@webjsdev/server 0.8.48 → 0.8.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.48",
+  "version": "0.8.49",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

package/src/js-scan.js

@@ -432,7 +432,13 @@ export function maskComments(src) {
  */
 export function extractWebComponentClassBodies(content) {
   const bodies = [];
-  const re = /class\s+\w+\s+extends\s+WebComponent/g;
+  // The optional `(?:\s*<[^{}();]*?>)?` skips a TypeScript generic parameter
+  // list on the class name (`class Grid<T> extends WebComponent`), so a generic
+  // component is not missed (which would let elision wrongly strip an
+  // interactive component, the unsafe direction). The exclusion class keeps the
+  // generic from swallowing the class body / a call, and stops it staying
+  // within the type-parameter list (#753, found differentially).
+  const re = /class\s+\w+(?:\s*<[^{}();]*?>)?\s+extends\s+WebComponent/g;
   let m;
   while ((m = re.exec(content)) !== null) {
     let i = m.index + m[0].length;

package/src/listener-bun.js

@@ -238,6 +238,16 @@ async function bunUpgrade(req, srv, ctx) {
 
   const wrapper = new BunWsAdapter();
   const handlerReq = upgradeRequest(req, url);
+  // Stamp the framework-trusted socket IP on the handler request so a `WS`
+  // handler's `clientIp(req)` returns the real peer, not a spoofed inbound
+  // `x-webjs-remote-ip` (#778). `srv.requestIP` must be queried with Bun's
+  // ORIGINAL `req` (the rebuilt `handlerReq` is unknown to it); the WeakMap
+  // stamp then makes `handlerReq` authoritative. Mirrors `stampRemoteIp` on the
+  // fetch path (which strips + stamps `req` directly). `upgradeRequest` already
+  // dropped any inbound copy of the header.
+  let ip;
+  try { ip = srv.requestIP(req)?.address; } catch {}
+  setTrustedRemoteIp(handlerReq, ip || '');
   const ok = srv.upgrade(req, {
     data: { wrapper, mod, req: handlerReq, params: match.params, pathname: url.pathname },
   });
@@ -254,7 +264,14 @@ async function bunUpgrade(req, srv, ctx) {
  */
 function upgradeRequest(req, url) {
   const headers = new Headers();
-  req.headers.forEach((v, k) => { if (!k.startsWith(':')) headers.set(k, v); });
+  // Skip a client-supplied `x-webjs-remote-ip`: it is a framework-internal trust
+  // header the caller re-stamps via the authoritative WeakMap (#778). Copying it
+  // would let a client spoof `clientIp` inside the WS handler on the fallback
+  // header read.
+  req.headers.forEach((v, k) => {
+    if (k.startsWith(':') || k === 'x-webjs-remote-ip') return;
+    headers.set(k, v);
+  });
   return new Request(url, { method: 'GET', headers });
 }
 

package/src/module-graph.js

@@ -14,7 +14,7 @@
 import { readFile, readdir, stat } from 'node:fs/promises';
 import { existsSync, readFileSync } from 'node:fs';
 import { join, resolve, dirname, extname, sep } from 'node:path';
-import { redactStringsAndTemplates } from './js-scan.js';
+import { redactStringsAndTemplates, redactToPlaceholders } from './js-scan.js';
 
 /**
  * Per-appDir cache of the parsed `package.json "imports"` subpath-alias map
@@ -78,7 +78,7 @@ export function expandImportAlias(spec, appDir) {
 }
 
 /** @type {RegExp} match static `import … from '…'` and `import '…'` */
-const IMPORT_RE = /\bimport\s+(?:(?:[\w*{}\s,]+)\s+from\s+)?['"]([^'"]+)['"]/g;
+const IMPORT_RE = /\bimport\s+(?:(?:[\w*{}\s,]+)\s+from\s+)?['"]([^'"]+)['"]/gd;
 
