@zubra/actions 5.7.0 → 5.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zubra/actions",
-  "version": "5.7.0",
+  "version": "5.8.0",
   "description": "Serve Zubra components' 'use server' functions over plain form posts, enhanced to fetch when JavaScript loads.",
   "type": "module",
   "main": "./src/index.js",
@@ -30,8 +30,8 @@
     "test": "node --test \"test/*.test.js\""
   },
   "peerDependencies": {
-    "@zubra/compiler": "^5.7.0",
-    "@zubra/server": "^5.7.0"
+    "@zubra/compiler": "^5.8.0",
+    "@zubra/server": "^5.8.0"
   },
   "devDependencies": {
     "@zubra/compiler": "file:../compiler",

package/src/core.js

@@ -5,12 +5,41 @@ export const MOUNT = '/_zb/action/';
 export const SCRIPT_PATH = '/_zb/actions.js';
 export const COOKIE = '__zb_result';
 export const CLEAR = `${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+/** The largest post read by default: 10 MB, files and fields together. */
+export const MAX_BYTES = 10 * 1024 * 1024;
+/** What a function's caller gets for a post over the limit; the function doesn't run. */
+export const TOO_LARGE = Object.freeze({ error: 'Too large' });
 
 /**
  * `routes`: a Map of URL → function. `client`: the enhancing script's source, served at
  * SCRIPT_PATH, or null when the host serves it as a static file.
  */
-export function createActionsCore({ routes, client = null, origins = [], onError = (error) => console.error(error), context = () => ({}) }) {
+export function createActionsCore({ routes, client = null, origins = [], onError = (error) => console.error(error), context = () => ({}), maxBytes = MAX_BYTES }) {
+  if (!(maxBytes > 0)) throw new TypeError('@zubra/actions: `maxBytes` is the largest post to read, in bytes (Infinity for no limit)');
+  const over = Symbol('too large');
+  /** The post's fields and files, or `over` when it's bigger than maxBytes (counted as it's read). */
+  async function readForm(request) {
+    if (Number(request.headers.get('content-length')) > maxBytes) return over;
+    if (maxBytes === Infinity || !request.body) return request.formData();
+    let seen = 0;
+    let tooLarge = false;
+    const counted = request.body.pipeThrough(
+      new TransformStream({
+        transform(chunk, controller) {
+          seen += chunk.byteLength;
+          if (seen <= maxBytes) return controller.enqueue(chunk);
+          tooLarge = true;
+          controller.error(new RangeError('too large'));
+        },
+      }),
+    );
+    try {
+      return await new Response(counted, { headers: { 'content-type': request.headers.get('content-type') ?? '' } }).formData();
+    } catch (error) {
+      if (tooLarge) return over;
+      throw error;
+    }
+  }
   const allowed = (request) => {
     const site = request.headers.get('sec-fetch-site');
     if (site) return site === 'same-origin' || site === 'none';
@@ -41,13 +70,19 @@ export function createActionsCore({ routes, client = null, origins = [], onError
     if (!fn) return text(404, 'Not Found');
     const wantsJson = (request.headers.get('accept') ?? '').includes('application/json');
     let value;
-    let failed = false;
+    let status = 200;
     try {
-      const more = await context({ request, ...extra });
-      value = await fn(await request.formData(), { ...more, request });
+      const form = await readForm(request);
+      if (form === over) {
+        status = 413;
+        value = TOO_LARGE;
+      } else {
+        const more = await context({ request, ...extra });
+        value = await fn(form, { ...more, request });
+      }
     } catch (error) {
       onError(error, request);
-      failed = true;
+      status = 500;
       value = { error: 'Something went wrong' };
     }
     if (value instanceof Response) {
@@ -63,7 +98,7 @@ export function createActionsCore({ routes, client = null, origins = [], onError
     }
     if (wantsJson) {
       return new Response(JSON.stringify(value ?? null), {
-        status: failed ? 500 : 200,
+        status,
         headers: { 'content-type': 'application/json' },
       });
     }

package/src/edge.d.ts

@@ -16,6 +16,11 @@ export interface EdgeActionsOptions<Extra extends object = object> {
   origins?: string[];
   /** Called when a server function throws. The client gets a generic error either way. */
   onError?: (error: unknown, request: Request) => void;
+  /**
+   * The largest post read, files and fields together, in bytes: 10 MB by default, `Infinity` for
+   * no limit. A bigger one gets `{ error: 'Too large' }` (status 413) and the function doesn't run.
+   */
+  maxBytes?: number;
   /** What else a server function gets beside `request`; `extra` is fetch's second argument (`{ env, ctx }`). */
   context?: (from: { request: Request } & Extra) => object | Promise<object>;
 }

