@sveltejs/kit 3.0.0-next.1 → 3.0.0-next.11

package/src/runtime/server/respond.js

@@ -8,13 +8,9 @@ import { is_endpoint_request, render_endpoint } from './endpoint.js';
 import { render_page } from './page/index.js';
 import { render_response } from './page/render.js';
 import { respond_with_error } from './page/respond_with_error.js';
-import { is_form_content_type } from '../../utils/http.js';
-import {
-	handle_fatal_error,
-	has_prerendered_path,
-	method_not_allowed,
-	redirect_response
-} from './utils.js';
+import { get_self_origin, is_csrf_forbidden, is_remote_forbidden } from './csrf.js';
+import { has_prerendered_path, method_not_allowed, redirect_response } from './utils.js';
+import { handle_fatal_error } from './errors.js';
 import { decode_pathname, disable_search, normalize_path } from '../../utils/url.js';
 import { find_route } from '../../utils/routing.js';
 import { redirect_json_response, render_data } from './data/index.js';
@@ -36,7 +32,7 @@ import {
 	strip_resolution_suffix
 } from '../pathname.js';
 import { server_data_serializer } from './page/data_serializer.js';
-import { get_remote_id, handle_remote_call } from './remote.js';
+import { get_remote_id, handle_remote_call } from './remote-functions.js';
 import { record_span } from '../telemetry/record_span.js';
 import { otel } from '../telemetry/otel.js';
 
@@ -70,23 +66,28 @@ export async function internal_respond(request, options, manifest, state) {
 	const is_data_request = has_data_suffix(url.pathname);
 	const remote_id = get_remote_id(url);
 
-	if (!DEV) {
+	if (!__SVELTEKIT_DEV__) {
 		const request_origin = request.headers.get('origin');
+		const self_origin = get_self_origin(options.paths_origin, url.origin);
 
 		if (remote_id) {
-			if (request.method !== 'GET' && request_origin !== url.origin) {
+			if (
+				is_remote_forbidden({
+					request,
+					request_origin,
+					self_origin
+				})
+			) {
 				const message = 'Cross-site remote requests are forbidden';
 				return json({ message }, { status: 403 });
 			}
 		} else if (options.csrf_check_origin) {
-			const forbidden =
-				is_form_content_type(request) &&
-				(request.method === 'POST' ||
-					request.method === 'PUT' ||
-					request.method === 'PATCH' ||
-					request.method === 'DELETE') &&
-				request_origin !== url.origin &&
-				(!request_origin || !options.csrf_trusted_origins.includes(request_origin));
+			const forbidden = is_csrf_forbidden({
+				request,
+				request_origin,
+				self_origin,
+				trusted_origins: options.csrf_trusted_origins
+			});
 
 			if (forbidden) {
 				const message = `Cross-site ${request.method} form submissions are forbidden`;
@@ -147,14 +148,16 @@ export async function internal_respond(request, options, manifest, state) {
 		},
 		remote: {
 			data: null,
+			explicit: null,
+			implicit: null,
 			forms: null,
-			refreshes: null,
 			requested: null,
-			reconnects: null,
 			batches: null,
 			live_iterators: null
 		},
 		is_in_remote_function: false,
+		is_in_remote_form_or_command: false,
+		is_in_remote_query: false,
 		is_in_render: false,
 		is_in_universal_load: false
 	};
@@ -317,7 +320,7 @@ export async function internal_respond(request, options, manifest, state) {
 		return resolve_route(resolved_path, new URL(request.url), manifest);
 	}
 
-	if (resolved_path === `/${app_dir}/env.js` || resolved_path === `/${app_dir}/env.script.js`) {
+	if (resolved_path === `/${app_dir}/env.js`) {
 		return get_public_env(request);
 	}
 
