fix: render the nearest error page when a form submission receives a non-ActionResult error response

[Nic-Polumeyv]

closes #15737

Submitting a use:enhance form that trips the CSRF origin check does nothing visible. The 403 response is right there in the network tab:

{ "message": "Cross-site POST form submissions are forbidden" }

but it has no type, so it isn't an ActionResult and every branch in the submit handler and applyAction skips it. Non-JSON responses already become { type: 'error' } through the catch around deserialize, so JSON that isn't an ActionResult was the one shape that failed silently.

Error responses without a recognized type now throw into that same catch and render the nearest +error.svelte. A body shaped like an App.Error becomes page.error as-is, the way an error(403, { message }) body does. Anything else goes through handleError, which #16162 routed this catch through, so the hook keeps seeing these failures and page.error keeps its declared shape. 2xx responses are untouched.

PatrickG suggested rendering the error page in the issue. teemingc flagged the same gap in #10464 with a server-side shape fix in mind; doing it on the client also covers proxy and middleware responses that kit's server never shaped. #10855 reports the same class of unhelpful failure for non-action endpoints; the non-2xx half of it is covered here.

Responses that do parse as an ActionResult pass through regardless of status, which keeps the pattern that prompted the #13197 revert (#13397) working. The docs line that revert added says posting to a +server.js endpoint results in an error; with this change that error surfaces instead of failing silently.

The test mimics the CSRF response with an endpoint, since the real check can't fire same-origin in Playwright. It fails on version-3 and passes with this change, in dev and build. The hook suffix in two of the assertions is handleError running.

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

• Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 349456c:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/349456c2ad45d66f98915d54a1b61f605b4f5712

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16308

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 349456c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR