ugly-app 0.1.1069 → 0.1.1071

package/src/server/Auth.ts

@@ -11,6 +11,8 @@ import { getUglyBotUrl } from '../shared/uglyBotUrl.js';
 
 /** Default cookie max-age: 30 days (in seconds). */
 const COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+/** `/auth/token` is per-visitor (cookie-keyed): no shared or browser cache. */
+const AUTH_TOKEN_CACHE_CONTROL = 'private, no-store';
 
 /**
  * Resolve the auth secret used for Mode B local JWTs. Same precedence as
@@ -307,6 +309,10 @@ export function createAuthRoutes(
 
   // GET /auth/token — exchange a valid auth_token cookie for a fresh JWT
   router.get('/auth/token', async (req: Request, res: Response) => {
+    // Per-visitor answer keyed only by the Cookie header, which shared caches
+    // ignore: a cached anonymous `{ token: null }` was replayed to signed-in
+    // visitors in production. Never let any cache store it.
+    res.setHeader('Cache-Control', AUTH_TOKEN_CACHE_CONTROL);
     const token = req.cookies?.auth_token as string | undefined;
     // `?probe=1` (the SSR boot's session check): "not signed in" is a normal
     // answer, not an error. Mirrors the Workers adapter.

package/src/server/adapter/workers/createWorkersApp.ts

@@ -97,6 +97,7 @@ import {
 import type { DbAdapter, PubSubMessage, ServerAdapter } from '../types.js';
 import type { QueueMessage, WorkersEnv } from './cf-types.js';
 import { CollectionDO } from './do-collection.js';
+import { withDynamicCacheDefault } from './edgeCache.js';
 import { createWorkersAdapter } from './index.js';
 import { runWithPendingPublishes } from './pubsub.js';
 import { backgroundWait } from '../../backgroundWait.js';
@@ -2835,6 +2836,8 @@ export function createWorkersApp<R extends AppRegistryBase>(
   // The Node implementation registers these via createAuthRoutes() on
   // the express router; on Workers they live here.
   const COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30; // 30 days
+  /** `/auth/token` is per-visitor (cookie-keyed): no shared or browser cache. */
+  const AUTH_TOKEN_CACHE_CONTROL = 'private, no-store';
   function buildCookie(token: string, opts: { clear?: boolean } = {}): string {
     const parts = [`auth_token=${opts.clear ? '' : token}`];
     parts.push('Path=/');
@@ -2898,6 +2901,11 @@ export function createWorkersApp<R extends AppRegistryBase>(
   });
 
   hono.get('/auth/token', async (c) => {
+    // The answer depends only on the Cookie header, which Cloudflare's Workers
+    // cache does not key on: without this, one anonymous probe's
+    // `{ token: null }` was cached and replayed to signed-in visitors, so SSR
+    // pages booted logged out. Mirrors server/Auth.ts.
+    c.header('Cache-Control', AUTH_TOKEN_CACHE_CONTROL);
     const token = getAuthCookie(c);
     // `?probe=1` (the SSR boot's session check) asks "is anyone signed in?",
     // for which "no" is a normal answer — a 401 there is a console error on
@@ -3273,7 +3281,12 @@ export function createWorkersApp<R extends AppRegistryBase>(
       // this request (the new-model cache lives on `ctx.cache`, not yet in the
       // published types — hence the structural `WorkerExecutionCtx`).
       ctx.executionCtx = ctxArg;
-      const res = await hono.fetch(request, env, ctxArg);
+      // A router response with no Cache-Control is never shared-cacheable:
+      // the edge cache ignores Cookie, so a per-visitor answer would leak.
+      const res = withDynamicCacheDefault(
+        request,
+        await hono.fetch(request, env, ctxArg),
+      );
       // Drain any console.error/warn buffered during this request into the
       // project's Postgres errorLog. The `setTimeout`-based flush scheduler
       // can't fire after the isolate freezes post-response, so we extend the

