bosia 0.4.4 → 0.5.0

package/src/core/server.ts

@@ -1,7 +1,7 @@
 import { Elysia } from "elysia";
 
 import { existsSync, readFileSync } from "fs";
-import { join, resolve as resolvePath } from "path";
+import { join } from "path";
 
 import { findMatch, compileRoutes, canonicalPathname } from "./matcher.ts";
 import { apiRoutes, serverRoutes } from "bosia:routes";
@@ -14,10 +14,12 @@ compileRoutes(serverRoutes);
 import type { Handle, RequestEvent } from "./hooks.ts";
 import { HttpError, Redirect, ActionFailure } from "./errors.ts";
 import { CookieJar } from "./cookies.ts";
+import { safePath } from "./safePath.ts";
 import { checkCsrf } from "./csrf.ts";
 import type { CsrfConfig } from "./csrf.ts";
-import { getCorsHeaders, handlePreflight } from "./cors.ts";
+import { applyCorsVary, getCorsHeaders, handlePreflight } from "./cors.ts";
 import type { CorsConfig } from "./cors.ts";
+import { buildCspHeader, CSP_DIRECTIVES_TEMPLATE, CSP_ENABLED, generateNonce } from "./csp.ts";
 import { isDev, compress, isStaticPath } from "./html.ts";
 import { dedup, dedupKey } from "./dedup.ts";
 import {
@@ -93,6 +95,12 @@ if (_corsAllowedOrigins?.length) {
 	console.log(`🌐 CORS allowed origins: ${_corsAllowedOrigins.join(", ")}`);
 }
 
+// ─── CSP Config ──────────────────────────────────────────
+
+if (CSP_DIRECTIVES_TEMPLATE) {
+	console.log(`🔒 CSP: opt-in header active`);
+}
+
 // ─── Core Request Resolver ────────────────────────────────
 // This is the inner handler that hooks wrap around.
 
@@ -104,11 +112,21 @@ function isValidRoutePath(path: string, origin: string): boolean {
 	}
 }
 
-/** Resolve a file path and verify it stays within the allowed base directory. Returns null if traversal detected. */
-function safePath(base: string, untrusted: string): string | null {
-	const root = resolvePath(base);
-	const full = resolvePath(join(base, untrusted));
-	return full.startsWith(root + "/") || full === root ? full : null;
+/**
+ * Decode an `_invalidated` bitmask string. Char 0 = page, char i+1 = layout
+ * depth i, '1' = run, '0' = skip. Missing/extra chars default to run.
+ */
+function buildMaskFromBits(
+	bits: string,
+	layoutCount: number,
+): { page: boolean; layouts: boolean[] } {
+	const page = bits[0] !== "0";
+	const layouts: boolean[] = [];
+	for (let i = 0; i < layoutCount; i++) {
+		const c = bits[i + 1];
+		layouts.push(c !== "0");
+	}
+	return { page, layouts };
 }
 
 /** Extract action name from URL searchParams — `?/login` → "login", no slash key → "default". */
@@ -145,15 +163,41 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			return Response.json({ error: "Invalid path", status: 400 }, { status: 400 });
 		}
 		const routeUrl = new URL(routePathStr, url.origin);
+		let invalidatedBits: string | null = null;
 		for (const [key, val] of url.searchParams.entries()) {
+			if (key === "_invalidated") {
+				invalidatedBits = val;
+				continue;
+			}
 			routeUrl.searchParams.append(key, val);
 		}
 		// Rewrite event.url so logging middleware sees the real page path, not /__bosia/data
 		event.url = routeUrl;
 		try {
 			const pageMatch = findMatch(serverRoutes, routeUrl.pathname);
+			// Build mask from `?_invalidated=<bits>` where char 0 = page,
+			// char i+1 = layout depth i, '1' = run, '0' = skip. Absent → run all.
+			// Mask is sized to the total layout count (matching client `layoutIds`),
+			// not the count of layout servers, so depths without a server loader
+			// still occupy a bit position and stay aligned with the client.
+			const mask = invalidatedBits
+				? buildMaskFromBits(
+						invalidatedBits,
+						pageMatch?.route
+							? ((pageMatch.route as any).layoutModules?.length ?? 0)
+							: 0,
+					)
+				: undefined;
 			const runLoad = async () => {
-				const data = await loadRouteData(routeUrl, locals, request, cookies);
+				const data = await loadRouteData(
+					routeUrl,
+					locals,
+					request,
+					cookies,
+					null,
+					pageMatch,
+					mask,
+				);
 
 				let metadata = null;
 				if (pageMatch) {
@@ -175,12 +219,17 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				return { data, metadata, cookiesAccessed: (cookies as CookieJar).accessed };
 			};
 
