Server Actions

CopytraverseModules(compilation, (mod, _chunk, chunkGroup, modId) => {
  // Go through all action entries and record the module ID for each entry.
  if (
    chunkGroup.name &&
    mod.request &&
    modId &&
    /next-flight-action-entry-loader/.test(mod.request)
  ) {
    const fromClient = /&__client_imported__=true/.test(mod.request)
 
    const mapping = this.isEdgeServer
      ? pluginState.edgeServerActionModules
      : pluginState.serverActionModules
 
    if (!mapping[chunkGroup.name]) {
      mapping[chunkGroup.name] = {}
    }
 
    mapping[chunkGroup.name][fromClient ? 'client' : 'server'] = {
      moduleId: modId,
      async: compilation.moduleGraph.isAsync(mod),
    }
  }

Copy  const serverManifest = {
    node: serverActions,
    edge: edgeServerActions,
    encryptionKey: this.encryptionKey,
  }
  const edgeServerManifest = {
    ...serverManifest,
    encryptionKey: 'process.env.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY',
  }
 
  const json = JSON.stringify(serverManifest, null, this.dev ? 2 : undefined)
  const edgeJson = JSON.stringify(
    edgeServerManifest,
    null,
    this.dev ? 2 : undefined
  )
 
  compilation.emitAsset(
    `${this.assetPrefix}${SERVER_REFERENCE_MANIFEST}.js`,
    new sources.RawSource(
      `self.__RSC_SERVER_MANIFEST=${JSON.stringify(edgeJson)}`
    ) as unknown as webpack.sources.RawSource
  )
  compilation.emitAsset(
    `${this.assetPrefix}${SERVER_REFERENCE_MANIFEST}.json`,
    new sources.RawSource(json) as unknown as webpack.sources.RawSource
  )
}

Copyexport interface ServerModuleMap {
  readonly [name: string]: {
    readonly id: string | number
    readonly name: string
    readonly chunks: Readonly<Array<string>> // currently not used
    readonly async?: boolean
  }
}

Copyexport function getActionNotFoundError(actionId: string | null): Error {
  return new Error(
    `Failed to find Server Action${actionId ? ` "${actionId}"` : ''}. This request might be from an older or newer deployment.\nRead more: https://nextjs.org/docs/messages/failed-to-find-server-action`
  )
}

Copyexport async function callServer(actionId: string, actionArgs: any[]) {
  return new Promise((resolve, reject) => {
    startTransition(() => {
      dispatchAppRouterAction({
        type: ACTION_SERVER_ACTION,
        actionId,
        actionArgs,
        resolve,
        reject,
      })
    })
  })

Copyfunction handleResult(nextState: AppRouterState) {
  // if we discarded this action, the state should also be discarded
  if (action.discarded) {
    // Check if the discarded server action revalidated data
    if (
      action.payload.type === ACTION_SERVER_ACTION &&
      action.payload.didRevalidate
    ) {
      // The server action was discarded but it revalidated data,
      // mark that we need to refresh after all actions complete
      actionQueue.needsRefresh = true
    }
    // This can't advance the queue (this action is no longer its head), but
    // if the queue has already drained, it flushes the refresh now.
    runRemainingActions(actionQueue, action, setState)
    return
  }

Copyexport function getServerActionRequestMetadata(
  req: IncomingMessage | BaseNextRequest | NextRequest
): {
  actionId: string | null
  isURLEncodedAction: boolean
  isMultipartAction: boolean
  isFetchAction: boolean
  isPossibleServerAction: boolean
} {
  let actionId: string | null
  let contentType: string | null
 
  if (req.headers instanceof Headers) {
    actionId = req.headers.get(ACTION_HEADER) ?? null
    contentType = req.headers.get('content-type')
  } else {
    actionId = (req.headers[ACTION_HEADER] as string) ?? null
    contentType = req.headers['content-type'] ?? null
  }
 
