fix: matching on data routes when middleware matcher is using allowed paths (#3506)

Author: pieh

edge-runtime/lib/next-request.ts

@@ -7,6 +7,7 @@ import {
   normalizeDataUrl,
   normalizeLocalePath,
   removeBasePath,
+  rewriteDataPath,
 } from './util.ts'
 
 interface I18NConfig {
@@ -82,18 +83,32 @@ export const localizeRequest = (
   },
 ): { localizedUrl: URL; locale?: string } => {
   const localizedUrl = new URL(url)
-  localizedUrl.pathname = removeBasePath(localizedUrl.pathname, nextConfig?.basePath)
+  const pathnameWithoutBasePath = removeBasePath(localizedUrl.pathname, nextConfig?.basePath)
+
+  const isDataRequest = pathnameWithoutBasePath.startsWith('/_next/data/')
+
+  const normalizedPath = isDataRequest
+    ? normalizeDataUrl(pathnameWithoutBasePath)
+    : pathnameWithoutBasePath
 
   // Detect the locale from the URL
-  const { detectedLocale } = normalizeLocalePath(localizedUrl.pathname, nextConfig?.i18n?.locales)
+  const { detectedLocale } = normalizeLocalePath(normalizedPath, nextConfig?.i18n?.locales)
 
   // Add the locale to the URL if not already present
-  localizedUrl.pathname = addLocale(
-    localizedUrl.pathname,
+  const normalizedPathWithLocale = addLocale(
+    normalizedPath,
     detectedLocale ?? nextConfig?.i18n?.defaultLocale,
   )
 
-  localizedUrl.pathname = addBasePath(localizedUrl.pathname, nextConfig?.basePath)
+  localizedUrl.pathname = addBasePath(
+    isDataRequest
+      ? rewriteDataPath({
+          dataUrl: pathnameWithoutBasePath,
+          newRoute: normalizedPathWithLocale,
+        })
+      : normalizedPathWithLocale,
+    nextConfig?.basePath,
+  )
 
   return {
     localizedUrl,

edge-runtime/middleware.ts

@@ -48,7 +48,12 @@ export async function handleMiddleware(
   if (
     !matchesMiddleware(localizedUrl.pathname, request, searchParamsToUrlQuery(url.searchParams))
   ) {
-    reqLogger.debug('Aborting middleware due to runtime rules')
+    reqLogger
+      .withFields({
+        next_original_url: url,
+        next_localized_url: localizedUrl.href,
+      })
+      .debug('Aborting middleware due to runtime rules')
 
     return
   }

package-lock.json

@@ -91,7 +91,6 @@
     "os": "^0.1.2",
     "outdent": "^0.8.0",
     "p-limit": "^6.0.0",
-    "path-to-regexp": "^6.2.1",
     "picomatch": "^4.0.2",
     "prettier": "^3.2.5",
     "semver": "^7.6.0",

package.json

@@ -5,7 +5,6 @@ import type { Manifest, ManifestFunction } from '@netlify/edge-functions'
 import { glob } from 'fast-glob'
 import type { FunctionsConfigManifest } from 'next-with-cache-handler-v2/dist/build/index.js'
 import type { EdgeFunctionDefinition as EdgeMiddlewareDefinition } from 'next-with-cache-handler-v2/dist/build/webpack/plugins/middleware-plugin.js'
-import { pathToRegexp } from 'path-to-regexp'
 
 import { EDGE_HANDLER_NAME, PluginContext } from '../plugin-context.js'
 
@@ -56,6 +55,20 @@ const copyRuntime = async (ctx: PluginContext, handlerDirectory: string): Promis
   )
 }
 
+const fixEdgeRuntimeTurbopackMatcherJsonPart = (matchers: EdgeMiddlewareDefinition['matchers']) => {
+  return matchers.map((matcher) => {
+    if (matcher.regexp) {
+      return {
+        ...matcher,
+        // Next.js in some versions produces "\\\\.json" for edge runtime middleware when built with turbopack
+        // with too many escapes preventing proper matching
+        regexp: matcher.regexp.replaceAll('\\\\.json', '\\.json'),
+      }
+    }
+    return matcher
+  })
+}
+
 /**
  * When i18n is enabled the matchers assume that paths _always_ include the
  * locale. We manually add an extra matcher for the original path without
@@ -80,13 +93,18 @@ const augmentMatchers = (
               // Next is producing pretty broad matcher for i18n locale. Presumably rest of their infrastructure protects this broad matcher
               // from matching on non-locale paths. For us this becomes request entry point, so we need to narrow it down to just defined locales
               // otherwise users might get unexpected matches on paths like `/api*`
-              regexp: matcher.regexp.replace(/\[\^\/\.]+/g, `(${i18NConfig.locales.join('|')})`),
+              // additionally we don't have a way to normalize i18n paths for request without locale information, so we need to adjust the regexp to mark locale part as optional
+              regexp: matcher.regexp
+                // replace i18n part matching:
+                //  - target locales only
+                //  - make it optional to allow matching both with and without locale
+                // (?:\\/((?!_next\\/)[^/.]{1,}))
+                .replace(
+                  '(?:\\/((?!_next\\/)[^/.]{1,}))',
+                  `(?:\\/((?!_next\\/)(${i18NConfig.locales.join('|')}){1,}))?`,
+                ),
             }
           : matcher,
-        {
-          ...matcher,
-          regexp: pathToRegexp(matcher.originalSource).source,
-        },
       ]
     }
     return matcher
@@ -330,7 +348,7 @@ export const createEdgeHandlers = async (ctx: PluginContext) => {
       runtime: 'edge',
       functionDefinition: edgeDefinition,
       name: edgeDefinition.name,
-      matchers: edgeDefinition.matchers,
+      matchers: fixEdgeRuntimeTurbopackMatcherJsonPart(edgeDefinition.matchers),
     }
   })