@server/next 0.39.0 → 0.40.1

package/index.d.ts

@@ -143,7 +143,7 @@ type KVStore = {
     keys: () => Promise<string[]>;
 };
 type Provider = "email" | "github" | "google" | "microsoft" | "discord" | "facebook" | "apple";
-type Strategy = "cookie" | "jwt" | "token" | "key";
+type Strategy = "cookie" | "jwt" | "token";
 type AuthSession = {
     id: string;
     provider: Provider;
@@ -156,22 +156,30 @@ type AuthUser<T = Record<string, any>> = T & {
     strategy: Strategy;
     email: string;
 };
-type AuthOption = `${Strategy}:${Provider}` | "key" | {
+type ProfileUser = {
+    id: string | number;
+    email: string;
+} & Record<string, any>;
+type AuthOption = `${Strategy}:${Provider}` | {
     strategy: Strategy;
     providers?: Provider | Provider[];
-    key?: string;
     session?: StoreSource;
     store?: StoreSource;
     redirect?: string;
-    cleanUser?: <T = AuthUser>(user: T) => T | Promise<T>;
+    onProfile?: (raw: any, provider: Provider) => ProfileUser | Promise<ProfileUser>;
+    onLogin?: (loginUser: AuthUser, existingUser: AuthUser | null, ctx: Context) => ProfileUser | Promise<ProfileUser>;
+    onUser?: <T = AuthUser>(user: T, ctx: Context) => T | Promise<T>;
+    onLogout?: (ctx: Context) => unknown;
 };
 type AuthSettings = {
     providers: Provider[];
     strategy: Strategy;
     store: KVStore;
     session: KVStore;
-    key?: string;
-    cleanUser: <T = AuthUser>(user: T) => T | Promise<T>;
+    onProfile?: (raw: any, provider: Provider) => ProfileUser | Promise<ProfileUser>;
+    onLogin?: (loginUser: AuthUser, existingUser: AuthUser | null, ctx: Context) => ProfileUser | Promise<ProfileUser>;
+    onUser: <T = AuthUser>(user: T, ctx: Context) => T | Promise<T>;
+    onLogout?: (ctx: Context) => unknown;
     redirect: string;
 };
 type LogLevel = "info";
@@ -501,4 +509,4 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
 }
 declare function server<Session extends Record<string, any> = {}, User extends Record<string, any> = {}>(options?: Options): Server<ServerConfig<Session, User>>;
 
-export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type BodyOption, type Bucket, type BucketFile, type BunEnv, type CacheOption, type Context, type Cookie, type CorsSettings, type ExtractPathParams, type FileInfo, type InferParamType, type InlineReply, type KVStore, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type StoreSource, type Strategy, type Time, type UploadOptions, type UploadedFile, cache, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };
+export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type BodyOption, type Bucket, type BucketFile, type BunEnv, type CacheOption, type Context, type Cookie, type CorsSettings, type ExtractPathParams, type FileInfo, type InferParamType, type InlineReply, type KVStore, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type ProfileUser, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type StoreSource, type Strategy, type Time, type UploadOptions, type UploadedFile, cache, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };

package/index.js

@@ -68,6 +68,10 @@ ServerError_default.extend({
     status: 401,
     message: "Credentials do not correspond to a user"
   },
+  AUTH_INVALID_USER: {
+    status: 500,
+    message: "{callback} must return a user with an 'id' and an 'email'"
+  },
   LOGIN_NO_EMAIL: "The email is required to log in",
   LOGIN_INVALID_EMAIL: "The email you wrote is not correct",
   LOGIN_NO_PASSWORD: "The email is required to log in",
@@ -912,6 +916,13 @@ var json = (...args) => r().json(...args);
 var file = (...args) => r().file(...args);
 var redirect = (...args) => r().redirect(...args);
 
