react-on-rails-pro-node-renderer 17.0.0-rc.6 → 17.0.0-rc.7

package/lib/worker/streamingUtils.js

@@ -22,10 +22,17 @@ function formatControlMessageChunk(metadata) {
     const header = `${serializedMetadata}\t${'0'.padStart(8, '0')}\n`;
     return Buffer.from(header);
 }
+// Control-message type strings: the TS end of the streaming wire protocol. The guarded
+// region below wraps only this single-line declaration (mirroring the Ruby single-line
+// CONTROL_MESSAGE_TYPES arrays) so unrelated literals in the functions cannot leak in.
+// MIRROR VALUES OF: react_on_rails/lib/react_on_rails/length_prefixed_parser.rb
+// MIRROR VALUES OF: react_on_rails_pro/lib/react_on_rails_pro/stream_request.rb
+const CONTROL_MESSAGE_TYPES = { propRequest: 'propRequest', renderComplete: 'renderComplete' };
+// MIRROR VALUES END
 function formatPropRequestChunk(propName) {
-    return formatControlMessageChunk({ messageType: 'propRequest', propName });
+    return formatControlMessageChunk({ messageType: CONTROL_MESSAGE_TYPES.propRequest, propName });
 }
 function formatRenderCompleteChunk() {
-    return formatControlMessageChunk({ messageType: 'renderComplete' });
+    return formatControlMessageChunk({ messageType: CONTROL_MESSAGE_TYPES.renderComplete });
 }
 //# sourceMappingURL=streamingUtils.js.map

package/lib/worker.d.ts

@@ -12,6 +12,7 @@ declare module '@fastify/multipart' {
 declare module 'fastify' {
     interface FastifyRequest {
         uploadDir: string;
+        uploadAssetValidationError: string | null;
     }
 }
 /** @internal Used in tests */

package/lib/worker.js

@@ -85,13 +85,16 @@ const fastifyConfig_js_1 = require("./worker/fastifyConfig.js");
 const vm_js_1 = require("./worker/vm.js");
 var fastifyConfig_js_2 = require("./worker/fastifyConfig.js");
 Object.defineProperty(exports, "configureFastify", { enumerable: true, get: function () { return fastifyConfig_js_2.configureFastify; } });
-const INCREMENTAL_REQUEST_CLOSE_TIMEOUT_MS = 1000;
+const INCREMENTAL_REQUEST_CLOSE_TIMEOUT_MS = 1_000;
 // Standard response streams use this only to release retained renderer context;
 // they are not aborted. Incremental responses may still close after request EOF.
 // These release/finish windows are intentionally equal so both stream paths
 // retain VM source-map registrations for the same idle period.
 const STREAM_CONTEXT_RELEASE_TIMEOUT_MS = constants_js_1.STREAM_CHUNK_TIMEOUT_MS;
 const INCREMENTAL_RESPONSE_FINISH_TIMEOUT_MS = STREAM_CONTEXT_RELEASE_TIMEOUT_MS;
+// Pull-mode clients can legitimately pause longer than the normal chunk window;
+// this coarse deadman only bounds abandoned request/response pairs.
+const INCREMENTAL_PULL_MODE_IDLE_TIMEOUT_MS = constants_js_1.STREAM_CHUNK_TIMEOUT_MS * 15;
 const HEALTH_ENDPOINT_ROUTES = ['/health', '/ready'];
 // TODO: Reassess the duplicated-route message format when upgrading Fastify.
