.error = await handleError(this.#store, failure);
+						data = this.#value(this.#html ? [, result.error] : result.error);
+					}
+					return this.#html
+						? `${this.#namespace}.ready.then(()=>${this.#namespace}.resolve(${id}, (app) => ${data}));`
+						: `{"type":"chunk","id":${id},"${result.error ? 'error' : 'data'}":${data}}\n`;
+				})
+		);
+		return id;
+	}
+
+	#value(value: unknown): string {
+		const transport = this.#server.hooks.transport ?? {};
+		if (!this.#html)
+			return stringify(value, { ...encoders(transport), Promise: (value) => this.#promise(value) });
+		const replace = (value: any): string | undefined => {
+			const id = this.#promise(value);
+			if (id !== undefined) return `${this.#namespace}.defer(${id})`;
+			for (const [name, codec] of Object.entries(transport)) {
+				const encoded = codec.encode(value);
+				if (encoded) return `app.decode(${escapeJson(name)}, ${uneval(encoded, replace)})`;
+			}
+			return undefined;
+		};
+		return uneval(value, replace);
+	}
+
+	serialize(nodes: DataResult[]): SerializedData {
+		const strings = nodes.map((node) => {
+			if (!node) return 'null';
+			if (node.type !== 'data') return this.#html ? this.#value(node) : JSON.stringify(node);
+			try {
+				const payload: DataNode = {
+					type: 'data',
+					data: node.data,
+					uses: serializedUses(node.uses)
+				};
+				if (node.slash) payload.slash = node.slash;
+				if (this.#html) return this.#value(payload);
+				const data = this.#value(node.data);
+				return `{"type":"data","data":${data},"uses":${JSON.stringify(payload.uses)}${node.slash ? `,"slash":${JSON.stringify(node.slash)}` : ''}}`;
+			} catch (error) {
+				if (error instanceof Error && 'path' in error)
+					errors.load_not_serializable(
+						{
+							id: this.#store.event.route.id ?? '',
+							message: error.message,
+							path: this.#html ? String(error.path).slice(1) : `data${error.path}`
+						},
+						{ cause: error }
+					);
+				throw error;
+			}
+		});
+		return {
+			data: this.#html
+				? `[${strings.join(',')}]`
+				: `{"type":"data","nodes":[${strings.join(',')}]}\n`,
+			chunks: this.#id > 1 ? this.#chunks : null
+		};
+	}
+}
+
+export async function dataResponse(
+	server: Server,
+	store: RequestStore,
+	page: PageBranch | null,
+	invalidated?: boolean[]
+): Promise<Response> {
+	if (!page)
+		return new Response(null, {
+			status: 404,
+			headers: versionHeader(server.options)
+		});
+	const indexes = [...page.layouts, page.leaf];
+	const loads: Array<() => Promise<ServerDataNode | null>> = [];
+	const pending: Array<Promise<ServerDataNode | null> | undefined> = [];
+	let aborted = false;
+	for (const [index, id] of indexes.entries()) {
+		loads.push(
+			() =>
+				(pending[index] ??= (async () => {
+					if (aborted) return null;
+					const node = id == null ? undefined : await server.manifest.nodes[id]!();
+					return serverLoad(server, store, node, async () =>
+						Object.assign(
+							{},
+							...(await Promise.all(loads.slice(0, index).map((load) => load()))).map(
+								(value) => value?.data
+							)
+						)
+					);
+				})().catch((error) => {
+					aborted = true;
+					throw error;
+				}))
+		);
+	}
+	try {
+		await Promise.all(
+			loads.map((load, index) =>
+				invalidated && !invalidated[index]
+					? null
+					: load().catch((error) => {
+							if (error instanceof Redirect) throw error;
+							return null;
+						})
+			)
+		);
+		const nodes = await Promise.all(
+			loads.map(async (_load, index): Promise<DataResult> => {
+				if (!pending[index] || (invalidated && !invalidated[index])) return { type: 'skip' };
+				try {
+					return await pending[index]!;
+				} catch (error) {
+					if (error instanceof Redirect) throw error;
+					const body = await handleError(store, error);
+					return { type: 'error', error: body, status: body.status };
+				}
+			})
+		);
+		const { data, chunks } = new DataSerializer(server, store, false).serialize(nodes);
+		return new Response(chunks ? streamText(data, chunks) : data, {
+			headers: {
+				'content-type': chunks ? `text/${identity.name}-data` : 'application/json',
+				'cache-control': 'private, no-store',
+				...versionHeader(server.options)
+			}
+		});
+	} catch (error) {
+		if (error instanceof Redirect)
+			return Response.json(
+				{ type: 'redirect', status: error.status, location: error.location },
+				{
+					headers: {
+						'cache-control': 'private, no-store',
+						...versionHeader(server.options)
+					}
+				}
+			);
+		const body = await handleError(store, error);
+		return Response.json(body, {
+			status: body.status,
+			headers: {
+				'cache-control': 'private, no-store',
+				...versionHeader(server.options)
+			}
+		});
+	}
+}