Skip to content

fix: always run basicAuth route rule first#4204

Merged
pi0 merged 4 commits into
mainfrom
fix/basic-auth-route-rule
Apr 14, 2026
Merged

fix: always run basicAuth route rule first#4204
pi0 merged 4 commits into
mainfrom
fix/basic-auth-route-rule

Conversation

@pi0

@pi0 pi0 commented Apr 14, 2026

Copy link
Copy Markdown
Member

This PR makes sure basicAuth route rule (first introduced via #4049 in v3.0.260311-beta) always runs first before others like proxy, etc.

@vercel

vercel Bot commented Apr 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nitro.build Ready Ready Preview, Comment Apr 14, 2026 9:17pm

Request Review

@coderabbitai

coderabbitai Bot commented Apr 14, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9613b6b7-ecbb-41f0-9eee-c210201f0b34

📥 Commits

Reviewing files that changed from the base of the PR and between afa764b and c1dee18.

📒 Files selected for processing (1)
  • src/runtime/internal/route-rules.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • src/runtime/internal/route-rules.ts

📝 Walkthrough

Walkthrough

Deterministically orders route rules by an optional numeric order on rule handlers before building middleware; extends rule handler types to carry order; sets basicAuth.order = -1; adds fixtures and tests for basic-auth-on-secure-subpaths; updates Netlify/Vercel preset snapshots to include the new redirect entry.

Changes

Cohort / File(s) Summary
Route rule sorting & type
src/runtime/internal/app.ts, src/types/route-rules.ts
Sort route rules by handler.order (default 0) when constructing middleware; widen MatchedRouteRule.handler type to allow a static order?: number.
basicAuth rule ordering
src/runtime/internal/route-rules.ts
Export basicAuth with an attached order: -1 property so it executes before other rules (e.g., redirect/proxy).
Tests, fixtures & presets
test/fixture/nitro.config.ts, test/tests.ts, test/presets/netlify.test.ts, test/presets/vercel.test.ts
Add route-rule fixtures for basic-auth+redirect/proxy secure subpaths and tests asserting 401 responses; update preset snapshots to include the new redirect rule and formatting changes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title 'fix: always run basicAuth route rule first' follows conventional commits format (fix: prefix) and clearly describes the main change (ensuring basicAuth runs before other route rules).
Description check ✅ Passed The description is directly related to the changeset, explaining that basicAuth route rule now runs first before others like proxy, matching the actual implementation changes across multiple files.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/basic-auth-route-rule

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
src/runtime/internal/route-rules.ts (1)

93-96: Consider trimming the new explanatory comment block.

These lines mostly restate behavior already captured by RouteRuleOrder and test coverage.

As per coding guidelines "Do not add comments explaining what the line does unless prompted."

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/runtime/internal/route-rules.ts` around lines 93 - 96, Remove or shorten
the explanatory comment block above RouteRuleOrder in route-rules.ts so it
doesn't restate behavior already captured by the enum and tests; keep only a
concise one-line note (if any) that clarifies the ordering intent (e.g.,
"Execution order for route rule middleware; lower runs first") and remove the
extra sentence about basicAuth ordering since that logic is enforced by
RouteRuleOrder and covered by tests (refer to the RouteRuleOrder symbol to
locate the code).
src/types/route-rules.ts (1)

37-40: MatchedRouteRule.order is currently dead API surface.

