@sveltejs/kit 3.0.0-next.2 → 3.0.0-next.21

package/src/runtime/server/respond.js

@@ -1,21 +1,27 @@
-/** @import { RequestState, SSRNode } from 'types' */
+/** @import { SSRNode } from 'types' */
 import { DEV } from 'esm-env';
 import { json, text } from '@sveltejs/kit';
 import { Redirect, SvelteKitError } from '@sveltejs/kit/internal';
-import { merge_tracing, with_request_store } from '@sveltejs/kit/internal/server';
-import { base, app_dir } from '$app/paths/internal/server';
+import {
+	merge_tracing,
+	otel,
+	record_span,
+	with_request_store
+} from '@sveltejs/kit/internal/server';
+import { base, app_dir } from '#app/paths';
 import { is_endpoint_request, render_endpoint } from './endpoint.js';
 import { render_page } from './page/index.js';
 import { render_response } from './page/render.js';
 import { respond_with_error } from './page/respond_with_error.js';
-import { is_form_content_type } from '../../utils/http.js';
+import { get_self_origin, is_csrf_forbidden, is_remote_forbidden } from './csrf.js';
+import { has_prerendered_path, method_not_allowed, redirect_response } from './utils.js';
+import { handle_fatal_error } from './errors.js';
 import {
-	handle_fatal_error,
-	has_prerendered_path,
-	method_not_allowed,
-	redirect_response
-} from './utils.js';
-import { decode_pathname, disable_search, normalize_path } from '../../utils/url.js';
+	decode_pathname,
+	disable_search,
+	normalize_path,
+	relative_pathname
+} from '../../utils/url.js';
 import { find_route } from '../../utils/routing.js';
 import { redirect_json_response, render_data } from './data/index.js';
 import { add_cookies_to_headers, get_cookies } from './cookie.js';
@@ -25,20 +31,20 @@ import { validate_server_exports } from '../../utils/exports.js';
 import { action_json_redirect, is_action_json_request } from './page/actions.js';
 import { INVALIDATED_PARAM, TRAILING_SLASH_PARAM } from '../shared.js';
 import { get_public_env } from './env_module.js';
-import { resolve_route } from './page/server_routing.js';
+import { resolve_route, resolve_route_by_id } from './page/server_routing.js';
 import { validateHeaders } from './validate-headers.js';
 import {
 	add_data_suffix,
 	add_resolution_suffix,
+	extract_route_id,
 	has_data_suffix,
 	has_resolution_suffix,
+	is_route_id_resolution_path,
 	strip_data_suffix,
 	strip_resolution_suffix
 } from '../pathname.js';
 import { server_data_serializer } from './page/data_serializer.js';
-import { get_remote_id, handle_remote_call } from './remote.js';
-import { record_span } from '../telemetry/record_span.js';
-import { otel } from '../telemetry/otel.js';
+import { get_remote_id, handle_remote_call } from './remote-functions.js';
 
 /** @type {import('types').RequiredResolveOptions['transformPageChunk']} */
 const default_transform = ({ html }) => html;
@@ -49,6 +55,28 @@ const default_filter = () => false;
 /** @type {import('types').RequiredResolveOptions['preload']} */
 const default_preload = ({ type }) => type === 'js' || type === 'css';
 
+// `Sec-Fetch-Dest` values for subresource requests that can never render an HTML error page
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Dest
+const non_html_fetch_destinations = new Set([
+	'audio',
+	'audioworklet',
+	'font',
+	'image',
+	'json',
+	'manifest',
+	'paintworklet',
+	'report',
+	'script',
+	'serviceworker',
+	'sharedworker',
+	'style',
+	'track',
+	'video',
+	'webidentity',
+	'worker',
+	'xslt'
+]);
+
 const page_methods = new Set(['GET', 'HEAD', 'POST']);
 
 const allowed_page_methods = new Set(['GET', 'HEAD', 'OPTIONS']);
@@ -59,7 +87,7 @@ export const respond = propagate_context(internal_respond);
  * @param {Request} request
  * @param {import('types').SSROptions} options
  * @param {import('@sveltejs/kit').SSRManifest} manifest
- * @param {import('types').SSRState} state
+ * @param {import('types').RequestState} state
  * @returns {Promise<Response>}
  */
 export async function internal_respond(request, options, manifest, state) {
@@ -70,23 +98,28 @@ export async function internal_respond(request, options, manifest, state) {
 	const is_data_request = has_data_suffix(url.pathname);
 	const remote_id = get_remote_id(url);
 
