test(event): cover shared _url normalization semantics

pi0 · claude · pi0 · commit 4a218a83bd97 · 2026-07-03T22:06:22.000Z
Pins three behaviors around the in-place percent-decode of req._url: decodePathname is idempotent so repeated H3Event construction on a shared _url never double-decodes, requestWithURL shadows the parsed _url (unit-level companion to d21d93c), and srvx NodeRequestURL writes the normalized pathname back to the raw Node req.url (e2e). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
diff --git a/test/event.test.ts b/test/event.test.ts
@@ -93,6 +93,23 @@ describeMatrix("event", (t, { it, expect }) => {
     expect(await result.text()).toBe("200");
   });
 
+  it("normalizes percent-encoded pathname and syncs the raw node url", async () => {
+    t.app.all("/*", (event) => ({
+      pathname: event.url.pathname,
+      rawNodeUrl: event.runtime?.node?.req?.url ?? null,
+    }));
+    const res = await t.fetch("/h%65llo?q=%41");
+    const body = await res.json();
+    expect(body.pathname).toBe("/hello");
+    if (t.target === "node") {
+      // srvx NodeRequestURL writes pathname mutations back to the raw
+      // Node request; the search string must stay untouched
+      expect(body.rawNodeUrl).toBe("/hello?q=%41");
+    } else {
+      expect(body.rawNodeUrl).toBe(null);
+    }
+  });
+
   it("event.waitUntil", () => {
     const event = mockEvent("/");
     event.req.waitUntil = vi.fn();
diff --git a/test/unit/event.test.ts b/test/unit/event.test.ts
@@ -0,0 +1,41 @@
+import { describe, it, expect } from "vitest";
+import { FastURL } from "srvx";
+import { H3Event } from "../../src/event.ts";
+import { decodePathname } from "../../src/utils/internal/path.ts";
+
+describe("H3Event URL normalization", () => {
+  it("reuses the runtime-provided _url object in place", () => {
+    const req = new Request("http://localhost/h%65llo");
+    (req as any)._url = new FastURL("http://localhost/h%65llo");
+    const event = new H3Event(req);
+    expect(event.url).toBe((req as any)._url);
+    expect(event.url.pathname).toBe("/hello");
+  });
+
+  it("does not double-decode when two events share one _url", () => {
+    const href = "http://localhost/a%2541-%41";
+    const req = new Request(href);
+    (req as any)._url = new FastURL(href);
+    const first = new H3Event(req);
+    expect(first.url.pathname).toBe("/a%2541-A");
+    const second = new H3Event(req);
+    expect(second.url).toBe(first.url);
+    expect(second.url.pathname).toBe("/a%2541-A");
+  });
+});
+
+describe("decodePathname", () => {
+  it("is idempotent", () => {
+    for (const input of [
+      "/a%41b",
+      "/a%2541", // encoded % must stay encoded, never becoming decodable
+      "/%2525",
+      "/a%2Fb", // reserved chars stay encoded
+      "/caf%C3%A9",
+      "/plain",
+    ]) {
+      const once = decodePathname(input);
+      expect(decodePathname(once)).toBe(once);
+    }
+  });
+});
diff --git a/test/unit/request.test.ts b/test/unit/request.test.ts
@@ -35,6 +35,13 @@ describe("requestWithURL", () => {
     expect(proxied.headers.get("x-test")).toBe("value");
   });
 
+  it("shadows the runtime-parsed _url of the source request", () => {
+    const target = new Request("http://example.com/base/path");
+    (target as any)._url = new URL("http://example.com/base/path");
+    const proxied = requestWithURL(target, "http://example.com/path");
+    expect((proxied as any)._url).toBeUndefined();
+  });
+
   it("is instanceof Request", () => {
     const proxied = requestWithURL(original, "http://example.com/path");
     expect(proxied instanceof Request).toBe(true);
