fix(fetch): restore RequestInit.redirect mode selection, add end-to-end coverage

changelog.d/11162-fetch-redirect-modes.md

@@ -0,0 +1,6 @@
+`fetch` redirects now match Node 26.5.1's observable results beyond mode selection (which #11066's port, 42fcb5f66b, already restored):
+
+- `redirect: 'error'` hitting a 3xx now rejects with `TypeError: fetch failed` whose cause is `Error("unexpected redirect")` with no `.code`. It used to surface turnloop-http's `redirect mode is error` with `code: 'UND_ERR_REQ_RETRY'`. Exceeding the 20-redirect limit likewise rejects with `Error("redirect count exceeded")` and no `.code`, where the old cause carried `UND_ERR_REDIRECT` (`turnloop_bridge::failure_for`).
+- `Response.type` is `"cors"` once a followed redirect hop leaves the request's first origin, and it stays `"cors"` even if a later hop returns (A -> B -> A), which is undici's sticky response tainting. It was hardcoded to `"basic"`. A direct request to another origin with no redirect stays `"basic"`. The engine tracks this as `ResponseOut::cross_origin_redirect`.
+
+Adds `test-files/test_gap_fetch_redirect_modes.ts`: two local `node:http` servers (a genuine second origin) driving follow/manual/error across 301-308, a mixed chain, cross-origin hops (including A -> B -> A), a direct cross-origin request, and a redirect-limit loop. Also adds an `absent_redirect_lowers_to_none` HIR lowering test.

crates/perry-hir/tests/fetch_redirect_lowering.rs

@@ -54,3 +54,11 @@ fn redirect_shorthand_is_preserved() {
         "shorthand redirect option must remain attached to FetchWithOptions"
     );
 }
+
+#[test]
+fn absent_redirect_lowers_to_none() {
+    let module = lower_src(r#"fetch("http://example.test/start", { method: "GET" });"#)
+        .expect("fetch without redirect should lower");
+
+    assert!(redirect_expr(&module).is_none());
+}

crates/perry-stdlib/src/fetch/turnloop_bridge.rs

@@ -268,6 +268,14 @@ fn store(response: ResponseOut) -> usize {
     for (name, value) in response.headers {
         headers.append(&name, &value);
     }
+    // `"cors"` exactly when a followed redirect hop left the request's first
+    // origin (see `ResponseOut::cross_origin_redirect`); `"basic"` otherwise.
+    let type_name = if response.cross_origin_redirect {
+        "cors"
+    } else {
+        "basic"
+    }
+    .to_string();
     let id = alloc_fetch_handle_id();
     FETCH_RESPONSES.lock().unwrap().insert(
         id,
@@ -278,7 +286,7 @@ fn store(response: ResponseOut) -> usize {
             body: response.body,
             body_present: true,
             body_used: false,
-            type_name: "basic".to_string(),
+            type_name,
             url: response.final_url,
             redirected: response.redirected,
             cached_headers_id: None,
@@ -290,5 +298,21 @@ fn store(response: ResponseOut) -> usize {
 }
 
 fn failure_for(error: ClientError) -> FetchFailure {
-    FetchFailure::from_client(error.code, error.message, error.syscall)
+    // The engine's two redirect refusals carry a `code` Node's own rejection
+    // does not: measured against Node 26.5.1, `redirect: 'error'` hitting a
+    // 3xx rejects with `cause = Error("unexpected redirect")` (no `.code`),
+    // and exceeding the redirect limit rejects with
+    // `cause = Error("redirect count exceeded")` (also no `.code`) — unlike a
+    // real transport failure (`ENOTFOUND`, …), whose cause does carry one.
+    // turnloop-http's text already matches the second message; the first
+    // needs remapping from "redirect mode is error" to Node's wording.
+    match (error.code, error.message.as_str()) {
+        ("UND_ERR_REQ_RETRY", "redirect mode is error") => {
+            FetchFailure::refused("unexpected redirect", None)
+        }
+        ("UND_ERR_REDIRECT", "redirect count exceeded") => {
+            FetchFailure::refused("redirect count exceeded", None)
+        }
+        _ => FetchFailure::from_client(error.code, error.message, error.syscall),
+    }
 }

crates/perry-stdlib/src/turnloop_client/exchange.rs

@@ -1096,6 +1096,11 @@ fn on_end(engine: &mut Engine, conn_id: i64) {
             REDIRECTS.fetch_add(1, Ordering::Relaxed);
             if let Some(req) = engine.requests.get_mut(&req_id) {
                 req.redirected = true;
+                if !req.cross_origin_redirect {
+                    req.cross_origin_redirect = url::Url::parse(&req.spec.url)
+                        .map(|first| first.origin() != req.request.url.origin())
+                        .unwrap_or(false);
+                }
                 req.conn = None;
                 req.retried = false;
                 // Re-resolve the route for the NEW url. `HTTP_PROXY` and
@@ -1127,6 +1132,7 @@ fn on_end(engine: &mut Engine, conn_id: i64) {
                     body: if req.streaming { Vec::new() } else { body },
                     final_url: req.request.url.as_str().to_string(),
                     redirected: req.redirected,
+                    cross_origin_redirect: req.cross_origin_redirect,
                 })
             });
             if let Some(response) = response {

crates/perry-stdlib/src/turnloop_client/mod.rs

@@ -234,6 +234,14 @@ pub(crate) struct ResponseOut {
     pub(crate) body: Vec<u8>,
     pub(crate) final_url: String,
     pub(crate) redirected: bool,
+    /// True once any followed redirect hop landed on an origin other than the
+    /// one `submit` was called with. `fetch`'s `store()` reports such a
+    /// response as `type: "cors"`: undici taints the response the first time
+    /// a hop's URL is not same-origin with the request's first URL and never
+    /// un-taints it, so an A -> B -> A chain is still `"cors"` (measured
+    /// against Node 26.5.1). A direct cross-origin request with no redirect
+    /// stays `"basic"` — there is no page origin server-side.
+    pub(crate) cross_origin_redirect: bool,
 }
 
 pub(crate) enum Outcome {
@@ -336,6 +344,9 @@ struct Req {
     decoded: Vec<u8>,
     /// True once a redirect has been followed, for `response.redirected`.
     redirected: bool,
+    /// True once a followed redirect reached a different origin than
+    /// `spec.url`'s. Sticky, for `ResponseOut::cross_origin_redirect`.
+    cross_origin_redirect: bool,
     /// True once the final head has been streamed to a streaming sink.
     streaming: bool,
     /// Set when the request has been retried once after an idle-connection
@@ -641,6 +652,7 @@ fn start_here(spec: RequestSpec, sink: Sink, prepared: Prepared) -> Result<(), D
                 decoder: None,
                 decoded: Vec::new(),
                 redirected: false,
+                cross_origin_redirect: false,
                 streaming: false,
                 retried: false,
                 delivered: false,

test-files/test_gap_fetch_redirect_modes.ts

@@ -0,0 +1,275 @@
+// End-to-end coverage for fetch's three RequestInit.redirect modes
+// ('follow', 'manual', 'error') (#11136). The mode plumbing itself is unit
+// tested (the FetchRedirectMode -> turnloop_http::client::RedirectMode
+// mapping, the HIR lowering); nothing else exercises the engine's actual
+// follow/expose-as-is/reject behavior end to end, the rejection shape, or
+// the 'redirected' / 'type' / final-url response metadata that go with it.
+//
+// Two local `node:http` servers on ephemeral ports stand in for two distinct
+// origins, so a redirect between them is a genuine cross-origin hop (the
+// `Authorization` header must be stripped). Ports are never printed --
+// only normalized origin labels -- and nothing here depends on wall-clock
+// time, so the output is deterministic across runs and across the Perry /
+// Node oracle comparison.
+//
+// Measured against Node 26.5.1 (see the fix commit for the full transcript):
+// - `redirect: 'manual'` on a 3xx does NOT produce a WHATWG "opaqueredirect"
+//   filtered response (status 0, no headers) the way a browser's CORS layer
+//   would. Node's fetch exposes the raw 3xx response as-is: real status,
+//   real headers (including Location), type "basic", `redirected: false`,
+//   and `url` equal to the REQUESTED url, not the Location target.
+// - `redirect: 'error'` hitting a 3xx rejects with `TypeError: fetch failed`
+//   whose cause is a bare `Error("unexpected redirect")` -- no `.code`.
+// - Exceeding the redirect limit (20, matching turnloop-http's
+//   DEFAULT_MAX_REDIRECTS) rejects the same way, cause
+//   `Error("redirect count exceeded")`, also no `.code`.
+// - `type` is "cors" once any followed hop leaves the request's first
+//   origin, and stays "cors" even if a later hop comes back (A -> B -> A).
+//   A direct request to another origin, with no redirect, is "basic".
+
+import { createServer } from "node:http";
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+function j(value: unknown): string {
+  return JSON.stringify(value);
+}
+
+function listen(server: ReturnType<typeof createServer>): Promise<string> {
+  return new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      resolve(`http://127.0.0.1:${port}`);
+    });
+  });
+}
+
+function readBody(req: IncomingMessage): Promise<string> {
+  return new Promise((resolve) => {
+    let body = "";
+    req.on("data", (chunk: Buffer) => {
+      body += chunk.toString("utf8");
+    });
+    req.on("end", () => resolve(body));
+  });
+}
+
+async function main(): Promise<void> {
+  let originA = "";
+  let originB = "";
+  let loopHits = 0;
+
+  // Origin B: only ever reached via the cross-origin hop from origin A.
+  const serverB = createServer((req: IncomingMessage, res: ServerResponse) => {
+    if (req.url === "/landed") {
+      const auth = req.headers["authorization"] ?? null;
+      res.writeHead(200, { "content-type": "text/plain" });
+      res.end("landed auth=" + j(auth));
+      return;
+    }
+    if (req.url === "/back") {
+      res.writeHead(302, { Location: originA + "/final", "content-length": "0" });
+      res.end();
+      return;
+    }
+    res.writeHead(404, { "content-length": "0" });
+    res.end();
+  });
+
+  // Origin A: every redirect shape under test.
+  const serverA = createServer((req: IncomingMessage, res: ServerResponse) => {
+    const url = req.url ?? "";
+    const redirectTo = (status: number, location: string) => {
+      res.writeHead(status, { Location: location, "content-length": "0" });
+      res.end();
+    };
+
+    if (url === "/loop") {
+      loopHits++;
+      redirectTo(302, "/loop");
+      return;
+    }
+    if (url === "/r301") return redirectTo(301, "/final");
+    if (url === "/r302") return redirectTo(302, "/final");
+    if (url === "/r303") return redirectTo(303, "/final");
+    if (url === "/r307") return redirectTo(307, "/final");
+    if (url === "/r308") return redirectTo(308, "/final");
+    // A mixed chain: 302 (rewriting) -> 307 (preserving) -> 303 (rewriting,
+    // already-GET no-op by the time it's reached).
+    if (url === "/chain1") return redirectTo(302, "/chain2");
+    if (url === "/chain2") return redirectTo(307, "/chain3");
+    if (url === "/chain3") return redirectTo(303, "/final");
+    if (url === "/crosshop") return redirectTo(302, originB + "/landed");
+    if (url === "/crossback") return redirectTo(302, originB + "/back");
+    if (url === "/final") {
+      readBody(req).then((body) => {
+        const auth = req.headers["authorization"] ?? null;
+        res.writeHead(200, { "content-type": "text/plain" });
+        res.end("method=" + req.method + " body=" + j(body) + " auth=" + j(auth));
+      });
+      return;
+    }
+    res.writeHead(404, { "content-length": "0" });
+    res.end();
+  });
+
+  originB = await listen(serverB);
+  originA = await listen(serverA);
+
+  function normalize(url: string): string {
+    return url.replace(originA, "http://origin-a").replace(originB, "http://origin-b");
+  }
+
+  async function reportResponse(label: string, res: Response): Promise<void> {
+    const body = await res.text().catch((e: any) => "TEXT_ERROR:" + e?.message);
+    console.log(
+      label +
+        " status=" + res.status +
+        " redirected=" + res.redirected +
+        " type=" + res.type +
+        " ok=" + res.ok +
+        " url=" + normalize(res.url) +
+        " body=" + j(body)
+    );
+  }
+
+  async function reportManual(label: string, res: Response): Promise<void> {
+    await reportResponse(label, res);
+    console.log(
+      label +
+        " location=" + j(res.headers.get("location")) +
+        " content-length=" + j(res.headers.get("content-length")) +
+        " bodyUsed=" + res.bodyUsed
+    );
+  }
+
+  async function reportThrow(label: string, go: () => Promise<Response>): Promise<void> {
+    try {
+      const res = await go();
+      console.log(label + " NO_THROW status=" + res.status);
+    } catch (error: any) {
+      const cause = error?.cause;
+      console.log(
+        label +
+          " threw " + error?.name + " " + j(error?.message) +
+          " cause=" + (cause ? cause.name + " " + j(cause.message) : "none") +
+          " causeCode=" + j(cause?.code ?? null)
+      );
+    }
+  }
+
+  // --- follow mode (default): every status code, simple GET ---
+  for (const code of [301, 302, 303, 307, 308]) {
+    const res = await fetch(originA + "/r" + code);
+    await reportResponse("follow GET " + code, res);
+  }
+
+  // --- follow mode: POST + body, contrasting 301/302/303 (method rewritten
+  // to GET, body cleared) against 307/308 (method and body preserved) ---
+  for (const code of [301, 302, 303, 307, 308]) {
+    const res = await fetch(originA + "/r" + code, {
+      method: "POST",
+      body: "payload-" + code,
+      headers: { Authorization: "Bearer same-origin-token" },
+    });
+    await reportResponse("follow POST " + code, res);
+  }
+
+  // --- follow mode: a mixed multi-hop chain (302 -> 307 -> 303 -> 200) ---
+  {
+    const res = await fetch(originA + "/chain1", {
+      method: "POST",
+      body: "chain-body",
+    });
+    await reportResponse("follow chain", res);
+  }
+
+  // --- follow mode: explicit redirect: 'follow' is identical to the default ---
+  {
+    const res = await fetch(originA + "/r302", { redirect: "follow" });
+    await reportResponse("follow explicit r302", res);
+  }
+
+  // --- follow mode: cross-origin hop strips Authorization ---
+  {
+    const res = await fetch(originA + "/crosshop", {
+      headers: { Authorization: "Bearer cross-origin-token" },
+    });
+    await reportResponse("follow crosshop", res);
+  }
+
+  // --- follow mode: A -> B -> A; the response stays tainted "cors" ---
+  {
+    const res = await fetch(originA + "/crossback");
+    await reportResponse("follow crossback", res);
+  }
+
+  // --- a direct request to the second origin, no redirect: "basic" ---
+  {
+    const res = await fetch(originB + "/landed");
+    await reportResponse("direct origin-b", res);
+  }
+
+  // --- follow mode: too many redirects (loop exceeding the follow limit) ---
+  await reportThrow("follow loop", () => fetch(originA + "/loop"));
+  console.log("follow loop hits=" + loopHits);
+
+  // --- manual mode: exposes the 3xx response as-is, does not follow ---
+  {
+    const res = await fetch(originA + "/r301", { redirect: "manual" });
+    await reportManual("manual r301", res);
+  }
+  {
+    const res = await fetch(originA + "/r302", { redirect: "manual" });
+    await reportManual("manual r302", res);
+  }
+  {
+    const res = await fetch(originA + "/r307", {
+      method: "POST",
+      body: "manual-body",
+      redirect: "manual",
+    });
+    await reportManual("manual POST r307", res);
+  }
+
+  // --- manual mode: a non-redirect (200) response is unaffected ---
+  {
+    const res = await fetch(originA + "/final", { redirect: "manual" });
+    await reportResponse("manual final200", res);
+  }
+
+  // --- error mode: rejects the moment a redirect status is seen ---
+  await reportThrow("error r302", () => fetch(originA + "/r302", { redirect: "error" }));
+  await reportThrow("error r307", () => fetch(originA + "/r307", { redirect: "error" }));
+
+  // --- error mode: a non-redirect (200) response does not throw ---
+  {
+    const res = await fetch(originA + "/final", { redirect: "error" });
+    await reportResponse("error final200", res);
+  }
+
+  serverA.close();
+  serverB.close();
+}
+
+main();
+
+/*
+@covers
+crates/perry-stdlib/src/fetch/turnloop_bridge.rs:
+  - dispatch
+  - dispatch_inputs
+  - engine_redirect
+  - store
+  - failure_for
+crates/perry-stdlib/src/turnloop_client/exchange.rs:
+  - on_end
+crates/perry-stdlib/src/fetch/request_handle.rs:
+  - resolve_fetch_inputs
+crates/perry-stdlib/src/fetch/mod.rs:
+  - js_fetch_with_options
+crates/perry-runtime/src/object/global_fetch.rs:
+  - js_fetch_set_pending_redirect
+  - js_fetch_take_pending_redirect
+  - global_this_fetch_thunk
+*/