-	if (!DEV) {
+	if (!__SVELTEKIT_DEV__) {
 		const request_origin = request.headers.get('origin');
+		const self_origin = get_self_origin(options.paths_origin, url.origin);
 
 		if (remote_id) {
-			if (request.method !== 'GET' && request_origin !== url.origin) {
+			if (
+				is_remote_forbidden({
+					request,
+					request_origin,
+					self_origin
+				})
+			) {
 				const message = 'Cross-site remote requests are forbidden';
 				return json({ message }, { status: 403 });
 			}
 		} else if (options.csrf_check_origin) {
-			const forbidden =
-				is_form_content_type(request) &&
-				(request.method === 'POST' ||
-					request.method === 'PUT' ||
-					request.method === 'PATCH' ||
-					request.method === 'DELETE') &&
-				request_origin !== url.origin &&
-				(!request_origin || !options.csrf_trusted_origins.includes(request_origin));
+			const forbidden = is_csrf_forbidden({
+				request,
+				request_origin,
+				self_origin,
+				trusted_origins: options.csrf_trusted_origins
+			});
 
 			if (forbidden) {
 				const message = `Cross-site ${request.method} form submissions are forbidden`;
@@ -108,12 +141,18 @@ export async function internal_respond(request, options, manifest, state) {
 	/** @type {boolean[] | undefined} */
 	let invalidated_data_nodes;
 
+	let skip_route_resolution = false;
+
+	/** Whether this is a `/${app_dir}/routes/<route_id>/__route.js` request, used by `preloadCode` */
+	let is_route_id_resolution_request = false;
+
 	if (is_route_resolution_request) {
 		/**
 		 * If the request is for a route resolution, first modify the URL, then continue as normal
 		 * for path resolution, then return the route object as a JS file.
 		 */
 		url.pathname = strip_resolution_suffix(url.pathname);
+		is_route_id_resolution_request = is_route_id_resolution_path(url.pathname);
 	} else if (is_data_request) {
 		url.pathname =
 			strip_data_suffix(url.pathname) +
@@ -125,8 +164,15 @@ export async function internal_respond(request, options, manifest, state) {
 			.map((node) => node === '1');
 		url.searchParams.delete(INVALIDATED_PARAM);
 	} else if (remote_id) {
-		url.pathname = request.headers.get('x-sveltekit-pathname') ?? base;
-		url.search = request.headers.get('x-sveltekit-search') ?? '';
+		// query clients don't send these headers, leaving `event.url` as the endpoint URL
+		const pathname = request.headers.get('x-sveltekit-pathname');
+
+		if (pathname === null) {
+			skip_route_resolution = true;
+		} else {
+			url.pathname = pathname;
+			url.search = request.headers.get('x-sveltekit-search') ?? '';
+		}
 	}
 
 	/** @type {Record<string, string>} */
@@ -137,29 +183,7 @@ export async function internal_respond(request, options, manifest, state) {
 		url
 	);
 
-	/** @type {RequestState} */
-	const event_state = {
-		prerendering: state.prerendering,
-		transport: options.hooks.transport,
-		handleValidationError: options.hooks.handleValidationError,
-		tracing: {
-			record_span
-		},
-		remote: {
-			data: null,
-			forms: null,
-			refreshes: null,
-			requested: null,
-			reconnects: null,
-			batches: null,
-			live_iterators: null
-		},
-		is_in_remote_function: false,
-		is_in_render: false,
-		is_in_universal_load: false
-	};
-
-	/** @type {import('@sveltejs/kit').RequestEvent} */
+	/** @type {import('$app/server').RequestEvent} */
 	const event = {
 		cookies,
 		// @ts-expect-error `fetch` needs to be created after the `event` itself
@@ -173,7 +197,12 @@ export async function internal_respond(request, options, manifest, state) {
 			}),
 		locals: {},
 		params: {},
-		platform: state.platform,
+		platform: state.emulator?.platform
+			? await state.emulator.platform({
+					config: {},
+					prerender: !!state.prerendering?.fallback
+				})
+			: state.platform,
 		request,
 		route: { id: null },
 		setHeaders: (new_headers) => {
@@ -211,6 +240,7 @@ export async function internal_respond(request, options, manifest, state) {
 		isRemoteRequest: !!remote_id
 	};
 
