fix(nuxt): Delete public source maps before Nitro lists its public assets

dev-packages/e2e-tests/test-applications/nuxt-4-sourcemaps/assert-build.ts

@@ -15,6 +15,7 @@ import {
   getSourcemapSources,
   getSourcemaps,
   loadMockServerResults,
+  startNodeServer,
 } from '@sentry-internal/test-utils';
 
 /** This variant omits `sourcemaps.filesToDeleteAfterUpload`, so Sentry must upload but not delete. */
@@ -170,6 +171,11 @@ const debugIdsWithoutSourceMap = debugIdsOfChunksWithoutSourceMap(CLIENT_BUILD_O
 for (const outputDir of isStaticBuild ? [CLIENT_OUTPUT] : [CLIENT_OUTPUT, SERVER_OUTPUT]) {
   const injectedDebugIds = findInjectedDebugIds({ outputDir });
   assert.ok(injectedDebugIds.length > 0, `Expected debug IDs to be injected into ${outputDir}`);
+  // The exemption for chunks without a source map must not let a build without any uploaded map pass.
+  assert.ok(
+    injectedDebugIds.some(debugId => uploadedDebugIds.has(debugId)),
+    `Expected at least one debug ID in ${outputDir} to have an uploaded sourcemap`,
+  );
 
   const unuploaded = injectedDebugIds.filter(
     debugId => !uploadedDebugIds.has(debugId) && !debugIdsWithoutSourceMap.has(debugId),
@@ -232,4 +238,48 @@ if (keepClientSourceMaps) {
   console.log(`  ${CLIENT_OUTPUT} is free of source maps, sourceMappingURL comments and original source\n`);
 }
 
+// --- What the built server answers for the client source maps ---
+
+// `nuxt generate` emits no server, and a static host serves only the files that exist.
+if (!isStaticBuild) {
+  const clientChunkUrls = fs
+    .readdirSync(CLIENT_OUTPUT, { recursive: true, withFileTypes: true })
+    .filter(entry => entry.isFile() && entry.name.endsWith('.js'))
+    .map(
+      entry => `/${path.relative(CLIENT_OUTPUT, path.join(entry.parentPath, entry.name)).split(path.sep).join('/')}`,
+    );
+  assert.ok(clientChunkUrls.length > 0, `Expected client chunks in ${CLIENT_OUTPUT}`);
+
+  const server = await startNodeServer({ entry: path.join(SERVER_OUTPUT, 'index.mjs'), port: 3030 });
+
+  try {
+    // Without this, a server that serves no public files at all would pass the 404 checks.
+    const chunkStatus = (await fetch(`${server.baseUrl}${clientChunkUrls[0]}`)).status;
+    assert.equal(chunkStatus, 200, `Expected the server to serve the client chunk ${clientChunkUrls[0]}`);
+
+    // Nitro serves public files from a list it writes into the server bundle. A map deleted after that
+    // stays on the list, and Nitro answers its request with a 500 instead of a 404.
+    const responses = await Promise.all(
+      clientChunkUrls.map(async chunkUrl => {
+        const mapUrl = `${chunkUrl}.map`;
+        const expectedStatus = fs.existsSync(path.join(CLIENT_OUTPUT, mapUrl)) ? 200 : 404;
+        const { status } = await fetch(`${server.baseUrl}${mapUrl}`);
+        return { mapUrl, status, expectedStatus };
+      }),
+    );
+    const unexpectedStatuses = responses
+      .filter(({ status, expectedStatus }) => status !== expectedStatus)
+      .map(({ mapUrl, status, expectedStatus }) => `${mapUrl} → ${status}, expected ${expectedStatus}`);
+    assert.deepEqual(
+      unexpectedStatuses,
+      [],
+      'Expected the server to answer each client source map URL with 200 if the map is in the output, else 404',
+    );
+
+    console.log(`  The server answers all ${clientChunkUrls.length} client source map URL(s) as expected\n`);
+  } finally {
+    await server.close();
+  }
+}
+
 console.log('All sourcemap assertions passed!');

dev-packages/test-utils/src/index.ts

@@ -38,6 +38,9 @@ export { getRuntime } from './runtime';
 export type { Runtime } from './runtime';
 export { createBasicSentryServer, createTestServer } from './server';
 