+// src/auth/assertUser.ts
+function assertUser(user, callback3) {
+  if (!user || typeof user !== "object" || user.id == null || !user.email) {
+    throw ServerError_default.AUTH_INVALID_USER({ callback: callback3 });
+  }
+}
+
 // src/helpers/jwt.ts
 var enc = new TextEncoder();
 var dec = new TextDecoder();
@@ -982,7 +993,7 @@ async function verifyJwt(token, secret) {
 // src/auth/finishLogin.ts
 async function finishLogin(ctx, input) {
   const settings = ctx.options.auth;
-  const { strategy, cleanUser } = settings;
+  const { strategy, onLogin, onUser } = settings;
   const key = String(input.key);
   const auth2 = {
     id: createId(),
@@ -992,22 +1003,28 @@ async function finishLogin(ctx, input) {
     email: input.email,
     time: (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "")
   };
-  let user = input.user;
-  if (input.store !== false) {
-    const existing = await settings.store.get(key);
-    user = { ...existing ?? {}, ...input.user };
-  }
-  user = await cleanUser(user);
-  if (input.store !== false) await settings.store.set(key, user);
+  const loginUser = {
+    ...input.user,
+    provider: input.provider,
+    strategy
+  };
+  const existingUser = await settings.store.get(key) ?? null;
+  const user = onLogin ? await onLogin(loginUser, existingUser, ctx) : { ...existingUser ?? {}, ...loginUser };
+  assertUser(user, "onLogin");
+  await settings.store.set(key, user);
   if (!strategy.includes("jwt")) {
     await settings.session.set(auth2.id, auth2, { expires: "1w" });
   }
   if (strategy.includes("jwt")) {
     const token = await signJwt(auth2, ctx.options.secret, 7 * 24 * 60 * 60);
-    return status(201).json({ ...user, token });
+    const exposed = await onUser(user, ctx);
+    assertUser(exposed, "onUser");
+    return status(201).json({ ...exposed, token });
   }
   if (strategy.includes("token")) {
-    return status(201).json({ ...user, token: auth2.id });
+    const exposed = await onUser(user, ctx);
+    assertUser(exposed, "onUser");
+    return status(201).json({ ...exposed, token: auth2.id });
   }
   if (strategy.includes("cookie")) {
     return cookies("authentication", {
@@ -1018,7 +1035,6 @@ async function finishLogin(ctx, input) {
       sameSite: "Lax"
     }).redirect(settings.redirect);
   }
-  if (strategy.includes("key")) throw new Error("Key auth not supported yet");
   throw new Error("Unknown auth type");
 }
 
@@ -1128,11 +1144,15 @@ var callback = async (ctx) => {
     const parsed = JSON.parse(body.user).name;
     if (parsed) name = `${parsed.firstName} ${parsed.lastName}`.trim();
   }
+  const raw = { ...claims, name };
+  const { onProfile } = ctx.options.auth;
+  const profile = onProfile ? await onProfile(raw, "apple") : { id: raw.sub, name: raw.name, email: raw.email };
+  assertUser(profile, "onProfile");
   const res = await finishLogin(ctx, {
     provider: "apple",
-    key: claims.sub,
-    email: claims.email,
-    user: { id: claims.sub, name, email: claims.email }
+    key: profile.id,
+    email: profile.email,
+    user: profile
   });
   res.headers.append("set-cookie", clearState());
   return res;
@@ -1181,17 +1201,15 @@ function oauthProvider(config2) {
       }
     });
     if (!profileRes.ok) throw new Error(`${config2.name}: profile fetch failed`);
-    const profile = config2.profile(await profileRes.json());
+    const raw = await profileRes.json();
+    const { onProfile } = ctx.options.auth;
+    const profile = onProfile ? await onProfile(raw, config2.name) : config2.profile(raw);
+    assertUser(profile, "onProfile");
     const res = await finishLogin(ctx, {
       provider: config2.name,
       key: profile.id,
       email: profile.email,
-      user: {
-        id: profile.id,
-        name: profile.name,
-        email: profile.email,
-        picture: profile.picture
-      }
+      user: profile
     });
     res.headers.append("set-cookie", clearState());
     return res;
@@ -1237,8 +1255,7 @@ async function emailLogin(ctx) {
     provider: "email",
     key: user.email,
     email: user.email,
-    user,
-    store: false
+    user
   });
 }
 async function emailRegister(ctx) {
@@ -1259,13 +1276,11 @@ async function emailRegister(ctx) {
     time,
     ...data
   };
-  await store.set(email, user);
   return finishLogin(ctx, {
     provider: "email",
     key: email,
     email,
-    user,
-    store: false
+    user
   });
 }
 async function emailResetPassword() {
@@ -1345,21 +1360,25 @@ var getUserProfile = async (code) => {
   const email = emails.sort((a) => a.primary ? -1 : 1)[0]?.email;
   return { ...profile, email };
 };
+var defaultProfile = (raw) => ({
+  id: raw.id,
+  name: raw.name,
+  email: raw.email,
+  picture: raw.avatar_url,
+  location: raw.location,
+  created: raw.created_at
+});
 var callback2 = async (ctx) => {
   checkState(ctx, ctx.url.query.state);
-  const profile = await getUserProfile(ctx.url.query.code);
+  const raw = await getUserProfile(ctx.url.query.code);
+  const { onProfile } = ctx.options.auth;
+  const profile = onProfile ? await onProfile(raw, "github") : defaultProfile(raw);
+  assertUser(profile, "onProfile");
   const res = await finishLogin(ctx, {
     provider: "github",
     key: profile.id,
     email: profile.email,
-    user: {
-      id: profile.id,
-      name: profile.name,
-      email: profile.email,
-      picture: profile.avatar_url,
-      location: profile.location,
-      created: profile.created_at
-    }
+    user: profile
   });
   res.headers.append("set-cookie", clearState());
   return res;
@@ -1409,7 +1428,7 @@ var providers_default = {
 
