solidjs / solid / 35711298249

74%

main: 89%

push

github

fix(web): carry a live GET grant across a dev-only rebind (#3564) (#3566)

* fix(web): carry a live GET grant across a dev-only rebind (#3564)

Closes #3564.

Under `vite dev` an SSR program reload invalidates every module, but the next `/_server` request re-evaluates only the server module the requested id lives in. `registerServerFunction` sees a fresh callback under a stable, path-derived id and revokes the id's GET grant (#3129), counting on the declaring site re-running `GET()` right after. With a router's `query()` the declaration lives in the data-layer module, which the request does not import, so nothing re-arms the grant: every declared read answers 405 (`Allow: POST`) until the next document render evaluates that module again.

In the dev build a rebind now moves the grant to the new callback when the grant was LIVE at the rebind (`declaresRead(id)`), so the same declaration site keeps its read across a re-evaluation. A stale grant, one whose function the id no longer names, still dies with the rebind, and production builds keep revoking on every rebind, so a different function never inherits a declaration there.

The spec pins the dev carry-over, the stale-grant refusal in dev, and the production revocation against the built bundle.

* fix: address review findings

The dev carry moves a live GET grant to a re-registered callback before
that callback has re-declared it, so under the dev build a cross-site GET
to the rebound id answers 200 and runs the new function where a prod
build answers 403, and a later `GET()` on a reference from the earlier
evaluation throws the rebind error where the id used to answer 405. The
runtime cannot tell that sequence from a rebind whose declaration never
comes, so the carry either has to go or has to stop exempting the origin
gate; that choice is left to a maintainer and the source is unchanged.

The dev rebind spec now sends the cross-site request a hostile page can
cause for a rebind that never re-declare... (continued)

550 of 818 branches covered (67.24%)

Branch coverage included in aggregate %.

824 of 1070 relevant lines covered (77.01%)

17.38 hits per line