+export { startNodeServer } from './node-server';
+export type { NodeServerOptions, NodeServer } from './node-server';
+
 export { startMockSentryServer } from './mock-sentry-server';
 export type { MockSentryServerOptions, MockSentryServer } from './mock-sentry-server';
 export * from './sourcemap-upload-utils';

dev-packages/test-utils/src/node-server.ts

@@ -0,0 +1,55 @@
+import { spawn } from 'node:child_process';
+
+export interface NodeServerOptions {
+  /** Path to the server entry, e.g. `.output/server/index.mjs`. */
+  entry: string;
+  port: number;
+  /** How long to wait for the first response. Defaults to 30 seconds. */
+  timeoutMs?: number;
+}
+
+export interface NodeServer {
+  baseUrl: string;
+  /** Stops the server and resolves once its process has exited. */
+  close: () => Promise<void>;
+}
+
+/**
+ * Starts a built Node server and resolves once it answers HTTP requests. The server gets the port via `PORT`.
+ *
+ * Rejects if the server exits or does not answer before the timeout. Its output is printed only then.
+ */
+export async function startNodeServer({ entry, port, timeoutMs = 30_000 }: NodeServerOptions): Promise<NodeServer> {
+  const baseUrl = `http://localhost:${port}`;
+  const child = spawn(process.execPath, [entry], { env: { ...process.env, PORT: String(port) } });
+
+  let output = '';
+  child.stdout.on('data', chunk => (output += chunk));
+  child.stderr.on('data', chunk => (output += chunk));
+
+  const close = async (): Promise<void> => {
+    if (child.exitCode !== null || child.signalCode !== null) {
+      return;
+    }
+    const exited = new Promise(resolve => child.once('exit', resolve));
+    child.kill();
+    await exited;
+  };
+
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (child.exitCode !== null) {
+      throw new Error(`Server ${entry} exited with code ${child.exitCode} before it answered:\n${output}`);
+    }
+
+    try {
+      await fetch(baseUrl);
+      return { baseUrl, close };
+    } catch {
+      await new Promise(resolve => setTimeout(resolve, 250));
+    }
+  }
+
+  await close();
+  throw new Error(`Server ${entry} did not answer on ${baseUrl} within ${timeoutMs}ms:\n${output}`);
+}

packages/nuxt/src/vite/sourceMapDeletion.ts

@@ -1,4 +1,6 @@
-import { createSentryBuildPluginManager, type Options } from '@sentry/bundler-plugins/core';
+import { createSentryBuildPluginManager, globFiles, type Options } from '@sentry/bundler-plugins/core';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 
 export function withoutSourceMapDeletion(options: Options): Options {
   return {
@@ -32,3 +34,43 @@ export async function deleteSourceMapsAfterBuild(options: Options): Promise<void
 
   await sentryBuildPluginManager.deleteArtifacts();
 }
+
+/**
+ * Deletes the files in `publicDir` that match `filesToDeleteAfterUpload`. Nitro answers a request for a file it
+ * listed at build time but cannot read with a 500. Files outside `publicDir` are deleted in `close`.
+ */
+export async function deletePublicSourceMaps(options: Options, publicDir: string): Promise<void> {
+  const filesToDeleteAfterUpload = await options.sourcemaps?.filesToDeleteAfterUpload;
+
+  if (filesToDeleteAfterUpload === undefined) {
+    return;
+  }
+
+  const files = await globFiles(filesToDeleteAfterUpload);
+  const publicFiles = files.filter(file => isInDirectory(file, publicDir));
+
+  await Promise.all(
+    publicFiles.map(async file => {
+      logDebug(options, `Deleting ${file} before Nitro bundles the server.`);
+      // `deleteSourceMapsAfterBuild` tries again in `close`.
+      await fs.promises.rm(file, { force: true }).catch(error => logDebug(options, `Could not delete ${file}.`, error));
+    }),
+  );
+}
+
+function logDebug(options: Options, ...messages: unknown[]): void {
+  if (options.debug) {
+    // eslint-disable-next-line no-console
+    console.log('[Sentry]', ...messages);
+  }
+}
+
+function isInDirectory(file: string, directory: string): boolean {
+  const relativePath = path.relative(directory, file);
+  return (
+    relativePath !== '' &&
+    relativePath !== '..' &&
+    !relativePath.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relativePath)
+  );
+}

packages/nuxt/src/vite/sourceMaps.ts

@@ -5,7 +5,7 @@ import { warnOnRemovedBuildOptions } from '@sentry/core';
 import type { NitroConfig } from 'nitropack';
 import type { Plugin } from 'vite';
 import type { SentryNuxtModuleOptions } from '../common/types';
-import { deleteSourceMapsAfterBuild, withoutSourceMapDeletion } from './sourceMapDeletion';
+import { deletePublicSourceMaps, deleteSourceMapsAfterBuild, withoutSourceMapDeletion } from './sourceMapDeletion';
 import { validateSourceMapsOptionsPlugin } from './sentryVitePlugin';
 
 /**
@@ -112,6 +112,24 @@ export function setupSourceMaps(
     }
   });
 
