Implement encryption key into turbopack as hash salt (#72933)

I checked that the encryption key is now being used as the hash_salt. I'm not sure about how to add a test for this behavior so let me know about any suggestions there. (I tried looking for tests that would use the functions up the call tree without any luck)
vercel · Jan 9, 2025 · 6b7241a · 6b7241a
1 parent d80bd57
commit 6b7241a
Show file tree

Hide file tree

Showing 8 changed files with 61 additions and 11 deletions.
diff --git a/crates/next-api/src/app.rs b/crates/next-api/src/app.rs
@@ -179,6 +179,7 @@ impl AppProject {
             Value::new(self.client_ty().await?.clone_value()),
             self.project().next_mode(),
             self.project().next_config(),
+            self.project().encryption_key(),
         ))
     }
 
@@ -213,6 +214,7 @@ impl AppProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::NodeJs,
+            self.project().encryption_key(),
         ))
     }
 
@@ -225,6 +227,7 @@ impl AppProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::Edge,
+            self.project().encryption_key(),
         ))
     }
 
@@ -237,6 +240,7 @@ impl AppProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::NodeJs,
+            self.project().encryption_key(),
         ))
     }
 
@@ -249,6 +253,7 @@ impl AppProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::Edge,
+            self.project().encryption_key(),
         ))
     }
 
@@ -551,6 +556,7 @@ impl AppProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::NodeJs,
+            self.project().encryption_key(),
         ))
     }
 
@@ -563,6 +569,7 @@ impl AppProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::Edge,
+            self.project().encryption_key(),
         ))
     }
 

diff --git a/crates/next-api/src/pages.rs b/crates/next-api/src/pages.rs
@@ -330,6 +330,7 @@ impl PagesProject {
             }),
             self.project().next_mode(),
             self.project().next_config(),
+            self.project().encryption_key(),
         ))
     }
 
@@ -436,6 +437,7 @@ impl PagesProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::NodeJs,
+            self.project().encryption_key(),
         ))
     }
 
@@ -450,6 +452,7 @@ impl PagesProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::Edge,
+            self.project().encryption_key(),
         ))
     }
 
@@ -464,6 +467,7 @@ impl PagesProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::NodeJs,
+            self.project().encryption_key(),
         ))
     }
 
@@ -478,6 +482,7 @@ impl PagesProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::Edge,
+            self.project().encryption_key(),
         ))
     }
 
@@ -492,6 +497,7 @@ impl PagesProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::NodeJs,
+            self.project().encryption_key(),
         ))
     }
 
@@ -508,6 +514,7 @@ impl PagesProject {
             self.project().next_mode(),
             self.project().next_config(),
             NextRuntime::Edge,
+            self.project().encryption_key(),
         ))
     }
 

diff --git a/crates/next-api/src/project.rs b/crates/next-api/src/project.rs
@@ -691,6 +691,11 @@ impl Project {
         *self.js_config
     }
 
+    #[turbo_tasks::function]
+    pub(super) fn encryption_key(&self) -> Vc<RcStr> {
+        Vc::cell(self.encryption_key.clone())
+    }
+
     #[turbo_tasks::function]
     pub(super) async fn should_create_webpack_stats(&self) -> Result<Vc<bool>> {
         Ok(Vc::cell(
@@ -1122,6 +1127,7 @@ impl Project {
                 self.next_mode(),
                 self.next_config(),
                 NextRuntime::Edge,
+                self.encryption_key(),
             ),
             get_edge_resolve_options_context(
                 self.project_path(),
@@ -1207,6 +1213,7 @@ impl Project {
                 self.next_mode(),
                 self.next_config(),
                 NextRuntime::NodeJs,
+                self.encryption_key(),
             ),
             get_server_resolve_options_context(
                 self.project_path(),
@@ -1261,6 +1268,7 @@ impl Project {
                 self.next_mode(),
                 self.next_config(),
                 NextRuntime::Edge,
+                self.encryption_key(),
             ),
             get_edge_resolve_options_context(
                 self.project_path(),