package/src/edge.js

@@ -18,7 +18,7 @@ export { MOUNT, SCRIPT_PATH, COOKIE } from './core.js';
  * `{ request, ...extra }`, where `extra` is fetch's second argument (`{ env, ctx }` in a Worker).
  * `origins`, `onError` as the Node entry's.
  */
-export function createActions({ actions, client = null, origins = [], onError = (error) => console.error(error), context = () => ({}) } = {}) {
+export function createActions({ actions, client = null, origins = [], onError = (error) => console.error(error), context = () => ({}), maxBytes } = {}) {
   if (!actions || typeof actions !== 'object') throw new TypeError("createActions({ actions }): pass `actions` from `zubra-actions build`'s index.js");
-  return createActionsCore({ routes: routesFrom(actions), client, origins, onError, context });
+  return createActionsCore({ routes: routesFrom(actions), client, origins, onError, context, maxBytes });
 }

package/src/index.d.ts

@@ -11,6 +11,11 @@ export interface ActionsOptions {
   origins?: string[];
   /** Called when a server function throws. The client gets a generic error either way. */
   onError?: (error: unknown, request: Request) => void;
+  /**
+   * The largest post read, files and fields together, in bytes: 10 MB by default, `Infinity` for
+   * no limit. A bigger one gets `{ error: 'Too large' }` (status 413) and the function doesn't run.
+   */
+  maxBytes?: number;
   /**
    * What else a server function gets beside `request`, per request: the signed-in user, a
    * database handle. `req` is Node's request (Node, Express, Fastify); `c` is Hono's context.

package/src/index.js

@@ -14,7 +14,8 @@
 // - Anything else (the browser's own post) gets 303 See Other back to the page it came from, with
 //   the return value in a one-use cookie, so the page can render it (`result()`).
 // - A cross-site post is refused (Origin / Sec-Fetch-Site), so forms on other sites can't call it.
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { createActionsCore, routesFrom, MOUNT, SCRIPT_PATH, COOKIE } from './core.js';
@@ -33,6 +34,8 @@ const CLIENT = readFileSync(new URL('./client.js', import.meta.url), 'utf8');
  * (bare imports resolve from there, so keep it inside the project). `origins`: other origins
  * allowed to post (behind a proxy that rewrites Origin, say). `onError(error, request)`: called
  * when a function throws; the client gets a generic error, never the message or stack.
+ * `maxBytes`: the largest post read, files and fields together (10 MB by default; `Infinity`
+ * for none). A bigger one gets `{ error: 'Too large' }` (413) and the function doesn't run.
  */
 export async function createActions({
   components = 'components',
@@ -40,6 +43,7 @@ export async function createActions({
   origins = [],
   onError = (error) => console.error(error),
   context = () => ({}),
+  maxBytes,
 } = {}) {
   const root = resolve(components);
   if (!existsSync(root)) throw new Error(`@zubra/actions: no components folder at ${root}`);
@@ -50,10 +54,14 @@ export async function createActions({
   for (const { path, output } of await serverHalves(root)) {
     const module = join(cacheDir, `${flatName(relative(root, path))}.server.mjs`);
     // The server half lives in the cache folder, so its relative imports point back at the source.
-    writeFileSync(module, rewriteImports(output, (specifier) => pathToFileURL(resolve(dirname(path), specifier)).href));
+    // Written beside it and renamed into place, so another process starting at the same moment
+    // (a second worker, a parallel test) never imports a half-written file and finds no actions.
+    const writing = `${module}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(writing, rewriteImports(output, (specifier) => pathToFileURL(resolve(dirname(path), specifier)).href));
+    renameSync(writing, module);
     maps.push((await import(`${pathToFileURL(module).href}?t=${Date.now()}`)).actions);
   }
-  const core = createActionsCore({ routes: routesFrom(...maps), client: CLIENT, origins, onError, context });
+  const core = createActionsCore({ routes: routesFrom(...maps), client: CLIENT, origins, onError, context, maxBytes });
 
   /** Node's http: answers ours and returns true, or returns false without reading the body. */
   async function handle(req, res) {
@@ -76,10 +84,39 @@ export function toRequest(req) {
     if (Array.isArray(value)) value.forEach((each) => headers.append(name, each));
     else if (value !== undefined) headers.set(name, value);
   }
-  const body = req.method === 'GET' || req.method === 'HEAD' ? undefined : req;
+  const body = req.method === 'GET' || req.method === 'HEAD' ? undefined : bodyOf(req);
   return new Request(`${protocol}://${host}${req.url}`, { method: req.method, headers, body, duplex: 'half' });
 }
 
+/**
+ * A Node request's body as a web stream. Cancelling it (a post over maxBytes) discards the rest
+ * rather than destroying the request, so the connection survives to carry the answer: a browser
+ * still sending gets it instead of a reset. Node discards what's left once the response ends.
+ */
+function bodyOf(req) {
+  let data;
+  return new ReadableStream({
+    start(controller) {
+      data = (chunk) => controller.enqueue(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength));
+      req.on('data', data);
+      req.once('end', () => {
+        try {
+          controller.close();
+        } catch {}
+      });
+      req.once('error', (error) => {
+        try {
+          controller.error(error);
+        } catch {}
+      });
+    },
+    cancel() {
+      req.off('data', data);
+      req.resume();
+    },
+  });
+}
+
 /** Write a fetch Response to a Node response. */
 export async function send(response, res) {
   res.statusCode = response.status;