Repository navigation
[miniflare] Make static asset disk services read-only - #16607
petebacondarwin wants to merge 2 commits into
Conversation
🦋 Changeset detectedLatest commit: 2cfeb16 The changes in this PR will be included in the next version bump. This PR includes changesets to release 8 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Codeowners approval required for this PR:
Show detailed file reviewers
|
![devin-ai-integration[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
LGTM |
![clanky-the-clanker[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/5306670?s=60&v=4){kind=small}
There was a problem hiding this comment.
Superseded by the review of
2cfeb166.
This review, of c2b98c47
✅ Approved — A small, well-scoped permission change with matching tests and a changeset; no issues found.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low. A patch changeset for Miniflare fits this change.
🔒 Security: ✅ LGTM
The change shrinks the attack surface: the disk services now reject writes even when a caller reaches them directly instead of going through the namespace Worker.
📖 AGENTS.md: ✅ LGTM
Matches the repository's conventions: the behaviour is implemented in Miniflare so every consumer gets it, it has test coverage, and a changeset is included.
📋 Code Quality: ✅ LGTM
The writable: false change is limited to the asset and Sites storage services. The Workers bound to them only read, so serving behaviour is unchanged.
⚡ Performance: ✅ LGTM
No performance impact.
📝 Documentation: ✅ LGTM
No public documentation changes are needed. The behaviour is internal and does not add any configuration.
Reviewed commit: c2b98c47
@cloudflare/autoconfig
@cloudflare/build-output-utils
@cloudflare/codemods
@cloudflare/config
@cloudflare/containers-shared
create-cloudflare
@cloudflare/deploy-helpers
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-functions
@cloudflare/pages-shared
@cloudflare/runtime-types
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-plugin
@cloudflare/workers-auth
@cloudflare/workers-editor-shared
@cloudflare/workers-utils
wrangler
commit: |
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
There was a problem hiding this comment.
✅ Approved — A small, well-scoped permission change with matching tests and an accurate patch changeset. No issues found.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low. A miniflare patch changeset fits this change.
🔒 Security: ✅ LGTM
The change reduces the attack surface: the asset and Sites disk services now reject writes even when a caller reaches them directly.
📖 AGENTS.md: ✅ LGTM
Follows the repository's conventions: the behaviour is implemented in Miniflare so Wrangler, Vitest and Vite preview all get it, tests cover the change, and a changeset is included.
📋 Code Quality: ✅ LGTM
writable: false is set only on the assets and Workers Sites disk services. Each of these services is used only by its own namespace Worker, and those Workers only read from it, so asset serving works as before. Storage services that must stay writable (KV, R2, D1) are unchanged. The new test covers rejection of direct PUT and DELETE requests, asset updates after a reload, and KV persistence across reloads.
⚡ Performance: ✅ LGTM
No performance impact.
📝 Documentation: ✅ LGTM
The updated changeset describes the behaviour accurately. No public documentation is needed, because the change adds no configuration or API.
Reviewed commit: 2cfeb166
Miniflare's static assets and Workers Sites namespaces only read their disk services. Configure those services as read-only to match that contract, while preserving writable persistence services.
Adds coverage for direct disk-service PUT/DELETE rejection, ordinary asset serving, developer updates after reload, and KV persistence across reloads. Includes a Miniflare patch changeset.
Wrangler and Vitest inherit the behavior through Miniflare. Vite preview uses the same asset services; Vite dev continues to serve assets through its own middleware.
Validation passed: Miniflare build, 77 assets/Workers Sites/KV tests, package TypeScript check, type-aware lint, and formatting. Separate consumer end-to-end suites were not run.