-			// Dedup public routes by URL only. `(private)` scope routes (per-user content)
-			// skip the cache to prevent cross-user data leaks. See dedup.ts.
+			// Dedup public routes by URL + mask. `(private)` scope routes (per-user
+			// content) skip the cache to prevent cross-user data leaks. The mask is
+			// part of the key so concurrent requests for the same URL with different
+			// invalidation patterns don't collapse onto each other. See dedup.ts.
+			const dedupK = invalidatedBits
+				? `${dedupKey(routeUrl)}|m=${invalidatedBits}`
+				: dedupKey(routeUrl);
 			const result =
 				pageMatch?.route.scope === "private"
 					? await runLoad()
-					: await dedup(dedupKey(routeUrl), runLoad);
+					: await dedup(dedupK, runLoad);
 
 			const cookiesWereAccessed = (cookies as CookieJar).accessed || result.cookiesAccessed;
 			const cc = cookiesWereAccessed
@@ -359,6 +408,11 @@ async function resolve(event: RequestEvent): Promise<Response> {
 							`Action "${actionName}" not found`,
 							url,
 							request,
+							undefined,
+							undefined,
+							undefined,
+							undefined,
+							locals.nonce,
 						);
 					}
 
@@ -387,7 +441,17 @@ async function resolve(event: RequestEvent): Promise<Response> {
 									{ status: err.status },
 								);
 							}
-							return renderErrorPage(err.status, err.message, url, request);
+							return renderErrorPage(
+								err.status,
+								err.message,
+								url,
+								request,
+								undefined,
+								undefined,
+								undefined,
+								undefined,
+								locals.nonce,
+							);
 						}
 						throw err;
 					}
@@ -482,7 +546,18 @@ async function resolve(event: RequestEvent): Promise<Response> {
 
 	// SSR pages (+page.svelte) — streaming by default
 	const streamResponse = await renderSSRStream(url, locals, request, cookies, pageMatch);
-	if (!streamResponse) return renderErrorPage(404, "Not Found", url, request);
+	if (!streamResponse)
+		return renderErrorPage(
+			404,
+			"Not Found",
+			url,
+			request,
+			undefined,
+			undefined,
+			undefined,
+			undefined,
+			locals.nonce,
+		);
 	return streamResponse;
 }
 
@@ -518,13 +593,26 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 		}
 
 		const cookieJar = new CookieJar(request.headers.get("cookie") ?? "", isDev);
-		const event: RequestEvent = { request, url, locals: {}, params: {}, cookies: cookieJar };
+		const nonce = CSP_ENABLED ? generateNonce() : "";
+		const event: RequestEvent = {
+			request,
+			url,
+			locals: { nonce },
+			params: {},
+			cookies: cookieJar,
+		};
 		const response = userHandle ? await userHandle({ event, resolve }) : await resolve(event);
 
 		const headers = new Headers(response.headers);
 		for (const [k, v] of Object.entries(SECURITY_HEADERS)) headers.set(k, v);
-		// Apply CORS headers for allowed origins
+		const cspHeader = buildCspHeader(nonce);
+		if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
+		// Apply CORS headers for allowed origins. `Vary: Origin` is set whenever
+		// CORS is configured — even on responses to non-allowed origins — so
+		// downstream caches (CDNs, browser HTTP cache) key on the Origin header
+		// instead of serving an Access-Control-Allow-Origin response across origins.
 		if (CORS_CONFIG) {
+			applyCorsVary(headers);
 			const corsHeaders = getCorsHeaders(request, CORS_CONFIG);
 			if (corsHeaders) {
 				for (const [k, v] of Object.entries(corsHeaders)) headers.set(k, v);

package/src/lib/client.ts

@@ -10,3 +10,4 @@
 
 export { enhance } from "../core/client/enhance.ts";
 export type { SubmitFunction, ActionResult } from "../core/client/enhance.ts";
+export { invalidate, invalidateAll } from "../core/client/navigation.ts";

package/src/lib/index.ts

@@ -10,6 +10,7 @@ export type { HttpError, Redirect, RedirectOptions, ActionFailure } from "../cor
 export type {
 	RequestEvent,
 	LoadEvent,
+	LoaderDeps,
 	MetadataEvent,
 	Metadata,
 	Handle,