@webjsdev/server 0.8.67 → 0.8.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.67",
+  "version": "0.8.69",
   "type": "module",
   "description": "The server for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Provides the file-based router, SSR, server actions, route handlers, middleware, and live reload on Node 24+ or Bun.",
   "main": "index.js",

package/src/auth.js

@@ -15,6 +15,10 @@ const enc = new TextEncoder();
 const dec = new TextDecoder();
 const AUTH_COOKIE = 'webjs.auth';
 const STATE_COOKIE = 'webjs.auth.state';
+// Carries the post-sign-in target across the OAuth round trip (#1495). Signed
+// with the auth secret and short-lived (the same 10 minutes as the state
+// cookie), so the callback only ever lands on a path this app chose.
+const REDIRECT_COOKIE = 'webjs.auth.redirect';
 const DEFAULT_MAX_AGE = 30 * 24 * 60 * 60; // 30 days (seconds)
 
 // -- Web Crypto helpers -----------------------------------------------------
@@ -65,6 +69,27 @@ function randomId() {
   return b64url(bytes.buffer);
 }
 
+/**
+ * Accept a post-sign-in target only when it is a same-origin local path: one
+ * leading `/`, the next character neither `/` nor `\` (both make a
+ * protocol-relative URL a browser follows off-site), and no control
+ * characters or whitespace a browser might strip before resolving. Anything
+ * else returns `null` and the caller falls back to its default. A bad value is
+ * DROPPED, never repaired, since a repaired open redirect is still one.
+ *
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+function safeRedirectPath(value) {
+  if (typeof value !== 'string') return null;
+  if (value.length === 0 || value.length > 2048) return null;
+  if (value[0] !== '/') return null;
+  if (value[1] === '/' || value[1] === '\\') return null;
+  // eslint-disable-next-line no-control-regex
+  if (/[\u0000-\u001f\u007f\s\\]/.test(value)) return null;
+  return value;
+}
+
 // -- Cookie helpers ---------------------------------------------------------
 
 /** @param {string} header @returns {Record<string,string>} */
@@ -290,11 +315,16 @@ export function createAuth(config) {
         if (ok === false) return new Response(null, { status: 302, headers: { location: pages.error || '/?error=AccessDenied' } });
       }
       const cookie = await writeSession(user);
-      const redirectTo = opts.redirectTo || (data && data.redirectTo) || '/';
+      // `opts.redirectTo` is the app's own server-side choice and is trusted.
+      // `data.redirectTo` usually arrives from a submitted form, so it goes
+      // through the same local-path check the OAuth flow uses (#1495).
+      const redirectTo = opts.redirectTo || safeRedirectPath(data && data.redirectTo) || '/';
       return new Response(null, { status: 302, headers: { location: /** @type {string} */ (redirectTo), 'set-cookie': cookie } });
     }
 
-    if (provider.type === 'oauth') return oauthRedirect(provider, opts);
+    if (provider.type === 'oauth') {
+      return oauthRedirect(provider, { ...opts, redirectTo: opts.redirectTo || (data && data.redirectTo) });
+    }
     return new Response('Unsupported provider type', { status: 400 });
   }
 
@@ -332,9 +362,30 @@ export function createAuth(config) {
     const hdrs = new Headers();
     hdrs.set('location', url.toString());
     hdrs.append('set-cookie', setCookie(STATE_COOKIE, await sign(state, secret), 600_000, secure()));
+    // The post-sign-in target rides in its own signed cookie (#1495). With no
+    // valid target, any leftover cookie from an abandoned earlier attempt is
+    // cleared so it cannot steer this sign-in somewhere stale.
+    const target = safeRedirectPath(opts.redirectTo);
+    hdrs.append('set-cookie', target
+      ? setCookie(REDIRECT_COOKIE, await sign(target, secret), 600_000, secure())
+      : clearCookie(REDIRECT_COOKIE));
     return new Response(null, { status: 302, headers: hdrs });
   }
 
