fix: run loaders before markdown negotiation (#161)

Author: JoviDeCroock

.changeset/fix-markdown-loader-bypass.md

@@ -0,0 +1,5 @@
+---
+"@pracht/core": patch
+---
+
+Fix Markdown-for-Agents negotiation so route loaders and document headers still run before returning markdown responses, preventing loader auth/header bypass.

docs/DATA_LOADING.md

@@ -32,8 +32,9 @@ export. Named route exports such as `loader`, `head`, `headers`, `markdown`,
 
 A `markdown` string export opts the route into Markdown-for-Agents content
 negotiation: when a request arrives with `Accept: text/markdown`, the runtime
-returns the raw markdown source with `Content-Type: text/markdown` instead of
-rendering the component.
+still executes middleware, the route loader, and document header resolution
+first, then returns the raw markdown source with `Content-Type: text/markdown`
+instead of rendering the component.
 
 ### LoaderArgs
 

packages/framework/src/runtime-negotiation.ts

@@ -40,11 +40,9 @@ export function prefersMarkdown(accept: string | null): boolean {
   return md.quality >= html.quality;
 }
 
-export function markdownResponse(source: string): Response {
-  const headers = new Headers({
-    "content-type": "text/markdown; charset=utf-8",
-    "cache-control": "public, max-age=0, must-revalidate",
-  });
+export function markdownResponse(source: string, initHeaders?: HeadersInit): Response {
+  const headers = new Headers(initHeaders);
+  headers.set("content-type", "text/markdown; charset=utf-8");
   appendVaryHeader(headers, "Accept");
   applyDefaultSecurityHeaders(headers);
   return new Response(source, { status: 200, headers });

packages/framework/src/runtime.ts

@@ -371,17 +371,6 @@ export async function handlePrachtRequest<TContext>(
         throw new Error("Route module not found");
       }
 
-      // Markdown-for-Agents negotiation: if the route exposes raw markdown
-      // and the client prefers `text/markdown`, skip render and return the
-      // source.
-      if (
-        !isRouteStateRequest &&
-        typeof routeModule.markdown === "string" &&
-        prefersMarkdown(options.request.headers.get("accept"))
-      ) {
-        return markdownResponse(routeModule.markdown);
-      }
-
       currentPhase = "loader";
       const { loader, loaderFile: resolvedLoaderFile } = await dataFunctionsPromise;
       loaderFile = resolvedLoaderFile;
@@ -410,6 +399,16 @@ export async function handlePrachtRequest<TContext>(
         mergeDocumentHeaders(shellModule, routeModule, routeArgs, data),
       ]);
 
+      // Markdown-for-Agents negotiation must run after loader + header
+      // resolution so auth redirects/401s and cache policies still apply.
+      if (
+        !isRouteStateRequest &&
+        typeof routeModule.markdown === "string" &&
+        prefersMarkdown(options.request.headers.get("accept"))
+      ) {
+        return markdownResponse(routeModule.markdown, documentHeaders);
+      }
+
       const cssUrls = resolvePageCssUrls(
         options.cssManifest,
         match.route.shellFile,

packages/framework/test/runtime-negotiation.test.ts

@@ -98,4 +98,37 @@ describe("handlePrachtRequest markdown negotiation", () => {
     expect(response.status).toBe(200);
     expect(response.headers.get("content-type")?.includes("text/html")).toBe(true);
   });
+
+  it("runs loader and preserves document headers before returning markdown", async () => {
+    let loaderCalls = 0;
+    const response = await handlePrachtRequest({
+      app,
+      registry: {
+        routeModules: {
+          "./routes/home.md": async () => ({
+            markdown: "# Home\n",
+            loader: () => {
+              loaderCalls += 1;
+              return { ok: true };
+            },
+            headers: () => ({
+              "cache-control": "private, no-store",
+              "x-route-headers": "yes",
+            }),
+            Component: () => null,
+          }),
+        },
+      },
+      request: new Request("http://localhost/", {
+        headers: { accept: "text/markdown" },
+      }),
+    });
+
+    expect(loaderCalls).toBe(1);
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toBe("text/markdown; charset=utf-8");
+    expect(response.headers.get("cache-control")).toBe("private, no-store");
+    expect(response.headers.get("x-route-headers")).toBe("yes");
+    expect(await response.text()).toBe("# Home\n");
+  });
 });