eclipsa 0.1.7 → 0.1.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/{action-DqgkV3zb.mjs → action-CArGTCnQ.mjs} +179 -13
- package/action-CArGTCnQ.mjs.map +1 -0
- package/{client-DKPmN-wJ.mjs → client-B72eA7ds.mjs} +42 -3
- package/client-B72eA7ds.mjs.map +1 -0
- package/core/client/mod.mjs +3 -3
- package/core/dev-client/mod.mjs +3 -3
- package/core/internal.mjs +1 -1
- package/core/prod-client/mod.mjs +3 -3
- package/core/prod-client/mod.mjs.map +1 -1
- package/jsx/mod.mjs +1 -1
- package/mod.mjs +3 -3
- package/package.json +2 -2
- package/{signal-DBzloBrN.mjs → signal-DBswUs2I.mjs} +2 -2
- package/{signal-DBzloBrN.mjs.map → signal-DBswUs2I.mjs.map} +1 -1
- package/{ssr-CRg57Wn2.mjs → ssr-BUrr2VpM.mjs} +4 -4
- package/{ssr-CRg57Wn2.mjs.map → ssr-BUrr2VpM.mjs.map} +1 -1
- package/vite/build/runtime.d.mts +7 -1
- package/vite/build/runtime.mjs +3 -3
- package/vite/mod.mjs +145 -48
- package/vite/mod.mjs.map +1 -1
- package/web-utils/mod.mjs +2 -2
- package/action-DqgkV3zb.mjs.map +0 -1
- package/client-DKPmN-wJ.mjs.map +0 -1
|
@@ -378,6 +378,96 @@ const resetClientHooks = () => {
|
|
|
378
378
|
clientHooks = {};
|
|
379
379
|
};
|
|
380
380
|
//#endregion
|
|
381
|
+
//#region core/action-csrf.ts
|
|
382
|
+
const ACTION_CSRF_COOKIE = "__eclipsa_action_csrf";
|
|
383
|
+
const ACTION_CSRF_FIELD = "__e_csrf";
|
|
384
|
+
const ACTION_CSRF_HEADER = "x-eclipsa-csrf";
|
|
385
|
+
const ACTION_CSRF_INPUT_ATTR = "data-e-action-csrf";
|
|
386
|
+
const ACTION_CSRF_ERROR_MESSAGE = "Invalid CSRF token.";
|
|
387
|
+
const ACTION_CSRF_TOKEN_KEY = Symbol.for("eclipsa.action-csrf-token");
|
|
388
|
+
const ACTION_CSRF_SET_COOKIE_KEY = Symbol.for("eclipsa.action-csrf-set-cookie");
|
|
389
|
+
const getCrypto = () => {
|
|
390
|
+
if (globalThis.crypto) return globalThis.crypto;
|
|
391
|
+
const nodeCrypto = typeof process === "undefined" ? void 0 : process.getBuiltinModule?.("node:crypto");
|
|
392
|
+
if (nodeCrypto?.webcrypto) return nodeCrypto.webcrypto;
|
|
393
|
+
throw new Error("Web Crypto API is not available in this environment.");
|
|
394
|
+
};
|
|
395
|
+
const toHex = (bytes) => [...bytes].map((value) => value.toString(16).padStart(2, "0")).join("");
|
|
396
|
+
const createActionCsrfToken = () => {
|
|
397
|
+
const bytes = new Uint8Array(32);
|
|
398
|
+
getCrypto().getRandomValues(bytes);
|
|
399
|
+
return toHex(bytes);
|
|
400
|
+
};
|
|
401
|
+
const parseCookie = (cookieHeader, name) => {
|
|
402
|
+
if (!cookieHeader) return null;
|
|
403
|
+
for (const entry of cookieHeader.split(";")) {
|
|
404
|
+
const trimmed = entry.trim();
|
|
405
|
+
if (!trimmed.startsWith(`${name}=`)) continue;
|
|
406
|
+
const value = trimmed.slice(name.length + 1);
|
|
407
|
+
if (value.length === 0) return null;
|
|
408
|
+
try {
|
|
409
|
+
return decodeURIComponent(value);
|
|
410
|
+
} catch {
|
|
411
|
+
return value;
|
|
412
|
+
}
|
|
413
|
+
}
|
|
414
|
+
return null;
|
|
415
|
+
};
|
|
416
|
+
const shouldUseSecureCookie = (c) => {
|
|
417
|
+
try {
|
|
418
|
+
if (new URL(c.req.raw.url).protocol === "https:") return true;
|
|
419
|