 const FASTIFY_DUPLICATED_ROUTE_ERROR_CODE = 'FST_ERR_DUPLICATED_ROUTE';
@@ -262,7 +265,11 @@ const setResponseAndReleaseExecutionContext = async (result, res, executionConte
         executionContext.release();
     }
 };
-const isAsset = (value) => value.type === 'asset';
+const isAsset = (value) => typeof value === 'object' &&
+    value !== null &&
+    value.type === 'asset' &&
+    typeof value.savedFilePath === 'string' &&
+    typeof value.filename === 'string';
 function conflictingHealthEndpointPath(error) {
     if (typeof error !== 'object' || error === null) {
         return undefined;
@@ -348,6 +355,17 @@ const errorCode = (error) => {
     return typeof code === 'string' ? code : undefined;
 };
 const isValidRenderingRequest = (value) => typeof value === 'string' && value.length > 0;
+const isBooleanField = (value) => typeof value === 'boolean' || value === 'true' || value === 'false';
+const parseOptionalBooleanField = (body, key) => {
+    const value = body[key];
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (!isBooleanField(value)) {
+        return undefined;
+    }
+    return value === true || value === 'true';
+};
 const invalidRenderingRequestMessage = (body) => {
     const { renderingRequest } = body;
     let renderingRequestType = typeof renderingRequest;
@@ -379,6 +397,15 @@ const extractBodyArrayField = (body, key) => {
     }
     return undefined;
 };
+function discardMultipartFile(part) {
+    part.file.resume();
+    // eslint-disable-next-line no-param-reassign
+    part.value = {
+        filename: part.filename,
+        savedFilePath: '',
+        type: 'asset',
+    };
+}
 function run(config) {
     (0, runRscPeerCompatibilityCheck_js_1.runRscPeerCompatibilityCheck)({ proVersion: packageJson_js_1.default.version });
     // Store config in app state. From now it can be loaded by any module using
@@ -416,6 +443,7 @@ function run(config) {
     // from overwriting each other's files (GitHub issue #2449).
     // The directory path is lazily assigned in onFile (only for requests with file uploads).
     app.decorateRequest('uploadDir', '');
+    app.decorateRequest('uploadAssetValidationError', null);
     // Clean up the per-request upload directory after the response is sent.
     // Safe from a rate-limiting perspective (CodeQL js/missing-rate-limiting):
     // this is an internal service not exposed to the internet, the path is
@@ -433,6 +461,7 @@ function run(config) {
     // Supports multipart/form-data
     void app.register(multipart_1.default, {
         attachFieldsToBody: 'keyValues',
+        preservePath: true,
         limits: {
             fieldSize: constants_js_1.FIELD_SIZE_LIMIT,
             // For bundles and assets
@@ -446,16 +475,23 @@ function run(config) {
             if (typeof this?.uploadDir !== 'string') {
                 throw new Error('onFile: expected `this` to be bound to the Fastify request');
             }
-            // Lazily assign a per-request upload directory on first file upload
+            if (this.uploadAssetValidationError) {
+                discardMultipartFile(part);
+                return;
+            }
+            let safeFilename;
+            try {
+                safeFilename = (0, utils_js_1.validateAssetFilename)(part.filename);
+            }
+            catch (err) {
+                this.uploadAssetValidationError = err.message;
+                discardMultipartFile(part);
+                return;
+            }
+            // Lazily assign a per-request upload directory on first valid file upload.
             if (this.uploadDir === '') {
                 this.uploadDir = path_1.default.join(serverBundleCachePath, 'uploads', (0, crypto_1.randomUUID)());
             }
-            // Use path.basename to strip any directory components from the filename,
-            // preventing path traversal attacks (e.g. filename "../../etc/shadow").
-            const safeFilename = path_1.default.basename(part.filename);
-            if (!safeFilename) {
-                throw new Error(`onFile: received file with empty or invalid filename: ${JSON.stringify(part.filename)}`);
-            }
             const destinationPath = path_1.default.join(this.uploadDir, safeFilename);
             await (0, utils_js_1.saveMultipartFile)(part, destinationPath);
             // eslint-disable-next-line no-param-reassign
@@ -500,6 +536,15 @@ function run(config) {
             await setResponse((0, utils_js_1.badRequestResponseResult)(invalidRenderingRequestMessage(body)), res);
             return;
         }
+        const rscStreamObservability = parseOptionalBooleanField(body, 'rscStreamObservability');
+        if (body.rscStreamObservability != null && rscStreamObservability === undefined) {
