fix session subscription tracking

.changeset/odd-coats-shake.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+Fix session store subscription tracking during SSR

packages/kit/src/runtime/server/page/render.js

@@ -91,7 +91,14 @@ export async function render_response({
 			stores: {
 				page: writable(null),
 				navigating: writable(null),
-				session,
+				/** @type {import('svelte/store').Writable<App.Session>} */
+				session: {
+					...session,
+					subscribe: (fn) => {
+						is_private = true;
+						return session.subscribe(fn);
+					}
+				},
 				updated
 			},
 			/** @type {import('types').Page} */
@@ -129,17 +136,7 @@ export async function render_response({
 			props[`props_${i}`] = await branch[i].loaded.props;
 		}
 
-		let session_tracking_active = false;
-		const unsubscribe = session.subscribe(() => {
-			if (session_tracking_active) is_private = true;
-		});
-		session_tracking_active = true;
-
-		try {
-			rendered = options.root.render(props);
-		} finally {
-			unsubscribe();
-		}
+		rendered = options.root.render(props);
 	} else {
 		rendered = { head: '', html: '', css: { code: '', map: null } };
 	}

packages/kit/test/apps/basics/src/routes/caching/private/uses-session-in-init.svelte

@@ -0,0 +1,16 @@
+<script context="module">
+	/** @type {import('@sveltejs/kit').Load} */
+	export async function load() {
+		return {
+			maxage: 30
+		};
+	}
+</script>
+
+<script>
+	import { session } from '$app/stores';
+
+	const session_exists = !!$session;
+</script>
+
+<h1>this page will be cached for 30 seconds ({session_exists})</h1>

packages/kit/test/apps/basics/src/routes/caching/private/uses-session.svelte → packages/kit/test/apps/basics/src/routes/caching/private/uses-session-in-load.svelte

@@ -12,4 +12,8 @@
 	}
 </script>
 
-<h1>this page will be cached for 30 seconds</h1>
+<script>
+	export let session_exists;
+</script>
+
+<h1>this page will be cached for 30 seconds ({session_exists})</h1>

packages/kit/test/apps/basics/test/test.js

@@ -305,8 +305,13 @@ test.describe.parallel('Caching', () => {
 		expect(response.headers()['cache-control']).toBe('public, max-age=30');
 	});
 
-	test('sets cache-control: private if page uses session', async ({ request }) => {
-		const response = await request.get('/caching/private/uses-session');
+	test('sets cache-control: private if page uses session in load', async ({ request }) => {
+		const response = await request.get('/caching/private/uses-session-in-load');
+		expect(response.headers()['cache-control']).toBe('private, max-age=30');
+	});
+
+	test('sets cache-control: private if page uses session in init', async ({ request }) => {
+		const response = await request.get('/caching/private/uses-session-in-init');
 		expect(response.headers()['cache-control']).toBe('private, max-age=30');
 	});