 /**
  * @type {RegExp} match `export … from '…'` re-exports.
@@ -94,12 +94,16 @@ const IMPORT_RE = /\bimport\s+(?:(?:[\w*{}\s,]+)\s+from\s+)?['"]([^'"]+)['"]/g;
  *
  * Barrel files are common (`lib/index.ts` re-exports its siblings),
  * and the graph must follow these edges or downstream consumers of
- * the barrel see authorisation 404s on the underlying files. The
- * gap class excludes quotes and `;` (so the lazy match cannot cross
- * a statement boundary) but DOES allow newlines, so multi-line
- * brace lists are caught.
+ * the barrel see authorisation 404s on the underlying files. The gap
+ * class excludes quotes, `;`, AND the backtick but DOES allow newlines,
+ * so multi-line brace lists are caught. The primary defence against a
+ * stray `export` word inside a literal swallowing a real later edge is
+ * that `parseFile` scans over the FULLY-BLANKED mask (every comment /
+ * string / template / regex body blanked), so no keyword can anchor
+ * inside a literal at all (#753); the exclusions here are belt-and-
+ * suspenders on top of that.
  */
-const EXPORT_FROM_RE = /\bexport\b[^'";]+?\sfrom\s+['"]([^'"]+)['"]/g;
+const EXPORT_FROM_RE = /\bexport\b[^'";`]+?\sfrom\s+['"]([^'"]+)['"]/gd;
 
 /**
  * @type {RegExp} match a dynamic `import('…')` with a STRING-LITERAL specifier
@@ -118,7 +122,7 @@ const EXPORT_FROM_RE = /\bexport\b[^'";]+?\sfrom\s+['"]([^'"]+)['"]/g;
  * `import('./pages/' + name)` the char after the closing quote is `+`, neither
  * `,` nor `)`, so it does not match.
  */
-const DYNAMIC_IMPORT_RE = /\bimport\s*\(\s*['"]([^'"]+)['"]\s*[,)]/g;
+const DYNAMIC_IMPORT_RE = /\bimport\s*\(\s*['"]([^'"]+)['"]\s*[,)]/gd;
 