+            await setResponse((0, utils_js_1.badRequestResponseResult)('Invalid "rscStreamObservability" field in render request.'), res);
+            return;
+        }
+        if (req.uploadAssetValidationError) {
+            await setResponse((0, utils_js_1.badRequestResponseResult)(req.uploadAssetValidationError), res);
+            return;
+        }
         const { bundleTimestamp } = req.params;
         const { providedNewBundles, assetsToCopy } = extractBundlesAndAssets(body, bundleTimestamp);
         try {
@@ -512,6 +557,7 @@ function run(config) {
                         dependencyBundleTimestamps,
                         providedNewBundles,
                         assetsToCopy,
+                        rscStreamObservability,
                         tracingContext: context,
                     });
                     await setResponseAndReleaseExecutionContext(result.response, res, result.executionContext);
@@ -538,7 +584,11 @@ function run(config) {
         let incrementalRequestClosed = false;
         let incrementalResponseFinished = false;
         let incrementalExecutionContextReleased = false;
+        let pullModeRequestCanIdle = false;
+        let incrementalRequestClosePromise;
         let incrementalResponseFinishTimeoutId;
+        let incrementalPullModeIdleTimeoutId;
+        let stopIncrementalRequestReader;
         let incrementalTracingContext;
         const clearIncrementalResponseFinishTimeout = () => {
             if (!incrementalResponseFinishTimeoutId) {
@@ -547,6 +597,26 @@ function run(config) {
             clearTimeout(incrementalResponseFinishTimeoutId);
             incrementalResponseFinishTimeoutId = undefined;
         };
+        const clearIncrementalPullModeIdleTimeout = () => {
+            if (!incrementalPullModeIdleTimeoutId) {
+                return;
+            }
+            clearTimeout(incrementalPullModeIdleTimeoutId);
+            incrementalPullModeIdleTimeoutId = undefined;
+        };
+        const shouldStopReadingIncrementalRequest = () => pullModeRequestCanIdle && responseStarted && incrementalResponseFinished;
+        const wakeIncrementalRequestReader = () => {
+            stopIncrementalRequestReader?.();
+            stopIncrementalRequestReader = undefined;
+        };
+        const waitForIncrementalRequestReaderStop = () => {
+            if (shouldStopReadingIncrementalRequest()) {
+                return Promise.resolve();
+            }
+            return new Promise((resolve) => {
+                stopIncrementalRequestReader = resolve;
+            });
+        };
         const releaseIncrementalExecutionContextWhenDone = () => {
             if (incrementalExecutionContextReleased ||
                 !incrementalRequestClosed ||
@@ -560,7 +630,9 @@ function run(config) {
         };
         const markIncrementalResponseFinished = () => {
             clearIncrementalResponseFinishTimeout();
+            clearIncrementalPullModeIdleTimeout();
             incrementalResponseFinished = true;
+            wakeIncrementalRequestReader();
             releaseIncrementalExecutionContextWhenDone();
         };
         const scheduleIncrementalResponseFinishTimeout = () => {
@@ -605,8 +677,13 @@ function run(config) {
             if (!incrementalSink || incrementalRequestClosed) {
                 return;
             }
+            clearIncrementalPullModeIdleTimeout();
+            if (incrementalRequestClosePromise) {
+                await incrementalRequestClosePromise;
+                return;
+            }
             const sink = incrementalSink;
-            try {
+            incrementalRequestClosePromise = (async () => {
                 await waitForIncrementalRequestClose(Promise.resolve()
                     .then(() => sink.handleRequestClosed())
                     .catch((closeError) => {
@@ -615,13 +692,104 @@ function run(config) {
                         error: closeError,
                     });
                 }), timeoutMs);
+            })();
+            try {
+                await incrementalRequestClosePromise;
             }
             finally {
+                incrementalRequestClosePromise = undefined;
                 incrementalRequestClosed = true;
+                clearIncrementalPullModeIdleTimeout();
                 scheduleIncrementalResponseFinishTimeout();
                 releaseIncrementalExecutionContextWhenDone();
             }
         };
+        const shouldWatchPullModeIdleProgress = () => pullModeRequestCanIdle &&
+            responseStarted &&
+            !incrementalRequestClosed &&
+            !incrementalResponseFinished &&
+            !incrementalExecutionContextReleased &&
+            !!incrementalSink &&
+            !res.raw.destroyed &&