diff --git a/crates/next-core/src/next_client/context.rs b/crates/next-core/src/next_client/context.rs
@@ -228,6 +228,7 @@ pub async fn get_client_module_options_context(
     ty: Value<ClientContextType>,
     mode: Vc<NextMode>,
     next_config: Vc<NextConfig>,
+    encryption_key: ResolvedVc<RcStr>,
 ) -> Result<Vc<ModuleOptionsContext>> {
     let next_mode = mode.await?;
     let resolve_options_context = get_client_resolve_options_context(
@@ -283,9 +284,11 @@ pub async fn get_client_module_options_context(
     let target_browsers = env.runtime_versions();
 
     let mut next_client_rules =
-        get_next_client_transforms_rules(next_config, ty.into_value(), mode, false).await?;
+        get_next_client_transforms_rules(next_config, ty.into_value(), mode, false, encryption_key)
+            .await?;
     let foreign_next_client_rules =
-        get_next_client_transforms_rules(next_config, ty.into_value(), mode, true).await?;
+        get_next_client_transforms_rules(next_config, ty.into_value(), mode, true, encryption_key)
+            .await?;
     let additional_rules: Vec<ModuleRule> = vec![
         get_swc_ecma_transform_plugin_rule(next_config, project_path).await?,
         get_relay_transform_rule(next_config, project_path).await?,

diff --git a/crates/next-core/src/next_client/transforms.rs b/crates/next-core/src/next_client/transforms.rs
@@ -1,6 +1,7 @@
 use anyhow::Result;
 use next_custom_transforms::transforms::strip_page_exports::ExportFilter;
-use turbo_tasks::Vc;
+use turbo_rcstr::RcStr;
+use turbo_tasks::{ResolvedVc, Vc};
 use turbopack::module_options::ModuleRule;
 
 use crate::{
@@ -27,6 +28,7 @@ pub async fn get_next_client_transforms_rules(
     context_ty: ClientContextType,
     mode: Vc<NextMode>,
     foreign_code: bool,
+    encryption_key: ResolvedVc<RcStr>,
 ) -> Result<Vec<ModuleRule>> {
     let mut rules = vec![];
 
@@ -73,6 +75,7 @@ pub async fn get_next_client_transforms_rules(
             is_app_dir = true;
             rules.push(get_server_actions_transform_rule(
                 ActionsTransform::Client,
+                encryption_key,
                 enable_mdx_rs,
                 dynamic_io_enabled,
                 cache_kinds,

diff --git a/crates/next-core/src/next_server/context.rs b/crates/next-core/src/next_server/context.rs
@@ -419,14 +419,27 @@ pub async fn get_server_module_options_context(
     mode: Vc<NextMode>,
     next_config: Vc<NextConfig>,
     next_runtime: NextRuntime,
+    encryption_key: ResolvedVc<RcStr>,
 ) -> Result<Vc<ModuleOptionsContext>> {
     let next_mode = mode.await?;
-    let mut next_server_rules =
-        get_next_server_transforms_rules(next_config, ty.into_value(), mode, false, next_runtime)
-            .await?;
-    let mut foreign_next_server_rules =
-        get_next_server_transforms_rules(next_config, ty.into_value(), mode, true, next_runtime)
-            .await?;
+    let mut next_server_rules = get_next_server_transforms_rules(
+        next_config,
+        ty.into_value(),
+        mode,
+        false,
+        next_runtime,
+        encryption_key,
+    )
+    .await?;
+    let mut foreign_next_server_rules = get_next_server_transforms_rules(
+        next_config,
+        ty.into_value(),
+        mode,
+        true,
+        next_runtime,
+        encryption_key,
+    )
+    .await?;
     let mut internal_custom_rules = get_next_server_internal_transforms_rules(
         ty.into_value(),
         next_config.mdx_rs().await?.is_some(),