+  nuxt.hook('nitro:init', nitro => {
+    if (sourceMapsEnabled && !nitro.options.dev && !nuxt.options?._prepare) {
+      const publicDir = nitro.options.output.publicDir;
+      const rollupConfig = (nitro.options.rollupConfig ??= { output: {} });
+
+      rollupConfig.plugins = [
+        rollupConfig.plugins,
+        {
+          name: 'sentry-nuxt-public-source-map-deletion',
+          // By now the client build is in the public dir, and Nitro has not yet listed its files.
+          async buildStart() {
+            await deletePublicSourceMaps(getPluginOptions(moduleOptions, shouldDeleteFilesFallback), publicDir);
+          },
+        },
+      ];
+    }
+  });
+
   nuxt.hook('close', async () => {
     if (sourceMapsEnabled && !nuxt.options.dev && !nuxt.options?._prepare) {
       await deleteSourceMapsAfterBuild(getPluginOptions(moduleOptions, shouldDeleteFilesFallback));

packages/nuxt/test/vite/sourceMapDeletion.test.ts

@@ -0,0 +1,95 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { deletePublicSourceMaps } from '../../src/vite/sourceMapDeletion';
+
+const BUILD_FILES = [
+  '.output/public/_nuxt/entry.DxB3kLmA.js',
+  '.output/public/_nuxt/entry.DxB3kLmA.js.map',
+  '.output/public/_nuxt/pages/products.Cq81zR4t.js.map',
+  '.output/public-assets/_nuxt/entry.DxB3kLmA.js.map',
+  '.output/server/chunks/nitro/nitro.mjs.map',
+  '.nuxt/dist/server/_nuxt/index-B2kR7mXp.mjs.map',
+];
+
+let rootDir: string;
+let publicDir: string;
+
+/** Glob patterns need forward slashes, also on Windows. */
+function toGlob(relativePattern: string): string {
+  return path.join(rootDir, relativePattern).split(path.sep).join('/');
+}
+
+function remainingFiles(): string[] {
+  return BUILD_FILES.filter(file => fs.existsSync(path.join(rootDir, file)));
+}
+
+describe('deletePublicSourceMaps', () => {
+  beforeEach(() => {
+    rootDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sentry-nuxt-source-map-deletion-'));
+    publicDir = path.join(rootDir, '.output', 'public');
+
+    for (const file of BUILD_FILES) {
+      fs.mkdirSync(path.dirname(path.join(rootDir, file)), { recursive: true });
+      fs.writeFileSync(path.join(rootDir, file), '');
+    }
+  });
+
+  afterEach(() => {
+    fs.rmSync(rootDir, { recursive: true, force: true });
+  });
+
+  it('deletes the matched files in the public dir and keeps the matched files outside of it', async () => {
+    await deletePublicSourceMaps(
+      {
+        sourcemaps: {
+          filesToDeleteAfterUpload: [toGlob('.*/**/public*/**/*.map'), toGlob('.*/**/server/**/*.map')],
+        },
+      },
+      publicDir,
+    );
+
+    expect(remainingFiles()).toEqual([
+      '.output/public/_nuxt/entry.DxB3kLmA.js',
+      '.output/public-assets/_nuxt/entry.DxB3kLmA.js.map',
+      '.output/server/chunks/nitro/nitro.mjs.map',
+      '.nuxt/dist/server/_nuxt/index-B2kR7mXp.mjs.map',
+    ]);
+  });
+
+  it('keeps the files in the public dir that no pattern matches', async () => {
+    await deletePublicSourceMaps(
+      { sourcemaps: { filesToDeleteAfterUpload: toGlob('.output/public/_nuxt/pages/*.map') } },
+      publicDir,
+    );
+
+    expect(remainingFiles()).toEqual([
+      '.output/public/_nuxt/entry.DxB3kLmA.js',
+      '.output/public/_nuxt/entry.DxB3kLmA.js.map',
+      '.output/public-assets/_nuxt/entry.DxB3kLmA.js.map',
+      '.output/server/chunks/nitro/nitro.mjs.map',
+      '.nuxt/dist/server/_nuxt/index-B2kR7mXp.mjs.map',
+    ]);
+  });
+
+  it('resolves a promised list of patterns', async () => {
+    await deletePublicSourceMaps(
+      { sourcemaps: { filesToDeleteAfterUpload: Promise.resolve([toGlob('.output/public/**/*.map')]) } },
+      publicDir,
+    );
+
+    expect(remainingFiles()).toEqual([
+      '.output/public/_nuxt/entry.DxB3kLmA.js',
+      '.output/public-assets/_nuxt/entry.DxB3kLmA.js.map',
+      '.output/server/chunks/nitro/nitro.mjs.map',
+      '.nuxt/dist/server/_nuxt/index-B2kR7mXp.mjs.map',
+    ]);
+  });
+
+  it('deletes nothing when no deletion patterns are set', async () => {
+    await deletePublicSourceMaps({ sourcemaps: {} }, publicDir);
+
+    expect(remainingFiles()).toEqual(BUILD_FILES);
+  });
+});