Skip to content

fix: use fresh Request in serveWithAssets to avoid body-reuse crash - #68

Merged
Brooooooklyn merged 1 commit into
mainfrom
fix/serveWithAssets-fresh-request
Apr 2, 2026
Merged

Brooooooklyn merged 1 commit into
mainfrom
fix/serveWithAssets-fresh-request

Conversation

@Brooooooklyn

@Brooooooklyn Brooooooklyn commented Apr 2, 2026 •

Copy link
Copy Markdown
Member

fix: use fresh Request in serveWithAssets to avoid body-reuse crash

After app.fetch() processes a request, the original Request object may
have its body marked as "disturbed". Passing it to env.ASSETS.fetch()
then throws "Cannot reconstruct a Request with a used body."

Create a new Request from just the URL instead of reusing the original.
The method check already ensures only GET/HEAD reach this path, so a
plain new Request(url) (defaults to GET) is correct.

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

test: add tests for serveWithAssets body-reuse fix

Verify that:

  • Non-GET/HEAD requests are short-circuited (method guard)
  • ASSETS.fetch receives a fresh Request(url), not the original request

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com


Note

Low Risk
Low risk, narrowly scoped change to the worker asset fallthrough to prevent a runtime crash when the original Request has a disturbed body; behavior is covered by added unit tests.

Overview
Fixes serveWithAssets (generated by compileWorkerEntry) to call env.ASSETS.fetch() with a fresh Request built from the original URL/method/headers, avoiding Cloudflare’s "used body" crash after app.fetch().

Adds unit tests asserting the GET/HEAD guard remains in place and that ASSETS.fetch no longer receives the original request object.

Written by Cursor Bugbot for commit 24c0938. This will update automatically on new commits. Configure here.

Copy link
Copy Markdown
Member Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

Comment thread packages/void/src/router/compile.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3902577e46

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/void/src/router/compile.ts Outdated
@Brooooooklyn
Brooooooklyn force-pushed the fix/serveWithAssets-fresh-request branch from 3902577 to ff35fef Compare April 2, 2026 14:06

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Comment thread packages/void/src/router/compile.ts Outdated
After app.fetch() processes a request, the original Request object may
have its body marked as "disturbed". Passing it to env.ASSETS.fetch()
then throws "Cannot reconstruct a Request with a used body."

Create a new Request preserving url, method, and headers instead of
reusing the original. Headers (including If-None-Match / If-Modified-Since
for conditional requests) are not affected by body consumption and are
safe to forward, ensuring ASSETS can still return 304 Not Modified.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@Brooooooklyn
Brooooooklyn force-pushed the fix/serveWithAssets-fresh-request branch from ff35fef to 24c0938 Compare April 2, 2026 14:24
@Brooooooklyn
Brooooooklyn merged commit beda6b5 into main Apr 2, 2026
8 checks passed
@Brooooooklyn
Brooooooklyn deleted the fix/serveWithAssets-fresh-request branch April 2, 2026 14:38
cpojer pushed a commit that referenced this pull request Sep 11, 2026
…sAdminSuspended (#68)

Previous tests only verified middleware blocking on /me. Add coverage
for /projects to confirm the middleware rejects deleted and
admin-suspended users across all protected routes, and allows
usage-suspended users through.

Add unit tests for isAdminSuspended edge cases (null, usage-limit
reason, admin reason, unknown reason).

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant