Conversation
…ult in RPCHandler GetMethodGuardPlugin -> StrictGetMethodPlugin
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
WalkthroughThis change rebrands the "GET method guard" as the "Strict GET method" across documentation, tests, and code. Updates focus on replacing sidebar entries in the VitePress config, adjusting documentation to clarify default behavior in the RPC protocol, and modifying adapter initialization logic to call a new default options initializer. Additionally, tests are updated and expanded to verify the initialization of the strict GET method plugin, and exports in the plugins module have been replaced accordingly. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant RPCHandler
participant InitOptions
participant StrictPlugin
Client->>RPCHandler: new RPCHandler(options)
RPCHandler->>InitOptions: initDefaultStandardRPCHandlerOptions(options)
alt strictGetMethodPluginEnabled true (default)
InitOptions->>StrictPlugin: create instance of StrictGetMethodPlugin
StrictPlugin-->>RPCHandler: Plugin added to options
else strictGetMethodPluginEnabled false
InitOptions-->>RPCHandler: Skip adding plugin
end
RPCHandler->>RPCHandler: Continue initialization
Possibly related PRs
Poem
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
More templates
@orpc/arktype
@orpc/client
@orpc/contract
@orpc/openapi
@orpc/openapi-client
@orpc/react-query
@orpc/react
@orpc/server
@orpc/shared
@orpc/solid-query
@orpc/standard-server
@orpc/standard-server-fetch
@orpc/standard-server-node
@orpc/svelte-query
@orpc/valibot
@orpc/vue-colada
@orpc/vue-query
@orpc/zod
commit: |
Codecov ReportAll modified and coverable lines are covered by tests ✅ 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
packages/server/src/adapters/fetch/body-limit-plugin.test.ts (3)
23-27: Consider consistent configuration approach across all handler initializationsWhile this test case uses a POST request that wouldn't be affected by the
StrictGetMethodPlugin, for consistency in testing, consider adding the same configuration object to allRPCHandlerinitializations in this file.const handler = new RPCHandler(os.handler(() => 'ping'), { + strictGetMethodPluginEnabled: false, plugins: [ new BodyLimitPlugin({ maxBodySize: 22 }), ], })
42-46: Consider consistent configuration approach across all handler initializationsFor consistency with other test cases, consider adding the
strictGetMethodPluginEnabled: falseconfiguration here as well.const handler = new RPCHandler(os.handler(() => 'ping'), { + strictGetMethodPluginEnabled: false, plugins: [ new BodyLimitPlugin({ maxBodySize: 21 }), ], })
60-64: Consider consistent configuration approach across all handler initializationsFor consistency with other test cases, consider adding the
strictGetMethodPluginEnabled: falseconfiguration here as well.const handler = new RPCHandler(os.handler(() => 'ping'), { + strictGetMethodPluginEnabled: false, plugins: [ new BodyLimitPlugin({ maxBodySize: 21 }), ], })
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
packages/client/src/adapters/fetch/rpc-link.test.ts(2 hunks)packages/server/src/adapters/fetch/body-limit-plugin.test.ts(1 hunks)packages/server/src/adapters/fetch/rpc-handler.test.ts(1 hunks)packages/server/src/adapters/fetch/rpc-handler.ts(1 hunks)packages/server/src/adapters/node/rpc-handler.test.ts(1 hunks)packages/server/src/adapters/node/rpc-handler.ts(1 hunks)packages/server/src/adapters/standard/rpc-handler.test.ts(1 hunks)packages/server/src/adapters/standard/rpc-handler.ts(1 hunks)packages/server/src/plugins/simple-csrf-protection.test.ts(2 hunks)
🚧 Files skipped from review as they are similar to previous changes (4)
- packages/server/src/adapters/fetch/rpc-handler.ts
- packages/server/src/adapters/fetch/rpc-handler.test.ts
- packages/server/src/adapters/node/rpc-handler.ts
- packages/server/src/adapters/standard/rpc-handler.test.ts
🧰 Additional context used
🧬 Code Graph Analysis (1)
packages/server/src/adapters/standard/rpc-handler.ts (3)
packages/server/src/context.ts (1)
Context(1-1)packages/server/src/adapters/standard/handler.ts (1)
StandardHandlerOptions(25-47)packages/server/src/plugins/strict-get-method.ts (1)
StrictGetMethodPlugin(17-56)
🔇 Additional comments (9)
packages/server/src/adapters/node/rpc-handler.test.ts (1)
8-10: Configuration update aligns with new default plugin behaviorThe addition of
strictGetMethodPluginEnabled: falseto theRPCHandlerconstructor indicates that the renamedStrictGetMethodPluginis now enabled by default, which matches the PR objective of enabling it by default in theRPCHandler. This configuration is necessary as the test uses a GET request that would otherwise be blocked by the enabled plugin.packages/server/src/adapters/fetch/body-limit-plugin.test.ts (1)
9-10: Configuration only disabled for the GET request test caseThe
strictGetMethodPluginEnabled: falseconfiguration is correctly added to this test case which uses a GET request that would be blocked by the default-enabled plugin.packages/server/src/plugins/simple-csrf-protection.test.ts (2)
12-20: Configuration update aligns with new default plugin behaviorThe addition of
strictGetMethodPluginEnabled: falseis appropriate as the tests in this file use GET requests that would otherwise be blocked by the default-enabledStrictGetMethodPlugin. This allows the tests to focus specifically on CSRF protection functionality.
62-69: Configuration consistently applied to all handler initializationsGood job maintaining consistency by adding the
strictGetMethodPluginEnabled: falseconfiguration to this handler initialization as well, which follows the same pattern as the main handler in this file.packages/client/src/adapters/fetch/rpc-link.test.ts (2)
16-18: Configuration update aligns with new default plugin behaviorThe addition of
strictGetMethodPluginEnabled: falseis necessary as the test suite runs tests with both GET and POST methods, and the GET tests would be blocked by the default-enabledStrictGetMethodPlugin. This change ensures the tests can continue to function as expected while the plugin is enabled by default in production code.
50-52: Configuration consistently applied to all handler initializationsGood job maintaining consistency by adding the
strictGetMethodPluginEnabled: falseconfiguration to this handler initialization as well, which follows the same pattern as in theassertSuccessCasefunction.packages/server/src/adapters/standard/rpc-handler.ts (3)
9-16: Interface looks good with clear documentationThe addition of the
strictGetMethodPluginEnabledoption is well-documented with a clear JSDoc comment that includes the default value. The interface properly extends bothStandardHandlerOptionsandStandardRPCJsonSerializerOptions.
18-35: Implementation correctly enables StrictGetMethodPlugin by defaultThe
StandardRPCHandlerclass implementation properly initializes the options and conditionally adds theStrictGetMethodPluginwhen enabled (which is the default behavior). The initialization sequence is correct, with all dependencies properly set up before calling the parent constructor.
22-26: Security enhancement with StrictGetMethodPlugin enabled by defaultEnabling the
StrictGetMethodPluginby default is a good security practice as it restricts which procedures can be called via GET requests. This helps prevent potential security issues like CSRF attacks or unintended side effects from GET requests.
1 participant
GetMethodGuardPlugin -> StrictGetMethodPlugin
Summary by CodeRabbit
Documentation
Enhancements
Tests