+  /**
+   * Read the signed post-sign-in target the redirect leg stored, re-checking it
+   * as a local path (defence in depth: the signature proves this app wrote it,
+   * the check proves it is still a safe target). Null when absent or invalid.
+   *
+   * @param {Request} req
+   * @returns {Promise<string | null>}
+   */
+  async function readRedirectCookie(req) {
+    const raw = parseCookies(req.headers.get('cookie') || '')[REDIRECT_COOKIE];
+    if (!raw) return null;
+    return safeRedirectPath(await unsign(raw, secret));
+  }
+
   async function oauthCallback(req, provider) {
     const url = new URL(req.url);
     const code = url.searchParams.get('code');
@@ -376,13 +427,20 @@ export function createAuth(config) {
 
     if (cb.signIn) {
       const ok = await cb.signIn({ user, account: { provider: provider.id, accessToken } });
-      if (ok === false) return new Response(null, { status: 302, headers: { location: pages.error || '/?error=AccessDenied' } });
+      if (ok === false) {
+        const denied = new Headers();
+        denied.set('location', pages.error || '/?error=AccessDenied');
+        denied.append('set-cookie', clearCookie(STATE_COOKIE));
+        denied.append('set-cookie', clearCookie(REDIRECT_COOKIE));
+        return new Response(null, { status: 302, headers: denied });
+      }
     }
 
     const hdrs = new Headers();
-    hdrs.set('location', '/');
+    hdrs.set('location', (await readRedirectCookie(req)) || '/');
     hdrs.append('set-cookie', await writeSession(user));
     hdrs.append('set-cookie', clearCookie(STATE_COOKIE));
+    hdrs.append('set-cookie', clearCookie(REDIRECT_COOKIE));
     return new Response(null, { status: 302, headers: hdrs });
   }
 
@@ -401,7 +459,7 @@ export function createAuth(config) {
     if (seg[0] === 'signin' && seg[1]) {
       const p = providers.get(seg[1]);
       if (!p || p.type !== 'oauth') return new Response('Unknown OAuth provider', { status: 404 });
-      return oauthRedirect(p, { req });
+      return oauthRedirect(p, { req, redirectTo: new URL(req.url).searchParams.get('redirectTo') });
     }
     if (seg[0] === 'callback' && seg[1]) {
       const p = providers.get(seg[1]);
@@ -423,28 +481,31 @@ export function createAuth(config) {
     if (seg[0] === 'signin' && seg[1]) {
       const provider = providers.get(seg[1]);
       if (!provider) return new Response('Unknown provider', { status: 404 });
-      if (provider.type === 'credentials') {
-        // Bounded body read (issue #237): the credentials sign-in endpoint is
-        // public and unauthenticated, so cap its body to defend against
-        // memory exhaustion. Credentials are small fixed-shape JSON / form
-        // data, so the JSON / RPC limit applies. An over-limit body is a 413
-        // before any parse, and is never buffered whole (see body-limit.js).
-        const limits = getBodyLimits();
-        const limit = limits ? limits.json : DEFAULT_MAX_BODY_BYTES;
-        let body = {};
-        const ct = req.headers.get('content-type') || '';
-        if (ct.includes('json')) {
-          const { tooLarge, text } = await readTextBounded(req, limit);
-          if (tooLarge) return payloadTooLarge();
-          body = text ? JSON.parse(text) : {};
-        } else if (ct.includes('form')) {
-          const { tooLarge, formData } = await readFormDataBounded(req, limit);
-          if (tooLarge) return payloadTooLarge();
-          for (const [k, v] of formData.entries()) body[k] = v;
-        }
-        return signInFn('credentials', body, { req });
+      // Bounded body read (issue #237): the sign-in endpoint is public and
+      // unauthenticated, so cap its body to defend against memory exhaustion.
+      // Credentials (and an OAuth form's `redirectTo`, #1495) are small
+      // fixed-shape JSON / form data, so the JSON / RPC limit applies. An
+      // over-limit body is a 413 before any parse, and is never buffered
+      // whole (see body-limit.js).
+      const limits = getBodyLimits();
+      const limit = limits ? limits.json : DEFAULT_MAX_BODY_BYTES;
+      /** @type {Record<string, unknown>} */
+      let body = {};
+      const ct = req.headers.get('content-type') || '';
+      if (ct.includes('json')) {
+        const { tooLarge, text } = await readTextBounded(req, limit);
+        if (tooLarge) return payloadTooLarge();
+        body = text ? JSON.parse(text) : {};
+      } else if (ct.includes('form')) {
+        const { tooLarge, formData } = await readFormDataBounded(req, limit);
+        if (tooLarge) return payloadTooLarge();
+        for (const [k, v] of formData.entries()) body[k] = v;
+      }
+      if (provider.type === 'credentials') return signInFn('credentials', body, { req });
+      if (provider.type === 'oauth') {
+        const redirectTo = body.redirectTo ?? new URL(req.url).searchParams.get('redirectTo');
+        return oauthRedirect(provider, { req, redirectTo });
       }
-      if (provider.type === 'oauth') return oauthRedirect(provider, { req });
     }
     if (seg[0] === 'signout') return signOutFn({ req });
     return new Response('Not found', { status: 404 });

