Support sourcemaps for client-only code?

[kentcdodds]

Due to a security issue, sourcemaps were made opt-in: #350

Luckily for me all my code is open source anyway so I can just enable them. But I think there's probably a lot of value for people who don't want their server-side source to be visible but want client-side sourcemaps. What are the chances we could get an option (or a default) that adds sourcemaps but only for the client-side code?

I'm not even sure how possible that would be, but if it were possible to have sourcemaps for my modules that somehow magically doesn't include any server code that would be a stellar default I think.

[jacob-ebey]

I will definitely be looking into how we can optimize to allow sourcemaps in the browser without the server portions being included. It's strange though because at that point it's not a true sourcemap, but more of a partial-sourcemap.

[kiliman]

The compiler makes 2 passes. One for the server build and the other for client. Each one includes the sourcemap: true/false flag, so it should be possible to generate just for client code. Just need to add a separate option for client/server sourcemaps.

from createBrowserBuild()

remix/packages/remix-dev/compiler.ts

Line 300 in e6e6e1c

sourcemap: options.sourcemap,

from createServerBuild()

remix/packages/remix-dev/compiler.ts

Line 339 in e6e6e1c

sourcemap: options.sourcemap,

[sergiodxa]

But the sourcemap is not going to still show the loader/action code of each route? Because that's the source code used to create both the server and browser build.

[kiliman]

Ah, I see what you mean. Yeah, I just checked the sourcemap generated for the route and "sourcesContent" includes the entire source of the file, not just the stripped/client version. I supposed you could post-process the sourcemap and simply hide all the code that's not supposed to be on the client (replace each line with a blank to preserve line numbers). You'd only need to do that on the production build.

[kiliman]

Hmm. Why is this closed? It’s still an issue although there is a warning now that you probably shouldn’t expose your source map on production.

I want to fix this so it post-processes the map file and strips server code from the route.

[machour]

Converting this to a Proposal discussion, as per our Development Process.

[ariofrio]

What I actually would want, I think, is the server sourcemap and the client sourcemap to be in different files, so that I can have the server sourcemap available for Node stacktraces in logs but block it from being accessible by browsers, while client sourcemaps are accessible by browsers to help with debugging.

[brettdh]

Very cool, thanks. I will hopefully get a chance to try this out soon (this week).

[brettdh]

Got a chance to try this today. I got an error with this message:

  messageText: "Cannot find module 'remix-development-tools/index.css' or its corresponding type declarations.",

This was part of a large object printed after the list of source files found. It looks to me like this is the result of `parseFromFiles, here.

The text field of the error contained this import statement:

      'import rdtStylesheet from "remix-development-tools/index.css"\n' +

which comes from my app/root.tsx file, as instructed here: https://github.com/Code-Forge-Net/Remix-Dev-Tools

The source code is proprietary, but please let me know if you want me to dig some other specific info out of the error.

[kiliman]

Yes, the current parser doesn't work well for our use case.

I've already rewritten it using the ts-morph package. Its AST handling is much better and easier.

I've changed my strategy from stripping "server code" to assuming we'll strip everything and only include "client code" and what it references. This will be much safer. It will also strip out comments (which may include sensitive info).

I hope to have something ready over the weekend.

[brettdh]

No rush, but since it's been a bit, I wanted to check in on this.

[kiliman]

It is still on my TODO list. I currently have family visiting this week. Also, I'm focusing on getting my Remix Packs project finished.

[mmachatschek]

For anyone following: #8613

[brettdh]

I'm trying to understand what, if anything, has changed with regard to server code appearing in client sourcemaps in the Vite plugin. I'd made a note to come back to this after upgrading to a Remix version with Vite support, thinking that there would be some change, but looking back at @kiliman 's earlier comment, perhaps not:

Yes, unfortunately even though Remix creates separate bundles for server and client, the sourcemap still contains the entire source of your route module (including loaders, etc.). This happens with both the default compiler as well as Vite.

The sourcemap will need to be post-processed to strip out the server code.