zenstackhq / zenstack

Fullstack TypeScript toolkit that enhances Prisma ORM with flexible Authorization layer for RBAC/ABAC/PBAC/ReBAC, offering auto-generated type-safe APIs and frontend hooks.
https://zenstack.dev
MIT License
2.01k stars 85 forks source link

Error: Dynamic Code Evaluation (e. g. 'eval', 'new Function', 'WebAssembly.compile') not allowed in Edge Runtime #1672

Closed LilaRest closed 1 week ago

LilaRest commented 2 weeks ago

Description and expected behavior Hey there! I'm currently implement ZenStack in a NextJS project hosted on Cloudflare Pages (edge-runtime) so my entire application is set with:

export const runtime = "edge";

Development server works well, but as soon as I attempt a build, I obtain the error shown on the below screenshot. I tried to precisely follow the instructions from that documentation page, but the error persists.

Does anyone has an idea of what might be happening here?

Screenshots CleanShot 2024-08-30 at 19 25 35@2x

Environment (please complete the following information):

LilaRest commented 2 weeks ago

I managed to silent the error by the following dirty patch adding to my ./src/middleware.ts file:

export const config = {
  unstable_allowDynamic: [
    "/node_modules/**",
  ],
};

Now the app builds correctly and is deployed by Cloudflare Pages, but the entire website returns an "Error: 500", here is a screenshot of the logs:

CleanShot 2024-08-30 at 20 32 13@2x

LilaRest commented 2 weeks ago

After further investigation, I realize that both errors are the same. They refer to the usage of an evaluation code somewhere in the ZenStack enhancer. https://nextjs.org/docs/messages/edge-dynamic-code-evaluation

I tried to find any of these in the ZenStack code using the VSCode search bar, but I haven't found anything yet.

LilaRest commented 2 weeks ago

https://github.com/cloudflare/next-on-pages/issues/615

LilaRest commented 1 week ago

I tried to run the enhanced ZenStack client in an API route and get an even more explicit error: EvalError: Code generation from strings disallowed for this context.

There is definitely a dynamic code evaluation made somewhere in ZenStack runtime or one of its dependencies. Again, using the raw Prisma client works perfectly.

Happy to pay some $$ to prioritize this issue :)

ymc9 commented 1 week ago

Fixed in 2.5.0