bosia 0.8.3 → 0.8.5

package/src/core/server.ts

@@ -24,15 +24,19 @@ import { buildCspHeader, CSP_DIRECTIVES_TEMPLATE, CSP_ENABLED, generateNonce } f
 import { isDev, compress, isStaticPath } from "./html.ts";
 import { dev500WithPlugins } from "./dev-500.ts";
 import { OUT_DIR } from "./paths.ts";
-import { buildStaticManifest, lookupStatic } from "./staticManifest.ts";
-import { dedup, dedupKey } from "./dedup.ts";
+import { buildPrerenderManifest, buildStaticManifest, lookupStatic } from "./staticManifest.ts";
+import { dedup } from "./dedup.ts";
 import {
 	CACHE_ENABLED,
+	CACHE_KEYS,
+	CACHE_MAX_BODY_BYTES,
 	buildCompressedVariants,
 	cacheGet,
 	cacheSet,
+	coalesceMiss,
 	computeCacheKey,
 	serveCached,
+	warnUncoveredCookies,
 } from "./cache.ts";
 import { reportDevErrorFromCatch } from "./devErrorReport.ts";
 import {
@@ -187,6 +191,7 @@ function parseActionName(url: URL): string {
 // Dev keeps the per-request fallthrough so files dropped into `public/` mid-session
 // are served without a restart (dev's watcher doesn't fire on `public/`).
 const staticManifest = isDev ? null : buildStaticManifest(OUT_DIR);
+const prerenderManifest = isDev ? null : buildPrerenderManifest(OUT_DIR);
 
 async function resolve(event: RequestEvent): Promise<Response> {
 	const { request, url, locals, cookies } = event;
@@ -284,15 +289,18 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				return { data, metadata, cookiesAccessed: (cookies as CookieJar).accessed };
 			};
 
-			// Dedup public routes by URL + mask. `(private)` scope routes (per-user
-			// content) skip the cache to prevent cross-user data leaks. The mask is
-			// part of the key so concurrent requests for the same URL with different
-			// invalidation patterns don't collapse onto each other. See dedup.ts.
-			const dedupK = invalidatedBits
-				? `${dedupKey(routeUrl)}|m=${invalidatedBits}`
-				: dedupKey(routeUrl);
-			const result =
-				pageMatch?.route.scope === "private" ? await runLoad() : await dedup(dedupK, runLoad);
+			// Dedup concurrent identical requests. The key includes the CACHE_KEYS
+			// identity hash, so different users never share a loader result — same
+			// isolation contract as the response cache. The mask is part of the key
+			// so concurrent requests for the same URL with different invalidation
+			// patterns don't collapse onto each other. See dedup.ts.
+			const dedupK =
+				computeCacheKey(routeUrl, request, cookies as CookieJar) +
+				(invalidatedBits ? `|m=${invalidatedBits}` : "");
+			const result = await dedup(dedupK, runLoad);
+			// Identity only covers CACHE_KEYS — warn if a loader read a session
+			// cookie outside that list (dedup could then mix users' results).
+			warnUncoveredCookies(cookies);
 
 			const cookiesWereAccessed = (cookies as CookieJar).accessed || result.cookiesAccessed;
 			const cc = cookiesWereAccessed ? "private, no-cache" : "public, max-age=0, must-revalidate";
@@ -359,6 +367,10 @@ async function resolve(event: RequestEvent): Promise<Response> {
 	// `.webp` URLs that would otherwise be intercepted by isStaticPath).
 	const apiMatch = await resolveApiMatch(apiRoutes, path);
 	if (apiMatch) {
+		// INVARIANT: once set, releaseApiMiss must fire exactly once — a missed
+		// release() hangs coalesced waiters for the process lifetime. The cache
+		// write path hands it off to its microtask by nulling it first.
+		let releaseApiMiss: (() => void) | null = null;
 		try {
 			const mod = await apiMatch.route.module();
 			const handler = mod[method];
@@ -383,10 +395,20 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				CACHE_ENABLED && !CSP_ENABLED && (mod as any).cache !== false && method === "GET";
 			let apiCacheKey: string | null = null;
 			if (apiCacheable) {
-				apiCacheKey = computeCacheKey(url, request, cookies);
+				apiCacheKey = computeCacheKey(url, request, cookies as CookieJar);
 				if (!url.searchParams.has("_invalidated")) {
 					const hit = cacheGet(apiCacheKey);
 					if (hit) return serveCached(hit, request);
+					// Miss coalescing: first miss runs the handler; concurrent misses
+					// wait, re-check the cache, and on a still-miss run independently.
+					const gate = coalesceMiss(apiCacheKey);
+					if (gate.wait) {
+						await gate.wait;
+						const rehit = cacheGet(apiCacheKey);
+						if (rehit) return serveCached(rehit, request);
+					} else {
+						releaseApiMiss = gate.release;
+					}
 				}
 			}
 
