[PR #188] [MERGED] Fix Pages prod middleware named proxy export resolution #375

New issue

Closed

opened 2026-05-06 12:39:29 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:29 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/188
Author: @pomarie
Created: 2/28/2026
Status: ✅ Merged
Merged: 2/28/2026
Merged by: @southpolesteve

Base: main ← Head: fix/proxy-named-export-pages-prod

📝 Commits (2)

f25d59a fix pages prod middleware named proxy export
2a7ecc5 remove security remediation report from PR

📊 Changes

5 files changed (+162 additions, -4 deletions)

View changed files

📝 packages/vinext/src/index.ts (+1 -1)
📝 packages/vinext/src/server/middleware.ts (+2 -2)
📝 tests/app-router.test.ts (+7 -1)
📝 tests/pages-router.test.ts (+128 -0)
📝 tests/shims.test.ts (+24 -0)

📄 Description

summary

we found a production-only mismatch in how vinext runs proxy.ts for Pages Router apps.

if an app exported proxy.ts as export function proxy(...) (named export), the generated production middleware runner ignored it and acted like no middleware existed. this means requests could continue straight to routes that were expected to be gated by proxy logic.

why this is a problem

teams commonly put auth/authz checks in proxy.ts (redirect unauthenticated users, block private paths, tenant checks, etc).

before this fix, those checks could silently not run in Pages production output when using named proxy. that is teh dangerous part: no crash, just skipped protection.

why lowercase `proxy`

we resolve the export by exact name, and JavaScript export names are case-sensitive. Next.js 16 also documents/uses proxy in lowercase. so proxy must be matched exactly; Proxy or PROXY are different identifiers.

what changed

fixed generated Pages production resolver to use: default || proxy || middleware
updated middleware warning/docs text to mention named proxy support
added regression tests for:
- named proxy execution in generated Pages prod entry
- export precedence (default > proxy > middleware)
- codegen assertion coverage in app-router test suite

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/188 **Author:** [@pomarie](https://github.com/pomarie) **Created:** 2/28/2026 **Status:** ✅ Merged **Merged:** 2/28/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/proxy-named-export-pages-prod` --- ### 📝 Commits (2) - [`f25d59a`](https://github.com/cloudflare/vinext/commit/f25d59a03ee19434a1baa69f7e37f20b1e417dc9) fix pages prod middleware named proxy export - [`2a7ecc5`](https://github.com/cloudflare/vinext/commit/2a7ecc51837e77be9f0ff8ff42e17890f3d33eac) remove security remediation report from PR ### 📊 Changes **5 files changed** (+162 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/index.ts` (+1 -1) 📝 `packages/vinext/src/server/middleware.ts` (+2 -2) 📝 `tests/app-router.test.ts` (+7 -1) 📝 `tests/pages-router.test.ts` (+128 -0) 📝 `tests/shims.test.ts` (+24 -0) </details> ### 📄 Description ## summary we found a production-only mismatch in how vinext runs `proxy.ts` for Pages Router apps. if an app exported `proxy.ts` as `export function proxy(...)` (named export), the generated production middleware runner ignored it and acted like no middleware existed. this means requests could continue straight to routes that were expected to be gated by proxy logic. ## why this is a problem teams commonly put auth/authz checks in `proxy.ts` (redirect unauthenticated users, block private paths, tenant checks, etc). before this fix, those checks could silently not run in Pages production output when using named `proxy`. that is teh dangerous part: no crash, just skipped protection. ## why lowercase `proxy` we resolve the export by exact name, and JavaScript export names are case-sensitive. Next.js 16 also documents/uses `proxy` in lowercase. so `proxy` must be matched exactly; `Proxy` or `PROXY` are different identifiers. ## what changed - fixed generated Pages production resolver to use: `default || proxy || middleware` - updated middleware warning/docs text to mention named `proxy` support - added regression tests for: - named `proxy` execution in generated Pages prod entry - export precedence (`default > proxy > middleware`) - codegen assertion coverage in app-router test suite --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>