Files
twenty/packages/twenty-server/test/integration/rest/suites/front-component-built-js.integration-spec.ts
T
Félix Malfait 13f380b80d perf(front-component): fingerprint built-JS URLs by path for CDN caching (#22530)
**Stacked on #22523** — base is that branch, so the diff shows only this
commit. GitHub will retarget it to `main` automatically once #22523
merges.

Follows up on @FelixMalfait's question on #22523: move the
BuiltFrontComponent cache key from a query string into the path so it
plays well with Cloudflare cache rules.

## What

- URL: `/rest/front-components/:id?checksum=<c>` →
`/rest/front-components/:id/<c>.js` (`getFrontComponentUrl`).
- Route: the controller now accepts `[':frontComponentId',
':frontComponentId/:cacheKey']`. `:cacheKey` is a pure cache-buster the
server **ignores** — it still resolves by `:frontComponentId`, exactly
as the query param did.

## Why a path segment (not `:id-<checksum>.js`)

A path-based, extension-bearing URL is matched by Cloudflare's
**default** static-asset caching and by trivial `*.js` path cache rules,
and it's immune to any "ignore query string" cache setting that would
otherwise collapse `?checksum=` to one entry and serve stale JS.

I used a path **segment** (`/:id/:checksum.js`) rather than the literal
`:id-<checksum>.js` you sketched because the id is a **UUID — which
itself contains hyphens** — so a `-` separator is ambiguous to parse. A
segment is unambiguous and equally CDN-friendly (still ends in `.js`).

## Backward compatibility

The bare `:frontComponentId` route is kept, so URLs minted before this
deploys (query-string form, or in-flight pages) still resolve. It can be
dropped in a later release once no client mints the old form. No data
migration — the URL is computed at render time from `frontComponentId` +
`builtComponentChecksum`.

## ⚠️ Decision for you: this alone does not edge-cache — `private` vs
`public`

BFC is served behind `WorkspaceAuthGuard` and #22523 set its header to
**`private`**, max-age, immutable. `private` means shared caches
(Cloudflare) **won't** store it — so today this is browser-cache only,
and the path change just makes it *ready* for edge caching + clean cache
rules.

To actually get **edge** caching you'd additionally either flip BFC to
`public` or add a Cloudflare rule that overrides cache-control — which
means **accepting that the `id`+`checksum` URL becomes the access
capability** (a cache hit is served without re-checking origin auth).
The cache key is unique per component+build so there's no
cross-workspace mixup, but the built JS effectively becomes
public-by-URL (same posture PublicAsset already has). I've **left it
`private`** here; flipping to `public` is your call and can be a
one-line follow-up.

## Tests

- `getFrontComponentUrl` unit test: fingerprinted path when a checksum
is present, bare fallback otherwise.
- Integration test: the `/front-components/:id/:checksum.js` path serves
the built JS with `Content-Type: application/javascript` and
`Cache-Control: private, max-age=86400, immutable`. Existing bare-route
tests remain and still pass.

https://claude.ai/code/session_01AKwhTxYFDhWhCZ4b7sf35W

---
_Generated by [Claude
Code](https://claude.ai/code/session_01AKwhTxYFDhWhCZ4b7sf35W)_

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22530?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
2026-07-03 17:17:14 +02:00

