gsd-pi 2.67.0-dev.46f9884 → 2.67.0-dev.509bd95

package/dist/web/standalone/node_modules/next/dist/server/app-render/action-handler.js

@@ -37,6 +37,8 @@ const _headers = require("../web/spec-extension/adapters/headers");
 const _utils1 = require("../web/utils");
 const _manifestssingleton = require("./manifests-singleton");
 const _helpers = require("../base-http/helpers");
+const _segmentexplorerpath = require("./segment-explorer-path");
+const _serverreferenceinfo = require("../../shared/lib/server-reference-info");
 const _redirectstatuscode = require("../../client/components/redirect-status-code");
 const _requeststore = require("../async-storage/request-store");
 const _workunitasyncstorageexternal = require("../app-render/work-unit-async-storage.external");
@@ -50,6 +52,7 @@ function _interop_require_default(obj) {
         default: obj
     };
 }
+const INLINE_ACTION_PREFIX = '$$RSC_SERVER_ACTION_';
 /**
  * Checks if the app has any server actions defined in any runtime.
  */ function hasServerActions() {
@@ -105,7 +108,10 @@ function addRevalidationHeader(res, { workStore, requestStore }) {
     // so we need to invalidate the entire cache if a path was revalidated.
     // TODO-APP: Currently paths are treated as tags, so the second element of the tuple
     // is always empty.
-    const isTagRevalidated = ((_workStore_pendingRevalidatedTags = workStore.pendingRevalidatedTags) == null ? void 0 : _workStore_pendingRevalidatedTags.length) ? 1 : 0;
+    // Only count tags without a profile (updateTag) as requiring client cache invalidation
+    // Tags with a profile (revalidateTag) use stale-while-revalidate and shouldn't
+    // trigger immediate client-side cache invalidation
+    const isTagRevalidated = ((_workStore_pendingRevalidatedTags = workStore.pendingRevalidatedTags) == null ? void 0 : _workStore_pendingRevalidatedTags.some((item)=>item.profile === undefined)) ? 1 : 0;
     const isCookieRevalidated = (0, _requestcookies.getModifiedCookieValues)(requestStore.mutableCookies).length ? 1 : 0;
     // First check if a tag, cookie, or path was revalidated.
     if (isTagRevalidated || isCookieRevalidated) {
@@ -374,7 +380,9 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
     // When running actions the default is no-store, you can still `cache: 'force-cache'`
     workStore.fetchCache = 'default-no-store';
     const originHeader = req.headers['origin'];
-    const originDomain = typeof originHeader === 'string' && originHeader !== 'null' ? new URL(originHeader).host : undefined;
+    const originHost = typeof originHeader === 'string' ? // However, these contexts can still send along credentials like cookies,
+    // so we need to check if they're allowed cross-origin requests.
+    originHeader === 'null' ? 'null' : new URL(originHeader).host : undefined;
     const host = parseHostHeader(req.headers);
     let warning = undefined;
     function warnBadServerActionRequest() {
@@ -384,20 +392,22 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
     }
     // This is to prevent CSRF attacks. If `x-forwarded-host` is set, we need to
     // ensure that the request is coming from the same host.
-    if (!originDomain) {
-        // This might be an old browser that doesn't send `host` header. We ignore
-        // this case.
+    if (!originHost) {
+        // This is a handcrafted request without an origin or a request from an unsafe browser.
+        // We'll let this through but log a warning.
+        // We can't guard against unsafe browsers and handcrafted requests can't contain
+        // user credentials that haven't been shared willingly.
         warning = 'Missing `origin` header from a forwarded Server Actions request.';
-    } else if (!host || originDomain !== host.value) {
+    } else if (!host || originHost !== host.value) {
         // If the customer sets a list of allowed origins, we'll allow the request.
         // These are considered safe but might be different from forwarded host set
         // by the infra (i.e. reverse proxies).
-        if ((0, _csrfprotection.isCsrfOriginAllowed)(originDomain, serverActions == null ? void 0 : serverActions.allowedOrigins)) {
+        if ((0, _csrfprotection.isCsrfOriginAllowed)(originHost, serverActions == null ? void 0 : serverActions.allowedOrigins)) {
         // Ignore it
         } else {
             if (host) {
                 // This seems to be an CSRF attack. We should not proceed the action.