  // We don't actually support URL encoded actions, and the action handler will bail out if it sees one.
  // But we still want it to flow through to the action handler, to prevent changes in behavior when a regular
  // page component tries to handle a POST.
  const isURLEncodedAction = Boolean(
    req.method === 'POST' && contentType === 'application/x-www-form-urlencoded'
  )
  const isMultipartAction = Boolean(
    req.method === 'POST' && contentType?.startsWith('multipart/form-data')
  )
  const isFetchAction = Boolean(
    actionId !== undefined &&
      typeof actionId === 'string' &&
      req.method === 'POST'
  )
 
  const isPossibleServerAction = Boolean(
    isFetchAction || isURLEncodedAction || isMultipartAction
  )
 
  return {
    actionId,
    isURLEncodedAction,
    isMultipartAction,
    isFetchAction,
    isPossibleServerAction,
  }
}

Copyexport const isCsrfOriginAllowed = (
  originDomain: string,
  allowedOrigins: string[] = []
): boolean => {
  // DNS names are case-insensitive per RFC 1035
  // Use ASCII-only toLowerCase to avoid unicode issues
  const normalizedOrigin = originDomain.replace(/[A-Z]/g, (c) =>
    c.toLowerCase()
  )
 
  return allowedOrigins.some((allowedOrigin) => {
    if (!allowedOrigin) return false
 
    const normalizedAllowed = allowedOrigin.replace(/[A-Z]/g, (c) =>
      c.toLowerCase()
    )
 
    return (
      normalizedAllowed === normalizedOrigin ||
      matchWildcardDomain(originDomain, allowedOrigin)
    )
  })
}

Copyfunction areAllActionIdsValid(
  mpaFormData: FormData,
  serverModuleMap: ServerModuleMap
): boolean {
  let seenActionRefs = 0
  let hasAtLeastOneAction = false
  // Before we attempt to decode the payload for a possible MPA action, assert
  // that all action IDs are valid IDs.
  for (let key of mpaFormData.keys()) {
    if (!key.startsWith($ACTION_)) {
      // not a relevant field
      continue
    }
 
    if (key.startsWith($ACTION_ID_)) {
      // No Bound args case
      if (isInvalidActionIdFieldName(key, serverModuleMap)) {
        return false
      }
 
      hasAtLeastOneAction = true
    } else if (key.startsWith($ACTION_REF_)) {
      if (++seenActionRefs > 2) {
        // We only expect to see at most 2 $ACTION_REF_ fields in the form data:
        // one from <form action="..." method="post">
        // and one from <input action="..." type="submit">
        return false
      }
 
      // Bound args case
      const actionDescriptorField =
        $ACTION_ + key.slice($ACTION_REF_.length) + ':0'
      const actionFields = mpaFormData.getAll(actionDescriptorField)
      if (actionFields.length !== 1) {
        return false
      }
      const actionField = actionFields[0]
      if (typeof actionField !== 'string') {
        return false
      }
 
      if (isInvalidStringActionDescriptor(actionField, serverModuleMap)) {
        return false
      }
      hasAtLeastOneAction = true
    }
  }
  return hasAtLeastOneAction
}

Copyfunction getActionModIdOrError(
  actionId: string | null,
  serverModuleMap: ServerModuleMap
): string | number {
  // if we're missing the action ID header, we can't do any further processing
  if (!actionId) {
    throw new InvariantError("Missing 'next-action' header.")
  }
 
  const entry = serverModuleMap[actionId]
 
  if (entry == null) {
    // The proxy throws for malformed IDs and IDs that are missing from the
    // manifest. It only returns undefined when the ID collides with a
    // well-known property name (e.g. `toString`) that the proxy excludes from
    // server reference validation so that framework reflection probes don't
    // throw. Next.js never produces such an ID, so this is almost certainly a
    // probe with a known-bad ID. Repeat the manifest's throw logic here so the
    // caller gets a diagnosable error instead of a `TypeError`.
    throw mightBeServerReferenceId(actionId)
      ? getActionNotFoundError(actionId)
      : getInvalidServerReferenceIdError(actionId)
  }
 
  return entry.id
}

Copy * Limit on the number of arguments passed to a server action. This prevents
 * stack overflow during `action.apply()` from malicious requests.
 */
const SERVER_ACTION_ARGS_LIMIT = 1000
 
