feat(solidstart): Serve the managed tunnel on SolidStart v1

`withSentry` registers a Nitro v2 plugin that answers tunnel requests from the
`request` hook, before the app's middleware. It goes through `server.plugins`
because vinxi's dev server ignores plugins that Nitro modules add.

Author: logaretm

dev-packages/e2e-tests/test-applications/solidstart/app.config.ts

@@ -4,5 +4,10 @@ import { defineConfig } from '@solidjs/start/config';
 export default defineConfig(
   withSentry({
     middleware: './src/middleware.ts',
+    vite: {
+      define: {
+        __E2E_TEST_TUNNEL__: JSON.stringify(!!process.env.E2E_TEST_TUNNEL),
+      },
+    },
   }),
 );

dev-packages/e2e-tests/test-applications/solidstart/package.json

@@ -10,7 +10,9 @@
     "test:prod": "TEST_ENV=production playwright test",
     "test:build": "pnpm install && pnpm build",
     "test:assert": "pnpm test:prod && pnpm test:dev",
-    "test:dev": "TEST_ENV=development playwright test db"
+    "test:dev": "TEST_ENV=development playwright test db",
+    "test:build:tunnel": "pnpm install && E2E_TEST_TUNNEL=1 pnpm build",
+    "test:assert:tunnel": "E2E_TEST_TUNNEL=1 E2E_TEST_DSN=http://public@localhost:3031/1337 TEST_ENV=production playwright test tunnel"
   },
   "type": "module",
   "dependencies": {
@@ -36,5 +38,14 @@
   },
   "volta": {
     "extends": "../../package.json"
+  },
+  "sentryTest": {
+    "variants": [
+      {
+        "build-command": "pnpm test:build:tunnel",
+        "assert-command": "pnpm test:assert:tunnel",
+        "label": "solidstart (tunnel)"
+      }
+    ]
   }
 }

dev-packages/e2e-tests/test-applications/solidstart/src/entry-client.tsx

@@ -3,13 +3,15 @@ import * as Sentry from '@sentry/solidstart';
 import { solidRouterBrowserTracingIntegration } from '@sentry/solidstart/solidrouter';
 import { StartClient, mount } from '@solidjs/start/client';
 
+declare const __E2E_TEST_TUNNEL__: boolean;
+
 Sentry.init({
   // We can't use env variables here, seems like they are stripped
   // out in production builds.
-  dsn: 'https://public@dsn.ingest.sentry.io/1337',
+  dsn: __E2E_TEST_TUNNEL__ ? 'http://public@localhost:3031/1337' : 'https://public@dsn.ingest.sentry.io/1337',
   environment: 'qa', // dynamic sampling bias to keep transactions
   integrations: [solidRouterBrowserTracingIntegration()],
-  tunnel: 'http://localhost:3031/', // proxy server
+  tunnel: __E2E_TEST_TUNNEL__ ? true : 'http://localhost:3031/', // proxy server
   // Performance Monitoring
   tracesSampleRate: 1.0, //  Capture 100% of the transactions
   debug: !!import.meta.env.DEBUG,

dev-packages/e2e-tests/test-applications/solidstart/src/instrument.server.ts

@@ -4,6 +4,6 @@ Sentry.init({
   dsn: process.env.E2E_TEST_DSN,
   environment: 'qa', // dynamic sampling bias to keep transactions
   tracesSampleRate: 1.0, //  Capture 100% of the transactions
-  tunnel: 'http://localhost:3031/', // proxy server
+  tunnel: process.env.E2E_TEST_TUNNEL ? true : 'http://localhost:3031/', // proxy server
   debug: !!process.env.DEBUG,
 });

dev-packages/e2e-tests/test-applications/solidstart/src/middleware.ts

@@ -2,5 +2,14 @@ import { sentryBeforeResponseMiddleware } from '@sentry/solidstart';
 import { createMiddleware } from '@solidjs/start/middleware';
 
 export default createMiddleware({
+  onRequest: [
+    // The tunnel variant checks that the managed tunnel answers before an auth middleware like this one.
+    event => {
+      const request = event.request;
+      if (process.env.E2E_TEST_TUNNEL && request.method === 'POST' && request.headers.get('x-auth') !== 'ok') {
+        return new Response('blocked by user auth', { status: 401 });
+      }
+    },
+  ],
   onBeforeResponse: [sentryBeforeResponseMiddleware()],
 });