@@ -329,14 +332,17 @@ export async function internal_respond(request, options, manifest, state) {
 	}
 
 	if (!state.prerendering?.fallback) {
-		// TODO this could theoretically break — should probably be inside a try-catch
-		const matchers = await manifest._.matchers();
-		const result = find_route(resolved_path, manifest._.routes, matchers);
-
-		if (result) {
-			route = result.route;
-			event.route = { id: route.id };
-			event.params = result.params;
+		try {
+			const matchers = await manifest._.matchers();
+			const result = find_route(resolved_path, manifest._.routes, matchers);
+
+			if (result) {
+				route = result.route;
+				event.route = { id: route.id };
+				event.params = result.params;
+			}
+		} catch (e) {
+			return await handle_fatal_error(event, event_state, options, e);
 		}
 	}
 
@@ -617,54 +623,80 @@ export async function internal_respond(request, options, manifest, state) {
 						invalidated_data_nodes,
 						trailing_slash
 					);
-				} else if (route.endpoint && (!route.page || is_endpoint_request(event))) {
-					response = await render_endpoint(event, event_state, await route.endpoint(), state);
-				} else if (route.page) {
-					if (!page_nodes) {
-						throw new Error('page_nodes not found. This should never happen');
-					} else if (page_methods.has(method)) {
-						response = await render_page(
-							event,
-							event_state,
-							route.page,
-							options,
-							manifest,
-							state,
-							page_nodes,
-							resolve_opts
-						);
-					} else {
-						const allowed_methods = new Set(allowed_page_methods);
-						const node = await manifest._.nodes[route.page.leaf]();
-						if (node?.server?.actions) {
-							allowed_methods.add('POST');
+				} else {
+					let endpoint;
+					if (
+						route.endpoint &&
+						(!route.page || (!state.prerendering && is_endpoint_request(event)))
+					) {
+						endpoint = await route.endpoint();
+
+						// Prefer rendering the page if the endpoint can't handle this GET or HEAD request
+						if (route.page && (method === 'GET' || method === 'HEAD')) {
+							const endpoint_can_handle = !!(
+								endpoint.GET ||
+								endpoint.fallback ||
+								(method === 'HEAD' && endpoint.HEAD)
+							);
+							if (!endpoint_can_handle) {
+								endpoint = undefined;
+							}
 						}
+					}
 
-						if (method === 'OPTIONS') {
-							// This will deny CORS preflight requests implicitly because we don't
-							// add the required CORS headers to the response.
-							response = new Response(null, {
-								status: 204,
-								headers: {
-									allow: Array.from(allowed_methods.values()).join(', ')
-								}
-							});
+					if (endpoint) {
+						response = await render_endpoint(event, event_state, endpoint, state);
+					} else if (route.page) {
+						if (!page_nodes) {
+							throw new Error('page_nodes not found. This should never happen');
+						} else if (page_methods.has(method)) {
+							response = await render_page(
+								event,
+								event_state,
+								route.page,
+								options,
+								manifest,
+								state,
+								page_nodes,
+								resolve_opts
+							);
 						} else {
-							const mod = [...allowed_methods].reduce((acc, curr) => {
-								acc[curr] = true;
-								return acc;
-							}, /** @type {Record<string, any>} */ ({}));
-							response = method_not_allowed(mod, method);
+							const allowed_methods = new Set(allowed_page_methods);
+							const node = await manifest._.nodes[route.page.leaf]();
+							if (node?.server?.actions) {
+								allowed_methods.add('POST');
+							}
+
+							if (method === 'OPTIONS') {
+								// This will deny CORS preflight requests implicitly because we don't
+								// add the required CORS headers to the response.
+								response = new Response(null, {
+									status: 204,
+									headers: {
+										allow: Array.from(allowed_methods.values()).join(', ')
+									}
+								});
+							} else {
+								const mod = [...allowed_methods].reduce((acc, curr) => {
+									acc[curr] = true;
+									return acc;
+								}, /** @type {Record<string, any>} */ ({}));
+								response = method_not_allowed(mod, method);
+							}
 						}
+					} else {
+						// a route will always have a page or an endpoint, but TypeScript doesn't know that
+						throw new Error('Route is neither page nor endpoint. This should never happen');
 					}
-				} else {
-					// a route will always have a page or an endpoint, but TypeScript doesn't know that
-					throw new Error('Route is neither page nor endpoint. This should never happen');
 				}
 