package/src/dev/config.js

@@ -317,6 +317,28 @@ export async function readDevWatchPathsFromApp(appDir) {
   return out;
 }
 
+/**
+ * The dev tooling switches in `webjs.dev` (#1504): `embedOrigins` (the embed
+ * bridge, #1498) and `sourceLocations` (#1499). Raw values; the env overrides
+ * and validation live with each feature (`resolveEmbedOrigins`,
+ * `sourceLocationsRequested`). A missing or unreadable package.json is both
+ * off.
+ *
+ * @param {string} appDir
+ * @returns {Promise<{ embedOrigins: unknown, sourceLocations: unknown }>}
+ */
+export async function readDevToolingFromApp(appDir) {
+  let dev;
+  try {
+    const pkg = JSON.parse(await readFile(join(appDir, 'package.json'), 'utf8'));
+    dev = pkg && pkg.webjs && pkg.webjs.dev;
+  } catch {
+    dev = undefined;
+  }
+  if (!dev || typeof dev !== 'object') return { embedOrigins: undefined, sourceLocations: undefined };
+  return { embedOrigins: dev.embedOrigins, sourceLocations: dev.sourceLocations };
+}
+
 /**
  * Resolve the node:http server timeouts (issue #237) from the app's
  * package.json `webjs.requestTimeoutMs` / `webjs.headersTimeoutMs` /

package/src/dev/handler.js

@@ -1,5 +1,5 @@
 import { readFile } from 'node:fs/promises';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -16,6 +16,8 @@ import {
   buildActionIndex,
 } from '../actions.js';
 import { registerActionHooks } from '../action-seed.js';
+import { sourceLocationsRequested } from '../dev-source-locations.js';
+import { registerSourceLocationHook } from '../dev-source-locations-hook.js';
 import { readRegenerateRules, isRegenerateOutputPath } from '../dev-regenerate.js';
 import { classifyChangedPath } from '../dev-classify.js';
 import { ensureStripper } from '../ts-strip.js';
@@ -39,6 +41,7 @@ import { setAssetUrlProvider, setFormActionResolver } from '@webjsdev/core';
 import { resolveActionIdentity } from '../form-action-identity.js';
 import { setAssetRoots, clearAssetHashCache, setElisionFingerprint, withAssetHash, assetHashFor, resolveAssetUrl } from '../asset-hash.js';
 import { applySecurityHeaders, webRequestIsHttps } from '../headers.js';
+import { resolveEmbedOrigins, setEmbedOrigins, allowEmbedFraming } from '../dev-embed.js';
 import {
   applyRedirects,
   applyTrailingSlash,
@@ -59,6 +62,7 @@ import {
   readAllowedOriginsFromApp,
   readCspConfigFromApp,
   readBodyLimitsFromApp,
+  readDevToolingFromApp,
 } from './config.js';
 import {
   exists, kebab, resolveRequestId, shouldAccessLog, loadAppEnv, collectRouteModules,
@@ -213,6 +217,16 @@ export async function createRequestHandler(opts) {
   // analysis pass re-reads it each rebuild so a dev toggle takes effect live.
   setClientRouterEnabled(await readClientRouterEnabled(appDir));
 