 // src/auth/parseAuthOptions.ts
 var defaultRedirect = "/user";
-function defaultCleanUser(fullUser) {
+function defaultOnUser(fullUser) {
   const { password: _password, ...user } = fullUser;
   return user;
 }
@@ -1424,19 +1443,6 @@ function parseAuthOptions(auth2, all) {
     throw new Error("Auth options needs a strategy");
   }
   const strategy = auth2.strategy;
-  if (strategy === "key") {
-    const key = auth2.key || env.AUTH_KEY;
-    if (!key) {
-      throw new Error("`key` auth needs the AUTH_KEY env var (or auth.key)");
-    }
-    return {
-      strategy,
-      providers: [],
-      key,
-      redirect: auth2.redirect || defaultRedirect,
-      cleanUser: auth2.cleanUser || defaultCleanUser
-    };
-  }
   const list = Array.isArray(auth2.providers) ? auth2.providers : auth2.providers ? [auth2.providers] : [];
   if (!list.length) {
     throw new Error("Auth options needs a provider");
@@ -1448,7 +1454,8 @@ function parseAuthOptions(auth2, all) {
     );
   }
   const redirect2 = auth2.redirect || defaultRedirect;
-  const cleanUser = auth2.cleanUser || defaultCleanUser;
+  const { onProfile, onLogin, onLogout } = auth2;
+  const onUser = auth2.onUser || defaultOnUser;
   if (!auth2.store && !all.store) {
     throw new Error("Need a userStore store for Auth");
   }
@@ -1462,7 +1469,10 @@ function parseAuthOptions(auth2, all) {
     strategy,
     providers: list,
     redirect: redirect2,
-    cleanUser,
+    onProfile,
+    onLogin,
+    onUser,
+    onLogout,
     store: authStore,
     session: sessionStore
   };
@@ -2236,14 +2246,6 @@ async function verify(password, hash3) {
   });
 }
 
-// src/helpers/safeEqual.ts
-function safeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-
 // src/auth/findSessionId.ts
 var validateToken = (authorization) => {
   const [type2, id] = authorization.trim().split(" ");
@@ -2276,19 +2278,6 @@ function findSessionId(ctx) {
 }
 
