@weaverse/next 0.1.0-alpha.13 → 0.1.0-alpha.14

package/dist/server.js

@@ -1,5 +1,7 @@
 'use strict';
 
+var schema = require('@weaverse/schema');
+
 // src/seo.ts
 function hasOpenGraphContent(seo) {
   return Boolean(seo?.title || seo?.description || seo?.image || seo?.type);
@@ -180,6 +182,36 @@ function resolveRequestUrl(context) {
   let search = context?.searchParams ? new URLSearchParams(context.searchParams).toString() : "";
   return `http://localhost${pathname}${search ? `?${search}` : ""}`;
 }
+var DENIED_ROUTE_CONTEXT_PARAMS = [
+  "weaverseprojectid",
+  "weaversehost",
+  "weaverseapikey",
+  "weaverseapibase",
+  "weaversepublicapibase",
+  "weaverseversion",
+  "projectid",
+  "weaversedraftitem",
+  "__weaversedraftitem",
+  "_rsc"
+];
+var ROUTE_CONTEXT_I18N_KEYS = [
+  "country",
+  "label",
+  "language",
+  "locale",
+  "pathPrefix"
+];
+function sanitizeRouteContextSearch(search) {
+  let params = new URLSearchParams(search);
+  let denied = new Set(DENIED_ROUTE_CONTEXT_PARAMS);
+  for (let key of [...new Set(params.keys())]) {
+    if (denied.has(key.toLowerCase())) {
+      params.delete(key);
+    }
+  }
+  let serialized = params.toString();
+  return serialized ? `?${serialized}` : "";
+}
 
 // src/utils.ts
 function generateDataFromSchema(schema) {
@@ -209,6 +241,119 @@ var STATUS_BAD_REQUEST = 400;
 var STATUS_NOT_FOUND = 404;
 var STATUS_UNPROCESSABLE = 422;
 var STATUS_SERVER_ERROR = 500;
+var MAX_PATHNAME_LENGTH = 2048;
+var MAX_SEARCH_LENGTH = 8192;
+var MAX_HANDLE_LENGTH = 512;
+var MAX_I18N_FIELD_LENGTH = 256;
+var CONTROL_CHAR_PATTERN = /[\u0000-\u001F\u007F]/;
+function isValidPathname(pathname) {
+  if (!pathname || pathname.length > MAX_PATHNAME_LENGTH) {
+    return false;
+  }
+  if (pathname[0] !== "/" || pathname.startsWith("//")) {
+    return false;
+  }
+  if (pathname.includes("\\") || pathname.includes("?")) {
+    return false;
+  }
+  if (pathname.includes("#") || CONTROL_CHAR_PATTERN.test(pathname)) {
+    return false;
+  }
+  return true;
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  let proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function sanitizeRouteContextI18n(input) {
+  if (input === void 0) {
+    return;
+  }
+  if (!isPlainObject(input)) {
+    return null;
+  }
+  let source = input;
+  let allowed = new Set(ROUTE_CONTEXT_I18N_KEYS);
+  for (let key of Object.keys(source)) {
+    if (!allowed.has(key)) {
+      return null;
+    }
+  }
+  let result = {};
+  for (let key of ROUTE_CONTEXT_I18N_KEYS) {
+    let value = source[key];
+    if (value === void 0) {
+      continue;
+    }
+    if (typeof value !== "string" || value.length > MAX_I18N_FIELD_LENGTH) {
+      return null;
+    }
+    result[key] = value;
+  }
+  return Object.keys(result).length ? result : void 0;
+}
+function reconstructRouteContext(request, routeContext) {
+  if (typeof routeContext !== "object" || routeContext === null || Array.isArray(routeContext)) {
+    return null;
+  }
+  let { pathname, search, handle, pageType, i18n } = routeContext;
+  if (typeof pathname !== "string" || !isValidPathname(pathname)) {
+    return null;
+  }
+  if (typeof search !== "string" || search.length > MAX_SEARCH_LENGTH) {
+    return null;
+  }
+  let rawSearch = search;
+  if (rawSearch.length && !rawSearch.startsWith("?")) {
+    return null;
+  }
+  let sanitizedI18n = sanitizeRouteContextI18n(i18n);
+  if (sanitizedI18n === null) {
+    return null;
+  }
+  let resolvedPageType;
+  if (pageType !== void 0) {
+    let parsed = schema.PageTypeSchema.safeParse(pageType);
+    if (!parsed.success) {
+      return null;
+    }
+    resolvedPageType = parsed.data;
+  }
+  let resolvedHandle;
+  if (handle !== void 0) {
+    if (typeof handle !== "string" || !handle || handle.length > MAX_HANDLE_LENGTH) {
+      return null;
+    }
+    resolvedHandle = handle;
+  }
+  let endpointUrl = new URL(request.url);
+  let routeUrl = new URL(endpointUrl.origin);
+  routeUrl.pathname = pathname;
+  routeUrl.search = sanitizeRouteContextSearch(rawSearch);
+  let canonicalPathname = routeUrl.pathname;
+  let searchParams = routeUrl.searchParams;
+  let lastParam2 = (key) => {
+    let values = searchParams.getAll(key);
+    return values.length ? values.at(-1) : void 0;
+  };
+  return {
+    pathname: canonicalPathname,
+    searchParams,
+    url: routeUrl,
+    // Headers come from the actual same-origin POST, never its JSON body.
+    headers: new Headers(request.headers),
+    ...sanitizedI18n ? { i18n: sanitizedI18n } : {},
+    ...resolvedPageType ? { pageType: resolvedPageType } : {},
+    ...resolvedHandle ? { handle: resolvedHandle } : {},
+    isDesignMode: lastParam2("isDesignMode") === "true",
+    isPreviewMode: lastParam2("isPreviewMode") === "true",
+    isRevisionPreview: searchParams.has("__revisionId"),
+    sectionType: lastParam2("sectionType") || void 0
+  };
+}
 function json(body, status) {
   return new Response(JSON.stringify(body), {
     status,
@@ -242,9 +387,18 @@ function createWeaverseNextRevalidateHandler(config) {
       if (!draftItem) {
         return json({ error: "invalid-payload" }, STATUS_BAD_REQUEST);
       }
+      let requestContext;
+      let body = payload;
+      if (Object.hasOwn(body, "routeContext")) {
+        let reconstructed = reconstructRouteContext(request, body.routeContext);
+        if (!reconstructed) {
+          return json({ error: "invalid-route-context" }, STATUS_BAD_REQUEST);
+        }
+        requestContext = reconstructed;
+      }
       let client;
       try {
-        client = await config.getClient(request);
+        client = await config.getClient(request, requestContext);
       } catch (error) {
         console.error("\u274C Revalidate handler getClient failed.", error);
         return json({ error: "client-init-failed" }, STATUS_SERVER_ERROR);
@@ -420,7 +574,9 @@ function buildWeaverseNextRequestInfo(context) {
     pathname: getPathnameFromContext(context),
     search: search ? `?${search}` : "",
     queries: toQueryRecord(searchParams),
-    ...context?.i18n ? { i18n: context.i18n } : {}
+    ...context?.i18n ? { i18n: context.i18n } : {},
+    ...context?.pageType ? { pageType: context.pageType } : {},
+    ...context?.handle ? { handle: context.handle } : {}
   };
 }