feat(rsc): validate server action exports with runtime global

Author: SyMind

crates/rspack_core/src/runtime_globals.rs

@@ -300,6 +300,8 @@ define_runtime_globals! {
 
   // react server component
   const RSC_MANIFEST;
+
+  const RSC_ENSURE_SERVER_ACTIONS;
 }
 
 impl Default for RuntimeGlobals {
@@ -373,6 +375,7 @@ pub static REQUIRE_SCOPE_GLOBALS: LazyLock<RuntimeGlobals> = LazyLock::new(|| {
     | RuntimeGlobals::RSPACK_UNIQUE_ID
     | RuntimeGlobals::ASYNC_STARTUP
     | RuntimeGlobals::RSC_MANIFEST
+    | RuntimeGlobals::RSC_ENSURE_SERVER_ACTIONS
     | RuntimeGlobals::TO_BINARY
     | RuntimeGlobals::DEFERRED_MODULES_ASYNC_TRANSITIVE_DEPENDENCIES
     | RuntimeGlobals::DEFERRED_MODULES_ASYNC_TRANSITIVE_DEPENDENCIES_SYMBOL
@@ -473,6 +476,7 @@ pub fn runtime_globals_to_string(
     RuntimeGlobals::HAS_FETCH_PRIORITY => "has fetch priority",
 
     RuntimeGlobals::RSC_MANIFEST => "rscM",
+    RuntimeGlobals::RSC_ENSURE_SERVER_ACTIONS => "rscA",
     RuntimeGlobals::TO_BINARY => "tb",
     _ => unreachable!(),
   };

crates/rspack_loader_swc/src/rsc_transforms/server_actions.rs

@@ -1704,38 +1704,27 @@ impl<'a, C: Comments> VisitMut for ServerActions<'a, C> {
 
       // Ensure that the exports are functions by appending a runtime check:
       //
-      //   import { ensureServerActions } from 'react-server-dom-rspack/server'
-      //   ensureServerActions([action1, action2, ...])
+      //   __webpack_require__.rscA([action1, action2, ...])
       //
       // But it's only needed for the server layer, because on the client
       // layer they're transformed into references already.
       if self.has_action && self.config.is_react_server_layer {
         new.append(&mut self.extra_items);
 
         if !server_reference_exports.is_empty() {
-          let ensure_ident = private_ident!("ensureServerActions");
-          new.push(ModuleItem::ModuleDecl(ModuleDecl::Import(ImportDecl {
-            span: DUMMY_SP,
-            specifiers: vec![ImportSpecifier::Named(ImportNamedSpecifier {
-              span: DUMMY_SP,
-              local: ensure_ident.clone(),
-              imported: None,
-              is_type_only: false,
-            })],
-            src: Box::new(Str {
-              span: DUMMY_SP,
-              value: atom!("react-server-dom-rspack/server").into(),
-              raw: None,
-            }),
-            type_only: false,
-            with: None,
-            phase: Default::default(),
-          })));
           new.push(ModuleItem::Stmt(Stmt::Expr(ExprStmt {
             span: DUMMY_SP,
             expr: Box::new(Expr::Call(CallExpr {
               span: DUMMY_SP,
-              callee: Callee::Expr(Box::new(Expr::Ident(ensure_ident))),
+              callee: Callee::Expr(Box::new(Expr::Member(MemberExpr {
+                span: DUMMY_SP,
+                obj: Box::new(Expr::Ident(Ident::new(
+                  atom!("__webpack_require__"),
+                  DUMMY_SP,
+                  SyntaxContext::empty(),
+                ))),
+                prop: MemberProp::Ident(quote_ident!("rscA")),
+              }))),
               args: vec![ExprOrSpread {
                 spread: None,
                 expr: Box::new(Expr::Array(ArrayLit {

crates/rspack_plugin_rsc/src/ensure_server_actions_runtime_module.rs

@@ -0,0 +1,43 @@
+use indoc::formatdoc;
+use rspack_core::{
+  RuntimeGlobals, RuntimeModule, RuntimeModuleGenerateContext, RuntimeModuleStage, RuntimeTemplate,
+  impl_runtime_module,
+};
+
+#[impl_runtime_module]
+#[derive(Debug)]
+pub struct RscEnsureServerActionsRuntimeModule {}
+
+impl RscEnsureServerActionsRuntimeModule {
+  pub fn new(runtime_template: &RuntimeTemplate) -> Self {
+    Self::with_default(runtime_template)
+  }
+}
+
+#[async_trait::async_trait]
+impl RuntimeModule for RscEnsureServerActionsRuntimeModule {
+  fn stage(&self) -> RuntimeModuleStage {
+    RuntimeModuleStage::Attach
+  }
+
+  async fn generate(
+    &self,
+    context: &RuntimeModuleGenerateContext<'_>,
+  ) -> rspack_error::Result<String> {
+    Ok(formatdoc! {
+      r#"
+        {ensure_server_actions} = function(actions) {{
+          for (var i = 0; i < actions.length; i++) {{
+            var action = actions[i];
+            if (typeof action !== "function") {{
+              throw new Error('A "use server" file can only export async functions, found ' + typeof action + ".");
+            }}
+          }}
+        }};
+      "#,
+      ensure_server_actions = context
+        .runtime_template
+        .render_runtime_globals(&RuntimeGlobals::RSC_ENSURE_SERVER_ACTIONS),
+    })
+  }
+}