+
} catch {}
|
|
420
|
+
return c.req.header("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase() === "https";
|
|
421
|
+
};
|
|
422
|
+
const readActionCsrfTokenFromCookieHeader = (cookieHeader) => parseCookie(cookieHeader, ACTION_CSRF_COOKIE);
|
|
423
|
+
const readActionCsrfTokenFromDocument = (doc) => readActionCsrfTokenFromCookieHeader(doc.cookie);
|
|
424
|
+
const readActionCsrfTokenFromFormData = (value) => {
|
|
425
|
+
const token = value.get(ACTION_CSRF_FIELD);
|
|
426
|
+
return typeof token === "string" && token.length > 0 ? token : null;
|
|
427
|
+
};
|
|
428
|
+
const readActionCsrfTokenFromRequest = (c) => readActionCsrfTokenFromCookieHeader(c.req.header("cookie"));
|
|
429
|
+
const ensureActionCsrfToken = (c) => {
|
|
430
|
+
const record = c;
|
|
431
|
+
const existing = record[ACTION_CSRF_TOKEN_KEY];
|
|
432
|
+
if (typeof existing === "string" && existing.length > 0) return existing;
|
|
433
|
+
const cookieToken = readActionCsrfTokenFromRequest(c);
|
|
434
|
+
if (cookieToken) {
|
|
435
|
+
record[ACTION_CSRF_TOKEN_KEY] = cookieToken;
|
|
436
|
+
record[ACTION_CSRF_SET_COOKIE_KEY] = false;
|
|
437
|
+
return cookieToken;
|
|
438
|
+
}
|
|
439
|
+
const created = createActionCsrfToken();
|
|
440
|
+
record[ACTION_CSRF_TOKEN_KEY] = created;
|
|
441
|
+
record[ACTION_CSRF_SET_COOKIE_KEY] = true;
|
|
442
|
+
return created;
|
|
443
|
+
};
|
|
444
|
+
const getCurrentActionCsrfToken = () => {
|
|
445
|
+
const context = getCurrentServerRequestContext();
|
|
446
|
+
return context ? ensureActionCsrfToken(context) : null;
|
|
447
|
+
};
|
|
448
|
+
const serializeActionCsrfCookie = (token, secure) => [
|
|
449
|
+
`${ACTION_CSRF_COOKIE}=${encodeURIComponent(token)}`,
|
|
450
|
+
"Path=/",
|
|
451
|
+
"SameSite=Lax",
|
|
452
|
+
...secure ? ["Secure"] : []
|
|
453
|
+
].join("; ");
|
|
454
|
+
const applyActionCsrfCookie = (response, c) => {
|
|
455
|
+
const record = c;
|
|
456
|
+
if (record[ACTION_CSRF_SET_COOKIE_KEY] !== true) return response;
|
|
457
|
+
const token = record[ACTION_CSRF_TOKEN_KEY];
|
|
458
|
+
if (!token) return response;
|
|
459
|
+
const cookieValue = serializeActionCsrfCookie(token, shouldUseSecureCookie(c));
|
|
460
|
+
try {
|
|
461
|
+
response.headers.append("set-cookie", cookieValue);
|
|
462
|
+
} catch {
|
|
463
|
+
const next = new Response(response.body, response);
|
|
464
|
+
next.headers.append("set-cookie", cookieValue);
|
|
465
|
+
response = next;
|
|
466
|
+
}
|
|
467
|
+
record[ACTION_CSRF_SET_COOKIE_KEY] = false;
|
|
468
|
+
return response;
|
|
469
|
+
};
|
|
470
|
+
//#endregion
|
|
381
471
|
//#region core/suspense.ts
|
|
382
472
|
const PENDING_SIGNAL_ERROR_KEY = Symbol.for("eclipsa.pending-signal-error");
|
|
383
473
|
const SUSPENSE_TYPE_KEY = Symbol.for("eclipsa.suspense-type");
|
|
@@ -1399,7 +1489,15 @@ const ROUTE_DOCUMENT_FALLBACK = Object.freeze({
|
|
|
1399
1489
|
document: true,
|
|
1400
1490
|
ok: false
|
|
1401
1491
|
});
|
|
1402
|
-
const
|
|
1492
|
+
const decodeRoutePathSegment = (segment) => {
|
|
1493
|
+
try {
|
|
1494
|
+
return decodeURIComponent(segment);
