From 97871f7b90d244b4e8219f428b1c4a2f6731ffe4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 15 Oct 2026 21:31:50 +0200 Subject: [PATCH] fix(http): mint the fresh request id through randomId The proxy no longer calls crypto.randomUUID itself, so it leaves the client-random-id exemption list; the request-id helper uses the shared randomId, which also works without a secure context. --- src/__tests__/client-random-id-guard.test.ts | 2 -- src/lib/http/request-id.ts | 4 +++- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/__tests__/client-random-id-guard.test.ts b/src/__tests__/client-random-id-guard.test.ts index fc1c9491a..af8da88f1 100644 --- a/src/__tests__/client-random-id-guard.test.ts +++ b/src/__tests__/client-random-id-guard.test.ts @@ -47,8 +47,6 @@ const SKIP_DIRS = new Set([ * runs on the server where the property always exists. */ const SERVER_SIDE_EXEMPT = new Set([ - // Next middleware — runs on the edge runtime, never in the page. - "src/proxy.ts", // The one module allowed to reach for the platform call. "src/lib/random-id.ts", ]); diff --git a/src/lib/http/request-id.ts b/src/lib/http/request-id.ts index 51754621d..74df2a8c5 100644 --- a/src/lib/http/request-id.ts +++ b/src/lib/http/request-id.ts @@ -10,6 +10,8 @@ * * Edge-safe: no Node imports, because `src/proxy.ts` reads it too. */ +import { randomId } from "@/lib/random-id"; + export const REQUEST_ID_PATTERN = /^[A-Za-z0-9-]{8,64}$/; /** The incoming id when it is well-formed, else `null`. */ @@ -22,5 +24,5 @@ export function acceptIncomingRequestId( /** The incoming id when it is well-formed, else a fresh UUID. */ export function resolveRequestId(value: string | null | undefined): string { - return acceptIncomingRequestId(value) ?? crypto.randomUUID(); + return acceptIncomingRequestId(value) ?? randomId(); }