refactor(rsc-mf): validate remote alias before bridge action prefixing

Author: cursoragent

tests/integration/rsc-mf/remote/src/runtime/registerServerCallback.ts

@@ -28,17 +28,23 @@ export function registerRemoteServerCallback(
   if (!remoteOrigin) {
     return;
   }
+  const normalizedRemoteAlias = remoteAlias.trim();
+  if (!normalizedRemoteAlias || normalizedRemoteAlias.includes(':')) {
+    throw new Error(
+      `Remote alias must be a non-empty identifier without ":" delimiters. Received: ${remoteAlias}`,
+    );
+  }
   const remoteActionUrl = getNormalizedRemoteActionUrl(remoteOrigin);
   const callbackKey = JSON.stringify({
-    remoteAlias,
+    remoteAlias: normalizedRemoteAlias,
     remoteActionUrl,
   });
   if (registeredCallbackKey === callbackKey) {
     return;
   }
 
   setServerCallback(async (id, args) => {
-    const hostActionId = getHostActionId(id, remoteAlias);
+    const hostActionId = getHostActionId(id, normalizedRemoteAlias);
     const temporaryReferences = createTemporaryReferenceSet();
     const response = fetch(remoteActionUrl, {
       method: 'POST',

tests/integration/rsc-mf/tests/index.test.ts

@@ -618,6 +618,15 @@ function runTests({ mode }: TestConfig) {
       expect(runtimeRegisterSource).not.toContain('127.0.0.1:');
       expect(runtimeRegisterSource).not.toContain('window.location');
       expect(runtimeRegisterSource).toContain("remoteAlias = 'rscRemote'");
+      expect(runtimeRegisterSource).toContain(
+        'const normalizedRemoteAlias = remoteAlias.trim()',
+      );
+      expect(runtimeRegisterSource).toContain(
+        "!normalizedRemoteAlias || normalizedRemoteAlias.includes(':')",
+      );
+      expect(runtimeRegisterSource).toContain(
+        'Remote alias must be a non-empty identifier without ":" delimiters',
+      );
       expect(runtimeRegisterSource).toContain(
         "if (rawActionId.startsWith('remote:'))",
       );
@@ -630,7 +639,16 @@ function runTests({ mode }: TestConfig) {
       expect(runtimeRegisterSource).toContain('getNormalizedRemoteActionUrl');
       expect(runtimeRegisterSource).toContain("url.search = ''");
       expect(runtimeRegisterSource).toContain("url.hash = ''");
+      expect(runtimeRegisterSource).toContain(
+        'remoteAlias: normalizedRemoteAlias',
+      );
+      expect(runtimeRegisterSource).toContain(
+        'getHostActionId(id, normalizedRemoteAlias)',
+      );
       expect(runtimeRegisterSource).toContain('remoteActionUrl,');
+      expect(runtimeRegisterSource).not.toContain(
+        'getHostActionId(id, remoteAlias)',
+      );
       expect(runtimeRegisterSource).not.toContain(
         'remoteActionIdToHostProxyActionId',
       );