From 64a279f7f92dcd4855af83fcbb09ea5ba1521ee8 Mon Sep 17 00:00:00 2001
From: Tee Ming <chewteeming01@gmail.com>
Date: Fri, 3 Feb 2023 18:48:05 +0800
Subject: [PATCH] fix: initialise state.initiator for render_endpoint() (#8869)

ensure endpoints can fetch endpoints on the same host but not part of the application
fixes #8851
---
 .changeset/slimy-donkeys-itch.md                      |  5 +++++
 packages/kit/src/runtime/server/endpoint.js           |  5 ++++-
 packages/kit/src/runtime/server/respond.js            |  2 +-
 .../prerendered-endpoint/proxy/+server.js             |  3 +++
 packages/kit/test/apps/basics/test/server.test.js     | 11 +++++++++++
 5 files changed, 24 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/slimy-donkeys-itch.md
 create mode 100644 packages/kit/test/apps/basics/src/routes/prerendering/prerendered-endpoint/proxy/+server.js

diff --git a/.changeset/slimy-donkeys-itch.md b/.changeset/slimy-donkeys-itch.md
new file mode 100644
index 000000000000..01aa7b70c507
--- /dev/null
+++ b/.changeset/slimy-donkeys-itch.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: ensure endpoints can fetch endpoints on the same host but not part of the application
diff --git a/packages/kit/src/runtime/server/endpoint.js b/packages/kit/src/runtime/server/endpoint.js
index fcce53a98324..571080368670 100644
--- a/packages/kit/src/runtime/server/endpoint.js
+++ b/packages/kit/src/runtime/server/endpoint.js
@@ -4,11 +4,12 @@ import { method_not_allowed } from './utils.js';
 
 /**
  * @param {import('types').RequestEvent} event
+ * @param {import('types').SSRRoute} route
  * @param {import('types').SSREndpoint} mod
  * @param {import('types').SSRState} state
  * @returns {Promise<Response>}
  */
-export async function render_endpoint(event, mod, state) {
+export async function render_endpoint(event, route, mod, state) {
 	const method = /** @type {import('types').HttpMethod} */ (event.request.method);
 
 	let handler = mod[method];
@@ -38,6 +39,8 @@ export async function render_endpoint(event, mod, state) {
 		}
 	}
 
+	state.initiator = route;
+
 	try {
 		const response = await handler(
 			/** @type {import('types').RequestEvent<Record<string, any>>} */ (event)
diff --git a/packages/kit/src/runtime/server/respond.js b/packages/kit/src/runtime/server/respond.js
index 7b228363024b..658b9b25d801 100644
--- a/packages/kit/src/runtime/server/respond.js
+++ b/packages/kit/src/runtime/server/respond.js
@@ -358,7 +358,7 @@ export async function respond(request, options, manifest, state) {
 						trailing_slash ?? 'never'
 					);
 				} else if (route.endpoint && (!route.page || is_endpoint_request(event))) {
-					response = await render_endpoint(event, await route.endpoint(), state);
+					response = await render_endpoint(event, route, await route.endpoint(), state);
 				} else if (route.page) {
 					response = await render_page(
 						event,
diff --git a/packages/kit/test/apps/basics/src/routes/prerendering/prerendered-endpoint/proxy/+server.js b/packages/kit/test/apps/basics/src/routes/prerendering/prerendered-endpoint/proxy/+server.js
new file mode 100644
index 000000000000..59396b64d3ad
--- /dev/null
+++ b/packages/kit/test/apps/basics/src/routes/prerendering/prerendered-endpoint/proxy/+server.js
@@ -0,0 +1,3 @@
+export async function GET({ fetch }) {
+	return await fetch('/prerendering/prerendered-endpoint/api');
+}
diff --git a/packages/kit/test/apps/basics/test/server.test.js b/packages/kit/test/apps/basics/test/server.test.js
index a375d7621faf..cad3f9f88fd6 100644
--- a/packages/kit/test/apps/basics/test/server.test.js
+++ b/packages/kit/test/apps/basics/test/server.test.js
@@ -97,6 +97,17 @@ test.describe('Endpoints', () => {
 		expect(headers.head).toEqual(headers.get);
 	});
 
+	test('Prerendered +server.js called from a non-prerendered +server.js works', async ({
+		baseURL
+	}) => {
+		const res = await fetch(`${baseURL}/prerendering/prerendered-endpoint/proxy`);
+
+		expect(res.status).toBe(200);
+		expect(await res.json()).toStrictEqual({
+			message: 'Im prerendered and called from a non-prerendered +page.server.js'
+		});
+	});
+
 	// TODO all the remaining tests in this section are really only testing
 	// setResponse, since we're not otherwise changing anything on the response.
 	// might be worth making these unit tests instead