debugbundle 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd8a77046a7f20cf6971b6e73ca8e5c7557738706e32e3b30e741f3410f8d00a
-  data.tar.gz: 0bd638cf69ff2c6894706b1bc996f801e849b6f5a5c134543a3a18d1c598725f
+  metadata.gz: e2430cc8a51d6a72fa6e52896ac7b7c1be9ccc810fab56e154aae1bc76bc4aa6
+  data.tar.gz: 04a32dd64f1bb5b39ebb636c5db76eee2148ae7be3b888d15e0e351734dd2084
 SHA512:
-  metadata.gz: c9431211f33958cf178a8ace0e01b3842a2a2ff1bed8e11129e053ceb6b8685ff17499d03c80bc3cfe3fc7fd6839eced529ab01238760f04a65f4181e6685507
-  data.tar.gz: f7a432f0dc42da84a44415c767610473d8f332577eeb658c1417e47e4227e2701f7143e67fb9a8fa40db700dfca9f9ba0f655fe270fbd779de0e499507dc6836
+  metadata.gz: 960d4640460f35d27c18cdf20529a9c57f0d68fcd1225d3d6d571579d6007103ecb9be21596db8946dc88e6e3aa857f8bdb191f9724fe76baa6dfd701d53d25f
+  data.tar.gz: c6fec66551b3b37eb6b84829f0bb567813d6ae81a16e752851f02cabffb6d5b4911b28576b07ad6ea6e024f6a0a3daa9e5db78bfd96e21e063521ae732554fe0

data/lib/debugbundle/rack/relay_middleware.rb

@@ -19,7 +19,7 @@ module DebugBundle
         )
 
         body = response.body ? JSON.generate(response.body) : ''
-        [response.status, { 'Content-Type' => 'application/json' }, [body]]
+        [response.status, { 'Content-Type' => 'application/json' }.merge(response.headers || {}), [body]]
       end
 
       private

data/lib/debugbundle/rails/railtie.rb

@@ -23,6 +23,9 @@ if defined?(Rails::Railtie)
           app.middleware.use(DebugBundle::Rack::Middleware, client: client)
           if DebugBundle::Rails.relay_route_enabled?(app)
             app.routes.append do
+              match DebugBundle::Rails.relay_path(app),
+                    to: DebugBundle::Rails::RelayEndpoint.new(app: app),
+                    via: :options
               post DebugBundle::Rails.relay_path(app), to: DebugBundle::Rails::RelayEndpoint.new(app: app)
             end
           end

data/lib/debugbundle/relay/handler.rb

@@ -16,7 +16,7 @@ module DebugBundle
     DEFAULT_MAX_BODY_BYTES = 262_144
     DEFAULT_RATE_LIMIT_PER_MINUTE = 60
 
-    Response = Struct.new(:status, :body, keyword_init: true)
+    Response = Struct.new(:status, :body, :headers, keyword_init: true)
 
     class Handler
       def initialize(
@@ -51,57 +51,94 @@ module DebugBundle
       end
 
       def handle(request)
-        return Response.new(status: 405, body: nil) unless request.fetch(:method, 'POST').to_s.upcase == 'POST'
-
+        method = request.fetch(:method, 'POST').to_s.upcase
         headers = normalize_headers(request[:headers] || {})
-        return Response.new(status: 403, body: nil) unless origin_allowed?(headers)
-        unless json_content_type?(headers['content-type'])
-          return Response.new(status: 400,
-                              body: invalid_body('Relay requests must use Content-Type: application/json.'))
-        end
-
         raw_body = request[:body].to_s
-        return Response.new(status: 413, body: nil) if raw_body.bytesize > @max_body_bytes
-        return Response.new(status: 429, body: nil) if rate_limited?(request[:ip_address] || request[:ip])
-
-        decoded = JSON.parse(raw_body)
-        batch = decoded.fetch('batch')
-        unless batch.is_a?(Array)
-          return Response.new(status: 400,
-                              body: invalid_body('Relay request body must include a batch array.'))
-        end
+        return Response.new(status: 403, body: nil, headers: {}) unless origin_allowed?(headers)
 