+            !res.raw.writableEnded;
+        const scheduleIncrementalPullModeIdleTimeout = () => {
+            if (incrementalPullModeIdleTimeoutId || !shouldWatchPullModeIdleProgress()) {
+                return;
+            }
+            incrementalPullModeIdleTimeoutId = setTimeout(() => {
+                incrementalPullModeIdleTimeoutId = undefined;
+                if (!shouldWatchPullModeIdleProgress()) {
+                    return;
+                }
+                log_js_1.default.warn({
+                    msg: 'Timed out waiting for pull-mode incremental render progress after response started',
+                    timeoutMs: INCREMENTAL_PULL_MODE_IDLE_TIMEOUT_MS,
+                });
+                if (!res.raw.destroyed) {
+                    res.raw.destroy();
+                }
+                void closeIncrementalRequest({
+                    timeoutMs: INCREMENTAL_REQUEST_CLOSE_TIMEOUT_MS,
+                });
+                markIncrementalResponseFinished();
+            }, INCREMENTAL_PULL_MODE_IDLE_TIMEOUT_MS);
+        };
+        const refreshIncrementalPullModeIdleTimeout = () => {
+            if (!shouldWatchPullModeIdleProgress()) {
+                clearIncrementalPullModeIdleTimeout();
+                return;
+            }
+            clearIncrementalPullModeIdleTimeout();
+            scheduleIncrementalPullModeIdleTimeout();
+        };
+        const refreshIncrementalResponseFinishTimeout = () => {
+            if (!incrementalRequestClosed ||
+                incrementalResponseFinished ||
+                incrementalExecutionContextReleased ||
+                !incrementalSink) {
+                return;
+            }
+            clearIncrementalResponseFinishTimeout();
+            scheduleIncrementalResponseFinishTimeout();
+        };
+        const trackIncrementalResponseProgress = (stream) => {
+            const progressStream = new stream_1.Transform({
+                transform(chunk, encoding, callback) {
+                    refreshIncrementalPullModeIdleTimeout();
+                    refreshIncrementalResponseFinishTimeout();
+                    callback(null, chunk);
+                },
+            });
+            const forwardSourceError = (error) => progressStream.destroy(error);
+            const endProgressStream = () => {
+                if (!progressStream.writableEnded && !progressStream.destroyed) {
+                    progressStream.end();
+                }
+            };
+            stream.once('close', endProgressStream);
+            stream.once('error', forwardSourceError);
+            progressStream.once('close', () => {
+                stream.off('close', endProgressStream);
+                stream.off('error', forwardSourceError);
+                if (!progressStream.writableEnded && !stream.destroyed) {
+                    stream.destroy();
+                }
+            });
+            stream.pipe(progressStream);
+            return progressStream;
+        };
+        const getIncrementalRequestChunkTimeoutMs = () => {
+            if (pullModeRequestCanIdle &&
+                responseStarted &&
+                !incrementalResponseFinished &&
+                !res.raw.destroyed &&
+                !res.raw.writableEnded) {
+                scheduleIncrementalPullModeIdleTimeout();
+                return Number.POSITIVE_INFINITY;
+            }
+            clearIncrementalPullModeIdleTimeout();
+            return constants_js_1.STREAM_CHUNK_TIMEOUT_MS;
+        };
         try {
             await (0, tracing_js_1.trace)(async (context) => {
                 incrementalTracingContext = context;
@@ -649,6 +817,7 @@ function run(config) {
                         try {
                             const { response, sink } = await (0, handleIncrementalRenderRequest_js_1.handleIncrementalRenderRequest)(initial);
                             incrementalSink = sink;
+                            pullModeRequestCanIdle = !!incrementalSink && tempReqBody.pullEnabled === true;
                             return {
                                 response,
                                 shouldContinue: !!incrementalSink,
@@ -667,6 +836,7 @@ function run(config) {
                             log_js_1.default.error({ msg: 'Unexpected update chunk received after rendering was aborted', obj });
                             return;
                         }
+                        refreshIncrementalPullModeIdleTimeout();
                         try {
                             await incrementalSink.add(obj);
                         }
@@ -678,9 +848,10 @@ function run(config) {
                     onResponseStart: async (response) => {
                         responseStarted = true;
