chore: drop the server tests that only test the platform

[Nic-Polumeyv]

Two kinds of test in the moved server suite exercise nothing in kit under a direct Server.respond call.

Six of the eight CSRF cases repeat csrf.spec.js one for one: same origin, non-allowed origins, GET, non-form content types, the method loop, missing origin. Only the 403 body text and the csrf.trustedOrigins wiring are checked nowhere else, so those two stay.

The slow-read test hands the endpoint an in-memory buffer, so nothing is read slowly and the digest round-trip only proves Request.body. The backpressure it used to reach over HTTP has its own cases in node/index.spec.js.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from cab2a84:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/cab2a84e8d7dac42b89ab54c67fffc509f0007dc

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/17037

[changeset-bot]

⚠️ No Changeset found

Latest commit: cab2a84

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[svelte-docs-bot]

Preview: https://svelte-dev-git-preview-kit-17037-svelte.vercel.app/

[coderabbitai]

📝 Walkthrough

Walkthrough

The CSRF test suite now contains one successful POST form request from https://trusted.example.com. Tests for other origins, methods, content types, and missing origins were removed. The slow request-body hashing test was also removed.

Merge Risk: 🔵 Low · up to ef26f

This test-only change reduces CSRF coverage to a trusted-origin case, leaving configured trusted-origin propagation less protected against regression. The change is mergeable with owner awareness of this bounded coverage gap.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Backward Compatibility Impact Disclosure	✅ Passed	The pull request changes only the private test-basics test application. It removes a test route and test cases; it does not change @sveltejs/kit exports, package metadata, runtime source, request/…
Title check	✅ Passed	The title uses the required chore: prefix and accurately describes the removal of platform-only server tests.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (1)

packages/kit/test/apps/basics/unit-test/server.spec.js-201-201 (1)

201-201: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Retain multi-entry csrf.trustedOrigins coverage.

This test validates only one trusted-origin entry. packages/kit/src/runtime/server/csrf.spec.js also tests only a singleton trusted_origins array. If server configuration drops entries after the first, all remaining tests pass. Keep the additional trusted-origin case here, or add a focused test that passes at least two configured origins.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: QUIET

Plan: Advanced

Run ID: 06cdfebf-a730-47cc-96bc-22cbf983b8c3

📥 Commits

Reviewing files that changed from the base of the PR and between 7b36829 and ff6cb45.

📒 Files selected for processing (1)

• packages/kit/test/apps/basics/unit-test/server.spec.js

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• sveltejs/vite-plugin-svelte (manual)
• vitejs/vite (manual)
• sveltejs/svelte (manual)

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.

[coderabbitai]

🧹 Nitpick comments (1)

packages/kit/test/apps/basics/unit-test/server.spec.js (1)

176-190: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Align the retained CSRF test with the case it sends.

This test sends no Origin header, so it covers a missing origin, not an incorrect origin. Rename the test to reflect that case. The response text varies by method, not by content_type, so use one representative form content type per method.

Proposed narrowing

-	test('Blocks requests with incorrect origin', async () => {
-		const content_types = [
-			'application/x-www-form-urlencoded',
-			'multipart/form-data',
-			'text/plain',
-			'text/plaiN'
-		];
+	test('Reports forbidden response text for mutating form methods', async () => {
 		const methods = ['POST', 'PUT', 'PATCH', 'DELETE'];
 		for (const method of methods) {
-			for (const content_type of content_types) {
-				const res = await get('/csrf', { method, headers: { 'content-type': content_type } });
-				const message = `request method: ${method}, content-type: ${content_type}`;
+			const res = await get('/csrf', {
+				method,
+				headers: { 'content-type': 'application/x-www-form-urlencoded' }
+			});
+			const message = `request method: ${method}`;
 				expect(res.status, message).toBe(403);
 				expect(await res.text(), message).toBe(
 					`Cross-site ${method} form submissions are forbidden`
 				);
-			}
 		}
 	});

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: QUIET

Plan: Advanced

Run ID: 5f3b44b1-0548-4aa0-a4be-4ace4fa91141

📥 Commits

Reviewing files that changed from the base of the PR and between ff6cb45 and 75eb48d.

📒 Files selected for processing (2)

• packages/kit/test/apps/basics/src/routes/endpoint-input/sha256/+server.js
• packages/kit/test/apps/basics/unit-test/server.spec.js

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• sveltejs/vite-plugin-svelte (manual)
• vitejs/vite (manual)
• sveltejs/svelte (manual)

💤 Files with no reviewable changes (1)

• packages/kit/test/apps/basics/src/routes/endpoint-input/sha256/+server.js

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

[Rich-Harris]

I don't think unit-test is a good name for this directory, because the things in it aren't unit tests. Tbh I think the best thing would be to have test/playwright and test/vitest. That would make this PR much larger, so I'll make that change in a follow-up

[Rich-Harris]

ah whoops meant to comment that in #16872

[Nic-Polumeyv]

records.js exists because unit-test/server.spec.js runs under vitest and can't reach the fixtures, so it needs the helpers from a module that isn't the Playwright config. Is it ok to put it back?

[Rich-Harris]

Yeah I did a 'find all references' on #16872 and it didn't show up anywhere else, so I figured it had been part of an earlier exploration and was no longer needed. I think my language server was just glitching. I did put them back, downstack, but somehow that didn't affect this PR, which is further evidence that stacks are a stupid buggy feature that we should avoid like the plague. We should just have standalone PRs that target other branches like we used to — almost all the same benefits for authors but without the absolute clusterfuck that comes from trying to merge them. If this PR had been done like that we could just merge version-3 into it, but instead:

Your branch and 'origin/csrf-dedup' have diverged,
and have 6 and 5 different commits each, respectively.

Luckily in this case the merge conflict was trivial to resolve, but it could have been a real PITA