Merge branch 'main' into arena/019f6307-astro

Author: kariitsme

.changeset/green-clocks-greet.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes dev server returning 404 for `?url` imported assets when accessed via browser navigation

packages/astro/src/assets/fonts/infra/fs-font-file-content-resolver.ts

@@ -17,10 +17,11 @@ export class FsFontFileContentResolver implements FontFileContentResolver {
 			return url;
 		}
 		try {
-			// We use the url and the file content for the id generation because:
-			// - The URL is not hashed unlike remote providers
-			// - A font file can renamed and swapped so we would incorrectly cache it
-			return url + this.#readFileSync(url);
+			// We only use the file content for the id generation to ensure
+			// deterministic output filenames regardless of the project's location
+			// on disk. The absolute path is excluded so that the same font file
+			// produces the same hash across different checkout directories.
+			return this.#readFileSync(url);
 		} catch (cause) {
 			throw new AstroError(AstroErrorData.UnknownFilesystemError, { cause });
 		}

packages/astro/src/vite-plugin-astro-server/route-guard.ts

@@ -112,9 +112,11 @@ export function routeGuardMiddleware(settings: AstroSettings): vite.Connect.Next
 			return next();
 		}
 
+		const resolved = new URL('.' + pathname, config.root);
 		const fsInfo: RouteGuardFsInfo = {
-			existsInPublic: fs.existsSync(new URL('.' + pathname, config.publicDir)),
-			existsInSrc: fs.existsSync(new URL('.' + pathname, config.srcDir)),
+			existsInPublic:
+				resolved.pathname.startsWith(config.publicDir.pathname) && fs.existsSync(resolved),
+			existsInSrc: resolved.pathname.startsWith(config.srcDir.pathname) && fs.existsSync(resolved),
 			existsAtRootAsFile: false,
 		};
 

packages/astro/test/units/assets/fonts/infra.test.ts

@@ -767,12 +767,12 @@ describe('fonts infra', () => {
 			assert.equal(fontFileIdContentResolver.resolve(url), url);
 		});
 
-		it('returns url and content when absolute', () => {
+		it('returns content only when absolute', () => {
 			const url = fileURLToPath(new URL(import.meta.url));
 			const fontFileIdContentResolver = new FsFontFileContentResolver({
 				readFileSync: () => 'content',
 			});
-			assert.equal(fontFileIdContentResolver.resolve(url), url + 'content');
+			assert.equal(fontFileIdContentResolver.resolve(url), 'content');
 		});
 	});
 

packages/astro/test/units/dev/route-guard-middleware.test.ts

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+import { after, describe, it } from 'node:test';
+import { routeGuardMiddleware } from '../../../dist/vite-plugin-astro-server/route-guard.js';
+import { createBasicSettings, createFixture, createRequestAndResponse } from '../test-utils.ts';
+
+describe('routeGuardMiddleware — filesystem resolution', () => {
+	let fixture: Awaited<ReturnType<typeof createFixture>>;
+
+	after(async () => {
+		await fixture?.rm();
+	});
+
+	it('allows src/ files through on browser navigation (Accept: text/html)', async () => {
+		fixture = await createFixture({
+			'src/downloads/a.pdf': '%PDF-1.4 test',
+		});
+		const settings = await createBasicSettings({ root: fixture.path });
+		const middleware = routeGuardMiddleware(settings);
+
+		// Simulate browser navigation to /src/downloads/a.pdf
+		const { req, res } = createRequestAndResponse({
+			method: 'GET',
+			url: '/src/downloads/a.pdf',
+			headers: { accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' },
+		});
+
+		let nextCalled = false;
+		middleware(req, res, () => {
+			nextCalled = true;
+		});
+
+		assert.equal(nextCalled, true, 'next() should be called — file is inside srcDir');
+		assert.notEqual((res as any).statusCode, 404, 'should not return 404 for files inside srcDir');
+	});
+
+	it('blocks root-level files outside srcDir/publicDir', async () => {
+		fixture = await createFixture({
+			'README.md': '# Test',
+			'src/pages/index.astro': '',
+		});
+		const settings = await createBasicSettings({ root: fixture.path });
+		const middleware = routeGuardMiddleware(settings);
+
+		const { req, res } = createRequestAndResponse({
+			method: 'GET',
+			url: '/README.md',
+			headers: { accept: 'text/html' },
+		});
+
+		let nextCalled = false;
+		middleware(req, res, () => {
+			nextCalled = true;
+		});
+
+		assert.equal(nextCalled, false, 'next() should NOT be called — file is at root');
+		assert.equal((res as any).statusCode, 404, 'should return 404 for root-level files');
+	});
+});