Turbopack: support Subresource Integrity

crates/next-api/src/app.rs

@@ -80,14 +80,15 @@ use crate::{
     module_graph::{ClientReferencesGraphs, NextDynamicGraphs, ServerActionsGraphs},
     nft_json::NftJsonAsset,
     paths::{
-        all_paths_in_root, all_server_paths, get_asset_paths_from_root, get_js_paths_from_root,
+        all_asset_paths, all_paths_in_root, get_asset_paths_from_root, get_js_paths_from_root,
         get_wasm_paths_from_root, paths_to_bindings, wasm_paths_to_bindings,
     },
     project::{BaseAndFullModuleGraph, Project},
     route::{
         AppPageRoute, Endpoint, EndpointOutput, EndpointOutputPaths, ModuleGraphs, Route, Routes,
     },
     server_actions::{build_server_actions_loader, create_server_actions_manifest},
+    sri_manifest::get_sri_manifest_asset,
     webpack_stats::generate_webpack_stats,
 };
 
@@ -2007,26 +2008,34 @@ impl Endpoint for AppEndpoint {
 
         async move {
             let output = self.output();
-            let output_assets = output.output_assets();
-            let output = output.await?;
-            let node_root = &*this.app_project.project().node_root().await?;
+            let project = this.app_project.project();
+            let node_root = project.node_root().owned().await?;
+            let client_relative_root = project.client_relative_path().owned().await?;
 
-            let (server_paths, client_paths) = if this
-                .app_project
-                .project()
-                .next_mode()
-                .await?
-                .is_development()
+            let output_assets = output.output_assets();
+            let output_assets = if let Some(sri) =
+                &*project.next_config().experimental_sri().await?
+                && let Some(algorithm) = sri.algorithm.clone()
             {
-                let node_root = this.app_project.project().node_root().owned().await?;
-                let server_paths = all_server_paths(output_assets, node_root).owned().await?;
+                let sri_manifest = get_sri_manifest_asset(
+                    node_root.join(&format!(
+                        "server/app{}/subresource-integrity-manifest.json",
+                        &self.app_endpoint_entry().await?.original_name
+                    ))?,
+                    output_assets,
+                    client_relative_root.clone(),
+                    algorithm,
+                );
+                output_assets.concat_asset(sri_manifest)
+            } else {
+                output_assets
+            };
 
-                let client_relative_root = this
-                    .app_project
-                    .project()
-                    .client_relative_path()
-                    .owned()
-                    .await?;
+            let (server_paths, client_paths) = if project.next_mode().await?.is_development() {
+                let server_paths =
+                    all_asset_paths(output_assets, node_root.clone(), Default::default())
+                        .owned()
+                        .await?;
                 let client_paths = all_paths_in_root(output_assets, client_relative_root)
                     .owned()
                     .await?;
@@ -2035,7 +2044,7 @@ impl Endpoint for AppEndpoint {
                 (vec![], vec![])
             };
 
-            let written_endpoint = match *output {
+            let written_endpoint = match *output.await? {
                 AppEndpointOutput::NodeJs { rsc_chunk, .. } => EndpointOutputPaths::NodeJs {
                     server_entry_path: node_root
                         .get_path_to(&*rsc_chunk.path().await?)
@@ -2054,7 +2063,7 @@ impl Endpoint for AppEndpoint {
                 EndpointOutput {
                     output_assets: output_assets.to_resolved().await?,
                     output_paths: written_endpoint.resolved_cell(),
-                    project: this.app_project.project().to_resolved().await?,
+                    project: project.to_resolved().await?,
                 }
                 .cell(),
             )