getRouteRules() in src/runtime/internal/app.ts orders middleware via RouteRuleOrder[rule.name] and never consults this field, so type/API and runtime behavior can diverge. Consider removing order for now or wiring it into the comparator.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/types/route-rules.ts` around lines 37 - 40, MatchedRouteRule.order is
unused at runtime; update getRouteRules in src/runtime/internal/app.ts to
consult MatchedRouteRule.order when sorting instead of only using
RouteRuleOrder[rule.name]. Change the comparator in getRouteRules to compute
each rule's sort key as (rule.order ?? RouteRuleOrder[rule.name] ?? 0) so
explicit per-rule order overrides the lookup, and leave the type
MatchedRouteRule.order in src/types/route-rules.ts as-is; ensure comparison
remains stable for equal keys.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/runtime/internal/route-rules.ts`:
- Around line 93-96: Remove or shorten the explanatory comment block above
RouteRuleOrder in route-rules.ts so it doesn't restate behavior already captured
by the enum and tests; keep only a concise one-line note (if any) that clarifies
the ordering intent (e.g., "Execution order for route rule middleware; lower
runs first") and remove the extra sentence about basicAuth ordering since that
logic is enforced by RouteRuleOrder and covered by tests (refer to the
RouteRuleOrder symbol to locate the code).

In `@src/types/route-rules.ts`:
- Around line 37-40: MatchedRouteRule.order is unused at runtime; update
getRouteRules in src/runtime/internal/app.ts to consult MatchedRouteRule.order
when sorting instead of only using RouteRuleOrder[rule.name]. Change the
comparator in getRouteRules to compute each rule's sort key as (rule.order ??
RouteRuleOrder[rule.name] ?? 0) so explicit per-rule order overrides the lookup,
and leave the type MatchedRouteRule.order in src/types/route-rules.ts as-is;
ensure comparison remains stable for equal keys.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 609e80cb-6a78-4c13-8536-29d2a4247a15

📥 Commits

Reviewing files that changed from the base of the PR and between 039bc3f and dc25539.

📒 Files selected for processing (5)
  • src/runtime/internal/app.ts
  • src/runtime/internal/route-rules.ts
  • src/types/route-rules.ts
  • test/fixture/nitro.config.ts
  • test/tests.ts

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
src/runtime/internal/route-rules.ts (1)

86-87: Remove the explanatory inline comment block.

The added comment explains behavior rather than encoding intent in code/tests, which conflicts with this repo’s style rule.

As per coding guidelines src/**/*.{ts,js}: “Do not add comments explaining what the line does unless prompted”.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/runtime/internal/route-rules.ts` around lines 86 - 87, Remove the
explanatory inline comment block that begins "// Must run before
`redirect`/`proxy`/`cache`..." in route-rules.ts; instead encode the behavior
via tests or explicit code assertions (e.g., add a unit/integration test or an
ordering constant) so intent is enforced in code, not explained by a comment.
Locate the comment near the routing rules/middleware ordering setup in
route-rules.ts (the section that references redirect/proxy/cache) and delete it,
and if needed add a test or an ordering constant to ensure unauthorized requests
are processed before redirect/proxy/cache.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/runtime/internal/route-rules.ts`:
- Around line 86-87: Remove the explanatory inline comment block that begins "//
Must run before `redirect`/`proxy`/`cache`..." in route-rules.ts; instead encode
the behavior via tests or explicit code assertions (e.g., add a unit/integration
test or an ordering constant) so intent is enforced in code, not explained by a
comment. Locate the comment near the routing rules/middleware ordering setup in
route-rules.ts (the section that references redirect/proxy/cache) and delete it,
and if needed add a test or an ordering constant to ensure unauthorized requests
are processed before redirect/proxy/cache.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9a3be77d-4b94-47b1-a1c2-2f41022707c2

📥 Commits

Reviewing files that changed from the base of the PR and between dc25539 and afa764b.

📒 Files selected for processing (5)
  • src/runtime/internal/app.ts
  • src/runtime/internal/route-rules.ts
  • src/types/route-rules.ts
  • test/presets/netlify.test.ts
  • test/presets/vercel.test.ts
✅ Files skipped from review due to trivial changes (1)
  • src/runtime/internal/app.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • src/types/route-rules.ts

@pkg-pr-new

pkg-pr-new Bot commented Apr 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4204

commit: c1dee18

@pi0
pi0 merged commit 84c94cf into main Apr 14, 2026
12 checks passed
@pi0
pi0 deleted the fix/basic-auth-route-rule branch April 14, 2026 21:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant