@rangojs/router 0.0.0-experimental.tapabs3 → 0.1.1

package/src/rsc/response-route-handler.ts

@@ -27,15 +27,10 @@ import {
   finalizeResponse,
   isCacheableStatus,
   buildRouteMiddlewareEntries,
-  mergeStubHeadersAndFinalize,
+  rewrapResponseRouteResponse,
 } from "./helpers.js";
 import { isWebSocketUpgradeResponse } from "../response-utils.js";
 import { stringifyJsonRouteResult } from "./json-route-result.js";
-import {
-  EXTERNAL_REDIRECT_MARKER,
-  isExternalRedirect,
-  markExternalRedirect,
-} from "../redirect-origin.js";
 
 export interface ResponseRouteMatch {
   responseType: string;
@@ -104,48 +99,17 @@ export async function handleResponseRoute<TEnv>(
   const callHandler = async () => {
     const errorCtx = { request, url, env };
 
-    // Re-wrap a handler-returned Response through createResponseWithMergedHeaders
-    // so that stub headers (cookies, custom headers set via ctx.header()) are included.
-    // Use Headers (not Record<string, string>) to preserve duplicate entries like Set-Cookie.
-    const rewrapResponse = (result: Response) => {
-      // 204/205/304 are NOT short-circuited — they're valid for the Response
-      // constructor and must honor ctx.setStatus() overrides. Only upgrade
-      // responses (status 101 / `webSocket` property) bypass reconstruction.
-      if (isWebSocketUpgradeResponse(result)) {
-        return mergeStubHeadersAndFinalize(result);
-      }
-      const headers = new Headers();
-      result.headers.forEach((value, key) => {
-        // Never copy the reserved external-redirect marker off a handler result.
-        // It is not a trust signal -- the opt-in is the out-of-band brand below
-        // -- and a proxy-style route returning an attacker-controlled upstream
-        // response must not let a forged value ride through to the browser.
-        if (key.toLowerCase() === EXTERNAL_REDIRECT_MARKER) return;
-        if (key.toLowerCase() === "set-cookie") {
-          headers.append(key, value);
-        } else {
-          headers.set(key, value);
-        }
-      });
-      const rewrapped = createResponseWithMergedHeaders(result.body, {
-        status: result.status,
-        headers,
-      });
-      // Transfer the out-of-band external brand only when the handler result is
-      // genuinely branded (a real redirect(url, { external: true })). A proxied
-      // upstream Response is never branded, so an attacker cannot opt a response
-      // route's redirect out of the same-origin guard by injecting the header.
-      if (isExternalRedirect(result)) {
-        markExternalRedirect(rewrapped);
-      }
-      return rewrapped;
-    };
-
     try {
-      const result = await (preview.handler as Function)(responseHandlerCtx);
+      let result: unknown;
+      try {
+        result = await (preview.handler as Function)(responseHandlerCtx);
+      } catch (error) {
+        if (!(error instanceof Response)) throw error;
+        result = error;
+      }
 
       if (result instanceof Response) {
-        return rewrapResponse(result);
+        return rewrapResponseRouteResponse(result);
       }
 
       // Handled before the MIME lookup (json is also a RESPONSE_TYPE_MIME key).