+	// @ts-expect-error this has to be assigned lazily
 	event.fetch = create_fetch({
 		event,
 		options,
@@ -220,17 +250,11 @@ export async function internal_respond(request, options, manifest, state) {
 		set_internal
 	});
 
-	if (state.emulator?.platform) {
-		event.platform = await state.emulator.platform({
-			config: {},
-			prerender: !!state.prerendering?.fallback
-		});
-	}
-
 	/** @type {string | null} */
 	let resolved_path = url.pathname;
 
-	if (!remote_id) {
+	// `reroute` hooks receive pathnames, so they must not run for route-ID resolution requests
+	if (!remote_id && !is_route_id_resolution_request) {
 		const prerendering_reroute_state = state.prerendering?.inside_reroute;
 		try {
 			// For the duration or a reroute, disable the prerendering state as reroute could call API endpoints
@@ -299,7 +323,7 @@ export async function internal_respond(request, options, manifest, state) {
 				statusText: response.statusText
 			});
 		} catch (error) {
-			return await handle_fatal_error(event, event_state, options, error);
+			return await handle_fatal_error(event, state, options, error);
 		}
 	}
 
@@ -314,10 +338,14 @@ export async function internal_respond(request, options, manifest, state) {
 	}
 
 	if (is_route_resolution_request) {
+		if (is_route_id_resolution_request) {
+			return resolve_route_by_id(extract_route_id(resolved_path), new URL(request.url), manifest);
+		}
+
 		return resolve_route(resolved_path, new URL(request.url), manifest);
 	}
 
-	if (resolved_path === `/${app_dir}/env.js` || resolved_path === `/${app_dir}/env.script.js`) {
+	if (resolved_path === `/${app_dir}/env.js`) {
 		return get_public_env(request);
 	}
 
@@ -328,15 +356,20 @@ export async function internal_respond(request, options, manifest, state) {
 		return text('Not found', { status: 404, headers });
 	}
 
-	if (!state.prerendering?.fallback) {
-		// TODO this could theoretically break — should probably be inside a try-catch
-		const matchers = await manifest._.matchers();
-		const result = find_route(resolved_path, manifest._.routes, matchers);
-
-		if (result) {
-			route = result.route;
-			event.route = { id: route.id };
-			event.params = result.params;
+	if (!state.prerendering?.fallback && !skip_route_resolution) {
+		try {
+			const matchers = await manifest._.matchers();
+			const result = find_route(resolved_path, manifest._.routes, matchers);
+
+			if (result) {
+				route = result.route;
+				// @ts-expect-error this has to be assigned lazily
+				event.route = { id: route.id };
+				// @ts-expect-error this has to be assigned lazily
+				event.params = result.params;
+			}
+		} catch (e) {
+			return await handle_fatal_error(event, state, options, e);
 		}
 	}
 
@@ -372,10 +405,9 @@ export async function internal_respond(request, options, manifest, state) {
 						status: 308,
 						headers: {
 							'x-sveltekit-normalize': '1',
+							// relative so (possibly invisible) path prefixes are preserved
 							location:
-								// ensure paths starting with '//' are not treated as protocol-relative
-								(normalized.startsWith('//') ? url.origin + normalized : normalized) +
-								(url.search === '?' ? '' : url.search)
+								relative_pathname(url.pathname, normalized) + (url.search === '?' ? '' : url.search)
 						}
 					});
 				}
@@ -393,10 +425,11 @@ export async function internal_respond(request, options, manifest, state) {
 					prerender = node.prerender ?? prerender;
 				} else if (page_nodes) {
 					config = page_nodes.get_config() ?? config;
-					prerender = page_nodes.prerender();
+					prerender = state.prerender_default = page_nodes.prerender();
 				}
 
 				if (state.emulator?.platform) {
+					// @ts-expect-error this has to be assigned lazily
 					event.platform = await state.emulator.platform({ config, prerender });
 				}
 