+  // Dev embed bridge (#1498): `WEBJS_EMBED_ORIGINS` (or `webjs.dev.embedOrigins`) lets the listed parent
+  // origins frame this dev server and receive the bridge's messages. Read once
+  // here, and only in dev, so a production handler records no origins and
+  // neither injects the script nor relaxes a framing header.
+  // `webjs.dev.embedOrigins` in package.json is the default (#1504); a set
+  // env var replaces it for one run.
+  const devTooling = dev ? await readDevToolingFromApp(appDir) : { embedOrigins: undefined, sourceLocations: undefined };
+  const embedOriginsValue = dev ? resolveEmbedOrigins(process.env.WEBJS_EMBED_ORIGINS, devTooling.embedOrigins) : [];
+  setEmbedOrigins(embedOriginsValue);
+
   const coreDir = locateCoreDir(appDir);
   // Switch the importmap between dist/ bundles and src/ per-file
   // URLs depending on whether the resolved @webjsdev/core install
@@ -278,6 +292,21 @@ export async function createRequestHandler(opts) {
   // on seeding would mean `webjs.seed: false` silently broke every no-JS form.
   await registerActionHooks({ seed: await readSeedEnabled(appDir), dev });
 
+  // Dev source locations (#1499): `WEBJS_SOURCE_LOCATIONS=1` (or
+  // `webjs.dev.sourceLocations: true`) under `webjs dev`
+  // stamps `data-webjs-src="<file>:<line>"` on the element opening tags of the
+  // app's `html` templates. Read once (the SSR load hook is process-global and
+  // cannot be uninstalled), never in prod. The browser half reads
+  // `state.sourceLocations` in serve.js; the SSR half is this load hook, which
+  // must be in place before any app module is imported.
+  // `webjs.dev.sourceLocations` is the default (#1504); the env var wins.
+  const sourceLocations = dev && sourceLocationsRequested(process.env, devTooling.sourceLocations);
+  if (sourceLocations) {
+    registerSourceLocationHook(appDir);
+    // Module URLs are realpaths, so a symlinked app dir registers both forms.
+    try { const real = realpathSync(appDir); if (real !== appDir) registerSourceLocationHook(real); } catch { /* keep appDir only */ }
+  }
+
   // When an app commits a vendor pin (.webjs/vendor/importmap.json) it carries a
   // deterministic vendor map that is cheap to read (one file, no analysis, no
   // network). Resolve it AT BOOT and publish the build id immediately so the
@@ -430,6 +459,9 @@ export async function createRequestHandler(opts) {
     // settings (a multi-tenant embedder, or the differential elision test)
     // must not share it, or the second would serve the first's elided source.
     tsCache: new Map(),
+    // Dev source locations (#1499), fixed for the handler's lifetime, so the
+    // per-handler tsCache above never mixes annotated and plain bytes.
+    sourceLocations,
     // The most recent unresolved dev error frame (#264), or null. Pushed to the
     // SSE channel for the live overlay and replayed to a freshly-connected tab.
     // Dev-only (never populated when !dev); cleared on a successful rebuild.
@@ -996,6 +1028,12 @@ export async function createRequestHandler(opts) {
         }
       }
 