-                console.error(`\`${host.type}\` header with value \`${limitUntrustedHeaderValueForLogs(host.value)}\` does not match \`origin\` header with value \`${limitUntrustedHeaderValueForLogs(originDomain)}\` from a forwarded Server Actions request. Aborting the action.`);
+                console.error(`\`${host.type}\` header with value \`${limitUntrustedHeaderValueForLogs(host.value)}\` does not match \`origin\` header with value \`${limitUntrustedHeaderValueForLogs(originHost)}\` from a forwarded Server Actions request. Aborting the action.`);
             } else {
                 // This is an attack. We should not proceed the action.
                 console.error(`\`x-forwarded-host\` or \`host\` headers are not provided. One of these is needed to compare the \`origin\` header from a forwarded Server Actions request. Aborting the action.`);
@@ -551,6 +561,10 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                 temporaryReferences = createTemporaryReferenceSet();
                 const { PassThrough, Readable, Transform } = require('node:stream');
                 const { pipeline } = require('node:stream/promises');
+                // If actionBody was stashed in request meta (from parsing the postponed
+                // state prefix in minimal mode), use it instead of req.body
+                const actionBodyFromMeta = (0, _requestmeta.getRequestMeta)(req, 'actionBody');
+                const body = actionBodyFromMeta ? Readable.from(actionBodyFromMeta) : req.body;
                 const defaultBodySizeLimit = '1 MB';
                 const bodySizeLimit = (serverActions == null ? void 0 : serverActions.bodySizeLimit) ?? defaultBodySizeLimit;
                 const bodySizeLimitBytes = bodySizeLimit !== defaultBodySizeLimit ? require('next/dist/compiled/bytes').parse(bodySizeLimit) : 1024 * 1024 // 1 MB
@@ -590,7 +604,7 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                         try {
                             ;
                             [, boundActionArguments] = await Promise.all([
-                                pipeline(req.body, sizeLimitTransform, busboy, {
+                                pipeline(body, sizeLimitTransform, busboy, {
                                     signal: abortController.signal
                                 }),
                                 decodeReplyFromBusboy(busboy, serverModuleMap, {
@@ -621,7 +635,7 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                         try {
                             ;
                             [, formData] = await Promise.all([
-                                pipeline(req.body, sizeLimitTransform, sizeLimitedBody, {
+                                pipeline(body, sizeLimitTransform, sizeLimitedBody, {
                                     signal: abortController.signal
                                 }),
                                 fakeRequest.formData()
@@ -678,7 +692,7 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                     const sizeLimitedBody = new PassThrough();
                     const chunks = [];
                     await Promise.all([
-                        pipeline(req.body, sizeLimitTransform, sizeLimitedBody),
+                        pipeline(body, sizeLimitTransform, sizeLimitedBody),
                         (async ()=>{
                             for await (const chunk of sizeLimitedBody){
                                 chunks.push(Buffer.from(chunk));
@@ -709,24 +723,67 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
             const actionMod = await ComponentMod.__next_app__.require(actionModId);
             const actionHandler = actionMod[// `actionId` must exist if we got here, as otherwise we would have thrown an error above
             actionId];
+            // Log server action call in development when enabled
+            let logInfo = null;
+            const { type: actionType } = (0, _serverreferenceinfo.extractInfoFromServerReferenceId)(actionId);
+            if (process.env.NODE_ENV === 'development' && ctx.renderOpts.logServerFunctions && // TODO: For now, skip logging for 'use cache' Server Functions as the
+            // output needs more work, or a different approach entirely.