|
|
1495
|
+
} catch {
|
|
1496
|
+
return segment;
|
|
1497
|
+
}
|
|
1498
|
+
};
|
|
1499
|
+
const splitRawRoutePath = (pathname) => normalizeRoutePath(pathname).split("/").filter(Boolean);
|
|
1500
|
+
const splitRoutePath = (pathname) => splitRawRoutePath(pathname).map(decodeRoutePathSegment);
|
|
1403
1501
|
const matchRouteSegments = (segments, pathnameSegments, routeIndex = 0, pathIndex = 0, params = {}) => {
|
|
1404
1502
|
if (routeIndex >= segments.length) return pathIndex >= pathnameSegments.length ? params : null;
|
|
1405
1503
|
const segment = segments[routeIndex];
|
|
@@ -1464,8 +1562,14 @@ const scoreSpecialManifestEntry = (entry, pathname) => {
|
|
|
1464
1562
|
return score;
|
|
1465
1563
|
};
|
|
1466
1564
|
const findSpecialManifestEntry = (manifest, pathname, kind) => {
|
|
1467
|
-
const
|
|
1565
|
+
const normalizedPath = normalizeRoutePath(pathname);
|
|
1566
|
+
const matched = matchRouteManifest(manifest, normalizedPath);
|
|
1468
1567
|
if (matched?.entry[kind]) return matched;
|
|
1568
|
+
const rawPathSegments = splitRawRoutePath(normalizedPath);
|
|
1569
|
+
for (let length = rawPathSegments.length - 1; length >= 0; length -= 1) {
|
|
1570
|
+
const candidate = matchRouteManifest(manifest, length === 0 ? "/" : `/${rawPathSegments.slice(0, length).join("/")}`);
|
|
1571
|
+
if (candidate?.entry[kind]) return candidate;
|
|
1572
|
+
}
|
|
1469
1573
|
let best = null;
|
|
1470
1574
|
let bestScore = -1;
|
|
1471
1575
|
for (const entry of manifest) {
|
|
@@ -1475,7 +1579,7 @@ const findSpecialManifestEntry = (manifest, pathname, kind) => {
|
|
|
1475
1579
|
best = {
|
|
1476
1580
|
entry,
|
|
1477
1581
|
params: EMPTY_ROUTE_PARAMS,
|
|
1478
|
-
pathname:
|
|
1582
|
+
pathname: normalizedPath
|
|
1479
1583
|
};
|
|
1480
1584
|
bestScore = score;
|
|
1481
1585
|
}
|
|
@@ -2133,6 +2237,16 @@ const renderScopedStyleNode = (container, scopeId, style) => {
|
|
|
2133
2237
|
};
|
|
2134
2238
|
const renderFrameScopedStylesToString = (frame) => frame.scopedStyles.map((style) => renderScopedStyleString(frame.component.scopeId, style)).join("");
|
|
2135
2239
|
const renderFrameScopedStylesToNodes = (frame, container) => frame.scopedStyles.map((style) => renderScopedStyleNode(container, frame.component.scopeId, style));
|
|
2240
|
+
const createActionCsrfInputString = (token) => `<input ${ACTION_CSRF_INPUT_ATTR}="" name="${escapeAttr(ACTION_CSRF_FIELD)}" type="hidden" value="${escapeAttr(token)}">`;
|
|
2241
|
+
const createActionCsrfInputNode = (doc, token) => {
|
|
2242
|
+
const input = createElementNode(doc, "input");
|
|
2243
|
+
input.setAttribute(ACTION_CSRF_INPUT_ATTR, "");
|
|
2244
|
+
input.setAttribute("name", ACTION_CSRF_FIELD);
|
|
2245
|
+
input.setAttribute("type", "hidden");
|
|
2246
|
+
input.setAttribute("value", token);
|
|
2247
|
+
return input;
|
|
2248
|
+
};
|
|
2249
|
+
const readActionCsrfTokenFromRuntimeDocument = (doc) => doc && "cookie" in doc && typeof doc.cookie === "string" ? readActionCsrfTokenFromDocument(doc) : null;
|
|
2136
2250
|
const registerRuntimeScopedStyle = (cssText, attributes = {}) => {
