perf(router): resolve cached middleware without async wrappers

Author: chrisbbreuer

storage/framework/core/router/src/stacks-router.ts

@@ -1283,13 +1283,16 @@ function negateMiddleware(name: string, inner: MiddlewareHandler): MiddlewareHan
 /**
  * Load the handler a parsed reference names, negated when it asked to be.
  */
-async function loadParsedMiddleware(parsed: ParsedMiddleware): Promise<MiddlewareHandler | null> {
-  const handler = await loadMiddleware(parsed.name)
-
-  if (!handler || !parsed.negated)
-    return handler
+function loadParsedMiddleware(parsed: ParsedMiddleware): MiddlewareHandler | null | Promise<MiddlewareHandler | null> {
+  // Resolved modules are synchronous values. Keep cached failures as null so
+  // the caller still fails closed, and use the same cache hot reload clears.
+  const cached = middlewareCache.get(parsed.name)
+  if (cached !== undefined)
+    return cached && parsed.negated ? negateMiddleware(parsed.name, cached) : cached
 
-  return negateMiddleware(parsed.name, handler)
+  return loadMiddleware(parsed.name).then(handler =>
+    handler && parsed.negated ? negateMiddleware(parsed.name, handler) : handler,
+  )
 }
 
 /**
@@ -1699,7 +1702,8 @@ function createMiddlewareHandler(routeKey: string, handler: StacksHandler): Rout
           ;enhancedReq._middlewareParams[middlewareName] = params
         }
 
-        const middleware = await loadParsedMiddleware(parsed)
+        const loaded = loadParsedMiddleware(parsed)
+        const middleware = loaded instanceof Promise ? await loaded : loaded
         if (!middleware || typeof middleware.handle !== 'function') {
           // Fail CLOSED. The previous `continue` served the route WITHOUT
           // the middleware — a typo'd `auth` alias silently unprotected the

storage/framework/core/router/tests/middleware-fail-closed.test.ts

@@ -20,6 +20,8 @@
  */
 
 import { afterAll, beforeEach, describe, expect, test } from 'bun:test'
+import { unlinkSync, writeFileSync } from 'node:fs'
+import { appPath } from '@stacksjs/path'
 import { assertRouteMiddlewareResolvable, clearMiddlewareCache, clearRouteMiddlewareRegistry, createStacksRouter, findUnresolvableRouteMiddleware } from '../src/stacks-router'
 
 beforeEach(() => {
@@ -37,6 +39,31 @@ afterAll(() => {
 })
 
 describe('request-time fail-closed', () => {
+  test('a broken middleware stays closed when its failed load is cached', async () => {
+    const name = `BrokenCached${crypto.randomUUID().replaceAll('-', '')}`
+    const file = appPath(`Middleware/${name}.ts`)
+    writeFileSync(file, 'export default {}\n')
+    let handlerRuns = 0
+
+    try {
+      const router = createStacksRouter()
+      router.get('/mw-broken-cached', () => {
+        handlerRuns++
+        return { ok: true }
+      }).middleware(name)
+
+      for (let request = 0; request < 2; request++) {
+        const res = await router.handleRequest(new Request('http://localhost/mw-broken-cached'))
+        expect(res.status).toBe(500)
+        expect(handlerRuns).toBe(0)
+      }
+    }
+    finally {
+      unlinkSync(file)
+      clearMiddlewareCache()
+    }
+  })
+
   test('resolvable alias → middleware runs, handler runs, 200', async () => {
     const router = createStacksRouter()
     let handlerRan = false

storage/framework/core/router/tests/middleware-references.test.ts

@@ -86,6 +86,30 @@ describe('alias lookup happens before the colon is read as a parameter', () => {
 })
 
 describe('negated references', () => {
+  test('warm handlers and reloaded handlers enforce the current request environment', async () => {
+    const previous = config.app.env
+    const router = createStacksRouter()
+    router.get('/mw-cache-prod', () => ({ ok: true })).middleware('env:production')
+    router.get('/mw-cache-not-prod', () => ({ ok: true })).middleware('!env:production')
+
+    try {
+      for (let cycle = 0; cycle < 2; cycle++) {
+        clearMiddlewareCache()
+        for (const env of ['production', 'local', 'production']) {
+          config.app.env = env as typeof config.app.env
+          const allowed = await router.handleRequest(new Request('http://localhost/mw-cache-prod'))
+          const negated = await router.handleRequest(new Request('http://localhost/mw-cache-not-prod'))
+          expect(allowed.status).toBe(env === 'production' ? 200 : 403)
+          expect(negated.status).toBe(env === 'production' ? 403 : 200)
+        }
+      }
+    }
+    finally {
+      config.app.env = previous
+      clearMiddlewareCache()
+    }
+  })
+
   test('!auth passes when auth refuses', async () => {
     const router = createStacksRouter()
     let handlerRan = false