@webjsdev/server 0.8.24 → 0.8.26

package/src/check.js

@@ -10,6 +10,7 @@ import { buildModuleGraph, transitiveDeps } from './module-graph.js';
 import { scanComponents } from './component-scanner.js';
 import { buildRouteTable } from './router.js';
 import { analyzeElision } from './component-elision.js';
+import { RESERVED_CONFIG } from './action-config.js';
 
 /**
  * Convention validator for webjs apps.
@@ -107,6 +108,11 @@ export const RULES = [
     description:
       'A page / layout / component module that SHIPS to the browser (the build does NOT elide it) must not transitively import a server-only `.server.{ts,js}` module. The server module is replaced by a stub in the browser, so the import is fine while the page is display-only and elided (its server import is stripped), but the moment the page also does client work (it imports a component to register, enables the client router, uses a reactive primitive, …) it stops being elided and must load in the browser, dragging the server import with it. The stub then throws (or a server-only export like `auth` is missing) the instant the module loads, a runtime browser crash that `webjs typecheck` and the rest of `webjs check` miss. The rule reuses the build\'s own elision verdict, so it ONLY fires on modules that genuinely ship; a display-only page the framework elides is never flagged. The fix is to keep the server call off the browser-shipped module: gate the route in `middleware.ts`, call the server through a `\'use server\'` action, or register the component in a layout so the page elides again. Server-to-server imports (`.server.ts` importing `.server.ts`) and `middleware.ts` / `route.ts` (never shipped) are never flagged.',
   },
+  {
+    name: 'one-action-per-configured-file',
+    description:
+      'A `\'use server\'` action file that declares HTTP-verb config (any of `method` / `cache` / `tags` / `invalidates` / `validate`, #488) must export exactly ONE callable action function. The config is file-level (it applies to the action in the file), so a second exported function would silently inherit the same verb / cache, which is almost never intended and makes the contract ambiguous. Move the extra function to its own `.server.ts` file (the one-function-per-file convention), or, if it is a private helper, do not export it. Files with no verb config are unaffected.',
+  },
   {
     name: 'no-scaffold-placeholder',
     description:
@@ -727,6 +733,43 @@ export async function checkConventions(appDir) {
     }
   }
 
+  // --- Rule: one-action-per-configured-file (#488) ---
+  // A `'use server'` file that declares HTTP-verb config (method/cache/tags/
+  // invalidates/validate) must export exactly one callable action; the config
+  // is file-level, so a second exported function would silently inherit it.
+  {
+    for (const { rel, content, scan } of files) {
+      if (!/\.server\.m?[jt]s$/.test(rel)) continue;
+      if (!hasUseServerDirective(content)) continue;
+      if (!/\bexport\s+const\s+(?:method|cache|tags|invalidates|validate|middleware)\b/.test(scan)) continue;
+      const names = new Set();
+      let m;
+      const reFn = /\bexport\s+(?:async\s+)?function\s*\*?\s+([A-Za-z_$][\w$]*)/g;
+      while ((m = reFn.exec(scan))) names.add(m[1]);
+      // An arrow-const action: `export const x = (...) => ...`, the paren-less
+      // `export const x = id => ...`, or a function expression. The `=>` /
+      // `function` anchor keeps a plain `export const N = 5` from counting.
+      // An OPTIONAL `: Type` annotation may sit between the name and the `=`
+      // (#495); the type itself can contain a function-type `=>`, so the
+      // annotation matcher consumes any non-`=` char OR a literal `=>`, and the
+      // assignment is the first `=` NOT followed by `>` (`=(?!>)`). The
+      // alternation is unambiguous at each position (a `=` can only start `=>`),
+      // so there is no catastrophic backtracking.
+      const reArrow = /\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*(?::(?:[^=]|=>)*?)?=(?!>)\s*(?:async\s+)?(?:function\b|(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>)/g;
+      while ((m = reArrow.exec(scan))) names.add(m[1]);
+      if (/\bexport\s+default\b/.test(scan)) names.add('default');
+      const actions = [...names].filter((n) => !RESERVED_CONFIG.has(n));
+      if (actions.length > 1) {
+        violations.push({
+          rule: 'one-action-per-configured-file',
+          file: rel,
+          message: `Configured action file exports ${actions.length} callable functions (${actions.join(', ')}); the verb/cache config is file-level, so only one action per file is allowed.`,
+          fix: 'Move the extra function to its own .server.{js,ts} file, or keep it private (do not export it).',
+        });
+      }
+    }
+  }
+
   // --- Rule: tag-name-has-hyphen ---
   {
     for (const { rel, scan } of files) {