 				// If the route contains a page and an endpoint, we need to add a
 				// `Vary: Accept` header to the response because of browser caching
-				if (request.method === 'GET' && route.page && route.endpoint) {
+				if (
+					(request.method === 'GET' || request.method === 'HEAD') &&
+					route.page &&
+					route.endpoint
+				) {
 					const vary = response.headers
 						.get('vary')
 						?.split(',')

package/src/runtime/server/sourcemaps.js

@@ -0,0 +1,183 @@
+/* eslint-disable n/prefer-global/process */
+
+// using `getBuiltinModule` rather than `import` makes this safe to run in non-Node-compatible environments
+const fs = globalThis.process?.getBuiltinModule?.('node:fs');
+const url = globalThis.process?.getBuiltinModule?.('node:url');
+const path = globalThis.process?.getBuiltinModule?.('node:path');
+const module = globalThis.process?.getBuiltinModule?.('node:module');
+
+const cwd = globalThis.process?.cwd?.();
+
+/** @type {(file: string) => string} */
+const relative = cwd ? (file) => path.relative(cwd, file) : (file) => file;
+
+/**
+ * Applies sourcemaps, makes paths relative to the cwd, and truncates
+ * non-user code from the bottom of the stack
+ * @param {Error} error
+ * @returns void
+ */
+export let fix_stack_trace = (error) => {
+	if (!error.stack || !fs) return;
+
+	let end = 0;
+
+	error.stack = error.stack
+		.split('\n')
+		.map((line, i) => {
+			const match = line.match(/^ {4}at.+(file:\/\/\/.*):(\d+):(\d+)(\)?)$/);
+
+			if (!match) {
+				if (!line.includes('node:internal/')) {
+					end = i + 1;
+				}
+
+				return line;
+			}
+
+			const file = url.fileURLToPath(match[1]);
+			const traced = trace(file, Number(match[2]) - 1, Number(match[3]) - 1);
+
+			// truncate non-user code from the bottom of the stack (but leave it in otherwise)
+			if (!/[\\/]node_modules[\\/]/.test(traced?.file ?? file)) {
+				end = i + 1;
+			}
+
+			if (traced?.line) {
+				const location = `${match[1]}:${match[2]}:${match[3]}`;
+				const original = `${relative(traced.file)}:${traced.line}:${traced.column}`;
+
+				return line.replace(location, original);
+			}
+
+			if (traced) {
+				return `${line.replace(match[1], relative(file))} [${traced.file}]`;
+			}
+
+			return line;
+		})
+		.slice(0, end)
+		.join('\n');
+};
+
+/**
+ * Override the implementation of fix_stack_trace (for using during dev)
+ * @param {(error: Error) => void} fn
+ */
+export function set_fix_stack_trace(fn) {
+	fix_stack_trace = fn;
+}
+
+/** @type {Map<string, { map: import('node:module').SourceMap; directory: string } | null>} */
+const source_maps = new Map();
+
+/** @type {Map<string, Array<string | undefined>>} */
+const source_regions = new Map();
+
+/** @param {string} file */
+function get_source_map(file) {