|
|
2137
2251
|
const frame = getCurrentFrame();
|
|
2138
2252
|
if (!frame || frame.component.id === "$root") throw new Error("useStyleScoped() can only be used while rendering a component.");
|
|
@@ -3990,6 +4104,7 @@ const renderStringNode = (inputElementLike) => {
|
|
|
3990
4104
|
const frame = getCurrentFrame();
|
|
3991
4105
|
let hasInnerHTML = false;
|
|
3992
4106
|
let innerHTML = null;
|
|
4107
|
+
let isActionForm = false;
|
|
3993
4108
|
if (frame && hasScopedStyles(frame) && resolved.type !== "style") attrParts.push(`${SCOPED_STYLE_ATTR}="${escapeAttr(frame.component.scopeId)}"`);
|
|
3994
4109
|
for (const name in resolved.props) {
|
|
3995
4110
|
if (!Object.hasOwn(resolved.props, name)) continue;
|
|
@@ -4033,13 +4148,21 @@ const renderStringNode = (inputElementLike) => {
|
|
|
4033
4148
|
if (resolved.type === "body" && name === "data-e-resume") continue;
|
|
4034
4149
|
if (value === true) {
|
|
4035
4150
|
attrParts.push(name);
|
|
4151
|
+
if (name === "data-e-action-form") isActionForm = true;
|
|
4036
4152
|
continue;
|
|
4037
4153
|
}
|
|
4154
|
+
if (name === "data-e-action-form") isActionForm = true;
|
|
4038
4155
|
attrParts.push(`${name}="${escapeAttr(String(value))}"`);
|
|
4039
4156
|
}
|
|
4040
4157
|
if (resolved.type === "body" && container) attrParts.push("data-e-resume=\"paused\"");
|
|
4041
4158
|
let childrenText = innerHTML ?? "";
|
|
4042
|
-
if (!hasInnerHTML)
|
|
4159
|
+
if (!hasInnerHTML) {
|
|
4160
|
+
if (resolved.type === "form" && isActionForm) {
|
|
4161
|
+
const csrfToken = getCurrentActionCsrfToken();
|
|
4162
|
+
if (csrfToken) childrenText += createActionCsrfInputString(csrfToken);
|
|
4163
|
+
}
|
|
4164
|
+
childrenText += renderStringNode(resolved.props.children);
|
|
4165
|
+
}
|
|
4043
4166
|
const rendered = resolved.type === "__ECLIPSA_FRAGMENT" ? childrenText : `<${resolved.type}${attrParts.length > 0 ? ` ${attrParts.join(" ")}` : ""}>${childrenText}</${resolved.type}>`;
|
|
4044
4167
|
return resolved.key === null || resolved.key === void 0 ? rendered : wrapStringWithKeyedRange(rendered, resolveKeyedRangeScope(), resolved.key);
|
|
4045
4168
|
};
|
|
@@ -4271,6 +4394,10 @@ const renderClientNodes = (inputElementLike, container) => {
|
|
|
4271
4394
|
rememberManagedAttributesForNode(element);
|
|
4272
4395
|
nodes = [element];
|
|
4273
4396
|
} else {
|
|
4397
|
+
if (resolved.type === "form" && element.getAttribute("data-e-action-form") !== null) {
|
|
4398
|
+
const csrfToken = readActionCsrfTokenFromRuntimeDocument(container.doc);
|
|
4399
|
+
if (csrfToken) element.appendChild(createActionCsrfInputNode(container.doc, csrfToken));
|
|
4400
|
+
}
|
|
4274
4401
|
const childNodes = renderClientNodes(resolved.props.children, container);
|
|
4275
4402
|
for (const child of childNodes) element.appendChild(child);
|
|
4276
4403
|
rememberManagedAttributesForNode(element);
|
|
@@ -6233,6 +6360,14 @@ const ACTION_STREAM_CONTENT_TYPE = "application/eclipsa-action-stream+json";
|
|
|
6233
6360
|
const ACTION_FORM_ATTR = "data-e-action-form";
|
|
6234
6361
|
