fix: allow commands from within endpoints

[dummdidumm]

fixes #14325

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4b4de69

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[MAttila42]

lgtm

[Rich-Harris]

I'm not sure this is quite right — surely we want to allow commands in POST requests etc, but not in GET/HEAD?

[MAttila42]

Are you suggesting that SvelteKit should not let developers use certain remote functions inside certain endpoints because of opinions?

[dummdidumm]

I'm not sure this is quite right — surely we want to allow commands in POST requests etc, but not in GET/HEAD?

For what technical reason?

[Rich-Harris]

RFC 9110 on HTTP semantics says this:

Request methods are considered "safe" if their defined semantics are essentially read-only; i.e., the client does not request, and does not expect, any state change on the origin server as a result of applying a safe method to a target resource. Likewise, reasonable use of a safe method is not expected to cause any harm, loss of property, or unusual burden on the origin server ... Of the request methods defined by this specification, the GET, HEAD, OPTIONS, and TRACE methods are defined to be safe.

GET and HEAD are safe — aka side-effect-free — methods. command and form are means of producing side-effects. They are incompatible.

[dummdidumm]

So no technical reason but spec reason. I'm fine looking into adjusting this, just wanted to clarify

implemented endpoint method check for commands

[svelte-docs-bot]

Preview: https://svelte-dev-git-preview-kit-14343-svelte.vercel.app/