138 lines
4.5 KiB
TypeScript

import { createFrontComponent } from 'test/integration/metadata/suites/front-component/utils/create-front-component.util';
import { deleteFrontComponent } from 'test/integration/metadata/suites/front-component/utils/delete-front-component.util';
import { seedBuiltFrontComponentFile } from 'test/integration/metadata/suites/front-component/utils/seed-built-front-component-file.util';
import { makeRestAPIRequest } from 'test/integration/rest/utils/make-rest-api-request.util';
import { expectOneNotInternalServerErrorHttpResponseSnapshot } from 'test/integration/utils/expect-one-not-internal-server-error-http-response-snapshot.util';
const BUILT_COMPONENT_PATH = 'src/front-components/test-endpoint.mjs';
describe('Front component built JS endpoint', () => {
let frontComponentId: string;
let cleanupBuiltFile: (() => void) | undefined;
beforeAll(async () => {
const { cleanup } = await seedBuiltFrontComponentFile({
builtComponentPath: BUILT_COMPONENT_PATH,
});
cleanupBuiltFile = cleanup;
const { data } = await createFrontComponent({
expectToFail: false,
input: {
name: 'testBuiltJsEndpoint',
componentName: 'TestBuiltJsEndpoint',
sourceComponentPath: 'src/front-components/test-endpoint.tsx',
builtComponentPath: BUILT_COMPONENT_PATH,
builtComponentChecksum: 'test-checksum-123',
},
});
frontComponentId = data.createFrontComponent.id;
});
afterAll(async () => {
if (frontComponentId) {
await deleteFrontComponent({
expectToFail: false,
input: { id: frontComponentId },
});
}
cleanupBuiltFile?.();
});
it('should serve the built JS file with correct content type', async () => {
await makeRestAPIRequest({
method: 'get',
path: `/front-components/${frontComponentId}`,
bearer: APPLE_JANE_ADMIN_ACCESS_TOKEN,
})
.expect(200)
.expect('Content-Type', /application\/javascript/)
.expect((res) => {
expect(res.text).toBe('dummy built component content');
});
});
it('should serve the built JS from the checksum-fingerprinted path with an immutable cache header', async () => {
await makeRestAPIRequest({
method: 'get',
path: `/front-components/${frontComponentId}/test-checksum-123.js`,
bearer: APPLE_JANE_ADMIN_ACCESS_TOKEN,
})
.expect(200)
.expect('Content-Type', /application\/javascript/)
.expect('Cache-Control', 'private, max-age=86400, immutable')
.expect((res) => {
expect(res.text).toBe('dummy built component content');
});
});
it('should return 404 for a non-existent front component ID', async () => {
const nonExistentId = '00000000-0000-0000-0000-000000000000';
const response = await makeRestAPIRequest({
method: 'get',
path: `/front-components/${nonExistentId}`,
bearer: APPLE_JANE_ADMIN_ACCESS_TOKEN,
});
expectOneNotInternalServerErrorHttpResponseSnapshot(response);
});
it('should return 404 when front component exists but built file is missing on storage', async () => {
const missingBuiltPath = 'src/front-components/will-be-deleted.mjs';
const { cleanup } = await seedBuiltFrontComponentFile({
builtComponentPath: missingBuiltPath,
});
const { data } = await createFrontComponent({
expectToFail: false,
input: {
name: 'testMissingBuiltFile',
componentName: 'TestMissingBuiltFile',
sourceComponentPath: 'src/front-components/will-be-deleted.tsx',
builtComponentPath: missingBuiltPath,
builtComponentChecksum: 'will-be-deleted-checksum',
},
});
const missingFileComponentId = data.createFrontComponent.id;
cleanup();
try {
const response = await makeRestAPIRequest({
method: 'get',
path: `/front-components/${missingFileComponentId}`,
bearer: APPLE_JANE_ADMIN_ACCESS_TOKEN,
});
expectOneNotInternalServerErrorHttpResponseSnapshot(response);
} finally {
await deleteFrontComponent({
expectToFail: false,
input: { id: missingFileComponentId },
});
}
});
it('should return 403 when no token is provided', async () => {
await makeRestAPIRequest({
method: 'get',
path: `/front-components/${frontComponentId}`,
bearer: '',
}).expect(403);
});
it('should return 401 when an invalid token is provided', async () => {
await makeRestAPIRequest({
method: 'get',
path: `/front-components/${frontComponentId}`,
bearer: INVALID_ACCESS_TOKEN,
}).expect(401);
});
});