diff --git a/crates/next-core/src/next_server/transforms.rs b/crates/next-core/src/next_server/transforms.rs
@@ -1,6 +1,7 @@
 use anyhow::Result;
 use next_custom_transforms::transforms::strip_page_exports::ExportFilter;
-use turbo_tasks::Vc;
+use turbo_rcstr::RcStr;
+use turbo_tasks::{ResolvedVc, Vc};
 use turbopack::module_options::ModuleRule;
 
 use crate::{
@@ -30,6 +31,7 @@ pub async fn get_next_server_transforms_rules(
     mode: Vc<NextMode>,
     foreign_code: bool,
     next_runtime: NextRuntime,
+    encryption_key: ResolvedVc<RcStr>,
 ) -> Result<Vec<ModuleRule>> {
     let mut rules = vec![];
 
@@ -90,6 +92,7 @@ pub async fn get_next_server_transforms_rules(
             // need to apply to foreign code too
             rules.push(get_server_actions_transform_rule(
                 ActionsTransform::Client,
+                encryption_key,
                 mdx_rs,
                 dynamic_io_enabled,
                 cache_kinds,
@@ -102,6 +105,7 @@ pub async fn get_next_server_transforms_rules(
         ServerContextType::AppRSC { .. } => {
             rules.push(get_server_actions_transform_rule(
                 ActionsTransform::Server,
+                encryption_key,
                 mdx_rs,
                 dynamic_io_enabled,
                 cache_kinds,
@@ -114,6 +118,7 @@ pub async fn get_next_server_transforms_rules(
         ServerContextType::AppRoute { .. } => {
             rules.push(get_server_actions_transform_rule(
                 ActionsTransform::Server,
+                encryption_key,
                 mdx_rs,
                 dynamic_io_enabled,
                 cache_kinds,

diff --git a/crates/next-core/src/next_shared/transforms/server_actions.rs b/crates/next-core/src/next_shared/transforms/server_actions.rs
@@ -2,6 +2,7 @@ use anyhow::Result;
 use async_trait::async_trait;
 use next_custom_transforms::transforms::server_actions::{server_actions, Config};
 use swc_core::{common::FileName, ecma::ast::Program};
+use turbo_rcstr::RcStr;
 use turbo_tasks::ResolvedVc;
 use turbopack::module_options::{ModuleRule, ModuleRuleEffect};
 use turbopack_ecmascript::{CustomTransformer, EcmascriptInputTransform, TransformContext};
@@ -18,13 +19,15 @@ pub enum ActionsTransform {
 /// Returns a rule which applies the Next.js Server Actions transform.
 pub fn get_server_actions_transform_rule(
     transform: ActionsTransform,
+    encryption_key: ResolvedVc<RcStr>,
     enable_mdx_rs: bool,
     dynamic_io_enabled: bool,
     cache_kinds: ResolvedVc<CacheKinds>,
 ) -> ModuleRule {
     let transformer =
         EcmascriptInputTransform::Plugin(ResolvedVc::cell(Box::new(NextServerActions {
             transform,
+            encryption_key,
             dynamic_io_enabled,
             cache_kinds,
         }) as _));
@@ -40,6 +43,7 @@ pub fn get_server_actions_transform_rule(
 #[derive(Debug)]
 struct NextServerActions {
     transform: ActionsTransform,
+    encryption_key: ResolvedVc<RcStr>,
     dynamic_io_enabled: bool,
     cache_kinds: ResolvedVc<CacheKinds>,
 }
@@ -53,7 +57,7 @@ impl CustomTransformer for NextServerActions {
             Config {
                 is_react_server_layer: matches!(self.transform, ActionsTransform::Server),
                 dynamic_io_enabled: self.dynamic_io_enabled,
-                hash_salt: "".into(),
+                hash_salt: self.encryption_key.await?.to_string(),
                 cache_kinds: self.cache_kinds.await?.clone_value(),
             },
             ctx.comments.clone(),