-        accepted = []
-        errors = []
+        response_headers = source_origin(headers) ? cors_headers(source_origin(headers)) : {}
+        early_response = request_validation_response(
+          method: method,
+          headers: headers,
+          raw_body: raw_body,
+          ip_address: request[:ip_address] || request[:ip]
+        )
+        return with_headers(early_response, response_headers) if early_response
 
-        batch.each_with_index do |candidate, index|
-          sanitized = sanitize_event(candidate)
-          if sanitized
-            accepted << sanitized
-          else
-            errors << "batch[#{index}]: Invalid browser relay event payload."
-          end
-        end
+        accepted, errors = sanitize_batch(raw_body)
 
         deliver(accepted) unless accepted.empty?
 
-        unless errors.empty?
-          return Response.new(status: 400,
-                              body: { 'accepted' => accepted.length,
-                                      'rejected' => errors.length, 'errors' => errors })
-        end
-
-        Response.new(status: 202, body: { 'accepted' => accepted.length, 'rejected' => 0, 'errors' => [] })
+        with_headers(batch_response(accepted, errors), response_headers)
       rescue JSON::ParserError
-        Response.new(status: 400, body: invalid_body('Relay request body must be valid JSON.'))
+        with_headers(invalid_json_response, response_headers || {})
       rescue KeyError
-        Response.new(status: 400, body: invalid_body('Relay request body must include a batch array.'))
+        with_headers(missing_batch_response, response_headers || {})
       rescue StandardError
-        Response.new(status: 500, body: nil)
+        with_headers(Response.new(status: 500, body: nil), response_headers || {})
       end
 
       private
 
+      def with_headers(response, headers)
+        Response.new(status: response.status, body: response.body, headers: headers.merge(response.headers || {}))
+      end
+
+      def request_validation_response(method:, headers:, raw_body:, ip_address:)
+        return Response.new(status: 204, body: nil) if method == 'OPTIONS'
+        return Response.new(status: 405, body: nil) unless method == 'POST'
+        return invalid_content_type_response unless json_content_type?(headers['content-type'])
+        return Response.new(status: 413, body: nil) if raw_body.bytesize > @max_body_bytes
+        return Response.new(status: 429, body: nil) if rate_limited?(ip_address)
+
+        nil
+      end
+
+      def invalid_content_type_response
+        Response.new(
+          status: 400,
+          body: invalid_body('Relay requests must use Content-Type: application/json.')
+        )
+      end
+
+      def invalid_json_response
+        Response.new(status: 400, body: invalid_body('Relay request body must be valid JSON.'))
+      end
+
+      def missing_batch_response
+        Response.new(status: 400, body: invalid_body('Relay request body must include a batch array.'))
+      end
+
+      def batch_response(accepted, errors)
+        return invalid_batch_response(accepted, errors) unless errors.empty?
+
+        Response.new(
+          status: 202,
+          body: { 'accepted' => accepted.length, 'rejected' => 0, 'errors' => [] }
+        )
+      end
+
+      def invalid_batch_response(accepted, errors)
+        Response.new(
+          status: 400,
+          body: {
+            'accepted' => accepted.length,
+            'rejected' => errors.length,
+            'errors' => errors
+          }
+        )
+      end
+
+      def cors_headers(origin)
+        {
+          'Access-Control-Allow-Origin' => origin,
+          'Access-Control-Allow-Methods' => 'POST, OPTIONS',
+          'Access-Control-Allow-Headers' => 'content-type',
+          'Access-Control-Max-Age' => '600',
+          'Vary' => 'Origin'
+        }
+      end
+
       def deliver(events)
         service_name = @service || events.first.dig('service', 'name') || 'service'
 
@@ -118,6 +155,21 @@ module DebugBundle
         end
       end
 
+      def sanitize_batch(raw_body)
+        decoded = JSON.parse(raw_body)
+        batch = decoded.fetch('batch')
+        raise KeyError unless batch.is_a?(Array)
+
+        batch.each_with_index.with_object([[], []]) do |(candidate, index), (accepted, errors)|
+          sanitized = sanitize_event(candidate)
+          if sanitized
+            accepted << sanitized
+          else
+            errors << "batch[#{index}]: Invalid browser relay event payload."
+          end
+        end
+      end
+
       def sanitize_event(candidate)
         return nil unless candidate.is_a?(Hash)
 
