fix: undefined HTTP method handlers not responding with 405

packages/start/api/utils.ts

@@ -0,0 +1,3 @@
+export function methodNotAllowed()  {
+  return new Response(null, { status: 405 });
+}

packages/start/fs-router/router.js

@@ -386,17 +386,20 @@ export function stringifyAPIRoutes(
    * @return {string}
    */
   function _stringifyRoutes(/** @type {(RouteConfig)[]} */ routes) {
+    const methodNotAllowed = jsFile.addNamedImport("methodNotAllowed", "solid-start/api/utils");
     return (
       `[\n` +
       routes
         .map(
           i =>
             `{\n${[
-              ...API_METHODS.filter(j => i.apiPath?.[j]).map(
-                v =>
-                  i.apiPath != null &&
-                  `${v}: ${jsFile.addNamedImport(v, path.posix.resolve(i.apiPath[v]))}`
-              ),
+              ...API_METHODS.map(v => {
+                if (i.componentPath && v === "GET")
+                  return undefined;
+                else if (i.apiPath?.[v])
+                  return `${v}: ${jsFile.addNamedImport(v, path.posix.resolve(i.apiPath[v]))}`;
+                return `${v}: ${methodNotAllowed}`;
+              }),
               i.componentPath ? `GET: "skip"` : undefined,
               `path: ${JSON.stringify(i.path)}`
             ]

test/api-routes-test.ts

@@ -131,6 +131,12 @@ test.describe("api routes", () => {
           "src/routes/api/[param]/index.js": js`
             import { json } from "solid-start/server";
             export let GET = ({ params }) => json(params);
+          `,
+          "src/routes/method-not-allowed.jsx": js`
+            export default function Page() { return <div>page</div>; }
+          `,
+          "src/routes/api/method-not-allowed.js": js`
+            export function POST () { return new Response(); }
           `
         }
       });
@@ -280,5 +286,23 @@ test.describe("api routes", () => {
       expect(res.headers.get("content-type")).toEqual("application/json; charset=utf-8");
       expect(await res.json()).toEqual({ static: true });
     });
+
+    test("should return 405 for undefined handlers on route with only a default export", async () => {
+      let res = await fixture.requestDocument("/method-not-allowed", { method: "GET" });
+      expect(res.status).toEqual(200);
+      ["POST", "PUT", "PATCH", "DELETE"].forEach(async method => {
+        res = await fixture.requestDocument("/method-not-allowed", { method });
+        expect(res.status).toEqual(405);
+      })
+    });
+
+    test("should return 405 for undefined handlers on route with only a POST export", async () => {
+      let res = await fixture.requestDocument("/api/method-not-allowed", { method: "POST" });
+      expect(res.status).toEqual(200);
+      ["GET", "PUT", "PATCH", "DELETE"].forEach(async method => {
+        res = await fixture.requestDocument("/api/method-not-allowed", { method });
+        expect(res.status).toEqual(405);
+      });
+    });
   }
 });