const ACTION_FORM_FIELD = "__e_action";
|
|
6235
6362
|
const ACTION_INPUT_CACHE_KEY = Symbol.for("eclipsa.action-input-cache");
|
|
6363
|
+
const ACTION_CSRF_ERROR_CODE = Symbol.for("eclipsa.action-csrf-error");
|
|
6364
|
+
var ActionCsrfError = class extends Error {
|
|
6365
|
+
[ACTION_CSRF_ERROR_CODE] = true;
|
|
6366
|
+
constructor() {
|
|
6367
|
+
super(ACTION_CSRF_ERROR_MESSAGE);
|
|
6368
|
+
this.name = "ActionCsrfError";
|
|
6369
|
+
}
|
|
6370
|
+
};
|
|
6236
6371
|
const getActionRegistry = () => {
|
|
6237
6372
|
const globalRecord = globalThis;
|
|
6238
6373
|
const existing = globalRecord[ACTION_REGISTRY_KEY];
|
|
@@ -6258,7 +6393,7 @@ const normalizeFormSubmissionInput = (value) => {
|
|
|
6258
6393
|
if (!isFormDataValue(value)) return value;
|
|
6259
6394
|
const normalized = formDataToInputObject(value);
|
|
6260
6395
|
return Object.fromEntries(Object.entries(normalized).flatMap(([key, entry]) => {
|
|
6261
|
-
if (key === "__e_action") return [];
|
|
6396
|
+
if (key === "__e_action" || key === "__e_csrf") return [];
|
|
6262
6397
|
if (Array.isArray(entry)) {
|
|
6263
6398
|
const values = entry.filter((candidate) => typeof candidate === "string").map((candidate) => candidate);
|
|
6264
6399
|
return values.length > 0 ? [[key, values.length === 1 ? values[0] : values]] : [];
|
|
@@ -6322,6 +6457,17 @@ const deserializeActionServerValue = (value) => deserializePublicValue(value, {
|
|
|
6322
6457
|
};
|
|
6323
6458
|
throw new TypeError(`Unsupported action input reference kind "${reference.kind}".`);
|
|
6324
6459
|
} });
|
|
6460
|
+
const isActionCsrfValid = async (c) => {
|
|
6461
|
+
const cookieToken = readActionCsrfTokenFromRequest(c);
|
|
6462
|
+
if (!cookieToken) return false;
|
|
6463
|
+
const contentType = c.req.header("content-type") ?? "";
|
|
6464
|
+
if (contentType.startsWith("application/eclipsa-action+json")) return c.req.header(ACTION_CSRF_HEADER) === cookieToken;
|
|
6465
|
+
if (contentType.startsWith("application/x-www-form-urlencoded") || contentType.startsWith("multipart/form-data")) {
|
|
6466
|
+
const input = await getActionInputCache(c);
|
|
6467
|
+
return isFormDataValue(input) && readActionCsrfTokenFromFormData(input) === cookieToken;
|
|
6468
|
+
}
|
|
6469
|
+
return false;
|
|
6470
|
+
};
|
|
6325
6471
|
const deserializeActionClientValue = (container, value) => deserializePublicValue(value, { deserializeReference(reference) {
|
|
6326
6472
|
if (!container) throw new TypeError("Action references require an active runtime container.");
|
|
6327
6473
|
if (readActionRefContainerId(reference) !== container.id) throw new TypeError("Action reference does not belong to the active runtime container.");
|
|
@@ -6471,12 +6617,22 @@ const invokeAction = async (id, input, container) => {
|
|
|
6471
6617
|
const isFormSubmission = isFormDataValue(input);
|
|
6472
6618
|
const actionPath = `/__eclipsa/action/${encodeURIComponent(id)}`;
|
|
6473
6619
|
const requestContext = typeof window === "undefined" ? getCurrentServerRequestContext() : null;
|
|
6620
|
+