package/src/server/adapter/workers/edgeCache.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest';
+import {
+  DYNAMIC_DEFAULT_CACHE_CONTROL,
+  withDynamicCacheDefault,
+} from './edgeCache.js';
+
+const get = new Request('https://app.test/x');
+
+describe('withDynamicCacheDefault', () => {
+  it('marks a header-less GET response private, no-store', () => {
+    const res = withDynamicCacheDefault(get, Response.json({ token: null }));
+    expect(res.headers.get('cache-control')).toBe(
+      DYNAMIC_DEFAULT_CACHE_CONTROL,
+    );
+  });
+
+  it('covers HEAD too', () => {
+    const head = new Request('https://app.test/x', { method: 'HEAD' });
+    const res = withDynamicCacheDefault(head, new Response(null));
+    expect(res.headers.get('cache-control')).toBe('private, no-store');
+  });
+
+  it('keeps a route that chose its own Cache-Control', () => {
+    const res = withDynamicCacheDefault(
+      get,
+      new Response('ok', {
+        headers: { 'cache-control': 'public, s-maxage=600' },
+      }),
+    );
+    expect(res.headers.get('cache-control')).toBe('public, s-maxage=600');
+  });
+
+  it('leaves non-GET methods alone (never cached anyway)', () => {
+    const post = new Request('https://app.test/x', { method: 'POST' });
+    const res = withDynamicCacheDefault(post, new Response('ok'));
+    expect(res.headers.get('cache-control')).toBeNull();
+  });
+
+  it('copies a response whose headers are immutable', async () => {
+    const original = new Response('body', {
+      status: 202,
+      headers: { 'x-a': '1' },
+    });
+    // Simulate a passthrough response (fetch / DO stub) with frozen headers.
+    Object.defineProperty(original, 'headers', {
+      value: new Proxy(original.headers, {
+        get(target, prop) {
+          if (prop === 'set')
+            return () => {
+              throw new TypeError("Can't modify immutable headers.");
+            };
+          const v = Reflect.get(target, prop) as unknown;
+          return typeof v === 'function' ? v.bind(target) : v;
+        },
+      }),
+    });
+    const res = withDynamicCacheDefault(get, original);
+    expect(res).not.toBe(original);
+    expect(res.status).toBe(202);
+    expect(res.headers.get('x-a')).toBe('1');
+    expect(res.headers.get('cache-control')).toBe('private, no-store');
+    expect(await res.text()).toBe('body');
+  });
+});

package/src/server/adapter/workers/edgeCache.ts

@@ -179,3 +179,41 @@ export function ssrCacheTags(routeName: string, extra: string[] = []): string {
   const tags = ['ssr', `ssr-${routeTag}`, ...extra.map(clean)].filter(Boolean);
   return [...new Set(tags)].join(',');
 }
+
+/** Default `Cache-Control` for a dynamic Worker response that set none. */
+export const DYNAMIC_DEFAULT_CACHE_CONTROL = 'private, no-store';
+
+/**
+ * Give a GET/HEAD response from the Worker's router (framework + app routes)
+ * `Cache-Control: private, no-store` when it carries no `Cache-Control` of its
+ * own.
+ *
+ * With the declarative Workers cache on, Cloudflare stores a header-less 200
+ * under path+query and does NOT key on Cookie or Authorization. A route whose
+ * answer depends on the caller (the auth cookie, a session) therefore leaked one
+ * visitor's answer to everyone: an anonymous `/auth/token?probe=1`
+ * `{ token: null }` was replayed to signed-in visitors. A route that is meant to
+ * be shared-cached says so with its own `Cache-Control` (static assets and SSR
+ * documents are produced outside the router and set theirs), so only the
+ * header-less remainder is touched. WebSocket upgrades (101) pass through.
+ */
+export function withDynamicCacheDefault(
+  request: Request,
+  res: Response,
+): Response {
+  const method = request.method.toUpperCase();
+  if (method !== 'GET' && method !== 'HEAD') return res;
+  if (res.status === 101) return res;
+  if ((res as Response & { webSocket?: unknown }).webSocket) return res;
+  if (res.headers.has('cache-control')) return res;
+  try {
+    res.headers.set('cache-control', DYNAMIC_DEFAULT_CACHE_CONTROL);
+    return res;
+  } catch {
+    // Immutable headers (a response passed through from fetch() or a Durable
+    // Object stub): copy it into a mutable one.
+    const copy = new Response(res.body, res);
+    copy.headers.set('cache-control', DYNAMIC_DEFAULT_CACHE_CONTROL);
+    return copy;
+  }
+}