akanjs 2.4.1 → 2.4.2-rc.1

package/server/routing/apiRouter.ts

@@ -1,11 +1,12 @@
 import { dayjs } from "akanjs/base";
-import type { Logger } from "akanjs/common";
+import { type Logger, websocketAuthContract } from "akanjs/common";
 import type { InjectRegistry } from "akanjs/service";
 import { Exception, type WebsocketReqData } from "akanjs/signal";
 import type { HmrWsData, HmrWsHub } from "../hmr/wsHub";
 import { copyBunRequestFields, type WebProxyRunner } from "../proxy";
 import { SignalResolver } from "../resolver";
 import type { HttpRoutes, SignalRouteOptions, WebsocketRoutes } from "../types";
+import { AppWsData } from "./appWsData";
 
 /**
  * Minimal render-state view the HMR WS hello message needs.
@@ -30,7 +31,7 @@ export interface ApiRouteInputs {
   routeOptions?: Record<string, SignalRouteOptions>;
   renderEnvRoutes: HttpRoutes;
   /** Upgrades the incoming request into an app-signal WebSocket. */
-  upgradeAppWs: (req: Request, data: { createdAt: number }) => boolean;
+  upgradeAppWs: (req: Request, data: AppWsData) => boolean;
   webProxyRunner?: WebProxyRunner | null;
 }
 
@@ -85,7 +86,7 @@ export class ApiRouter {
     const endpointPaths = new Set([...endpointEntries.map(([path]) => path), ...builtinEntries.map(([path]) => path)]);
     const routeTable = {
       [`${prefix}${websocketPrefix}` as "/api/ws"]: (req) => {
-        const upgraded = upgradeAppWs(req, { createdAt: Date.now() });
+        const upgraded = upgradeAppWs(req, AppWsData.fromRequest(req));
         if (upgraded) return;
         return new Response("Failed to upgrade to WebSocket", { status: 500 });
       },
@@ -138,6 +139,13 @@ export class ApiRouter {
           if (typeof message === "string") {
             const msg = JSON.parse(message) as WebsocketReqData;
             if (!msg.key) throw new Error("Message key is required");
+            if (msg.key === websocketAuthContract.key) {
+
+              AppWsData.applyCredential(AppWsData.of(ws), websocketAuthContract.readJwt(msg.data));
+              const revokedRooms = await SignalResolver.revalidateWsRooms(ws, registry);
+              ws.send(JSON.stringify(websocketAuthContract.makeAck(revokedRooms)));
+              return;
+            }
             const wsRoute = wsRoutes[msg.key];
             if (!wsRoute) throw new Error(`WebSocket route "${msg.key}" is not registered`);
             const eventType =

package/server/routing/appWsData.ts

@@ -0,0 +1,50 @@
+const CREDENTIAL_HEADERS = ["authorization", "cookie", "user-agent"] as const;
+
+/**
+ * Credential snapshot taken at the websocket handshake and carried on `ws.data` for the life of the
+ * socket, so auth middleware and guards can read the caller the same way they read an HTTP request.
+ * Only the credential headers are copied — retaining the whole `Request` would pin it for as long
+ * as the socket stays open.
+ */
+export class AppWsData {
+  static fromRequest(req: Request): AppWsData {
+    const headers = new Headers();
+    for (const key of CREDENTIAL_HEADERS) {
+      const value = req.headers.get(key);
+      if (value) headers.set(key, value);
+    }
+    return new AppWsData(headers);
+  }
+  static of(ws: Bun.ServerWebSocket<unknown>): AppWsData {
+    return ws.data as AppWsData;
+  }
+  /**
+   * Swaps the credential the socket authenticates with. Callers must run this synchronously on the
+   * auth frame: frames arrive in order, so a subscribe sent right after the credential must not be
+   * able to observe the previous one.
+   */
+  static applyCredential(data: AppWsData, jwt: string | null) {
+    if (jwt) data.headers.set("authorization", `Bearer ${jwt}`);
+    else {
+      data.headers.delete("authorization");
+      data.cookies.delete("jwt");
+      const cookie = [...data.cookies].map(([name, value]) => `${name}=${value}`).join("; ");
+      if (cookie) data.headers.set("cookie", cookie);
+      else data.headers.delete("cookie");
+    }
+    data.account = undefined;
+    data.resolvedAuthorization = undefined;
+  }
+  createdAt: number;
+  headers: Headers;
+  cookies: Bun.CookieMap;
+  account?: unknown;
+  /** The `authorization` value `account` was resolved from, so each frame need not re-verify it. */
+  resolvedAuthorization?: string;
+  socketId?: string;
+  constructor(headers: Headers) {
+    this.createdAt = Date.now();
+    this.headers = headers;
+    this.cookies = new Bun.CookieMap(headers.get("cookie") ?? "");
+  }
+}