crates/next-api/src/asset_hashes_manifest.rs

@@ -0,0 +1,67 @@
+use anyhow::Result;
+use serde::{Serialize, Serializer, ser::SerializeMap};
+use turbo_tasks::{ResolvedVc, Vc};
+use turbo_tasks_fs::{File, FileContent, FileSystemPath};
+use turbopack_core::{
+    asset::{Asset, AssetContent},
+    output::{OutputAsset, OutputAssetsReference},
+};
+
+use crate::paths::{AssetPath, AssetPaths};
+
+#[turbo_tasks::value]
+pub struct AssetHashesManifestAsset {
+    output_path: FileSystemPath,
+    asset_paths: ResolvedVc<AssetPaths>,
+}
+
+#[turbo_tasks::value_impl]
+impl AssetHashesManifestAsset {
+    #[turbo_tasks::function]
+    pub fn new(output_path: FileSystemPath, asset_paths: ResolvedVc<AssetPaths>) -> Vc<Self> {
+        AssetHashesManifestAsset {
+            output_path,
+            asset_paths,
+        }
+        .cell()
+    }
+}
+
+#[turbo_tasks::value_impl]
+impl OutputAssetsReference for AssetHashesManifestAsset {}
+
+#[turbo_tasks::value_impl]
+impl OutputAsset for AssetHashesManifestAsset {
+    #[turbo_tasks::function]
+    async fn path(&self) -> Vc<FileSystemPath> {
+        self.output_path.clone().cell()
+    }
+}
+
+#[turbo_tasks::value_impl]
+impl Asset for AssetHashesManifestAsset {
+    #[turbo_tasks::function]
+    async fn content(&self) -> Result<Vc<AssetContent>> {
+        let files = self.asset_paths.await?;
+
+        #[derive(Serialize)]
+        struct Manifest<'a>(#[serde(serialize_with = "serialize_vec_as_map")] &'a Vec<AssetPath>);
+
+        let json = serde_json::to_string(&Manifest(&files))?;
+
+        Ok(AssetContent::file(
+            FileContent::Content(File::from(json)).cell(),
+        ))
+    }
+}
+
+fn serialize_vec_as_map<S>(list: &Vec<AssetPath>, serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    let mut map = serializer.serialize_map(Some(list.len()))?;
+    for entry in list {
+        map.serialize_entry(&entry.path, &entry.content_hash)?;
+    }
+    map.end()
+}

crates/next-api/src/instrumentation.rs

@@ -28,7 +28,7 @@ use turbopack_core::{
 use crate::{
     nft_json::NftJsonAsset,
     paths::{
-        all_server_paths, get_js_paths_from_root, get_wasm_paths_from_root, wasm_paths_to_bindings,
+        all_asset_paths, get_js_paths_from_root, get_wasm_paths_from_root, wasm_paths_to_bindings,
     },
     project::Project,
     route::{Endpoint, EndpointOutput, EndpointOutputPaths, ModuleGraphs},
@@ -210,7 +210,9 @@ impl Endpoint for InstrumentationEndpoint {
 
             let server_paths = if this.project.next_mode().await?.is_development() {
                 let node_root = this.project.node_root().owned().await?;
-                all_server_paths(output_assets, node_root).owned().await?
+                all_asset_paths(output_assets, node_root, Default::default())
+                    .owned()
+                    .await?
             } else {
                 vec![]
             };

crates/next-api/src/lib.rs

@@ -5,6 +5,7 @@
 
 pub mod analyze;
 mod app;
+mod asset_hashes_manifest;
 mod client_references;
 mod dynamic_imports;
 mod empty;
@@ -23,5 +24,6 @@ pub mod project;
 pub mod route;
 pub mod routes_hashes_manifest;
 mod server_actions;
+mod sri_manifest;
 mod versioned_content_map;
 mod webpack_stats;

crates/next-api/src/middleware.rs

@@ -30,7 +30,7 @@ use turbopack_core::{
 use crate::{
     nft_json::NftJsonAsset,
     paths::{
-        all_paths_in_root, all_server_paths, get_asset_paths_from_root, get_js_paths_from_root,
+        all_asset_paths, all_paths_in_root, get_asset_paths_from_root, get_js_paths_from_root,
         get_wasm_paths_from_root, paths_to_bindings, wasm_paths_to_bindings,
     },
     project::Project,
@@ -337,7 +337,9 @@ impl Endpoint for MiddlewareEndpoint {
 
             let (server_paths, client_paths) = if this.project.next_mode().await?.is_development() {
                 let node_root = this.project.node_root().owned().await?;
-                let server_paths = all_server_paths(output_assets, node_root).owned().await?;
+                let server_paths = all_asset_paths(output_assets, node_root, Default::default())
+                    .owned()
+                    .await?;
 