 // src/auth/getUser.ts
-function getKeyUser(ctx) {
-  const expected = ctx.options.auth.key;
-  const header = ctx.headers.authorization;
-  if (!header) return;
-  const [type2, provided] = header.trim().split(" ");
-  if (type2?.toLowerCase() !== "bearer" || !provided) {
-    throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
-  }
-  if (!expected || !safeEqual(provided, expected)) {
-    throw ServerError_default.AUTH_INVALID_TOKEN();
-  }
-  return { id: "key", strategy: "key", provider: "key" };
-}
 async function getAuthSession(ctx) {
   const strategy = ctx.options.auth.strategy;
   if (strategy.includes("jwt")) {
@@ -2309,7 +2298,6 @@ async function getAuthSession(ctx) {
 async function getUser(ctx) {
   if (!ctx.options.auth) return;
   const options = ctx.options.auth;
-  if (options.strategy === "key") return getKeyUser(ctx);
   const auth2 = await getAuthSession(ctx);
   if (!auth2) return;
   if (options.strategy !== auth2.strategy) {
@@ -2328,7 +2316,9 @@ async function getUser(ctx) {
   if (!user) throw ServerError_default.AUTH_NO_USER();
   user.strategy = auth2.strategy;
   user.provider = auth2.provider;
-  return ctx.options.auth.cleanUser(user);
+  const exposed = await ctx.options.auth.onUser(user, ctx);
+  assertUser(exposed, "onUser");
+  return exposed;
 }
 
 // src/auth/logout.ts
@@ -2338,15 +2328,13 @@ async function logout(ctx) {
   if (!strategy.includes("jwt")) {
     await ctx.options.auth.session.del(findSessionId(ctx));
   }
+  if (ctx.options.auth.onLogout) await ctx.options.auth.onLogout(ctx);
   if (strategy.includes("token") || strategy.includes("jwt")) {
     return { token: null };
   }
   if (strategy.includes("cookie")) {
     return cookies({ authentication: null }).redirect("/");
   }
-  if (strategy.includes("key")) {
-    throw new Error("Key auth not supported yet");
-  }
   throw new Error("Unknown auth type");
 }
 
@@ -2362,7 +2350,6 @@ function auth(app) {
   app.use(async function middle(ctx) {
     ctx.user = await getUser(ctx);
   });
-  if (app.settings.auth.strategy === "key") return;
   app.post("/auth/logout", logout);
   const enabled = app.settings.auth.providers;
   for (const name of oauth2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.39.0",
+  "version": "0.40.1",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",
@@ -17,8 +17,7 @@
     "start": "bun test --watch",
     "lint": "npx tsc --noEmit && npx @biomejs/biome lint ./src --skip=lint/suspicious/noExplicitAny --skip=lint/style/noParameterAssign --skip=lint/suspicious/noConfusingVoidType --skip=lint/complexity/noBannedTypes",
     "test": "npm run test:bun && tsc --noEmit",
-    "test:bun": "bun test",
-    "test:jest": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
+    "test:bun": "bun test"
   },
   "main": "index.js",
   "type": "module",
@@ -65,21 +64,15 @@
     "tutorials": "docs/tutorials"
   },
   "dependencies": {
-    "bucket": "^0.6.0",
-    "polystore": "^0.23.2"
+    "bucket": "^0.7.1",
+    "polystore": "^0.24.0"
   },
   "devDependencies": {
     "@types/bun": "^1.3.0",
-    "@types/jest": "^30.0.0",
     "@types/node": "^24.10.0",
     "bun": "^1.3.13",
     "check-dts": "^0.8.2",
-    "jest": "^29.7.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.2"
-  },
-  "jest": {
-    "testEnvironment": "jest-environment-node",
-    "transform": {}
   }
 }

package/src/jsx/jsx-runtime.js

@@ -38,14 +38,30 @@ const encode = (str = "") => {
 const isValidChild = (child) =>
   child != null && child !== false && child !== true;
 