@@ -175,7 +227,7 @@ module DebugBundle
       end
 
       def origin_allowed?(headers)
-        origin = headers['origin'] || origin_from_referer(headers['referer'])
+        origin = source_origin(headers)
         return false if origin.nil? || origin.empty?
 
         return @allowed_origins.include?(normalize_origin(origin)) if @allowed_origins.any?
@@ -188,6 +240,10 @@ module DebugBundle
         false
       end
 
+      def source_origin(headers)
+        headers['origin'] || origin_from_referer(headers['referer'])
+      end
+
       def origin_from_referer(referer)
         return nil if referer.to_s.empty?
 

data/lib/debugbundle/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DebugBundle
-  VERSION = '0.1.2'
+  VERSION = '0.1.4'
 end

data/spec/relay_spec.rb

@@ -73,6 +73,46 @@ RSpec.describe DebugBundle::Relay::Handler do
     expect(response.status).to eq(403)
   end
 
+  it 'answers allowed cross-origin preflight without delivering events' do
+    handler = described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
+                                  allowed_origins: ['https://web.example.com'])
+    response = handler.handle(
+      method: 'OPTIONS',
+      headers: {
+        'host' => 'api.example.com',
+        'origin' => 'https://web.example.com',
+        'access-control-request-method' => 'POST',
+        'access-control-request-headers' => 'content-type'
+      },
+      body: '',
+      ip_address: '127.0.0.1'
+    )
+
+    expect(response.status).to eq(204)
+    expect(response.headers).to include(
+      'Access-Control-Allow-Origin' => 'https://web.example.com',
+      'Access-Control-Allow-Methods' => 'POST, OPTIONS'
+    )
+  end
+
+  it 'adds CORS headers to accepted cross-origin relay posts' do
+    handler = described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
+                                  allowed_origins: ['https://web.example.com'])
+    response = handler.handle(
+      method: 'POST',
+      headers: {
+        'host' => 'api.example.com',
+        'origin' => 'https://web.example.com',
+        'content-type' => 'application/json'
+      },
+      body: JSON.generate('batch' => [browser_event]),
+      ip_address: '127.0.0.1'
+    )
+
+    expect(response.status).to eq(202)
+    expect(response.headers).to include('Access-Control-Allow-Origin' => 'https://web.example.com', 'Vary' => 'Origin')
+  end
+
   it 'supports a shared rate-limit store interface' do
     Dir.mktmpdir do |directory|
       store = Class.new do
@@ -172,7 +212,29 @@ RSpec.describe DebugBundle::Relay::Handler do
 
       expect(status).to eq(202)
       expect(headers).to include('Content-Type' => 'application/json')
+      expect(headers).to include('Access-Control-Allow-Origin' => 'https://app.example.com')
       expect(JSON.parse(body.fetch(0))).to include('accepted' => 1)
     end
   end
+
+  it 'exposes Rack preflight headers' do
+    middleware = DebugBundle::Rack::RelayMiddleware.new(
+      nil,
+      handler: described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
+                                   allowed_origins: ['https://web.example.com'])
+    )
+
+    status, headers, body = middleware.call(
+      'REQUEST_METHOD' => 'OPTIONS',
+      'HTTP_HOST' => 'api.example.com',
+      'HTTP_ORIGIN' => 'https://web.example.com',
+      'HTTP_ACCESS_CONTROL_REQUEST_METHOD' => 'POST',
+      'REMOTE_ADDR' => '127.0.0.1',
+      'rack.input' => StringIO.new('')
+    )
+
+    expect(status).to eq(204)
+    expect(headers).to include('Access-Control-Allow-Origin' => 'https://web.example.com')
+    expect(body.fetch(0)).to eq('')
+  end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: debugbundle
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.4
 platform: ruby
 authors:
 - DebugBundle
 bindir: exe
 cert_chain: []
-date: 2026-05-26 00:00:00.000000000 Z
+date: 2026-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64