fix(nextjs): Align tunnel request matching in middleware with tunnel rewrite

The middleware wrapper treated every path under the tunnel route as a tunnel
request, while the tunnel rewrite only serves the exact route with the org and
project query params. Match tunnel requests the same way the rewrite does so
the two stay consistent.

Fixes JS-3719
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: chargome

packages/nextjs/src/common/utils/tunnelPathnameMatch.ts

@@ -6,3 +6,28 @@
 export function isPathnameUnderSentryTunnelRoute(pathname: string, tunnelPath: string): boolean {
   return pathname === tunnelPath || pathname.startsWith(`${tunnelPath}/`);
 }
+
+/**
+ * Returns true only for requests the tunnel rewrite (see `setUpTunnelRewriteRules`) would serve.
+ *
+ * This decides whether the user's middleware is skipped, so it must never be broader than the rewrite:
+ * anything it matches that Next.js does not rewrite to Sentry reaches the app without middleware.
+ */
+export function isSentryTunnelRequest(request: Request, tunnelPath: string): boolean {
+  // The SDK transport only ever sends POST requests
+  if (request.method !== 'POST') {
+    return false;
+  }
+
+  const url = new URL(request.url);
+
+  if (url.pathname !== tunnelPath && url.pathname !== `${tunnelPath}/`) {
+    return false;
+  }
+
+  // Next.js evaluates `has` conditions against the last value of a repeated query param, so every value has to qualify
+  return ['o', 'p'].every(key => {
+    const values = url.searchParams.getAll(key);
+    return values.length > 0 && values.every(value => /^\d+$/.test(value));
+  });
+}

packages/nextjs/src/common/wrapMiddlewareWithSentry.ts

@@ -9,7 +9,7 @@ import {
   withIsolationScope,
 } from '@sentry/core';
 import { flushSafelyWithTimeout, waitUntil } from '../common/utils/responseEnd';
-import { isPathnameUnderSentryTunnelRoute } from '../common/utils/tunnelPathnameMatch';
+import { isSentryTunnelRequest } from '../common/utils/tunnelPathnameMatch';
 import type { EdgeRouteHandler } from '../edge/types';
 
 /**
@@ -35,21 +35,15 @@ export function wrapMiddlewareWithSentry<H extends EdgeRouteHandler>(
       // TODO: This can never work with Turbopack, need to remove it for consistency between builds.
       if (tunnelRoute && typeof tunnelRoute === 'string') {
         const req: unknown = args[0];
-        // Check if the current request matches the tunnel route
-        if (req instanceof Request) {
-          const url = new URL(req.url);
-          const isTunnelRequest = isPathnameUnderSentryTunnelRoute(url.pathname, tunnelRoute);
-
-          if (isTunnelRequest) {
-            // Create a simple response that mimics NextResponse.next() so we don't need to import Next.js internals here
-            // https://github.com/vercel/next.js/blob/c12c9c1f78ad384270902f0890dc4cd341408105/packages/next/src/server/web/spec-extension/response.ts#L146
-            return new Response(null, {
-              status: 200,
-              headers: {
-                'x-middleware-next': '1',
-              },
-            }) as ReturnType<H>;
-          }
+        if (req instanceof Request && isSentryTunnelRequest(req, tunnelRoute)) {
+          // Create a simple response that mimics NextResponse.next() so we don't need to import Next.js internals here
+          // https://github.com/vercel/next.js/blob/c12c9c1f78ad384270902f0890dc4cd341408105/packages/next/src/server/web/spec-extension/response.ts#L146
+          return new Response(null, {
+            status: 200,
+            headers: {
+              'x-middleware-next': '1',
+            },
+          }) as ReturnType<H>;
         }
       }
 

packages/nextjs/test/config/wrappers.test.ts

@@ -112,7 +112,7 @@ describe('wrapMiddlewareWithSentry', () => {
     const wrappedOriginal = wrapMiddlewareWithSentry(origFunction);
 
     // Create a mock Request that matches the tunnel route
-    const mockRequest = new Request('https://example.com/monitoring/tunnel?o=123');
+    const mockRequest = new Request('https://example.com/monitoring/tunnel?o=123&p=456', { method: 'POST' });
 
     const result = await wrappedOriginal(mockRequest);
 
@@ -209,17 +209,37 @@ describe('wrapMiddlewareWithSentry', () => {
     expect(result).toBe(mockReturnValue);
   });
 
-  test('should skip processing for tunnel sub-paths under tunnelRoute', async () => {
-    (globalThis as any)._sentryRewritesTunnelPath = '/api/t';
+  test('should skip processing for the tunnel route with a trailing slash', async () => {
+    (globalThis as any)._sentryRewritesTunnelPath = '/monitoring';
 
     const origFunction: EdgeRouteHandler = vi.fn(async () => ({ status: 200 }));
     const wrappedOriginal = wrapMiddlewareWithSentry(origFunction);
 
-    const mockRequest = new Request('https://example.com/api/t/envelope?o=1');
+    await wrappedOriginal(new Request('https://example.com/monitoring/?o=123&p=456&r=us', { method: 'POST' }));
+
+    expect(origFunction).not.toHaveBeenCalled();
+  });
+
+  test.each([
+    ['a sub-path of the tunnel route', 'https://example.com/monitoring/anything/at/all?o=123&p=456', 'POST'],
+    ['a tunnel request without query params', 'https://example.com/monitoring', 'POST'],
+    ['a tunnel request without project id', 'https://example.com/monitoring?o=123', 'POST'],
+    ['a tunnel request with non-numeric ids', 'https://example.com/monitoring?o=abc&p=456', 'POST'],
+    ['a tunnel request with a repeated non-numeric org id', 'https://example.com/monitoring?o=123&o=abc&p=456', 'POST'],
+    ['a tunnel request with a repeated empty project id', 'https://example.com/monitoring?o=123&p=456&p=', 'POST'],
+    ['a non-POST tunnel request', 'https://example.com/monitoring?o=123&p=456', 'GET'],
+  ])('should run the middleware for %s', async (_, url, method) => {
+    (globalThis as any)._sentryRewritesTunnelPath = '/monitoring';
+
+    const mockReturnValue = { status: 200 };
+    const origFunction: EdgeRouteHandler = vi.fn(async (..._args) => mockReturnValue);
+    const wrappedOriginal = wrapMiddlewareWithSentry(origFunction);
+
+    const mockRequest = new Request(url, { method });
 
     const result = await wrappedOriginal(mockRequest);
 
-    expect(origFunction).not.toHaveBeenCalled();
-    expect(result).toBeDefined();
+    expect(origFunction).toHaveBeenCalledWith(mockRequest);
+    expect(result).toBe(mockReturnValue);
   });
 });