+	if (source_maps.has(file)) {
+		return source_maps.get(file);
+	}
+
+	try {
+		let source;
+		let directory = path.dirname(file);
+
+		const code = fs.readFileSync(file, 'utf8');
+		const matches = Array.from(code.matchAll(/\/\/[#@]\s*sourceMappingURL=(\S+)/g));
+		const url = matches.at(-1)?.[1];
+
+		if (url?.startsWith('data:')) {
+			const comma = url.indexOf(',');
+			const metadata = url.slice(5, comma);
+			const data = url.slice(comma + 1);
+			source = metadata.endsWith(';base64')
+				? Buffer.from(data, 'base64').toString()
+				: decodeURIComponent(data);
+		} else {
+			const map_file = url
+				? path.resolve(path.dirname(file), decodeURIComponent(url))
+				: `${file}.map`;
+			if (fs.existsSync(map_file)) {
+				directory = path.dirname(map_file);
+				source = fs.readFileSync(map_file, 'utf8');
+			}
+		}
+
+		if (source) {
+			const source_map = { map: new module.SourceMap(JSON.parse(source)), directory };
+			source_maps.set(file, source_map);
+
+			return source_map;
+		}
+	} catch {
+		// failure could be for any reason and this is best-effort, ignore
+	}
+
+	source_maps.set(file, null);
+	return null;
+}
+
+/**
+ *
+ * @param {string} file
+ * @param {number} line
+ * @param {number} column
+ * @returns {null | { file: string, line?: number, column?: number }}
+ */
+function trace(file, line, column) {
+	const source_map = get_source_map(file);
+	if (!source_map) return null;
+
+	const entry = source_map.map.findEntry(line, column);
+
+	if (
+		entry &&
+		'originalSource' in entry &&
+		entry.originalSource &&
+		typeof entry.originalLine === 'number' &&
+		typeof entry.originalColumn === 'number'
+	) {
+		const source = entry.originalSource.startsWith('file:')
+			? url.fileURLToPath(entry.originalSource)
+			: path.resolve(source_map.directory, entry.originalSource);
+
+		const traced = {
+			file: source,
+			line: entry.originalLine + 1,
+			column: entry.originalColumn + 1
+		};
+
+		// keep going, in case we are running code that was bundled a second time by an adapter
+		return trace(traced.file, traced.line - 1, traced.column - 1) ?? traced;
+	}
+
+	let regions = source_regions.get(file);
+	if (!regions) {
+		/** @type {string | undefined} */
+		let source;
+		regions = fs
+			.readFileSync(file, 'utf8')
+			.split('\n')
+			.map((line) => {
+				// Vite will merge multiple files into one but add region markers
+				// with the original file names, which we try to extract here.
+				const start = line.match(/^\/\/#region (.+)$/);
+				if (start) source = start[1];
+				if (line === '//#endregion') source = undefined;
+				return source;
+			});
+		source_regions.set(file, regions);
+	}
+
+	const source = regions[line];
+
+	if (source) {
+		return {
+			file: source
+		};
+	}
+
+	return null;
+}