package/server/rscClient.tsx

@@ -47,6 +47,7 @@ declare global {
     | undefined;
   var __AKAN_RSC_REFRESH__: ((options?: { buildId?: number }) => Promise<void>) | undefined;
   var __AKAN_RSC_CLEAR_CACHE__: (() => void) | undefined;
+  var __AKAN_RSC_IS_FROM_CACHE__: (() => boolean) | undefined;
   var __AKAN_DEV_SYNC_NAVIGATION__: ((href: string, kind: "push" | "replace" | "back" | "pop") => void) | undefined;
   var __AKAN_DEV_SYNC_NAVIGATION_APPLYING__: boolean | undefined;
   var __AKAN_GET_SYNC_ROUTE_HREF__: ((href: string) => string) | undefined;
@@ -299,8 +300,11 @@ let currentRouterState: AkanRouterStateV1 | null = initialRouterState;
 let currentSegmentTree: RscSegmentCacheNode | null = createAkanSegmentCacheTree(initialNode);
 let currentFullNode: RscCacheNode = initialNode;
 let currentCommitKind: "full" | "patch" = "full";
+let currentCommitFromCache = false;
 let navigationSeq = 0;
 
+globalThis.__AKAN_RSC_IS_FROM_CACHE__ = () => currentCommitFromCache;
+
 function rememberCommittedRouteState(node: RscCacheNode): void {
   rscPatchCache.clear();
   if (!node.routerState) return;
@@ -378,6 +382,7 @@ function Root(): ReactNode {
         maxEntries: MAX_RSC_CACHE_ENTRIES,
         startTransition,
         commitThenable: (node) => {
+          currentCommitFromCache = false;
           resetAkanSegmentOutletPatches();
           setThenable(node.thenable);
         },
@@ -397,6 +402,7 @@ function Root(): ReactNode {
     const scrollToTop = options.scrollToTop ?? true;
     try {
       let nextNode = rscCache.get(target);
+      const servedFromCache = !!nextNode;
       if (!nextNode) {
         const cachedPatch = rscPatchCache.get(target);
         if (cachedPatch) {
@@ -425,6 +431,7 @@ function Root(): ReactNode {
                 bumpScrollToTop: () => setScrollToTopTick((tick) => tick + 1),
               })
             ) {
+              currentCommitFromCache = true;
               rememberPatchedRouteState(patchResult.tree, patchResult.patchedNode);
               rememberRscPatchCacheNode(rscPatchCache, cachedPatch, MAX_RSC_CACHE_ENTRIES);
               return;
@@ -449,6 +456,7 @@ function Root(): ReactNode {
               bumpScrollToTop: () => setScrollToTopTick((tick) => tick + 1),
             })
           ) {
+            currentCommitFromCache = false;
             rememberPatchedRouteState(fetched.tree, fetched.patchedNode);
             const patchCacheNode = createRscPatchNavigationCacheNode({
               href: target,
@@ -493,6 +501,7 @@ function Root(): ReactNode {
         maxEntries: MAX_RSC_CACHE_ENTRIES,
         startTransition,
         commitThenable: (node) => {
+          currentCommitFromCache = servedFromCache;
           resetAkanSegmentOutletPatches();
           setThenable(node.thenable);
         },