rwsdk 1.0.4 → 1.0.5

package/dist/runtime/lib/router.js

@@ -206,7 +206,6 @@ export function defineRoutes(routes) {
                 throw error;
             }
             // --- Main flow ---
-            let firstRouteDefinitionEncountered = false;
             let actionHandled = false;
             const handleAction = async () => {
                 // Handle RSC actions once per request, based on the incoming URL.
@@ -241,17 +240,6 @@ export function defineRoutes(routes) {
                         currentRouteIndex++;
                         continue;
                     }
-                    // This is a RouteDefinition (route.type === "definition").
-                    // The first time we see one, we handle any RSC actions.
-                    if (!firstRouteDefinitionEncountered) {
-                        firstRouteDefinitionEncountered = true;
-                        try {
-                            await handleAction();
-                        }
-                        catch (error) {
-                            return await executeExceptHandlers(error, currentRouteIndex);
-                        }
-                    }
                     let params = null;
                     if (route.isStatic) {
                         if (route.path === path) {
@@ -310,6 +298,9 @@ export function defineRoutes(routes) {
                                     return handled;
                                 }
                             }
+                            // All global and route-specific middlewares have run, so it's
+                            // safe to handle any pending RSC action before rendering.
+                            await handleAction();
                             // Final component/handler
                             if (isRouteComponent(componentHandler)) {
                                 const requestInfo = getRequestInfo();
@@ -365,14 +356,13 @@ Route handlers must return one of:
                     }
                 }
                 // If we've gotten this far, no route was matched.
-                // We still need to handle a possible action if the app has no route definitions at all.
-                if (!firstRouteDefinitionEncountered) {
-                    try {
-                        await handleAction();
-                    }
-                    catch (error) {
-                        return await executeExceptHandlers(error, compiledRoutes.length - 1);
-                    }
+                // All global middlewares have already executed, so it's safe to handle
+                // any pending RSC action before returning the 404 response.
+                try {
+                    await handleAction();
+                }
+                catch (error) {
+                    return await executeExceptHandlers(error, compiledRoutes.length - 1);
                 }
                 return new Response("Not Found", { status: 404 });
             }