const csrfToken = typeof document !== "undefined" ? readActionCsrfTokenFromDocument(document) : requestContext ? ensureActionCsrfToken(requestContext) : null;
|
|
6474
6621
|
const currentRouteUrl = typeof window !== "undefined" ? window.location.href : requestContext?.req.header("x-eclipsa-route-url") ?? requestContext?.req.raw.url ?? null;
|
|
6475
6622
|
const requestUrl = requestContext ? new URL(actionPath, requestContext.req.raw.url).href : actionPath;
|
|
6476
|
-
const
|
|
6477
|
-
|
|
6623
|
+
const fetchImpl = requestContext && typeof requestContext.var.fetch === "function" ? requestContext.var.fetch : fetch;
|
|
6624
|
+
const csrfCookie = requestContext && csrfToken ? [requestContext.req.header("cookie"), `${ACTION_CSRF_COOKIE}=${encodeURIComponent(csrfToken)}`].filter(Boolean).join("; ") : null;
|
|
6625
|
+
const response = await fetchImpl(requestUrl, {
|
|
6626
|
+
body: isFormSubmission && csrfToken ? (() => {
|
|
6627
|
+
const next = new FormData();
|
|
6628
|
+
for (const [name, value] of input.entries()) next.append(name, value);
|
|
6629
|
+
next.set(ACTION_CSRF_FIELD, csrfToken);
|
|
6630
|
+
return next;
|
|
6631
|
+
})() : isFormSubmission ? input : JSON.stringify({ input: serializeActionClientValue(container, input) }),
|
|
6478
6632
|
headers: {
|
|
6479
6633
|
accept: `${ACTION_STREAM_CONTENT_TYPE}, ${ACTION_CONTENT_TYPE}`,
|
|
6634
|
+
...csrfCookie ? { cookie: csrfCookie } : {},
|
|
6635
|
+
...csrfToken ? { [ACTION_CSRF_HEADER]: csrfToken } : {},
|
|
6480
6636
|
...currentRouteUrl ? { [ROUTE_RPC_URL_HEADER]: currentRouteUrl } : {},
|
|
6481
6637
|
...isFormSubmission ? {} : { "content-type": ACTION_CONTENT_TYPE }
|
|
6482
6638
|
},
|
|
@@ -6540,6 +6696,7 @@ const getActionFormSubmissionId = async (c) => {
|
|
|
6540
6696
|
const executeActionSubmission = async (id, c) => {
|
|
6541
6697
|
const action = getActionRegistry().get(id);
|
|
6542
6698
|
if (!action) throw new Error(`Unknown action ${id}.`);
|
|
6699
|
+
if (!await isActionCsrfValid(c)) throw new ActionCsrfError();
|
|
6543
6700
|
const input = await readActionSubmissionInput(c);
|
|
6544
6701
|
const result = await composeMiddlewares(c, action.middlewares, action.handler);
|
|
6545
6702
|
if (result instanceof Response) return {
|
|
@@ -6583,6 +6740,15 @@ const createActionFormNode = (id, props) => {
|
|
|
6583
6740
|
hiddenInput.type = "hidden";
|
|
6584
6741
|
hiddenInput.value = id;
|
|
6585
6742
|
form.appendChild(hiddenInput);
|
|
6743
|
+
const csrfToken = readActionCsrfTokenFromDocument(document);
|
|
6744
|
+
if (csrfToken) {
|
|
6745
|
+
const csrfInput = document.createElement("input");
|
|
6746
|
+
csrfInput.name = ACTION_CSRF_FIELD;
|
|
6747
|
+
csrfInput.type = "hidden";
|
|
6748
|
+
csrfInput.value = csrfToken;
|
|
6749
|
+
csrfInput.setAttribute(ACTION_CSRF_INPUT_ATTR, "");
|
|
6750
|
+
form.appendChild(csrfInput);
|
|
6751
|
+
}
|
|
6586
6752
|
for (const [name, value] of Object.entries(props)) {
|
|
6587
6753
|
if (name === "children" || name === "action" || name === "method" || value === false || value === void 0 || value === null) continue;
|
|
6588
6754
|
