vinext 0.0.21 → 0.0.22

package/dist/index.js

@@ -6,6 +6,7 @@ import { handleApiRoute } from "./server/api-handler.js";
 import { generateRscEntry, generateSsrEntry, generateBrowserEntry, } from "./server/app-dev-server.js";
 import { loadNextConfig, resolveNextConfig, } from "./config/next-config.js";
 import { findMiddlewareFile, isProxyFile, runMiddleware } from "./server/middleware.js";
+import { logRequest, now } from "./server/request-log.js";
 import { generateSafeRegExpCode, generateMiddlewareMatcherCode, generateNormalizePathCode } from "./server/middleware-codegen.js";
 import { normalizePath } from "./server/normalize-path.js";
 import { findInstrumentationFile, runInstrumentation } from "./server/instrumentation.js";
@@ -1026,6 +1027,12 @@ function createReqRes(request, url, query, body) {
       else { res.writeHead(statusOrUrl, { Location: url2 }); }
       res.end();
     },
+    getHeaders: function() {
+      var h = Object.assign({}, resHeaders);
+      if (setCookieHeaders.length > 0) h["set-cookie"] = setCookieHeaders;
+      return h;
+    },
+    get headersSent() { return ended; },
   };
 
   return { req, res, responsePromise };
@@ -1140,8 +1147,9 @@ export async function renderPage(request, url, manifest) {
     }
 
     let pageProps = {};
+    var gsspRes = null;
     if (typeof pageModule.getServerSideProps === "function") {
-      const { req, res } = createReqRes(request, routeUrl, parseQuery(routeUrl), undefined);
+      const { req, res, responsePromise } = createReqRes(request, routeUrl, parseQuery(routeUrl), undefined);
       const ctx = {
         params, req, res,
         query: parseQuery(routeUrl),
@@ -1151,6 +1159,10 @@ export async function renderPage(request, url, manifest) {
         defaultLocale: i18nConfig ? i18nConfig.defaultLocale : undefined,
       };
       const result = await pageModule.getServerSideProps(ctx);
+      // If gSSP called res.end() directly (short-circuit), return that response.
+      if (res.headersSent) {
+        return await responsePromise;
+      }
       if (result && result.props) pageProps = result.props;
       if (result && result.redirect) {
         var gsspStatus = result.redirect.statusCode != null ? result.redirect.statusCode : (result.redirect.permanent ? 308 : 307);
@@ -1159,6 +1171,9 @@ export async function renderPage(request, url, manifest) {
       if (result && result.notFound) {
         return new Response("404", { status: 404 });
       }
+      // Preserve the res object so headers/status/cookies set by gSSP
+      // can be merged into the final HTML response.
+      gsspRes = res;
     }
     // Build font Link header early so it's available for ISR cached responses too.
     // Font preloads are module-level state populated at import time and persist across requests.
@@ -1335,16 +1350,33 @@ export async function renderPage(request, url, manifest) {
       await isrSet(isrCacheKey, { kind: "PAGES", html: fullHtml, pageData: pageProps, headers: undefined, status: undefined }, isrRevalidateSeconds);
     }
 