dev-packages/e2e-tests/test-applications/solidstart/tests/tunnel.test.ts

@@ -0,0 +1,40 @@
+import { expect, test } from '@playwright/test';
+import { getSpanOp, waitForStreamedSpan } from '@sentry-internal/test-utils';
+
+test.skip(!process.env.E2E_TEST_TUNNEL, 'Only runs in the tunnel variant');
+
+const APP_NAME = 'solidstart';
+const TUNNEL_PATH = /^\/[a-z0-9]{1,7}$/;
+
+test('answers the managed tunnel before the app middleware', async ({ page }) => {
+  // The variant's auth middleware rejects every other POST.
+  expect((await page.request.post('/', { data: 'x' })).status()).toBe(401);
+
+  const tunnelServerSpanPromise = waitForStreamedSpan(
+    APP_NAME,
+    span => getSpanOp(span) === 'http.server' && TUNNEL_PATH.test(String(span.attributes['url.path']?.value ?? '')),
+  );
+  const tunnelResponsePromise = page.waitForResponse(
+    response => response.request().method() === 'POST' && TUNNEL_PATH.test(new URL(response.url()).pathname),
+  );
+
+  await page.goto('/');
+  const tunnelResponse = await tunnelResponsePromise;
+
+  expect(tunnelResponse.status()).toBe(200);
+  expect(new URL(tunnelResponse.url()).origin).toBe(new URL(page.url()).origin);
+
+  // Anchor on a regular server span requested after the tunnel traffic: spans flush in order, so a tunnel span
+  // would arrive first.
+  const anchorSpanPromise = waitForStreamedSpan(
+    APP_NAME,
+    span => getSpanOp(span) === 'http.server' && String(span.attributes['url.path']?.value ?? '') === '/users/6',
+  );
+  await page.request.get('/users/6');
+
+  const winner = await Promise.race([
+    tunnelServerSpanPromise.then(() => 'tunnel' as const),
+    anchorSpanPromise.then(() => 'anchor' as const),
+  ]);
+  expect(winner).toBe('anchor');
+});

packages/solidstart/rollup.npm.config.mjs

@@ -13,6 +13,7 @@ export default makeNPMConfigVariants(
       'src/client/solidrouter.ts',
       'src/server/solidrouter.ts',
       'src/vite/index.ts',
+      'src/nitro/tunnelPlugin.ts',
     ],
     // prevent this internal code from ending up in our built package (this doesn't happen automatically because
     // the name doesn't match an SDK dependency)

packages/solidstart/src/config/types.ts

@@ -9,6 +9,7 @@ export type RollupConfig = {
 export type SolidStartInlineConfig = NonNullable<Parameters<typeof defineConfig>[0]>;
 
 export type SolidStartInlineServerConfig = {
+  plugins?: string[];
   hooks?: {
     close?: () => unknown;
     'rollup:before'?: (nitro: Nitro) => unknown;

packages/solidstart/src/config/withSentry.ts

@@ -1,3 +1,4 @@
+import { fileURLToPath } from 'node:url';
 import { debug } from '@sentry/core';
 import { INSTRUMENTED_MODULE_NAMES } from '@sentry/server-utils/orchestrion/config';
 import {
@@ -116,6 +117,15 @@ export function withSentry(
       externals,
       commonJS,
       modules: [...existingModules, sentryNitroModule],
+      // Through `server.plugins`, since vinxi's dev server ignores plugins that Nitro modules add.
+      plugins: [...(server.plugins || []), getTunnelPluginPath()],
     },
   };
 }
+
+function getTunnelPluginPath(): string {
+  const url = new URL('../nitro/tunnelPlugin.js', import.meta.url);
+
+  // `import.meta.url` is a file URL in the built package, but not in every test environment.
+  return url.protocol === 'file:' ? fileURLToPath(url) : url.pathname;
+}

packages/solidstart/src/nitro/tunnelPlugin.ts

@@ -0,0 +1,42 @@
+import { Readable } from 'node:stream';
+import { handleTunnelRequestIfMatched, isTunnelRequest } from '@sentry/core';
+import type { NitroAppPlugin } from 'nitropack';
+
+/**
+ * Answers managed tunnel requests on SolidStart v1 (Nitro v2). The `request` hook runs before the app's middleware
+ * and routing. `withSentry` registers it.
+ */
+export default (nitroApp => {
+  nitroApp.hooks.hook('request', async event => {
+    const { req, res } = event.node;
+    // Checked on the method and path first, so no other request's body gets wrapped in a web `Request`.
+    if (!isTunnelRequest(req)) {
+      return;
+    }
+
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+      if (value !== undefined) {
+        headers.set(name, Array.isArray(value) ? value.join(', ') : value);
+      }
+    }
+
+    const tunnelResponse = await handleTunnelRequestIfMatched(
+      new Request(`http://${req.headers.host}${req.url}`, {
+        method: req.method,
+        headers,
+        body: Readable.toWeb(req) as ReadableStream,
+        // Required by Node's `fetch` for a streamed body.
+        duplex: 'half',
+      } as RequestInit),
+    );
+    if (!tunnelResponse) {
+      return;
+    }
+
+    // Writing the response marks the event as handled, so Nitro stops here.
+    res.statusCode = tunnelResponse.status;
+    tunnelResponse.headers.forEach((value, name) => res.setHeader(name, value));
+    res.end(Buffer.from(await tunnelResponse.arrayBuffer()));
+  });
+}) satisfies NitroAppPlugin;