                 // Middleware could in theory have a client path (e.g. `new URL`).
                 let client_relative_root = this.project.client_relative_path().owned().await?;

crates/next-api/src/pages.rs

@@ -75,11 +75,12 @@ use crate::{
     module_graph::{NextDynamicGraphs, validate_pages_css_imports},
     nft_json::NftJsonAsset,
     paths::{
-        all_paths_in_root, all_server_paths, get_asset_paths_from_root, get_js_paths_from_root,
+        all_asset_paths, all_paths_in_root, get_asset_paths_from_root, get_js_paths_from_root,
         get_wasm_paths_from_root, paths_to_bindings, wasm_paths_to_bindings,
     },
     project::Project,
     route::{Endpoint, EndpointOutput, EndpointOutputPaths, ModuleGraphs, Route, Routes},
+    sri_manifest::get_sri_manifest_asset,
     webpack_stats::generate_webpack_stats,
 };
 
@@ -1601,28 +1602,36 @@ impl Endpoint for PageEndpoint {
             }
         };
         async move {
-            let output = self.output().await?;
-            let output_assets = self.output().output_assets();
-
-            let node_root = this.pages_project.project().node_root().owned().await?;
+            let output = self.output();
+            let project = this.pages_project.project();
+            let node_root = project.node_root().owned().await?;
+            let client_relative_root = project.client_relative_path().owned().await?;
 
-            let (server_paths, client_paths) = if this
-                .pages_project
-                .project()
-                .next_mode()
-                .await?
-                .is_development()
+            let output_assets = self.output().output_assets();
+            let output_assets = if let Some(sri) =
+                &*project.next_config().experimental_sri().await?
+                && let Some(algorithm) = sri.algorithm.clone()
             {
-                let server_paths = all_server_paths(output_assets, node_root.clone())
-                    .owned()
-                    .await?;
+                let sri_manifest = get_sri_manifest_asset(
+                    node_root.join(&format!(
+                        "server/pages{}/subresource-integrity-manifest.json",
+                        get_asset_prefix_from_pathname(&this.pathname)
+                    ))?,
+                    output_assets,
+                    client_relative_root.clone(),
+                    algorithm,
+                );
+                output_assets.concat_asset(sri_manifest)
+            } else {
+                output_assets
+            };
+
+            let (server_paths, client_paths) = if project.next_mode().await?.is_development() {
+                let server_paths =
+                    all_asset_paths(output_assets, node_root.clone(), Default::default())
+                        .owned()
+                        .await?;
 
-                let client_relative_root = this
-                    .pages_project
-                    .project()
-                    .client_relative_path()
-                    .owned()
-                    .await?;
                 let client_paths = all_paths_in_root(output_assets, client_relative_root)
                     .owned()
                     .await?;
@@ -1631,8 +1640,7 @@ impl Endpoint for PageEndpoint {
                 (vec![], vec![])
             };
 
-            let node_root = node_root.clone();
-            let written_endpoint = match *output {
+            let written_endpoint = match *output.await? {
                 PageEndpointOutput::NodeJs { entry_chunk, .. } => {
                     // Only set server_entry_path if pages should be created
                     let pages_structure = this.pages_structure.await?;
@@ -1661,7 +1669,7 @@ impl Endpoint for PageEndpoint {
                 EndpointOutput {
                     output_assets: output_assets.to_resolved().await?,
                     output_paths: written_endpoint.resolved_cell(),
-                    project: this.pages_project.project().to_resolved().await?,
+                    project: project.to_resolved().await?,
                 }
                 .cell(),
             )