-    const responseHeaders = { "Content-Type": "text/html" };
+    // Merge headers/status/cookies set by getServerSideProps on the res object.
+    // gSSP commonly uses res.setHeader("Set-Cookie", ...) or res.status(304).
+    var finalStatus = 200;
+    const responseHeaders = new Headers({ "Content-Type": "text/html" });
+    if (gsspRes) {
+      finalStatus = gsspRes.statusCode;
+      var gsspHeaders = gsspRes.getHeaders();
+      for (var hk of Object.keys(gsspHeaders)) {
+        var hv = gsspHeaders[hk];
+        if (hk === "set-cookie" && Array.isArray(hv)) {
+          for (var sc of hv) responseHeaders.append("set-cookie", sc);
+        } else if (hv != null) {
+          responseHeaders.set(hk, String(hv));
+        }
+      }
+      // Ensure Content-Type stays text/html (gSSP shouldn't override it for page renders)
+      responseHeaders.set("Content-Type", "text/html");
+    }
     if (isrRevalidateSeconds) {
-      responseHeaders["Cache-Control"] = "s-maxage=" + isrRevalidateSeconds + ", stale-while-revalidate";
-      responseHeaders["X-Vinext-Cache"] = "MISS";
+      responseHeaders.set("Cache-Control", "s-maxage=" + isrRevalidateSeconds + ", stale-while-revalidate");
+      responseHeaders.set("X-Vinext-Cache", "MISS");
     }
     // Set HTTP Link header for font preloading
     if (_fontLinkHeader) {
-      responseHeaders["Link"] = _fontLinkHeader;
+      responseHeaders.set("Link", _fontLinkHeader);
     }
-    return new Response(compositeStream, { status: 200, headers: responseHeaders });
+    return new Response(compositeStream, { status: finalStatus, headers: responseHeaders });
   } catch (e) {
     console.error("[vinext] SSR error:", e);
     return new Response("Internal Server Error", { status: 500 });
@@ -2236,8 +2268,135 @@ hydrate();
                         console.error("[vinext] Instrumentation error:", err);
                     });
                 }
+                // ── Dev request origin check ─────────────────────────────────────
+                // Registered directly (not in the returned function) so it runs
+                // BEFORE Vite's built-in middleware. This ensures all requests
+                // (including /@*, /__vite*, /node_modules* paths) are validated
+                // before Vite serves any content.
+                server.middlewares.use((req, res, next) => {
+                    const blockReason = validateDevRequest({
+                        origin: req.headers.origin,
+                        host: req.headers.host,
+                        "x-forwarded-host": req.headers["x-forwarded-host"],
+                        "sec-fetch-site": req.headers["sec-fetch-site"],
+                        "sec-fetch-mode": req.headers["sec-fetch-mode"],
+                    }, nextConfig?.serverActionsAllowedOrigins);
+                    if (blockReason) {
+                        console.warn(`[vinext] Blocked dev request: ${blockReason} (${req.url})`);
+                        res.writeHead(403, { "Content-Type": "text/plain" });
+                        res.end("Forbidden");
+                        return;
+                    }
+                    next();
+                });
                 // Return a function to register middleware AFTER Vite's built-in middleware
                 return () => {
+                    // App Router request logging in dev server
+                    //
+                    // For App Router, the RSC plugin handles requests internally.
+                    // We install a timing middleware here that:
+                    //   1. Intercepts writeHead() to pluck the X-Vinext-Timing header
+                    //      (compileMs,renderMs) that the RSC entry attaches before
+                    //      it is flushed to the client.
+                    //   2. Logs the full request after res finishes, using those timings.
+                    if (hasAppDir) {
+                        server.middlewares.use((req, res, next) => {
+                            const url = req.url ?? "/";
+                            // Skip Vite internals, HMR, and static assets.
+                            // Do NOT skip .rsc-suffixed URLs or RSC wire requests (Accept: text/x-component)
+                            // — those are soft navigations and should be logged like any other page request.
+                            const [pathname] = url.split("?");
+                            if (url.startsWith("/@") ||
+                                url.startsWith("/__vite") ||
+                                url.startsWith("/node_modules") ||
+                                (url.includes(".") && !pathname.endsWith(".html") && !pathname.endsWith(".rsc"))) {
+                                return next();
+                            }
+                            const _reqStart = now();
+                            let _compileMs;
+                            let _renderMs;
+                            // Intercept setHeader and writeHead so we can strip X-Vinext-Timing
+                            // before it reaches the client and capture the compile/render split.
+                            // The RSC plugin may set headers either way depending on its version.
+                            // Parse the three-part X-Vinext-Timing header:
+                            //   "handlerStart,inHandlerCompileMs,renderMs"
+                            //
+                            // True compile time = time the RSC plugin spent loading/transforming
+                            // modules before our handler code ran, plus any in-handler work before
+                            // renderToReadableStream. Concretely:
+                            //   compileMs = (handlerStart - _reqStart) + inHandlerCompileMs
+                            //   renderMs  = renderMs from header, or -1 for RSC-only (soft-nav)
+                            //               responses where rendering is not measured in the handler.
+                            //               In that case the middleware computes render time as
+                            //               totalMs - compileMs.
+                            //
+                            // handlerStart is performance.now() recorded at the very top of
+                            // _handleRequest in the generated RSC entry. _reqStart is recorded
+                            // here in the Node middleware, one stack frame before the RSC plugin
+                            // loads the module. The gap between them is exactly the Vite
+                            // compile/transform cost.
+                            function _parseTiming(raw) {