package/src/runtime/server/utils.js

@@ -1,15 +1,7 @@
 /** @import { ServerHooks } from 'types' */
 import * as devalue from 'devalue';
-import { DEV } from 'esm-env';
-import { json, text } from '@sveltejs/kit';
-import { HttpError } from '@sveltejs/kit/internal';
-import { with_request_store } from '@sveltejs/kit/internal/server';
-import { coalesce_to_error, get_message, get_status } from '../../utils/error.js';
-import { negotiate } from '../../utils/http.js';
-import { fix_stack_trace } from '../shared-server.js';
+import { text } from '@sveltejs/kit';
 import { ENDPOINT_METHODS } from '../../constants.js';
-import { escape_html } from '../../utils/escape.js';
-import * as path from '../../utils/path.js';
 
 /**
  * @param {Partial<Record<import('types').HttpMethod, any>>} mod
@@ -46,80 +38,6 @@ export function get_global_name(options) {
 	return __SVELTEKIT_DEV__ ? '__sveltekit_dev' : `__sveltekit_${options.version_hash}`;
 }
 
-/**
- * Return as a response that renders the error.html
- *
- * @param {import('types').SSROptions} options
- * @param {number} status
- * @param {string} message
- */
-export function static_error_page(options, status, message) {
-	let page = options.templates.error({ status, message: escape_html(message) });
-
-	if (__SVELTEKIT_DEV__) {
-		// inject Vite HMR client, for easier debugging
-		page = page.replace('</head>', '<script type="module" src="/@vite/client"></script></head>');
-	}
-
-	return text(page, {
-		headers: { 'content-type': 'text/html; charset=utf-8' },
-		status
-	});
-}
-
-/**
- * @param {import('@sveltejs/kit').RequestEvent} event
- * @param {import('types').RequestState} state
- * @param {import('types').SSROptions} options
- * @param {unknown} error
- */
-export async function handle_fatal_error(event, state, options, error) {
-	error = error instanceof HttpError ? error : coalesce_to_error(error);
-	const status = get_status(error);
-	const body = await handle_error_and_jsonify(event, state, options, error);
-
-	// ideally we'd use sec-fetch-dest instead, but Safari — quelle surprise — doesn't support it
-	const type = negotiate(event.request.headers.get('accept') || 'text/html', [
-		'application/json',
-		'text/html'
-	]);
-
-	if (event.isDataRequest || type === 'application/json') {
-		return json(body, {
-			status
-		});
-	}
-
-	return static_error_page(options, status, body.message);
-}
-
-/**
- * @param {import('@sveltejs/kit').RequestEvent} event
- * @param {import('types').RequestState} state
- * @param {import('types').SSROptions} options
- * @param {any} error
- * @returns {Promise<App.Error>}
- */
-export async function handle_error_and_jsonify(event, state, options, error) {
-	if (error instanceof HttpError) {
-		// @ts-expect-error custom user errors may not have a message field if App.Error is overwritten
-		return { message: 'Unknown Error', ...error.body };
-	}
-
-	if (__SVELTEKIT_DEV__ && typeof error == 'object') {
-		fix_stack_trace(error);
-	}
-
-	const status = get_status(error);
-	const message = get_message(error);
-
-	return (
-		(await with_request_store({ event, state }, () =>
-			options.hooks.handleError({ error, event, status, message })
-		)) ?? { message }
-	);
-}
-
 /**
  * @param {number} status
  * @param {string} location
@@ -140,7 +58,7 @@ export function clarify_devalue_error(event, error) {
 	if (error.path) {
 		return (
 			`Data returned from \`load\` while rendering ${event.route.id} is not serializable: ${error.message} (${error.path}). ` +
-			`If you need to serialize/deserialize custom types, use transport hooks: https://svelte.dev/docs/kit/hooks#Universal-hooks-transport.`
+			`If you need to serialize/deserialize custom types, use transport hooks: https://svelte.dev/docs/kit/hooks#transport.`
 		);
 	}
 
@@ -189,56 +107,6 @@ export function has_prerendered_path(manifest, pathname) {
 	);
 }
 
-/**
- * Formats the error into a nice message with sanitized stack trace
- * @param {number} status
- * @param {Error} error
- * @param {import('@sveltejs/kit').RequestEvent} event
- */
-export function format_server_error(status, error, event) {
-	const formatted_text = `\n\x1b[1;31m[${status}] ${event.request.method} ${event.url.pathname}\x1b[0m`;
-
-	if (status === 404) {
-		return formatted_text;
-	}
-
-	return `${formatted_text}\n${DEV ? clean_up_stack_trace(error) : error.stack}`;
-}
-
-/**
- * In dev, tidy up stack traces by making paths relative to the current project directory
- * @param {string} file
- */
-let relative = (file) => file;
-
-if (DEV) {
-	try {
-		relative = (file) => path.relative(__SVELTEKIT_ROOT__, file);
-	} catch {
-		// do nothing
-	}
-}
-
-/**
- * Provides a refined stack trace by excluding lines following the last occurrence of a line containing +page. +layout. or +server.
- * @param {Error} error
- */
-export function clean_up_stack_trace(error) {
-	const stack_trace = (error.stack?.split('\n') ?? []).map((line) => {
-		return line.replace(/\((.+)(:\d+:\d+)\)$/, (_, file, loc) => `(${relative(file)}${loc})`);
-	});
-
-	// progressive enhancement for people who haven't configured kit.files.src to something else
-	const last_line_from_src_code = stack_trace.findLastIndex((line) => /\(src[\\/]/.test(line));
-
-	if (last_line_from_src_code === -1) {
-		// default to the whole stack trace
-		return error.stack;
-	}
-
-	return stack_trace.slice(0, last_line_from_src_code + 1).join('\n');
-}
-
 /**
  * Returns the filename without the extension. e.g., `+page.server`, `+page`, etc.
  * @param {string | undefined} node_id