-const minifyCss = (str) =>
-  str
+// A `</style>` inside the CSS would close the element early and let whatever
+// follows run as HTML. The content is never encoded, so this runs on every
+// <style>, minified or not.
+const escapeCss = (str) => str.replace(/<\/style>/gi, "<\\/style>");
+
+const minifyCss = (str) => {
+  // Quoted values are content, not formatting: the spaces and delimiters in
+  // `content: ", "` have to survive. They're set aside while the rest is
+  // squeezed, then put back. Comments go first and unconditionally, so one
+  // written inside a string is stripped along with the rest.
+  const quoted = [];
+  return str
     .replace(/\/\*[\s\S]*?\*\//g, "")
+    .replace(
+      /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g,
+      (match) => `\0${quoted.push(match) - 1}\0`,
+    )
     .replace(/\s+/g, " ")
-    .replace(/\s*([{}:;,>~+])\s*/g, "$1")
+    // `+` is left out on purpose for `calc(100% + 10px)`
+    .replace(/\s*([{}:;,>~])\s*/g, "$1")
     .replace(/;}/g, "}")
-    .replace(/<\/style>/gi, "<\\/style>")
+    .replace(/\0(\d+)\0/g, (_, i) => quoted[i])
     .trim();
+};
 
 // React element detection (safe for custom objects too)
 const isReactElement = (val) =>
@@ -115,9 +131,9 @@ const jsx = (tag, { children, ...props } = {}) => {
     children = raw(content);
   }
 
-  // style: minified raw content
+  // style: raw content, minified only when asked for with <style minify>
   if (tag === "style" && typeof children === "string") {
-    children = raw(minifyCss(children));
+    children = raw(escapeCss(props?.minify ? minifyCss(children) : children));
   }
 
   // dangerouslySetInnerHTML
@@ -139,6 +155,8 @@ const jsx = (tag, { children, ...props } = {}) => {
   // attributes
   let attrStr = Object.entries(props || {})
     .filter(([k]) => k !== "dangerouslySetInnerHTML")
+    // `minify` drives <style>, it isn't an HTML attribute
+    .filter(([k]) => !(tag === "style" && k === "minify"))
     .filter(([k, v]) => !/on[A-Z]/.test(k) && typeof v !== "function")
     .filter(([, v]) => v !== false)
     .map(([k, v]) => {

package/src/jsx/jsx-runtime.test.jsx

@@ -299,52 +299,115 @@ describe("script tag", () => {
 });
 
 describe("style tag", () => {
-  it("renders style content", () => {
+  it("renders the CSS as written", () => {
     expect(<style>{"body { color: red; }"}</style>).toRender(
-      "<style>body{color:red}</style>",
+      "<style>body { color: red; }</style>",
     );
   });
 
-  it("minifies whitespace in style content", () => {
-    expect(
-      <style>{"body {\n  color:   red;\n  margin: 0;\n}"}</style>,
-    ).toRender("<style>body{color:red;margin:0}</style>");
-  });
-
-  it("strips CSS comments", () => {
-    expect(
-      <style>{"/* reset */ body { margin: 0; } /* end */"}</style>,
-    ).toRender("<style>body{margin:0}</style>");
-  });
-
-  it("preserves child combinator in selectors", () => {
-    expect(<style>{":not(pre) > code { background: none; }"}</style>).toRender(
-      "<style>:not(pre)>code{background:none}</style>",
+  it("keeps comments and whitespace without `minify`", () => {
+    expect(<style>{"/* reset */ body {\n  margin: 0;\n}"}</style>).toRender(
+      "<style>/* reset */ body {\n  margin: 0;\n}</style>",
     );
   });
 
-  it("preserves sibling combinators in selectors", () => {
-    expect(
-      <style>{"h2 + p { margin: 0; } h2 ~ p { color: red; }"}</style>,
-    ).toRender("<style>h2+p{margin:0}h2~p{color:red}</style>");
+  it("sends the content raw, like <script>", () => {
+    // Encoding it would break the CSS, so user input must never reach here
+    expect(<style>{"a::after { content: '>'; }"}</style>).toRender(
+      "<style>a::after { content: '>'; }</style>",
+    );
   });
 