@@ -419,10 +452,10 @@ export async function internal_respond(request, options, manifest, state) {
 				add_cookies_to_headers(response.headers, new_cookies.values());
 				return response;
 			} catch (err) {
-				return await handle_fatal_error(event, event_state, options, err);
+				return await handle_fatal_error(event, state, options, err);
 			}
 		}
-		return await handle_fatal_error(event, event_state, options, e);
+		return await handle_fatal_error(event, state, options, e);
 	}
 
 	async function handle() {
@@ -451,7 +484,7 @@ export async function internal_respond(request, options, manifest, state) {
 					}
 				};
 
-				return await with_request_store({ event: traced_event, state: event_state }, () =>
+				return await with_request_store({ event: traced_event, state }, () =>
 					options.hooks.handle({
 						event: traced_event,
 						resolve: (event, opts) => {
@@ -541,9 +574,9 @@ export async function internal_respond(request, options, manifest, state) {
 	}
 
 	/**
-	 * @param {import('@sveltejs/kit').RequestEvent} event
+	 * @param {import('$app/server').RequestEvent} event
 	 * @param {PageNodes | undefined} page_nodes
-	 * @param {import('@sveltejs/kit').ResolveOptions} [opts]
+	 * @param {import('@sveltejs/kit/hooks').ResolveOptions} [opts]
 	 */
 	async function resolve(event, page_nodes, opts) {
 		try {
@@ -558,11 +591,9 @@ export async function internal_respond(request, options, manifest, state) {
 			if (resolved_path === null) {
 				return await respond_with_error({
 					event,
-					event_state,
+					state,
 					options,
 					manifest,
-					state,
-					status: 400,
 					error: new SvelteKitError(
 						400,
 						'Malformed URI',
@@ -575,10 +606,9 @@ export async function internal_respond(request, options, manifest, state) {
 			if (options.hash_routing || state.prerendering?.fallback) {
 				return await render_response({
 					event,
-					event_state,
+					state,
 					options,
 					manifest,
-					state,
 					page_config: { ssr: false, csr: true },
 					status: 200,
 					error: null,
@@ -592,12 +622,12 @@ export async function internal_respond(request, options, manifest, state) {
 					],
 					fetched: [],
 					resolve_opts,
-					data_serializer: server_data_serializer(event, event_state, options)
+					data_serializer: server_data_serializer(event, state, options)
 				});
 			}
 
 			if (remote_id) {
-				return await handle_remote_call(event, event_state, options, manifest, remote_id);
+				return await handle_remote_call(event, state, options, manifest, remote_id);
 			}
 
 			if (route) {
@@ -609,62 +639,85 @@ export async function internal_respond(request, options, manifest, state) {
 				if (is_data_request) {
 					response = await render_data(
 						event,
-						event_state,
+						state,
 						route,
 						options,
 						manifest,
-						state,
 						invalidated_data_nodes,
 						trailing_slash
 					);
-				} else if (route.endpoint && (!route.page || is_endpoint_request(event))) {
-					response = await render_endpoint(event, event_state, await route.endpoint(), state);
-				} else if (route.page) {
-					if (!page_nodes) {
-						throw new Error('page_nodes not found. This should never happen');
-					} else if (page_methods.has(method)) {
-						response = await render_page(
-							event,
-							event_state,
-							route.page,
-							options,
-							manifest,
-							state,
-							page_nodes,
-							resolve_opts
-						);
-					} else {
-						const allowed_methods = new Set(allowed_page_methods);
-						const node = await manifest._.nodes[route.page.leaf]();
-						if (node?.server?.actions) {
-							allowed_methods.add('POST');
+				} else {
+					let endpoint;
+					if (
+						route.endpoint &&
+						(!route.page || (!state.prerendering && is_endpoint_request(event)))
+					) {
+						endpoint = await route.endpoint();
+
+						// Prefer rendering the page if the endpoint can't handle this GET, HEAD, or POST request
+						if (route.page && (method === 'GET' || method === 'HEAD' || method === 'POST')) {
+							const endpoint_can_handle =
+								method === 'POST'
+									? !!(endpoint.POST || endpoint.fallback)
+									: !!(endpoint.GET || endpoint.fallback || (method === 'HEAD' && endpoint.HEAD));
+							if (!endpoint_can_handle) {
+								endpoint = undefined;
+							}
 						}
+					}
 