+            actionType !== 'use-cache') {
+                var _serverActionsManifest_runtime;
+                const serverActionsManifest = (0, _manifestssingleton.getServerActionsManifest)();
+                const runtime = process.env.NEXT_RUNTIME === 'edge' ? 'edge' : 'node';
+                const actionInfo = (_serverActionsManifest_runtime = serverActionsManifest[runtime]) == null ? void 0 : _serverActionsManifest_runtime[actionId];
+                if (actionInfo) {
+                    var _actionInfo_exportedName;
+                    const isInlineAction = (_actionInfo_exportedName = actionInfo.exportedName) == null ? void 0 : _actionInfo_exportedName.startsWith(INLINE_ACTION_PREFIX);
+                    const projectDir = ctx.renderOpts.dir || (process.env.NEXT_RUNTIME === 'edge' ? '' : process.cwd());
+                    const location = (0, _segmentexplorerpath.normalizeFilePath)(projectDir, actionInfo.filename);
+                    // Format function name for display
+                    let functionName;
+                    if (isInlineAction) {
+                        functionName = '<inline action>';
+                    } else if (actionInfo.exportedName === 'default') {
+                        functionName = 'default';
+                    } else {
+                        functionName = actionInfo.exportedName || '<action>';
+                    }
+                    logInfo = {
+                        functionName,
+                        args: boundActionArguments,
+                        location
+                    };
+                }
+            }
+            const startTime = performance.now();
             const { actionResult, skipPageRendering } = await executeActionAndPrepareForRender(actionHandler, boundActionArguments, workStore, requestStore, actionWasForwarded).finally(()=>{
                 addRevalidationHeader(res, {
                     workStore,
                     requestStore
                 });
+                if (logInfo) {
+                    // Store server action log info to be logged after the request log
+                    const duration = Math.round(performance.now() - startTime);
+                    (0, _requestmeta.addRequestMeta)(req, 'devServerActionLog', {
+                        functionName: logInfo.functionName,
+                        args: logInfo.args,
+                        location: logInfo.location,
+                        duration
+                    });
+                }
             });
             // For form actions, we need to continue rendering the page.
             if (isFetchAction) {
+                // If we skip page rendering, we need to ensure pending revalidates
+                // are awaited before closing the response. Otherwise, this will be
+                // done after rendering the page.
+                const maybeRevalidatesPromise = skipPageRendering ? (0, _revalidationutils.executeRevalidates)(workStore) : false;
                 return {
                     type: 'done',
                     result: await generateFlight(req, ctx, requestStore, {
                         actionResult: Promise.resolve(actionResult),
                         skipPageRendering,
                         temporaryReferences,
-                        // If we skip page rendering, we need to ensure pending
-                        // revalidates are awaited before closing the response. Otherwise,
-                        // this will be done after rendering the page.
-                        waitUntil: skipPageRendering ? (0, _revalidationutils.executeRevalidates)(workStore) : undefined
+                        waitUntil: maybeRevalidatesPromise === false ? undefined : maybeRevalidatesPromise
                     })
                 };
             } else {
@@ -816,9 +873,20 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
         throw err;
     }
 }
+/**
+ * Limit on the number of arguments passed to a server action. This prevents
+ * stack overflow during `action.apply()` from malicious requests.
+ */ const SERVER_ACTION_ARGS_LIMIT = 1000;
 async function executeActionAndPrepareForRender(action, args, workStore, requestStore, actionWasForwarded) {
     requestStore.phase = 'action';
     let skipPageRendering = actionWasForwarded;
+    if (args.length > SERVER_ACTION_ARGS_LIMIT) {
+        throw Object.defineProperty(new Error(`Server Action arguments list is too long (${args.length}). Maximum allowed is ${SERVER_ACTION_ARGS_LIMIT}.`), "__NEXT_ERROR_CODE", {
+            value: "E986",
+            enumerable: false,
+            configurable: true
+        });
+    }
     try {
         const actionResult = await _workunitasyncstorageexternal.workUnitAsyncStorage.run(requestStore, ()=>action.apply(null, args));
         // If the page was not revalidated, or if the action was forwarded from

package/dist/web/standalone/node_modules/next/dist/server/app-render/app-render-prerender-utils.js

@@ -7,8 +7,6 @@ Object.defineProperty(exports, "__esModule", {
     ReactServerResult: null,
     createReactServerPrerenderResult: null,
     createReactServerPrerenderResultFromRender: null,