+      // Dev embed bridge (#1498): let the allowed origins frame the page. Runs
+      // after every header source above (defaults, webjs.headers, middleware,
+      // the CSP), so it overrides them all, which is the point: the variable
+      // is the developer saying "this dev server is framed by these origins".
+      if (embedOriginsValue.length) allowEmbedFraming(merged.headers, embedOriginsValue);
+
       // Server HTML cache write (#241): if the SSR marked this response as a
       // cache candidate (an opted-in `revalidate` page), store the FINAL body
       // now, after segment middleware has added any per-user Set-Cookie (which

package/src/dev/serve.js

@@ -28,6 +28,7 @@ import { stripTypeScript } from '../ts-strip.js';
 import { serveDownloadedBundle } from '../vendor.js';
 import { resolveImport } from '../module-graph.js';
 import { elideImportsFromSource } from '../component-elision.js';
+import { annotateSourceLocations, isSourceLocationCandidate, sourceLocationFile } from '../dev-source-locations.js';
 import { basePath } from '../importmap.js';
 import { withBasePath } from '../base-path.js';
 import { versionModuleImports } from '../asset-hash.js';
@@ -322,6 +323,9 @@ export async function handleCore(req, ctx) {
         moduleGraph: state.moduleGraph,
         elidableComponents: state.elidableComponents,
         appDir,
+        // Dev source locations (#1499): annotate the served module's `html`
+        // templates exactly as the SSR load hook annotates the server's copy.
+        sourceLocations: state.sourceLocations === true,
       };
       // A `?v=<hash>` app-module request is content-addressed -> immutable
       // (#243); an un-fingerprinted request keeps the 1h fallback.
@@ -691,7 +695,7 @@ export async function jsModuleResponse(abs, dev, elideOpts, immutable) {
   try { source = await readFile(abs, 'utf8'); }
   catch { return new Response('Not found', { status: 404 }); }
   let code = elideImportsFromSource(
-    source, abs, elideOpts.moduleGraph, elideOpts.elidableComponents, resolveImport, elideOpts.appDir,
+    annotateServedModule(source, abs, elideOpts), abs, elideOpts.moduleGraph, elideOpts.elidableComponents, resolveImport, elideOpts.appDir,
   );
   // Version same-origin relative import specifiers so the URL the browser
   // fetches matches the `?v=`-versioned modulepreload + boot specifier (#369).
@@ -707,6 +711,24 @@ export async function jsModuleResponse(abs, dev, elideOpts, immutable) {
   return new Response(code, { status: 200, headers });
 }
 
+/**
+ * Dev source locations (#1499): stamp `data-webjs-src` on the element opening
+ * tags of a served app module's `html` templates, the same transform the SSR
+ * load hook applies to the server's copy, so the two renders agree. A no-op
+ * unless the handler was built with `WEBJS_SOURCE_LOCATIONS=1` under dev, and
+ * for any module outside the app or under `node_modules`. Runs on the stripped
+ * code, which keeps every line where the source had it.
+ *
+ * @param {string} code
+ * @param {string} abs
+ * @param {{ appDir: string, sourceLocations?: boolean } | undefined} opts
+ * @returns {string}
+ */
+function annotateServedModule(code, abs, opts) {
+  if (!opts || !opts.sourceLocations || !isSourceLocationCandidate(abs, opts.appDir)) return code;
+  return annotateSourceLocations(code, sourceLocationFile(abs, opts.appDir));
+}
+
 /**
  * Strip TypeScript types from `source` via Node's built-in
  * `module.stripTypeScriptTypes`. Position-preserving whitespace
@@ -815,6 +837,7 @@ export async function tsResponse(abs, dev, elideOpts, cache, immutable, reportDe
     throw err;
   }
   if (elideOpts) {
+    code = annotateServedModule(code, abs, elideOpts);
     code = elideImportsFromSource(
       code, abs, elideOpts.moduleGraph, elideOpts.elidableComponents, resolveImport, elideOpts.appDir,
     );