crates/rspack_plugin_rsc/src/lib.rs

@@ -3,6 +3,7 @@ mod client_reference_dependency;
 mod component_info;
 mod constants;
 mod coordinator;
+mod ensure_server_actions_runtime_module;
 mod hot_reloader;
 mod loaders;
 mod manifest_runtime_module;

crates/rspack_plugin_rsc/src/server_plugin.rs

@@ -7,11 +7,12 @@ use derive_more::Debug;
 use futures::future::BoxFuture;
 use rspack_collections::{Identifiable, IdentifierMap};
 use rspack_core::{
-  BoxDependency, ChunkByUkey, ChunkNamedIdArtifact, ChunkUkey, Compilation, CompilationChunkIds,
-  CompilationParams, CompilationRuntimeRequirementInTree, CompilerCompilation, CompilerDone,
-  CompilerFailed, CompilerFinishMake, CompilerThisCompilation, Dependency, DependencyId,
-  DependencyType, EntryDependency, EntryOptions, Logger, Plugin, RuntimeGlobals, RuntimeModule,
-  RuntimeSpec, get_entry_runtime,
+  BoxDependency, ChunkByUkey, ChunkNamedIdArtifact, ChunkUkey, Compilation,
+  CompilationAdditionalModuleRuntimeRequirements, CompilationChunkIds, CompilationParams,
+  CompilationRuntimeRequirementInTree, CompilerCompilation, CompilerDone, CompilerFailed,
+  CompilerFinishMake, CompilerThisCompilation, Dependency, DependencyId, DependencyType,
+  EntryDependency, EntryOptions, Logger, Module, ModuleIdentifier, Plugin, RuntimeGlobals,
+  RuntimeModule, RuntimeSpec, get_entry_runtime,
 };
 use rspack_error::{Diagnostic, Result, ToStringResultToRspackResultExt};
 use rspack_hook::{plugin, plugin_hook};
@@ -23,6 +24,7 @@ use crate::{
   },
   constants::{CSS_REGEX, LAYERS_NAMES},
   coordinator::Coordinator,
+  ensure_server_actions_runtime_module::RscEnsureServerActionsRuntimeModule,
   hot_reloader::track_server_component_changes,
   loaders::action_entry_loader::ACTION_ENTRY_LOADER_IDENTIFIER,
   manifest_runtime_module::RscManifestRuntimeModule,
@@ -184,9 +186,77 @@ async fn runtime_requirements_in_tree(
       Box::new(RscManifestRuntimeModule::new(&compilation.runtime_template)),
     ));
   }
+  if runtime_requirements.contains(RuntimeGlobals::RSC_ENSURE_SERVER_ACTIONS) {
+    runtime_modules_to_add.push((
+      *chunk_ukey,
+      Box::new(RscEnsureServerActionsRuntimeModule::new(
+        &compilation.runtime_template,
+      )),
+    ));
+  }
   Ok(None)
 }
 
+#[plugin_hook(CompilationAdditionalModuleRuntimeRequirements for RscServerPlugin,tracing=false)]
+async fn additional_module_runtime_requirements(
+  &self,
+  compilation: &Compilation,
+  module_identifier: &ModuleIdentifier,
+  runtime_requirements: &mut RuntimeGlobals,
+) -> Result<()> {
+  let Some(module) = compilation.module_by_identifier(module_identifier) else {
+    return Ok(());
+  };
+
+  if module_needs_ensure_server_actions_runtime(module.as_ref(), compilation) {
+    runtime_requirements
+      .insert(RuntimeGlobals::REQUIRE | RuntimeGlobals::RSC_ENSURE_SERVER_ACTIONS);
+  }
+
+  Ok(())
+}
+
+fn has_server_actions(module: &dyn Module) -> bool {
+  module
+    .build_info()
+    .rsc
+    .as_ref()
+    .is_some_and(|rsc| !rsc.action_ids.is_empty())
+}
+
+fn is_rsc_layer_module(module: &dyn Module) -> bool {
+  module
+    .get_layer()
+    .is_some_and(|layer| layer == LAYERS_NAMES.react_server_components)
+}
+
+fn module_needs_ensure_server_actions_runtime(
+  module: &dyn Module,
+  compilation: &Compilation,
+) -> bool {
+  if !is_rsc_layer_module(module) {
+    return false;
+  }
+
+  if has_server_actions(module) {
+    return true;
+  }
+
+  let Some(concatenated_module) = module.as_concatenated_module() else {
+    return false;
+  };
+
+  let module_graph = compilation.get_module_graph();
+  concatenated_module
+    .get_modules()
+    .iter()
+    .any(|inner_module| {
+      module_graph
+        .module_by_identifier(&inner_module.id)
+        .is_some_and(|module| has_server_actions(module.as_ref()))
+    })
+}
+
 /// Compute server manifest and server_consumer_module_map once per entry. Stored in plugin_state for
 /// RscManifestRuntimeModule and onManifest to avoid recomputing.
 #[plugin_hook(CompilationChunkIds for RscServerPlugin, stage = -10000)]
@@ -227,6 +297,10 @@ impl Plugin for RscServerPlugin {
       .compilation_hooks
       .runtime_requirement_in_tree
       .tap(runtime_requirements_in_tree::new(self));
+    ctx
+      .compilation_hooks
+      .additional_module_runtime_requirements
+      .tap(additional_module_runtime_requirements::new(self));
 