async function executeActionAndPrepareForRender<
  TFn extends (...args: any[]) => Promise<any>,
>(
  action: TFn,
  args: Parameters<TFn>,
  workStore: WorkStore,
  requestStore: RequestStore,
  shouldSkipPageRendering: boolean
): Promise<{
  actionResult: Awaited<ReturnType<TFn>>
  skipPageRendering: boolean
}> {
  requestStore.phase = 'action'
  let skipPageRendering = shouldSkipPageRendering
 
  if (args.length > SERVER_ACTION_ARGS_LIMIT) {
    throw new Error(
      `Server Action arguments list is too long (${args.length}). Maximum allowed is ${SERVER_ACTION_ARGS_LIMIT}.`
    )
  }

Copy 
try {
  const actionResult = await workUnitAsyncStorage.run(requestStore, () =>
    action.apply(null, args)
  )
 
  // If the page was not revalidated, or if this is an action-only request,
  // we can skip rendering the page.
  skipPageRendering ||=
    workStore.pathWasRevalidated === undefined ||
    workStore.pathWasRevalidated === ActionDidNotRevalidate
 
  return { actionResult, skipPageRendering }

Copy} finally {
  if (!skipPageRendering) {
    requestStore.phase = 'render'
 
    // When we switch to the render phase, cookies() will return
    // `workUnitStore.cookies` instead of
    // `workUnitStore.userspaceMutableCookies`. We want the render to see any
    // cookie writes that we performed during the action, so we need to update
    // the immutable cookies to reflect the changes.
    synchronizeMutableCookies(requestStore)
 
    // The server action might have toggled draft mode, so we need to reflect
    // that in the work store to be up-to-date for subsequent rendering.
    workStore.isDraftMode = requestStore.draftMode.isEnabled
 
    // If the action called revalidateTag/revalidatePath, then that might
    // affect data used by the subsequent render, so we need to make sure all
    // revalidations are applied before that.
    await executeRevalidates(workStore)
  }
}

Copyreturn {
  type: 'done',
  result: await generateFlight(ctx, requestStore, {
    actionResult: promise,
    // If the page was not revalidated, or if this is an action-only
    // request, we can skip rendering the page.
    skipPageRendering,
    temporaryReferences,
    waitUntil: getRevalidationWaitUntil(workStore, skipPageRendering),
  }),
}

Copyexport function serverActionReducer(
  state: ReadonlyReducerState,
  action: ServerActionAction
): ReducerState {
  const { resolve, reject } = action
 
  // only pass along the `nextUrl` param (used for interception routes) if the current route was intercepted.
  // If the route has been intercepted, the action should be as well.
  // Otherwise the server action might be intercepted with the wrong action id
  // (ie, one that corresponds with the intercepted route)
  const nextUrl =
    // We always send the last next-url, not the current when
    // performing a dynamic request. This is because we update
    // the next-url after a navigation, but we want the same
    // interception route to be matched that used the last
    // next-url.
    (state.previousNextUrl || state.nextUrl) &&
    hasInterceptionRouteInCurrentTree(state.tree)
      ? state.previousNextUrl || state.nextUrl
      : null
 
  return fetchServerAction(state, nextUrl, action).then(
    async ({
      revalidationKind,
      actionResult,
      actionFlightData: flightData,
      actionFlightDataRenderedSearch: flightDataRenderedSearch,
      redirectLocation,
      redirectType,
      isPrerender,
      couldBeIntercepted,
    }) => {
      if (revalidationKind !== ActionDidNotRevalidate) {
        // There was either a revalidation or a refresh, or maybe both.
 
        // Evict the BFCache, which may contain dynamic data.
        invalidateBfCache()
 
        // Store whether this action triggered any revalidation
        // The action queue will use this information to potentially
        // trigger a refresh action if the action was discarded
        // (ie, due to a navigation, before the action completed)
        action.didRevalidate = true
 
        // If there was a revalidation, evict the prefetch cache.
        // TODO: Evict only segments with matching tags and/or paths.
        // TODO: We should only invalidate the route cache if cookies were
        // mutated, since route trees may vary based on cookies. For now we
        // invalidate both caches until we have a way to detect cookie
        // mutations on the client.