package/dist/runtime/lib/router.test.js

@@ -404,7 +404,7 @@ describe("defineRoutes - Request Handling Behavior", () => {
         });
     });
     describe("RSC Action Handling", () => {
-        it("should handle RSC actions before the first route definition", async () => {
+        it("should handle RSC actions after global middleware but before page rendering", async () => {
             const executionOrder = [];
             const middleware1 = (requestInfo) => {
                 executionOrder.push("middleware1");
@@ -473,6 +473,96 @@ describe("defineRoutes - Request Handling Behavior", () => {
             expect(executionOrder).toEqual(["rscActionHandler", "PageComponent2"]);
             // Should only call action handler once, even though there are multiple routes
         });
+        // Regression test for issue #1110:
+        // When a route definition appears before global middleware in the flattened
+        // route list (e.g. an API route defined before a session-setup middleware),
+        // the RSC action handler was incorrectly fired at the first route definition
+        // encountered – before those later middlewares had run. Interruptors
+        // (registered via serverAction/serverQuery) execute inside rscActionHandler,
+        // so they would see an incomplete request context (e.g. ctx.user not yet set).
+        it("should run all global middleware before rscActionHandler even when a route definition appears first", async () => {
+            const executionOrder = [];
+            // A route definition that appears BEFORE global middleware
+            const apiRoute = route("/api/data/", async () => new Response(JSON.stringify({ data: "ok" })));
+            // Global middleware that sets up context (e.g. session / auth)
+            const globalMiddleware = async (requestInfo) => {
+                executionOrder.push("globalMiddleware");
+                requestInfo.ctx.user = { id: 1 };
+            };
+            const PageComponent = () => {
+                executionOrder.push("PageComponent");
+                return React.createElement("div", {}, "Page");
+            };
+            const router = defineRoutes([
+                apiRoute,
+                globalMiddleware, // global middleware defined AFTER a route definition
+                route("/test/", PageComponent),
+            ]);
+            const deps = createMockDependencies();
+            deps.mockRequestInfo.request = new Request("http://localhost:3000/test/?__rsc_action_id=test");
+            deps.mockRscActionHandler = async (request) => {
+                executionOrder.push("rscActionHandler");
+                return { actionResult: "test-result" };
+            };
+            const request = new Request("http://localhost:3000/test/?__rsc_action_id=test");
+            await router.handle({
+                request,
+                renderPage: deps.mockRenderPage,
+                getRequestInfo: deps.getRequestInfo,
+                onError: deps.onError,
+                runWithRequestInfoOverrides: deps.mockRunWithRequestInfoOverrides,
+                rscActionHandler: deps.mockRscActionHandler,
+            });
+            // globalMiddleware must complete before rscActionHandler runs so that
+            // interruptors inside the action have access to ctx.user.
+            expect(executionOrder).toEqual([
+                "globalMiddleware",
+                "rscActionHandler",
+                "PageComponent",
+            ]);
+        });
+        it("should handle RSC actions after route-specific middleware", async () => {
+            const executionOrder = [];
+            const globalMiddleware = async (requestInfo) => {
+                executionOrder.push("globalMiddleware");
+                requestInfo.ctx.user = { id: 1 };
+            };
+            const requireAdmin = async (requestInfo) => {
+                executionOrder.push("requireAdmin");
+                if (!requestInfo.ctx.user?.isAdmin) {
+                    return new Response("Forbidden", { status: 403 });
+                }
+            };
+            const AdminPage = () => {
+                executionOrder.push("AdminPage");
+                return React.createElement("div", {}, "Admin");
+            };
+            const router = defineRoutes([
+                globalMiddleware,
+                route("/admin/", [requireAdmin, AdminPage]),
+            ]);
+            const deps = createMockDependencies();
+            deps.mockRequestInfo.request = new Request("http://localhost:3000/admin/?__rsc_action_id=test");
+            deps.mockRscActionHandler = async (request) => {
+                executionOrder.push("rscActionHandler");
+                return { actionResult: "test-result" };
+            };
+            const request = new Request("http://localhost:3000/admin/?__rsc_action_id=test");
+            const response = await router.handle({
+                request,
+                renderPage: deps.mockRenderPage,
+                getRequestInfo: deps.getRequestInfo,
+                onError: deps.onError,
+                runWithRequestInfoOverrides: deps.mockRunWithRequestInfoOverrides,
+                rscActionHandler: deps.mockRscActionHandler,
+            });
+            // requireAdmin should short-circuit before the action runs
+            expect(executionOrder).toEqual([
+                "globalMiddleware",
+                "requireAdmin",
+            ]);
+            expect(response.status).toBe(403);
+        });
     });
     describe("Page Route Matching and Rendering", () => {
         it("should match the first route that matches the path", async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rwsdk",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Build fast, server-driven webapps on Cloudflare with SSR, RSC, and realtime",
   "type": "module",
   "bin": {
@@ -154,7 +154,7 @@
   "license": "MIT",
   "dependencies": {
     "@ast-grep/napi": "~0.41.0",
-    "@cloudflare/workers-types": "~4.20260307.1",
+    "@cloudflare/workers-types": "~4.20260331.1",
     "@mdx-js/mdx": "~3.1.1",
     "@puppeteer/browsers": "~2.13.0",
     "@types/decompress": "~4.2.7",
@@ -172,11 +172,11 @@
     "execa": "~9.6.1",
     "find-up": "~8.0.0",
     "fs-extra": "~11.3.4",
-    "get-port": "^7.1.0",
+    "get-port": "^7.2.0",
     "glob": "~13.0.6",
     "ignore": "~7.0.5",
     "jsonc-parser": "~3.3.1",
-    "kysely": "~0.28.12",
+    "kysely": "~0.28.15",
     "kysely-do": "~0.0.1-rc.1",
     "lodash": "~4.17.23",
     "magic-string": "~0.30.21",
@@ -199,13 +199,14 @@
     "react-dom": ">=19.2.0-0 <19.3.0 || >=19.3.0-0 <20.0.0",
     "react-server-dom-webpack": ">=19.2.0-0 <19.3.0 || >=19.3.0-0 <20.0.0",
     "vite": "^6.2.6 || 7.x",
-    "wrangler": "^4.71.0"
+    "wrangler": "^4.77.0"
   },
   "packageManager": "pnpm@10.31.0",
   "devDependencies": {
-    "@cloudflare/vite-plugin": "1.26.1",
+    "@cloudflare/vite-plugin": "1.30.1",
+    "wrangler": "^4.77.0",
     "capnweb": "~0.5.0",
-    "@types/debug": "~4.1.12",
+    "@types/debug": "~4.1.13",
     "@types/js-beautify": "~1.14.3",
     "@types/lodash": "~4.17.24",
     "@types/node": "~25.3.5",
@@ -213,8 +214,8 @@
     "js-beautify": "~1.15.4",
     "semver": "~7.7.4",
     "tsx": "~4.21.0",
-    "typescript": "~5.9.3",
+    "typescript": "~6.0.2",
     "vite": "~7.3.1",
-    "vitest": "~4.0.18"
+    "vitest": "~4.1.2"
   }
 }