if (name === "class") {
|
|
@@ -6639,16 +6805,16 @@ const hasAction = (id) => getActionRegistry().has(id);
|
|
|
6639
6805
|
const executeAction = async (id, c) => {
|
|
6640
6806
|
try {
|
|
6641
6807
|
const result = await executeActionSubmission(id, c);
|
|
6642
|
-
return result.kind === "response" ? result.response : toActionResponse(result.value);
|
|
6808
|
+
return applyActionCsrfCookie(result.kind === "response" ? result.response : toActionResponse(result.value), c);
|
|
6643
6809
|
} catch (error) {
|
|
6644
6810
|
const publicError = await transformCurrentPublicError(error, "action");
|
|
6645
|
-
return new Response(JSON.stringify({
|
|
6811
|
+
return applyActionCsrfCookie(new Response(JSON.stringify({
|
|
6646
6812
|
error: toSerializedActionError(publicError),
|
|
6647
6813
|
ok: false
|
|
6648
6814
|
}), {
|
|
6649
6815
|
headers: { "content-type": ACTION_CONTENT_TYPE },
|
|
6650
|
-
status: 500
|
|
6651
|
-
});
|
|
6816
|
+
status: error instanceof ActionCsrfError ? 403 : 500
|
|
6817
|
+
}), c);
|
|
6652
6818
|
}
|
|
6653
6819
|
};
|
|
6654
6820
|
const __eclipsaAction = (id, middlewares, handler) => {
|
|
@@ -6795,6 +6961,6 @@ const __eclipsaAction = (id, middlewares, handler) => {
|
|
|
6795
6961
|
}, id));
|
|
6796
6962
|
};
|
|
6797
6963
|
//#endregion
|
|
6798
|
-
export { shouldReconnectDetachedInsertMarkers as $,
|
|
6964
|
+
export { shouldReconnectDetachedInsertMarkers as $, deserializeValue as $n, __eclipsaLoader as $t, getRuntimeComponentId as A, createPendingSignalError as An, getActionHookMeta as At, refreshRegisteredRouteContainers as B, createRequestFetch as Bn, getRegisteredLoaderHook as Bt, createOnCleanup as C, createContext as Cn, RESUME_FINAL_STATE_ELEMENT_ID as Ct, createStandaloneRuntimeSignal as D, materializeRuntimeContextProvider as Dn, __eclipsaLazy as Dt, createResumeContainer as E, materializeRuntimeContext as En, __eclipsaEvent as Et, notFound as F, applyActionCsrfCookie as Fn, getLoaderHandleMeta as Ft, renderSSRAttr as G, registerClientHooks as Gn, registerLoaderHook as Gt, registerRuntimeScopedStyle as H, getClientHooks as Hn, getSignalMeta as Ht, preserveReusableContentInRoots as I, ensureActionCsrfToken as In, getLoaderHookMeta as It, renderString as J, runHandleError as Jn, setExternalComponentMeta as Jt, renderSSRMap as K, resetClientHooks as Kn, setActionHandleMeta as Kt, primeLocationState as L, readActionCsrfTokenFromDocument as Ln, getNavigateMeta as Lt, getRuntimeSignalId as M, isSuspenseType as Mn, getEventMeta as Mt, getStreamingResumeBootstrapScriptContent as N, ACTION_CSRF_FIELD as Nn, getExternalComponentMeta as Nt, createWatch as O, useContext as On, __eclipsaWatch as Ot, installResumeListeners as P, ACTION_CSRF_INPUT_ATTR as Pn, getLazyMeta as Pt, restoreSignalRefs as Q, withServerRequestContext as Qn, setSignalMeta as Qt, primeRouteModules as R, APP_HOOKS_ELEMENT_ID as Rn, getRegisteredActionHook as Rt, createEffect as S, resolveRouteMetadata as Sn, ACTION_FORM_ATTR$1 as St, createOnVisible as T, getRuntimeContextReference as Tn, __eclipsaComponent as Tt, renderClientInsertable