Repository navigation
fix: mark the internal fetch helpers as server-only - #25
Merged
Merged
Conversation
Both modules are server-side utilities that no client component imports, but each carried a 'use server' directive. That registers every export as a server action, which makes them callable from outside rather than only from server code — not what these modules are for. Replace the directive with `import 'server-only'`. It enforces the same intent and turns any future client-side import into a build error instead of silently publishing an endpoint. Verified against the build manifests: registered server references drop from 55 to 53, and neither export appears in any per-page manifest or in the client bundles. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟢 Approval recommended
The focused server-only changes have no unresolved issues and passed the reported checks.
Pull request overview
Reclassifies internal fetch utilities as server-only modules without exposing them as Server Actions.
Changes:
- Replaces
'use server'withimport 'server-only'. - Adds and locks the
server-onlydependency.
File summaries
| File | Description |
|---|---|
pnpm-lock.yaml |
Locks the new dependency. |
package.json |
Declares the server-only dependency. |
lib/signed-fetch.ts |
Restricts signed requests to server code. |
lib/graphql/request.ts |
Restricts GraphQL requests to server code. |
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 3/4 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
lib/signed-fetch.tsandlib/graphql/request.tsare server-side utilities — every importer is a route handler, RSC page/layout, sitemap, badge renderer or agraphql/helpers/*module, and no client component pulls them in. Both nevertheless carried a'use server'directive, which registers each export as a server action and so makes it callable from outside rather than only from server code. That was not the intent of either module.This swaps the directive for
import 'server-only', which expresses the same "server code only" constraint without publishing anything, and turns a future client-side import into a build error rather than a silently exposed endpoint.Verification
tsc --noEmitclean;pnpm buildcompletes.server-reference-manifest.jsonfiles. Before: both exports appear as registered references across them. After: neither appears..next/static.No behaviour change: the modules are called exactly as before by the same server-side callers.
🤖 Generated with Claude Code