-    prerenderAndAbortInSequentialTasks: null,
-    prerenderAndAbortInSequentialTasksWithStages: null,
     processPrelude: null
 });
 function _export(target, all) {
@@ -30,91 +28,11 @@ _export(exports, {
     createReactServerPrerenderResultFromRender: function() {
         return createReactServerPrerenderResultFromRender;
     },
-    prerenderAndAbortInSequentialTasks: function() {
-        return prerenderAndAbortInSequentialTasks;
-    },
-    prerenderAndAbortInSequentialTasksWithStages: function() {
-        return prerenderAndAbortInSequentialTasksWithStages;
-    },
     processPrelude: function() {
         return processPrelude;
     }
 });
 const _invarianterror = require("../../shared/lib/invariant-error");
-const _apprenderscheduling = require("./app-render-scheduling");
-const _fastsetimmediateexternal = require("../node-environment-extensions/fast-set-immediate.external");
-function prerenderAndAbortInSequentialTasks(prerender, abort) {
-    if (process.env.NEXT_RUNTIME === 'edge') {
-        throw Object.defineProperty(new _invarianterror.InvariantError('`prerenderAndAbortInSequentialTasks` should not be called in edge runtime.'), "__NEXT_ERROR_CODE", {
-            value: "E538",
-            enumerable: false,
-            configurable: true
-        });
-    } else {
-        return new Promise((resolve, reject)=>{
-            const scheduleTimeout = (0, _apprenderscheduling.createAtomicTimerGroup)();
-            let pendingResult;
-            scheduleTimeout(()=>{
-                try {
-                    (0, _fastsetimmediateexternal.DANGEROUSLY_runPendingImmediatesAfterCurrentTask)();
-                    pendingResult = prerender();
-                    pendingResult.catch(()=>{});
-                } catch (err) {
-                    reject(err);
-                }
-            });
-            scheduleTimeout(()=>{
-                try {
-                    (0, _fastsetimmediateexternal.expectNoPendingImmediates)();
-                    abort();
-                    resolve(pendingResult);
-                } catch (err) {
-                    reject(err);
-                }
-            });
-        });
-    }
-}
-function prerenderAndAbortInSequentialTasksWithStages(prerender, advanceStage, abort) {
-    if (process.env.NEXT_RUNTIME === 'edge') {
-        throw Object.defineProperty(new _invarianterror.InvariantError('`prerenderAndAbortInSequentialTasksWithStages` should not be called in edge runtime.'), "__NEXT_ERROR_CODE", {
-            value: "E778",
-            enumerable: false,
-            configurable: true
-        });
-    } else {
-        return new Promise((resolve, reject)=>{
-            const scheduleTimeout = (0, _apprenderscheduling.createAtomicTimerGroup)();
-            let pendingResult;
-            scheduleTimeout(()=>{
-                try {
-                    (0, _fastsetimmediateexternal.DANGEROUSLY_runPendingImmediatesAfterCurrentTask)();
-                    pendingResult = prerender();
-                    pendingResult.catch(()=>{});
-                } catch (err) {
-                    reject(err);
-                }
-            });
-            scheduleTimeout(()=>{
-                try {
-                    (0, _fastsetimmediateexternal.DANGEROUSLY_runPendingImmediatesAfterCurrentTask)();
-                    advanceStage();
-                } catch (err) {
-                    reject(err);
-                }
-            });
-            scheduleTimeout(()=>{
-                try {
-                    (0, _fastsetimmediateexternal.expectNoPendingImmediates)();
-                    abort();
-                    resolve(pendingResult);
-                } catch (err) {
-                    reject(err);
-                }
-            });
-        });
-    }
-}
 class ReactServerResult {
     constructor(stream){
         this._stream = stream;

package/dist/web/standalone/node_modules/next/dist/server/app-render/app-render-render-utils.js

@@ -2,109 +2,73 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-0 && (module.exports = {
-    pipelineInSequentialTasks: null,
-    scheduleInSequentialTasks: null
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: all[name]
-    });
-}
-_export(exports, {
-    pipelineInSequentialTasks: function() {
-        return pipelineInSequentialTasks;
-    },
-    scheduleInSequentialTasks: function() {
-        return scheduleInSequentialTasks;
+Object.defineProperty(exports, "runInSequentialTasks", {
+    enumerable: true,
+    get: function() {
+        return runInSequentialTasks;
     }
 });
 const _invarianterror = require("../../shared/lib/invariant-error");
 const _apprenderscheduling = require("./app-render-scheduling");
 const _fastsetimmediateexternal = require("../node-environment-extensions/fast-set-immediate.external");
-function scheduleInSequentialTasks(render, followup) {
+const _isthenable = require("../../shared/lib/is-thenable");
+function noop() {}
+function runInSequentialTasks(first, ...rest) {
     if (process.env.NEXT_RUNTIME === 'edge') {