+                                const [handlerStart, inHandlerCompileMs, renderMs] = String(raw).split(",").map((v) => Number(v));
+                                if (!Number.isNaN(handlerStart) && !Number.isNaN(inHandlerCompileMs) && inHandlerCompileMs !== -1) {
+                                    _compileMs = Math.max(0, Math.round(handlerStart - _reqStart)) + inHandlerCompileMs;
+                                }
+                                if (!Number.isNaN(renderMs) && renderMs !== -1) {
+                                    _renderMs = renderMs;
+                                }
+                            }
+                            const _origSetHeader = res.setHeader.bind(res);
+                            res.setHeader = function (name, value) {
+                                if (name.toLowerCase() === "x-vinext-timing") {
+                                    _parseTiming(value);
+                                    return res; // drop the header — don't forward to client
+                                }
+                                return _origSetHeader(name, value);
+                            };
+                            const _origWriteHead = res.writeHead.bind(res);
+                            res.writeHead = function (statusCode, ...args) {
+                                // Normalise the optional headers argument (may be reason, headers object, or both).
+                                let headers;
+                                const [reasonOrHeaders, maybeHeaders] = args;
+                                if (typeof reasonOrHeaders === "string") {
+                                    headers = maybeHeaders;
+                                }
+                                else {
+                                    headers = reasonOrHeaders;
+                                }
+                                // Pull timing out of the headers object when present.
+                                if (headers && typeof headers === "object" && !Array.isArray(headers)) {
+                                    const timingKey = Object.keys(headers).find((k) => k.toLowerCase() === "x-vinext-timing");
+                                    if (timingKey) {
+                                        _parseTiming(headers[timingKey]);
+                                        delete headers[timingKey];
+                                    }
+                                }
+                                return _origWriteHead(statusCode, ...args);
+                            };
+                            res.on("finish", () => {
+                                // Strip .rsc suffix — it's an internal RSC protocol detail,
+                                // not part of the actual page path the user navigated to.
+                                const logUrl = url.replace(/\.rsc(\?|$)/, "$1");
+                                const totalMs = now() - _reqStart;
+                                // For RSC-only responses (soft nav), renderMs is -1 (sentinel meaning
+                                // "not measured in the handler"). Compute it as totalMs - compileMs,
+                                // which is how long the RSC stream took to fully flush to the client —
+                                // matching what Next.js shows for soft navigations.
+                                const resolvedRenderMs = _renderMs !== undefined
+                                    ? _renderMs
+                                    : (_compileMs !== undefined ? Math.max(0, Math.round(totalMs - _compileMs)) : undefined);
+                                logRequest({
+                                    method: req.method ?? "GET",
+                                    url: logUrl,
+                                    status: res.statusCode,
+                                    totalMs,
+                                    compileMs: _compileMs,
+                                    renderMs: resolvedRenderMs,
+                                });
+                            });
+                            next();
+                        });
+                    }
                     server.middlewares.use(async (req, res, next) => {
                         try {
                             let url = req.url ?? "/";
@@ -2255,9 +2414,12 @@ hydrate();
                             if (url.split("?")[0].endsWith(".rsc")) {
                                 return next();
                             }
-                            // ── Cross-origin request protection ─────────────────────────
-                            // Block requests from non-localhost origins to prevent
-                            // cross-origin data exfiltration from the dev server.
+                            // ── Cross-origin request protection (defense-in-depth) ──────
+                            // The pre-Vite middleware above already blocks cross-origin
+                            // requests before Vite serves any content. This second check
+                            // guards the Pages Router handler specifically, in case the
+                            // middleware ordering changes or new middleware is added between
+                            // the two. Both calls use the same validateDevRequest() function.
                             const blockReason = validateDevRequest({
                                 origin: req.headers.origin,
                                 host: req.headers.host,
@@ -2281,7 +2443,14 @@ hydrate();
                                 const imgUrl = rawImgUrl?.replaceAll("\\", "/") ?? null;
                                 // Allowlist: must start with "/" but not "//" — blocks absolute
                                 // URLs, protocol-relative, backslash variants, and exotic schemes.
-                                if (!imgUrl || !imgUrl.startsWith("/") || imgUrl.startsWith("//")) {
+                                // Also block internal Vite paths (/@*, /__vite*, /node_modules*)
+                                // to prevent redirecting to dev server endpoints.
+                                if (!imgUrl ||
+                                    !imgUrl.startsWith("/") ||
+                                    imgUrl.startsWith("//") ||
+                                    imgUrl.startsWith("/@") ||
+                                    imgUrl.startsWith("/__vite") ||
+                                    imgUrl.startsWith("/node_modules")) {
                                     res.writeHead(400);
                                     res.end(!rawImgUrl ? "Missing url parameter" : "Only relative URLs allowed");
                                     return;