package/src/cors.js

@@ -1,14 +1,11 @@
 /**
  * Reusable CORS primitive for webjs.
  *
- * Two surfaces share one origin-resolution + header-building core:
- *
- * 1. `cors(options)` returns a webjs MIDDLEWARE `(req, next) => Response`,
- *    usable in `middleware.js` (root or per-segment) or wrapped around a
- *    `route.js` handler. This is the public app-facing API.
- * 2. The `expose()` REST path (`actions.js`) reuses `resolveOrigin` and
- *    `applyCorsHeaders` so a route's `cors` config and a standalone
- *    `cors()` middleware compute identical headers.
+ * `cors(options)` returns a webjs MIDDLEWARE `(req, next) => Response`,
+ * usable in `middleware.js` (root or per-segment) or wrapped around a
+ * `route.js` handler. This is the public app-facing API. The shared
+ * origin-resolution + header-building core (`resolveOrigin` /
+ * `applyCorsHeaders`) is exported for reuse.
  *
  * Web-standards-first: the option shape mirrors the well-trodden
  * `cors` npm package and the Fetch CORS protocol. We reflect the

package/src/csrf.js

@@ -20,10 +20,11 @@ const webCrypto = /** @type {Crypto} */ (globalThis.crypto);
  * they cannot set the header to the matching value.
  *
  * Notes on scope:
- *   - Applies to internal RPC only. `expose()`d REST endpoints are *not*
- *     CSRF-protected by default because they're intended for external
- *     consumers; those endpoints should carry their own auth (bearer token,
- *     signed request, API key) which the app provides via middleware.
+ *   - Applies to internal RPC only. A `route.ts` REST endpoint (hand-written
+ *     or via the `route()` adapter) is *not* CSRF-protected because it is
+ *     intended for external consumers; such an endpoint should carry its own
+ *     auth (bearer token, signed request, API key) the app provides via
+ *     middleware.
  */
 
 export const CSRF_COOKIE = 'webjs_csrf';

package/src/dev.js

@@ -56,11 +56,6 @@ import {
   serveActionStub,
   serveServerOnlyStub,
   invokeAction,
-  matchExposedAction,
-  matchAllAtPath,
-  invokeExposedAction,
-  buildPreflightResponse,
-  withCors,
   isServerFile,
   hasUseServerDirective,
   hashFile,
@@ -1695,41 +1690,18 @@ async function handleCore(req, ctx) {
   // Internal server-action RPC endpoint
   const actMatch = /^\/__webjs\/action\/([a-f0-9]+)\/([A-Za-z0-9_$]+)$/.exec(path);
   if (actMatch) {
-    if (method !== 'POST') return new Response('POST only', { status: 405 });
+    // HTTP-verb actions (#488): any RPC verb may hit the endpoint; invokeAction
+    // enforces the action's DECLARED method (405 + Allow on a mismatch) and
+    // reads args from the URL (GET/DELETE) or the body (POST/PUT/PATCH).
+    if (!['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
+      return new Response('method not allowed', { status: 405 });
+    }
     // Pass the onError sink (issue #239): a server action that throws
     // unexpectedly is reported to the APM hook before the sanitized 500.
     const onActionError = reportError ? (e) => reportError(e, req, 'action') : undefined;
     return invokeAction(state.actionIndex, actMatch[1], actMatch[2], req, onActionError);
   }
 
-  // expose()d server actions (first-class REST), with optional CORS support.
-  if (method === 'OPTIONS') {
-    const allAtPath = matchAllAtPath(state.actionIndex, path);
-    if (allAtPath.length) {
-      const corsRoute = allAtPath.find((r) => r.cors);
-      const methods = [...new Set(allAtPath.map((r) => r.method))];
-      if (corsRoute) {
-        // Preflight: respond with cors headers + the union of methods at this path.
-        const preflight = buildPreflightResponse(corsRoute, req);
-        const newHeaders = new Headers(preflight.headers);
-        newHeaders.set('access-control-allow-methods', `${methods.join(', ')}, OPTIONS`);
-        return new Response(null, { status: preflight.status, headers: newHeaders });
-      }
-      return new Response(null, { status: 204, headers: { allow: `${methods.join(', ')}, OPTIONS` } });
-    }
-  } else {
-    const exposed = matchExposedAction(state.actionIndex, method, path);
-    if (exposed) {
-      // Pass the onError sink (issue #239): an exposed REST handler that throws
-      // unexpectedly is reported to the APM hook before the sanitized 500, the
-      // same as the RPC action path (phase 'action' covers both server-action
-      // invocation shapes).
-      const onActionError = reportError ? (e) => reportError(e, req, 'action') : undefined;
-      const resp = await invokeExposedAction(state.actionIndex, exposed.route, exposed.params, req, onActionError);
-      return withCors(resp, exposed.route, req);
-    }
-  }
-
   // Static: /public/*
   if (path.startsWith('/public/') || path === '/favicon.ico') {
     const p = path === '/favicon.ico' ? '/public/favicon.ico' : path;

package/src/importmap.js

@@ -265,9 +265,9 @@ export function buildCoreEntries(coreDir, distMode) {
   /** @type {Record<string, string>} */
   const out = {
     // Bare specifier: browser-only entry, slim by design (drops
-    // render-server, expose, setCspNonceProvider). Node-side
-    // consumers resolve via the package.json exports `default`
-    // condition and land on `index.js` instead.
+    // render-server, setCspNonceProvider). Node-side consumers
+    // resolve via the package.json exports `default` condition and
+    // land on `index.js` instead.
     '@webjsdev/core': distMode
       ? '/__webjs/core/dist/webjs-core-browser.js'
       : '/__webjs/core/index-browser.js',