-  it("removes spaces around braces, colons, and semicolons", () => {
-    expect(<style>{"a { color : red ; font-size : 1em ; }"}</style>).toRender(
-      "<style>a{color:red;font-size:1em}</style>",
+  it("escapes </style> either way, so it can't close the tag early", () => {
+    expect(<style>{"a { content: '</style>'; }"}</style>).toRender(
+      "<style>a { content: '<\\/style>'; }</style>",
+    );
+    expect(<style minify>{"a { content: '</style>'; }"}</style>).toRender(
+      "<style>a{content:'<\\/style>'}</style>",
     );
   });
 
-  it("removes trailing semicolon before closing brace", () => {
-    expect(<style>{"p { margin: 0; padding: 0; }"}</style>).toRender(
-      "<style>p{margin:0;padding:0}</style>",
+  it("never renders `minify` as an attribute", () => {
+    expect(<style minify>{"a { color: red; }"}</style>).toRender(
+      "<style>a{color:red}</style>",
     );
   });
 
-  it("does not break </style> injection", () => {
-    expect(<style>{"a { content: '</style>'; }"}</style>).toRender(
-      "<style>a{content:'<\\/style>'}</style>",
-    );
+  describe("with `minify`", () => {
+    it("minifies whitespace in style content", () => {
+      expect(
+        <style minify>{"body {\n  color:   red;\n  margin: 0;\n}"}</style>,
+      ).toRender("<style>body{color:red;margin:0}</style>");
+    });
+
+    it("strips CSS comments", () => {
+      expect(
+        <style minify>{"/* reset */ body { margin: 0; } /* end */"}</style>,
+      ).toRender("<style>body{margin:0}</style>");
+    });
+
+    it("preserves child combinator in selectors", () => {
+      expect(
+        <style minify>{":not(pre) > code { background: none; }"}</style>,
+      ).toRender("<style>:not(pre)>code{background:none}</style>");
+    });
+
+    it("preserves sibling combinators in selectors", () => {
+      // `+` keeps a single space, since removing it breaks calc() below
+      expect(
+        <style minify>
+          {"h2  +  p { margin: 0; } h2 ~ p { color: red; }"}
+        </style>,
+      ).toRender("<style>h2 + p{margin:0}h2~p{color:red}</style>");
+    });
+
+    it("keeps the spaces calc() needs around + and -", () => {
+      // `calc(100%+10px)` is invalid CSS: the operators need their whitespace
+      expect(<style minify>{"a { top: calc(100% + 10px); }"}</style>).toRender(
+        "<style>a{top:calc(100% + 10px)}</style>",
+      );
+      expect(<style minify>{"a { top: calc(100% - 10px); }"}</style>).toRender(
+        "<style>a{top:calc(100% - 10px)}</style>",
+      );
+    });
+
+    it("removes spaces around braces, colons, and semicolons", () => {
+      expect(
+        <style minify>{"a { color : red ; font-size : 1em ; }"}</style>,
+      ).toRender("<style>a{color:red;font-size:1em}</style>");
+    });
+
+    it("removes trailing semicolon before closing brace", () => {
+      expect(<style minify>{"p { margin: 0; padding: 0; }"}</style>).toRender(
+        "<style>p{margin:0;padding:0}</style>",
+      );
+    });
+
+    it("leaves quoted values alone", () => {
+      // The spaces and delimiters in here are content, not formatting
+      expect(<style minify>{'a::after { content: ", "; }'}</style>).toRender(
+        '<style>a::after{content:", "}</style>',
+      );
+      expect(
+        <style minify>{'a::after { content: "a; b: c"; }'}</style>,
+      ).toRender('<style>a::after{content:"a; b: c"}</style>');
+      expect(
+        <style minify>{"a::after { content: 'x  y'; }"}</style>,
+      ).toRender("<style>a::after{content:'x  y'}</style>");
+    });
+
+    it("handles an escaped quote inside a value", () => {
+      expect(
+        <style minify>{'a::after { content: "say \\" hi"; }'}</style>,
+      ).toRender('<style>a::after{content:"say \\" hi"}</style>');
+    });
+
+    it("still strips a comment written inside a value", () => {
+      // Comments are stripped first, unconditionally
+      expect(
+        <style minify>{'a::after { content: "/* hi */"; }'}</style>,
+      ).toRender('<style>a::after{content:""}</style>');
+    });
   });
 });