-        throw Object.defineProperty(new _invarianterror.InvariantError('`scheduleInSequentialTasks` should not be called in edge runtime.'), "__NEXT_ERROR_CODE", {
-            value: "E591",
+        throw Object.defineProperty(new _invarianterror.InvariantError('`runInSequentialTasks` should not be called in edge runtime.'), "__NEXT_ERROR_CODE", {
+            value: "E1054",
             enumerable: false,
             configurable: true
         });
     } else {
         return new Promise((resolve, reject)=>{
             const scheduleTimeout = (0, _apprenderscheduling.createAtomicTimerGroup)();
-            let pendingResult;
-            scheduleTimeout(()=>{
-                try {
-                    (0, _fastsetimmediateexternal.DANGEROUSLY_runPendingImmediatesAfterCurrentTask)();
-                    pendingResult = render();
-                } catch (err) {
-                    reject(err);
-                }
-            });
-            scheduleTimeout(()=>{
-                try {
-                    (0, _fastsetimmediateexternal.expectNoPendingImmediates)();
-                    followup();
-                    resolve(pendingResult);
-                } catch (err) {
-                    reject(err);
-                }
-            });
-        });
-    }
-}
-function pipelineInSequentialTasks(one, two, three) {
-    if (process.env.NEXT_RUNTIME === 'edge') {
-        throw Object.defineProperty(new _invarianterror.InvariantError('`pipelineInSequentialTasks` should not be called in edge runtime.'), "__NEXT_ERROR_CODE", {
-            value: "E875",
-            enumerable: false,
-            configurable: true
-        });
-    } else {
-        return new Promise((resolve, reject)=>{
-            const scheduleTimeout = (0, _apprenderscheduling.createAtomicTimerGroup)();
-            let oneResult;
-            scheduleTimeout(()=>{
-                try {
-                    (0, _fastsetimmediateexternal.DANGEROUSLY_runPendingImmediatesAfterCurrentTask)();
-                    oneResult = one();
-                } catch (err) {
-                    clearTimeout(twoId);
-                    clearTimeout(threeId);
-                    clearTimeout(fourId);
-                    reject(err);
-                }
-            });
-            let twoResult;
-            const twoId = scheduleTimeout(()=>{
-                // if `one` threw, then this timeout would've been cleared,
-                // so if we got here, we're guaranteed to have a value.
+            const ids = [];
+            let result;
+            ids.push(scheduleTimeout(()=>{
                 try {
                     (0, _fastsetimmediateexternal.DANGEROUSLY_runPendingImmediatesAfterCurrentTask)();
-                    twoResult = two(oneResult);
+                    result = first();
+                    // If the first function returns a thenable, suppress unhandled
+                    // rejections. A later task in the sequence (e.g. an abort) may
+                    // cause the promise to reject, and we don't want that to surface
+                    // as an unhandled rejection — the caller will observe the
+                    // rejection when they await the returned promise.
+                    if ((0, _isthenable.isThenable)(result)) {
+                        result.then(noop, noop);
+                    }
                 } catch (err) {
-                    clearTimeout(threeId);
-                    clearTimeout(fourId);
+                    for(let i = 1; i < ids.length; i++){
+                        clearTimeout(ids[i]);
+                    }
                     reject(err);
                 }
-            });
-            let threeResult;
-            const threeId = scheduleTimeout(()=>{
-                // if `two` threw, then this timeout would've been cleared,
-                // so if we got here, we're guaranteed to have a value.
+            }));
+            for(let i = 0; i < rest.length; i++){
+                const fn = rest[i];
+                let index = ids.length;
+                ids.push(scheduleTimeout(()=>{
+                    try {
+                        (0, _fastsetimmediateexternal.DANGEROUSLY_runPendingImmediatesAfterCurrentTask)();
+                        fn();
+                    } catch (err) {
+                        // clear remaining timeouts
+                        while(++index < ids.length){
+                            clearTimeout(ids[index]);
+                        }
+                        reject(err);
+                    }
+                }));
+            }
+            // We wait a task before resolving
+            ids.push(scheduleTimeout(()=>{
                 try {
                     (0, _fastsetimmediateexternal.expectNoPendingImmediates)();
-                    threeResult = three(twoResult);
+                    resolve(result);
                 } catch (err) {
-                    clearTimeout(fourId);
                     reject(err);
                 }
-            });
-            // We wait a task before resolving/rejecting
-            const fourId = scheduleTimeout(()=>{
-                resolve(threeResult);
-            });
+            }));
         });
     }
 }