fix(patches): sort endsWith checks by path length to prevent suffix collisions (#1166)

* fix(patches): sort endsWith checks by path length to prevent suffix collisions

Routes whose paths are suffixes of other routes (e.g. `/test/app` vs `/`)
were resolved to the wrong module because the shorter path matched first
in the generated `.endsWith()` chain.

Sort files by path length descending before generating the chain so that
longer (more specific) paths are always checked first.

Applied to all three `.endsWith()` chains:
- `getRequires()` in dynamic-requires.ts (JS files for requirePage and NodeModuleLoader)
- `htmlFiles` in dynamic-requires.ts (HTML files for requirePage)
- `getEvalManifestRule()` in load-manifest.ts (client-reference-manifest files)

* test: add unit tests for getRequires path sorting

Author: ash1day

.changeset/fix-dynamic-requires-suffix-collision.md

@@ -0,0 +1,9 @@
+---
+"@opennextjs/cloudflare": patch
+---
+
+fix: sort `.endsWith()` checks by path length descending to prevent suffix collisions in dynamic requires
+
+Routes whose paths are suffixes of other routes (e.g. `/test/app` vs `/`) were resolved incorrectly because the shorter path matched first in the generated `.endsWith()` chain. Sorting by path length descending ensures more specific (longer) paths are always checked first.
+
+Fixes #1156.

packages/cloudflare/src/cli/build/patches/plugins/dynamic-requires.spec.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from "vitest";
+
+import { getRequires } from "./dynamic-requires.js";
+
+describe("getRequires", () => {
+	test("sorts paths by length descending so longer paths match first", () => {
+		const files = ["app/page.js", "test/app/page.js", "page.js"];
+		const result = getRequires("id", files, "/server");
+
+		const endsWithPattern = /\.endsWith\("([^"]+)"\)/g;
+		const matches = [...result.matchAll(endsWithPattern)].map((m) => m[1]);
+
+		// Longer (more specific) paths should appear before shorter ones
+		expect(matches).toEqual(["test/app/page.js", "app/page.js", "page.js"]);
+	});
+
+	test("does not mutate the original files array", () => {
+		const files = ["b.js", "aa.js", "c.js"];
+		const original = [...files];
+		getRequires("id", files, "/server");
+
+		expect(files).toEqual(original);
+	});
+});

packages/cloudflare/src/cli/build/patches/plugins/dynamic-requires.ts

@@ -30,9 +30,13 @@ function getServerDir(buildOpts: BuildOptions) {
 	return join(buildOpts.outputDir, "server-functions/default", getPackagePath(buildOpts), ".next/server");
 }
 
-function getRequires(idVariable: string, files: string[], serverDir: string) {
+export function getRequires(idVariable: string, files: string[], serverDir: string) {
 	// Inline fs access and dynamic requires that are not supported by workerd.
-	return files
+	// Sort by path length descending so longer (more specific) paths match first.
+	// Without this, `/test/app/page.js` could match the `.endsWith("app/page.js")`
+	// check for `/` before reaching the correct `.endsWith("test/app/page.js")` check.
+	const sorted = [...files].sort((a, b) => b.length - a.length);
+	return sorted
 		.map(
 			(file) => `
     if (${idVariable}.replaceAll(${JSON.stringify(sep)}, ${JSON.stringify(posix.sep)}).endsWith(${JSON.stringify(normalizePath(file))})) {
@@ -111,7 +115,9 @@ async function getRequirePageRule(buildOpts: BuildOptions) {
 
 	const manifests = pagesManifests.concat(appPathsManifests);
 
-	const htmlFiles = manifests.filter((file) => file.endsWith(".html"));
+	// Sort html files by path length descending so longer (more specific) paths
+	// match first, preventing suffix collisions in the `.endsWith()` chain (see #1156).
+	const htmlFiles = manifests.filter((file) => file.endsWith(".html")).sort((a, b) => b.length - a.length);
 	const jsFiles = manifests.filter((file) => file.endsWith(".js"));
 
 	return {

packages/cloudflare/src/cli/build/patches/plugins/load-manifest.ts

@@ -100,7 +100,10 @@ async function getEvalManifestRule(buildOpts: BuildOptions) {
 		windowsPathsNoEscape: true,
 	});
 
-	const returnManifests = manifests
+	// Sort by path length descending so longer (more specific) paths match first,
+	// preventing suffix collisions in the `.endsWith()` chain (see #1156).
+	const sortedManifests = [...manifests].sort((a, b) => b.length - a.length);
+	const returnManifests = sortedManifests
 		.map((manifest) => {
 			const endsWith = normalizePath(relative(baseDir, manifest));
 			const key = normalizePath("/" + relative(appDir, manifest)).replace(