as U, getCurrentServerRequestContext as Un, getWatchMeta as Ut, registerResumeContainer as V, deserializePublicValue as Vn, getRegisteredLoaderHookIds as Vt, renderClientInsertableForOwner as W, markPublicError as Wn, registerActionHook as Wt, restoreResumedExternalComponents as X, toPublicError as Xn, setLoaderHookMeta as Xt, restoreRegisteredRpcHandles as Y, serializePublicValue as Yn, setLoaderHandleMeta as Yt, restoreResumedLocalSignalEffects as Z, transformCurrentPublicError as Zn, setNavigateMeta as Zt, beginSSRContainer as _, ROUTE_REPLACE_ATTR as _n, getRememberedInsertMarkerNodeCount as _t, action as a, loader_exports as an, IS_BROWSER as ar, useRuntimeLocation as at, collectPendingSuspenseBoundaryIds as b, composeRouteMetadata as bn, rememberManagedAttributesForNodes as bt, getActionFormSubmissionId as c, registerLoader as cn, noSerialize as cr, useRuntimeRouteParams as ct, primeActionState as d, ROUTE_DATA_REQUEST_HEADER as dn, writeAsyncSignalSnapshot as dt, consumePendingSsrLoaderIds as en, escapeInlineScriptText as er, syncRuntimeRefMarker as et, registerAction as f, ROUTE_LINK_ATTR as fn, INSERT_MARKER_PREFIX as ft, beginAsyncSSRContainer as g, ROUTE_PREFLIGHT_REQUEST_HEADER as gn, parseInsertMarker as gt, assignRuntimeRef as h, ROUTE_PREFLIGHT_ENDPOINT as hn, parseComponentBoundaryMarker as ht, __eclipsaAction as i, loader as in, serializeValue as ir, tryPatchNodeSequenceInPlace as it, getRuntimeContainer as j, isPendingSignalError as jn, getComponentMeta as jt, getResumePayloadScriptContent as k, Suspense as kn, getActionHandleMeta as kt, getNormalizedActionInput as l, resolvePendingLoaders as ln, useRuntimeSignal as lt, applyResumeHmrUpdateToRegisteredContainers as m, ROUTE_PREFETCH_ATTR as mn, createInsertMarker as mt, ACTION_FORM_ATTR as n, hasLoader as nn, parseSerializedJSON as nr, toResumePayloadSubset as nt, executeAction as o, markPendingSsrLoader as on, IS_SSR as or, useRuntimeNavigate as ot, validator as p, ROUTE_MANIFEST_ELEMENT_ID as pn, createComponentBoundaryHtmlComment as pt, renderSSRValue as q, resolveReroute as qn, setActionHookMeta as qt, ACTION_FORM_FIELD as r, isPendingSsrLoaderError as rn, serializeJSONScriptContent as rr, tryPatchElementShellInPlace as rt, executeActionSubmission as s, primeLoaderState as sn, isNoSerialize as sr, useRuntimeRouteError as st, ACTION_CONTENT_TYPE as t, executeLoader as tn, escapeJSONScriptText as tr, toResumePayload as tt, hasAction as u, ROUTE_DATA_ENDPOINT as un, withRuntimeContainer as ut, bindRuntimeEvent as v, ROUTE_RPC_URL_HEADER as vn, rememberInsertMarkerRange as vt, createOnMount as w, getContextProviderMeta as wn, RESUME_STATE_ELEMENT_ID as wt, createDetachedClientInsertOwner as x, renderRouteMetadataHead as xn, syncManagedAttributeSnapshot as xt, captureClientInsertOwner as y, ROUTE_METADATA_HEAD_ATTR as yn, rememberManagedAttributesForNode as yt, readAsyncSignalSnapshot as z, attachRequestFetch as zn, getRegisteredActionHookIds as zt };
|
|
6799
6965
|
|
|
6800
|
-
//# sourceMappingURL=action-
|
|
6966
|
+
//# sourceMappingURL=action-CArGTCnQ.mjs.map
|