                         if (response.stream) {
-                            const markFinished = runWhenStreamFinishes(response.stream, res, markIncrementalResponseFinished);
+                            const responseStream = trackIncrementalResponseProgress(response.stream);
+                            const markFinished = runWhenStreamFinishes(responseStream, res, markIncrementalResponseFinished);
                             try {
-                                await setResponse(response, res);
+                                await setResponse({ ...response, stream: responseStream }, res);
                             }
                             catch (error) {
                                 markFinished();
@@ -698,6 +869,9 @@ function run(config) {
                     onRequestEnded: async () => {
                         await closeIncrementalRequest();
                     },
+                    getChunkTimeoutMs: getIncrementalRequestChunkTimeoutMs,
+                    shouldStopReading: shouldStopReadingIncrementalRequest,
+                    waitForStopReading: waitForIncrementalRequestReaderStop,
                 });
             }, (0, tracing_js_1.startSsrRequestOptions)({ renderingRequest: 'ReactOnRails.incrementalRender' }));
         }
@@ -754,6 +928,10 @@ function run(config) {
             await setResponse(precheckResult, res);
             return;
         }
+        if (req.uploadAssetValidationError) {
+            await setResponse((0, utils_js_1.badRequestResponseResult)(req.uploadAssetValidationError), res);
+            return;
+        }
         const { providedNewBundles, assetsToCopy } = extractBundlesAndAssets(req.body);
         if (providedNewBundles.length === 0) {
             const errorMsg = 'No bundle_<hash> fields provided. ' +
@@ -815,6 +993,16 @@ function run(config) {
             await setResponse((0, utils_js_1.errorResponseResult)(message), res);
             return;
         }
+        let assetFilename;
+        try {
+            assetFilename = (0, utils_js_1.validateAssetFilename)(filename);
+        }
+        catch (err) {
+            const { message } = err;
+            log_js_1.default.info(message);
+            await setResponse((0, utils_js_1.badRequestResponseResult)(message), res);
+            return;
+        }
         // Handle targetBundles as either a string or an array
         const targetBundles = extractBodyArrayField(req.body, 'targetBundles');
         if (!targetBundles || targetBundles.length === 0) {
@@ -825,7 +1013,7 @@ function run(config) {
         }
         // Check if the asset exists in each of the target bundles
         const results = await Promise.all(targetBundles.map(async (bundleHash) => {
-            const assetPath = (0, utils_js_1.getAssetPath)(bundleHash, filename);
+            const assetPath = (0, utils_js_1.getAssetPath)(bundleHash, assetFilename);
             const exists = await (0, fileExistsAsync_js_1.default)(assetPath);
             if (exists) {
                 log_js_1.default.info(`/asset-exists Uploaded asset DOES exist in bundle ${bundleHash}: ${assetPath}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-on-rails-pro-node-renderer",
-  "version": "17.0.0-rc.6",
+  "version": "17.0.0-rc.7",
   "protocolVersion": "2.0.0",
   "description": "React on Rails Pro Node Renderer for server-side rendering",
   "engines": {
@@ -44,8 +44,7 @@
     "pino": "^9.14.0 || ^10.1.0"
   },
   "devDependencies": {
-    "@babel/core": "^7.26.10",
-    "@babel/eslint-parser": "^7.27.0",
+    "@babel/core": "^7.29.6",
     "@babel/preset-env": "^7.20.2",
     "@babel/preset-react": "^7.26.3",
     "@babel/preset-typescript": "^7.27.1",
@@ -66,18 +65,18 @@
     "@types/lockfile": "^1.0.4",
     "@types/touch": "^3.1.5",
     "babel-jest": "^29.7.0",
-    "form-auto-content": "^3.2.1",
-    "form-data": "^4.0.1",
+    "form-data": "^4.0.6",
     "jest-junit": "^16.0.0",
-    "jsdom": "^16.5.0",
     "node-html-parser": "^7.0.1",
-    "nps": "^5.9.12",
     "pino-pretty": "^13.0.0",
+    "react": "~19.2.7",
+    "react-dom": "~19.2.7",
+    "react-on-rails-rsc": "19.2.1-rc.0",
     "redis": "^5.0.1",
     "sentry-testkit": "^5.0.6",
     "touch": "^3.1.0",
     "typescript": "^5.4.3",
-    "react-on-rails": "17.0.0-rc.6"
+    "react-on-rails": "17.0.0-rc.7"
   },
   "peerDependencies": {
     "@honeybadger-io/js": ">=4.0.0",
@@ -173,7 +172,6 @@
     "build-watch": "pnpm run clean && tsc --watch --project src/tsconfig.json",
     "clean": "rm -rf ./lib",
     "ci": "jest --ci --runInBand --reporters=default --reporters=jest-junit",
-    "developing": "nps node-renderer.debug",
     "test": "jest tests",
     "type-check": "tsc --noEmit --noErrorTruncation  --project src/tsconfig.json"
   }