     ctx.compilation_hooks.chunk_ids.tap(chunk_ids::new(self));
 

tests/rspack-test/configCases/rsc-plugin/server-actions-export-validation/rspack.config.js

@@ -0,0 +1,84 @@
+const path = require('node:path');
+const { experiments } = require('@rspack/core');
+
+const { createPlugins, Layers } = experiments.rsc;
+const { ServerPlugin, ClientPlugin } = createPlugins();
+
+const ssrEntry = path.join(__dirname, 'src/framework/entry.ssr.js');
+const rscEntry = path.join(__dirname, 'src/framework/entry.rsc.js');
+
+const swcLoaderRule = {
+  test: /\.jsx?$/,
+  use: [
+    {
+      loader: 'builtin:swc-loader',
+      options: {
+        detectSyntax: 'auto',
+        jsc: {
+          transform: {
+            react: {
+              runtime: 'automatic',
+            },
+          },
+        },
+        rspackExperiments: {
+          reactServerComponents: true,
+        },
+      },
+    },
+  ],
+};
+
+module.exports = [
+  {
+    mode: 'production',
+    target: 'node',
+    entry: {
+      main: {
+        import: ssrEntry,
+      },
+    },
+    resolve: {
+      extensions: ['...', '.jsx'],
+    },
+    module: {
+      rules: [
+        swcLoaderRule,
+        {
+          resource: ssrEntry,
+          layer: Layers.ssr,
+        },
+        {
+          resource: rscEntry,
+          layer: Layers.rsc,
+          resolve: {
+            conditionNames: ['react-server', '...'],
+          },
+        },
+        {
+          issuerLayer: Layers.rsc,
+          resolve: {
+            conditionNames: ['react-server', '...'],
+          },
+        },
+      ],
+    },
+    plugins: [new ServerPlugin()],
+  },
+  {
+    mode: 'production',
+    target: 'web',
+    entry: {
+      main: {
+        import: './src/framework/entry.client.js',
+      },
+    },
+    resolve: {
+      extensions: ['...', '.jsx'],
+    },
+    module: {
+      rules: [swcLoaderRule],
+    },
+    plugins: [new ClientPlugin()],
+  },
+];

tests/rspack-test/configCases/rsc-plugin/server-actions-export-validation/src/App.js

@@ -0,0 +1,7 @@
+"use server-entry";
+
+import { Client } from "./Client";
+
+export const App = () => {
+	return <Client />;
+};

tests/rspack-test/configCases/rsc-plugin/server-actions-export-validation/src/Client.js

@@ -0,0 +1,15 @@
+"use client";
+
+import { invalidAction } from "./server-actions";
+
+export const Client = () => {
+	async function onClick() {
+		await invalidAction();
+	}
+
+	return (
+		<button type="button" onClick={onClick}>
+			Run actions
+		</button>
+	);
+};

tests/rspack-test/configCases/rsc-plugin/server-actions-export-validation/src/framework/entry.client.js

@@ -0,0 +1,2 @@
+// In a real app this entry would consume the RSC payload and hydrate.
+// This file exists mainly to mirror the typical split of RSC/SSR/client entries.

tests/rspack-test/configCases/rsc-plugin/server-actions-export-validation/src/framework/entry.rsc.js

@@ -0,0 +1,31 @@
+import {
+	loadServerAction,
+	renderToReadableStream
+} from "react-server-dom-rspack/server";
+import { App } from "../App";
+
+const RSC_ACTION_ERROR =
+	'A "use server" file can only export async functions, found number.';
+
+export const renderRscStream = () => {
+	return renderToReadableStream(<App />);
+};
+
+const getActionIds = () => {
+	const manifest = __rspack_rsc_manifest__;
+	expect(manifest).toBeDefined();
+	expect(manifest.serverManifest).toBeDefined();
+
+	return Object.keys(manifest.serverManifest);
+};
+
+it("should reject non-function server action exports with rscA at runtime", () => {
+	const actionIds = getActionIds();
+
+	expect(actionIds).toHaveLength(2);
+	expect(() => {
+		for (const actionId of actionIds) {
+			loadServerAction(actionId);
+		}
+	}).toThrow(RSC_ACTION_ERROR);
+});