 /**
  * @typedef {Map<string, Set<string>>} ModuleGraph
@@ -459,16 +463,26 @@ async function parseFile(file, appDir, graph, seen, dynamic, bare) {
   // graph edge to whatever path that string names. Since this caller only
   // checks keyword-in-code-position, blank every literal body so a
   // code-example `import` string never becomes an edge.
+  // Scan for edges over the FULLY-BLANKED mask: every comment / string /
+  // template / regex body is blanked to spaces (delimiters kept), `${...}`
+  // holes stay as code. Reason (#753, found differentially): a stray `import` /
+  // `export` word inside a comment, template, OR regex literal must not anchor a
+  // lazy regex match (e.g. `EXPORT_FROM_RE`'s `[^'";`]+?`) that spans across the
+  // literal's closing delimiter and consumes the next real `from '<spec>'`,
+  // whose keyword then sits in the blanked literal and is dropped, silently
+  // losing the real edge (the gate then 404s a legitimately imported module).
+  // Scanning over the blanked mask means NO keyword can anchor inside any
+  // literal or comment at all, so the whole class of delimiter blind spots
+  // (comment, string, template, regex) is closed at once, and there is nothing
+  // left for a per-match position guard to reject. The specifier itself is a
+  // string (blanked here), so it is read back from raw `src` via the match's
+  // group indices (the `d` flag).
   const masked = redactStringsAndTemplates(src, true);
   const deps = new Set();
   /** @type {Set<string>} bare npm vendor specifiers imported by this file (#754) */
   const bareDeps = new Set();
   for (const re of [IMPORT_RE, EXPORT_FROM_RE]) {
-    for (const m of src.matchAll(re)) {
-      // m.index is the keyword start (`\bimport` / `\bexport`). If that
-      // position is blanked in the mask, the match lives inside a literal
-      // and is not a real import edge.
-      if (masked[m.index] === ' ') continue;
+    for (const m of masked.matchAll(re)) {
       // A statement-leading `import type { X }` / `import type * as X` /
       // `import type Foo` (default type import) / `export type { X }` /
       // `export type *` is fully erased by the TS stripper, so it never becomes
@@ -481,22 +495,17 @@ async function parseFile(file, appDir, graph, seen, dynamic, bare) {
       //     followed by `from` is NOT type-only.
       //   - a MIXED `import { type A, b }` does NOT lead with `type`, so it is
       //     kept (its `b` binding is a real runtime edge).
+      // (m[0] here is over the mask, which keeps the binding syntax verbatim.)
       // #805
       const lead = m[0];
       const typeOnly =
         /^(?:import|export)\s+type\s*[{*]/.test(lead) ||
         (/^import\s+type\s+[A-Za-z_$]/.test(lead) && !/^import\s+type\s+from\b/.test(lead));
       if (typeOnly) continue;
-      const spec = m[1];
-      // Guard a match whose `from '<spec>'` tail reaches INTO a blanked literal:
-      // EXPORT_FROM_RE's lazy `[^'";]+?` can span a template body to a `from`
-      // written inside example code (`export const t = html\`...import x from
-      // 'left-pad'\``), so the KEYWORD is real but the SPECIFIER is not. A real
-      // string keeps its delimiters in the mask (only the body blanks), while a
-      // template body blanks whole, so a blanked opening quote means the
-      // specifier is inside a literal and the match is spurious.
-      const quoteAt = m.index + m[0].length - spec.length - 2;
-      if (masked[quoteAt] === ' ') continue;
+      // The specifier is read from RAW src at the match's captured-group indices
+      // (the group is the blanked string body in the mask; its position is the
+      // real specifier in src).
+      const spec = src.slice(m.indices[1][0], m.indices[1][1]);
       // Only resolve relative imports + `#`-style subpath aliases (#555)
       // within the project. A bare npm specifier (dayjs) has no alias match
       // and is skipped FROM THE GRAPH, but recorded as a vendor edge so SSR
@@ -513,12 +522,30 @@ async function parseFile(file, appDir, graph, seen, dynamic, bare) {
   }
   // Dynamic `import('…')` with a string-literal specifier (#751): a separate
   // edge class so the gate admits the lazily-loaded module (no 404) without
-  // preloading it. Same redaction-mask + alias rules as the static scan. A
-  // target already statically imported is not duplicated as a dynamic edge.
+  // preloading it. A target already statically imported is not duplicated as a
+  // dynamic edge.
+  //
+  // The static scan above runs over the FULLY-BLANKED mask, which also blanks
+  // the code inside `${...}` template holes. That drops a dynamic import written
+  // directly inside a hole (`html\`${import('./x.ts')}\``), which the AST counts
+  // as an edge but the mask scan did not, so the gate 404s a legitimately-loaded
+  // module (#918, the admit-fewer direction of the #753 family). So the dynamic
+  // scan instead runs over the PLACEHOLDER redaction (#634), which keeps `${...}`
+  // hole code readable (so a hole-position `import(...)` IS seen) while still
+  // tokenizing string / template-TEXT bodies to `__STR_<idx>__` and blanking
+  // comment / regex bodies (so a dynamic import written as literal TEXT is NOT
+  // an edge). The #753 swallow class stays closed because `DYNAMIC_IMPORT_RE` is
+  // tightly anchored on `import(`, never a lazy cross-delimiter span. The
+  // specifier surfaces as a `__STR_<idx>__` token, recovered from `literals`; a
+  // computed `import(expr)` still falls out (its char after the quote is not
+  // `,`/`)`), preserving the documented limitation.
+  const { redacted: holeAware, literals } = redactToPlaceholders(src);
   const dynDeps = new Set();
-  for (const m of src.matchAll(DYNAMIC_IMPORT_RE)) {
-    if (masked[m.index] === ' ') continue;
-    const spec = m[1];
+  for (const m of holeAware.matchAll(DYNAMIC_IMPORT_RE)) {
+    const token = m[1];
+    const pm = /^__STR_(\d+)__$/.exec(token);
+    const spec = pm ? literals[Number(pm[1])] : token;
+    if (spec == null) continue;
     if (!spec.startsWith('.') && !spec.startsWith('/') && !expandImportAlias(spec, appDir)) continue;
     const resolved = resolveImport(spec, file, appDir);
     if (resolved && !deps.has(resolved)) dynDeps.add(resolved);