-						if (method === 'OPTIONS') {
-							// This will deny CORS preflight requests implicitly because we don't
-							// add the required CORS headers to the response.
-							response = new Response(null, {
-								status: 204,
-								headers: {
-									allow: Array.from(allowed_methods.values()).join(', ')
-								}
-							});
+					if (endpoint) {
+						response = await render_endpoint(event, state, endpoint);
+					} else if (route.page) {
+						if (!page_nodes) {
+							throw new Error('page_nodes not found. This should never happen');
+						} else if (page_methods.has(method)) {
+							response = await render_page(
+								event,
+								state,
+								route.page,
+								options,
+								manifest,
+								page_nodes,
+								resolve_opts
+							);
 						} else {
-							const mod = [...allowed_methods].reduce((acc, curr) => {
-								acc[curr] = true;
-								return acc;
-							}, /** @type {Record<string, any>} */ ({}));
-							response = method_not_allowed(mod, method);
+							const allowed_methods = new Set(allowed_page_methods);
+							const node = await manifest._.nodes[route.page.leaf]();
+							if (node?.server?.actions) {
+								allowed_methods.add('POST');
+							}
+
+							if (method === 'OPTIONS') {
+								// This will deny CORS preflight requests implicitly because we don't
+								// add the required CORS headers to the response.
+								response = new Response(null, {
+									status: 204,
+									headers: {
+										allow: Array.from(allowed_methods.values()).join(', ')
+									}
+								});
+							} else {
+								const mod = [...allowed_methods].reduce((acc, curr) => {
+									acc[curr] = true;
+									return acc;
+								}, /** @type {Record<string, any>} */ ({}));
+								response = method_not_allowed(mod, method);
+							}
 						}
+					} else {
+						// a route will always have a page or an endpoint, but TypeScript doesn't know that
+						throw new Error('Route is neither page nor endpoint. This should never happen');
 					}
-				} else {
-					// a route will always have a page or an endpoint, but TypeScript doesn't know that
-					throw new Error('Route is neither page nor endpoint. This should never happen');
 				}
 
 				// If the route contains a page and an endpoint, we need to add a
 				// `Vary: Accept` header to the response because of browser caching
-				if (request.method === 'GET' && route.page && route.endpoint) {
+				if (
+					(request.method === 'GET' || request.method === 'HEAD') &&
+					route.page &&
+					route.endpoint
+				) {
 					const vary = response.headers
 						.get('vary')
 						?.split(',')
@@ -701,13 +754,18 @@ export async function internal_respond(request, options, manifest, state) {
 			// if this request came direct from the user, rather than
 			// via our own `fetch`, render a 404 page
 			if (state.depth === 0) {
+				if (non_html_fetch_destinations.has(event.request.headers.get('sec-fetch-dest') ?? '')) {
+					return text('Not Found', {
+						status: 404,
+						headers: { vary: 'Sec-Fetch-Dest' }
+					});
+				}
+
 				return await respond_with_error({
 					event,
-					event_state,
+					state,
 					options,
 					manifest,
-					state,
-					status: 404,
 					error: new SvelteKitError(404, 'Not Found', `Not found: ${event.url.pathname}`),
 					resolve_opts
 				});
@@ -728,12 +786,13 @@ export async function internal_respond(request, options, manifest, state) {
 			// and I don't even know how to describe it. need to investigate at some point
 
 			// HttpError from endpoint can end up here - TODO should it be handled there instead?
-			return await handle_fatal_error(event, event_state, options, e);
+			return await handle_fatal_error(event, state, options, e);
 		} finally {
 			event.cookies.set = () => {
 				throw new Error('Cannot use `cookies.set(...)` after the response has been generated');
 			};
 
+			// @ts-expect-error this has to be assigned lazily
 			event.setHeaders = () => {
 				throw new Error('Cannot use `setHeaders(...)` after the response has been generated');
 			};