@@ -433,23 +455,36 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				const extraHeaders = captureCacheableHeaders(response.headers);
 				const contentType = responseContentType || "application/octet-stream";
 				const keyForWrite = apiCacheKey;
+				// Hand the gate release to the write microtask: waiters resume only
+				// after the cacheSet attempt, so their re-check hits.
+				const rel = releaseApiMiss;
+				releaseApiMiss = null;
 				queueMicrotask(async () => {
 					try {
 						const buf = new Uint8Array(await cloned.arrayBuffer());
+						// Oversized bodies skip early so they never pay compression;
+						// cacheSet re-checks as the authoritative guard.
+						if (CACHE_MAX_BODY_BYTES > 0 && buf.length > CACHE_MAX_BODY_BYTES) return;
 						const { gzip, brotli } = buildCompressedVariants(buf);
 						// API endpoints have no LoaderDeps in v0.6 — invalidation is
 						// URL/prefix only. See ROADMAP for deferred tag support.
-						cacheSet(keyForWrite, {
-							raw: buf,
-							gzip,
-							brotli,
-							contentType,
-							status: 200,
-							extraHeaders,
-							tags: [],
-						});
+						cacheSet(
+							keyForWrite,
+							{
+								raw: buf,
+								gzip,
+								brotli,
+								contentType,
+								status: 200,
+								extraHeaders,
+								tags: [],
+							},
+							cookies,
+						);
 					} catch {
 						/* drop silently — cache population is best-effort */
+					} finally {
+						rel?.();
 					}
 				});
 			}
@@ -480,6 +515,8 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				});
 			}
 			return Response.json({ error: "Internal Server Error" }, { status: 500 });
+		} finally {
+			releaseApiMiss?.();
 		}
 	}
 
@@ -497,11 +534,18 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			return new Response("Not Found", { status: 404 });
 		}
 		// Dev: keep the per-request fallthrough so files dropped into `public/`
-		// mid-session are served without a restart.
-		if (path.startsWith("/dist/client/")) {
+		// mid-session are served without a restart. Decode once — filenames on
+		// disk are raw; safePath still runs after so traversal stays blocked.
+		let decodedPath: string;
+		try {
+			decodedPath = decodeURIComponent(path);
+		} catch {
+			return new Response("Not Found", { status: 404 });
+		}
+		if (decodedPath.startsWith("/dist/client/")) {
 			const resolved = safePath(
 				`${OUT_DIR}/client`,
-				path.split("?")[0].slice("/dist/client".length),
+				decodedPath.split("?")[0].slice("/dist/client".length),
 			);
 			if (resolved) {
 				const file = Bun.file(resolved);
@@ -511,17 +555,17 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			}
 			return new Response("Not Found", { status: 404 });
 		}
-		const pubPath = safePath("./public", path);
+		const pubPath = safePath("./public", decodedPath);
 		if (pubPath) {
 			const pub = Bun.file(pubPath);
 			if (await pub.exists()) return new Response(pub);
 		}
-		const distPath = safePath(OUT_DIR, path);
+		const distPath = safePath(OUT_DIR, decodedPath);
 		if (distPath) {
 			const dist = Bun.file(distPath);
 			if (await dist.exists()) return new Response(dist);
 		}
-		const staticPath = safePath(`${OUT_DIR}/static`, path);
+		const staticPath = safePath(`${OUT_DIR}/static`, decodedPath);
 		if (staticPath) {
 			const staticFile = Bun.file(staticPath);
 			if (await staticFile.exists()) return new Response(staticFile);
@@ -535,22 +579,18 @@ async function resolve(event: RequestEvent): Promise<Response> {
 	// in dev would mask errors (the badge stays empty, the SSE reload script
 	// isn't injected, and the page can't auto-recover when the source is fixed).
 	// Live SSR every request in dev so /about behaves like every other route.
-	if (!isDev) {
-		// Try both `<path>/index.html` (always/ignore mode) and `<path>.html` (never mode)
-		const prerenderCandidates =
-			path === "/" ? ["index.html"] : [`${path}/index.html`, `${path.replace(/\/$/, "")}.html`];
-		for (const candidate of prerenderCandidates) {
-			const prerenderPath = safePath(`${OUT_DIR}/prerendered`, candidate);
-			if (!prerenderPath) continue;
-			const prerenderFile = Bun.file(prerenderPath);
-			if (await prerenderFile.exists()) {
-				return new Response(prerenderFile, {
-					headers: {
-						"Content-Type": "text/html; charset=utf-8",
-						"Cache-Control": "public, max-age=3600",
-					},
-				});
-			}
+	if (prerenderManifest) {
+		// Keys come from a boot-time walk of `dist/prerendered/`, not from the
+		// URL, so no safePath needed — a non-matching path is just a miss.
+		const key = path === "/" ? "/" : path.replace(/\/$/, "");
+		const abs = prerenderManifest.get(key);
+		if (abs) {
+			return new Response(Bun.file(abs), {
+				headers: {
+					"Content-Type": "text/html; charset=utf-8",
+					"Cache-Control": "public, max-age=3600",
+				},
+			});
 		}
 	}
 