package/src/ssr.js

@@ -194,25 +194,30 @@ export async function ssrPage(route, params, url, opts) {
     // enter the viewport.
     const { eager: eagerComponents, lazy: lazyComponents } =
       componentPreloads(suspenseCtx.usedComponents, opts.appDir, opts.elidableComponents);
+    // The walk roots for BOTH preload passes are the BOOT's actually-shipped
+    // module set (`moduleUrls`, which already drops inert page/layout modules and
+    // substitutes an import-only page with its components), NOT the raw route
+    // entries `[route.file, ...route.layouts]`. Rooting at the raw entries would
+    // walk a dropped page's SSR-only subtree (a direct import OR a relative
+    // helper) and hint a `modulepreload` for a module nothing that ships imports,
+    // an over-fetch (#780, the app-module analog of the #754 vendor over-fetch).
+    const shippedRoots = moduleUrls.map((u) =>
+      resolve(opts.appDir, u.startsWith('/') ? u.slice(1) : u));
     const preloads = deduplicatedPreloads(
       eagerComponents,
       moduleUrls,
       opts.moduleGraph,
-      [route.file, ...route.layouts],
+      shippedRoots,
       opts.appDir,
       opts.serverFiles,
       opts.elidableComponents,
     );
     // Vendor modulepreload (#754): flatten the npm CDN waterfall by hinting the
     // vendor URLs the page's SHIPPED modules actually import, fetched in parallel
-    // instead of discovered level by level. The walk roots are the BOOT's shipped
-    // module set (`moduleUrls`, which already drops inert page/layout modules and
-    // substitutes an import-only page with its components) plus the rendered
-    // components, so a vendor reached ONLY through a dropped module (a page's
-    // SSR-only direct import OR its SSR-only relative helper) is never preloaded
-    // (no over-fetch).
-    const shippedRoots = moduleUrls.map((u) =>
-      resolve(opts.appDir, u.startsWith('/') ? u.slice(1) : u));
+    // instead of discovered level by level. Same shipped-module roots as the
+    // app-module walk above, so a vendor reached ONLY through a dropped module
+    // (a page's SSR-only direct import OR its SSR-only relative helper) is never
+    // preloaded (no over-fetch).
     const vendorPreloads = vendorPreloadTargets(
       reachedVendorSpecifiers(
         opts.moduleGraph,
@@ -1581,10 +1586,24 @@ function componentPreloads(usedTags, appDir, elidable) {
  * Merge component preloads with transitive dependencies from the module
  * graph, then deduplicate against the already-imported module URLs.
  *
+ * The walk ROOTS (`entryFiles`) are the boot's actually-SHIPPED page/layout
+ * module set (the caller passes the absolute paths of `moduleUrls`, which
+ * already drops an inert page/layout and substitutes an import-only page with
+ * its components), NOT the raw `[route.file, ...route.layouts]` route entries.
+ * This matches `reachedVendorSpecifiers`' roots so the two walks stay
+ * consistent. Rooting at the shipped set means a module reached ONLY through a
+ * dropped page/layout (its SSR-only direct app import OR its SSR-only relative
+ * helper) is never a walk root's dep, so it gets no `modulepreload` hint (no
+ * over-fetch, #780). A module that also ships some other way (a component shared
+ * with a live route, or reached via an import-only page's substituted
+ * components) is still reached through a real shipped root, so its hint stays
+ * (no under-fetch). `seen = new Set(moduleUrls)` already excludes the shipped
+ * modules' own URLs; the shipped-roots change closes the TRANSITIVE gap.
+ *
  * @param {string[]} componentUrls  direct component module URLs
  * @param {string[]} moduleUrls     boot script imports (page + layouts)
  * @param {import('./module-graph.js').ModuleGraph | undefined} graph
- * @param {string[]} entryFiles     absolute paths of page + layout files
+ * @param {string[]} entryFiles     absolute paths of the SHIPPED page/layout modules (from `moduleUrls`)
  * @param {string} appDir
  * @param {Set<string>} [elidableComponents]  absolute paths to skip in the walk
  * @returns {string[]}

package/src/websocket.js

@@ -4,6 +4,7 @@ import { urlFromRequest } from './forwarded.js';
 import { registerClient } from './broadcast.js';
 import { loadWsModule } from './listener-core.js';
 import { makeThenable } from './thenable-params.js';
+import { setTrustedRemoteIp } from './rate-limit.js';
 
 /**
  * WebSocket support.
@@ -106,7 +107,17 @@ function buildRequestFromUpgrade(req, url) {
   const headers = {};
   for (const [k, v] of Object.entries(req.headers)) {
     if (k.startsWith(':')) continue;
+    // Never copy an inbound `x-webjs-remote-ip`: it is a framework-internal
+    // trust header a client could spoof on the upgrade. The real socket IP is
+    // stamped below via the authoritative WeakMap (#778, the WS-seam analog of
+    // the #773 fetch-path IP-trust fix).
+    if (k === 'x-webjs-remote-ip') continue;
     headers[k] = Array.isArray(v) ? v.join(',') : String(v ?? '');
   }
-  return new Request(url, { method: 'GET', headers });
+  const webReq = new Request(url, { method: 'GET', headers });
+  // Stamp the framework-trusted socket IP so `clientIp(req)` inside the `WS`
+  // handler returns the real peer address (the WeakMap is authoritative and
+  // ignores the inbound header), matching the fetch path's `toWebRequest`.
+  setTrustedRemoteIp(webReq, req.socket?.remoteAddress || '');
+  return webReq;
 }