@@ -1008,7 +1048,6 @@ function loadBuiltManifest(): RouteManifest {
 			layoutServers: [],
 			errorPages: [],
 			trailingSlash: r.trailingSlash,
-			scope: r.scope,
 		})),
 		apis: apiRoutes.map((r: any) => ({ pattern: r.pattern, server: "" })),
 		errorPage: null,
@@ -1095,6 +1134,19 @@ for (const plugin of plugins) {
 app.listen(PORT, () => {
 	// In dev mode the proxy owns the user-facing port — don't print the internal port
 	if (!isDev) console.log(`⬡ Bosia server running at http://localhost:${PORT}`);
+	// Last line of startup on purpose — the cache identity contract is the one
+	// config mistake that leaks one user's page to another, so it stays visible.
+	if (CACHE_ENABLED) {
+		console.log(
+			`\n🔑 Response cache tells users apart ONLY by these cookies/headers: [${CACHE_KEYS.join(", ")}]\n` +
+				`   Using a different session cookie or auth header? Add its name to CACHE_KEYS,\n` +
+				`   or one user's personalised page can be served to another. Routes personalised\n` +
+				`   by anything else should set \`export const cache = false\`.\n` +
+				`   Note: the runtime auto-warns only on uncovered *cookie* reads — it CANNOT\n` +
+				`   detect header-based personalisation, so custom auth headers (X-Api-Key,\n` +
+				`   X-Auth-Token, …) must be added to CACHE_KEYS by hand.\n`,
+		);
+	}
 });
 
 async function shutdown() {

package/src/core/staticManifest.ts

@@ -100,10 +100,44 @@ export function buildStaticManifest(outDir: string): StaticManifest {
 }
 
 export function lookupStatic(manifest: StaticManifest, urlPath: string): StaticEntry | null {
-	const key = urlPath.split("?")[0];
+	const raw = urlPath.split("?")[0];
+	// Manifest keys are raw filenames; URLs arrive percent-encoded.
+	let key: string;
+	try {
+		key = decodeURIComponent(raw);
+	} catch {
+		return null; // malformed encoding → 404
+	}
 	return manifest.get(key) ?? null;
 }
 
+/**
+ * Boot-time map of URL path → absolute file path for `dist/prerendered/`.
+ * `index.html` → `/`, `foo/index.html` → `/foo`, `foo.html` → `/foo`.
+ * On collision the `…/index.html` variant wins (mirrors the old runtime
+ * candidate order). Replaces per-request `Bun.file().exists()` probes.
+ */
+export function buildPrerenderManifest(outDir: string): Map<string, string> {
+	const manifest = new Map<string, string>();
+	const root = join(resolvePath(outDir), "prerendered");
+	for (const { abs, rel } of walk(root)) {
+		if (!rel.endsWith(".html")) continue;
+		let key: string;
+		let isIndex = false;
+		if (rel === "index.html") {
+			key = "/";
+			isIndex = true;
+		} else if (rel.endsWith("/index.html")) {
+			key = `/${rel.slice(0, -"/index.html".length)}`;
+			isIndex = true;
+		} else {
+			key = `/${rel.slice(0, -".html".length)}`;
+		}
+		if (isIndex || !manifest.has(key)) manifest.set(key, abs);
+	}
+	return manifest;
+}
+
 // Re-export for tests that want to confirm a file-on-disk exists at the entry.
 export function entryFileExists(entry: StaticEntry): boolean {
 	try {

package/src/core/twHash.ts

@@ -0,0 +1,18 @@
+import { readFileSync, renameSync } from "fs";
+import { join, dirname } from "path";
+
+/** Temp filename Tailwind CLI writes to before the content-hash rename. */
+export const TW_TEMP_BASENAME = ".bosia-tw.build.css";
+
+/**
+ * Content-hash the compiled Tailwind CSS and rename it to its final
+ * `bosia-tw-<hash>.css` name (matches staticManifest's HASHED_BASENAME rule,
+ * so it gets immutable caching). Returns the final basename.
+ */
+export function finalizeTailwindCss(tempPath: string): string {
+	const bytes = readFileSync(tempPath);
+	const hash = new Bun.CryptoHasher("sha256").update(bytes).digest("hex").slice(0, 10);
+	const name = `bosia-tw-${hash}.css`;
+	renameSync(tempPath, join(dirname(tempPath), name));
+	return name;
+}

package/src/core/types.ts

@@ -26,12 +26,6 @@ export interface PageRoute {
 	errorPages: { path: string; depth: number }[];
 	/** Effective trailing-slash mode (page wins over layout chain). Defaults to "never". */
 	trailingSlash: TrailingSlash;
-	/**
-	 * Dedup scope. `"public"` (default) → loader runs once for concurrent identical
-	 * URLs. `"private"` → loader runs per-request (use for per-user routes).
-	 * Set by placing the route under a `(private)` group folder anywhere in the chain.
-	 */
-	scope: "public" | "private";
 }
 
 /** An API route discovered from the file system */