@agent-native/core 0.7.51 → 0.7.52

package/dist/server/core-routes-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAwEvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AA6CvD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAuqDhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}
+{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAwEvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AA6CvD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAspDhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}

package/dist/server/core-routes-plugin.js

@@ -1,4 +1,5 @@
-import { getH3App, awaitBootstrap } from "./framework-request-handler.js";
+import { getH3App, awaitBootstrap, markDefaultPluginProvided, } from "./framework-request-handler.js";
+import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
 import { defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getHeader, } from "h3";
 import path from "node:path";
 import { createPollHandler } from "./poll.js";
@@ -94,6 +95,7 @@ function redactValues(text, values) {
  */
 export function createCoreRoutesPlugin(options = {}) {
     return async (nitroApp) => {
+        markDefaultPluginProvided(nitroApp, "core-routes");
         // No-op when called from inside the bootstrap (auto-mount path).
         // Otherwise wait so other default plugins finish mounting first.
         await awaitBootstrap(nitroApp);
@@ -192,12 +194,7 @@ export function createCoreRoutesPlugin(options = {}) {
         // requests against the template's server at a different port. We echo
         // the exact origin + Allow-Credentials so same-site localhost ports
         // can cross-send cookies.
-        const allowlist = (process.env.CORS_ALLOWED_ORIGINS ?? "")
-            .split(",")
-            .map((s) => s.trim())
-            .filter(Boolean);
-        const isProduction = process.env.NODE_ENV === "production";
-        const LOCALHOST_RE = /^https?:\/\/(localhost|127\.0\.0\.1|tauri\.localhost)(:\d+)?$/;
+        const allowlist = readCorsAllowedOrigins();
         getH3App(nitroApp).use(defineEventHandler((event) => {
             const pathname = stripAppBasePath(event.url?.pathname ??
                 String(event.node?.req?.url ?? event.path ?? "/").split("?")[0]);
@@ -211,28 +208,11 @@ export function createCoreRoutesPlugin(options = {}) {
             // first allowlist entry — that previously echoed `Access-Control-
             // Allow-Origin: <unrelated-allowed-origin>` for disallowed callers,
             // which is permissive enough that some clients followed through.
-            let allowedOrigin = null;
-            if (origin) {
-                if (allowlist.length > 0) {
-                    if (allowlist.includes(origin))
-                        allowedOrigin = origin;
-                }
-                else {
-                    // No allowlist configured. In production we only allow
-                    // localhost-style origins (desktop tray dev usage); in dev we
-                    // allow any origin echo. This prevents a fresh deploy without
-                    // CORS_ALLOWED_ORIGINS from accepting credentialed requests
-                    // from any origin.
-                    if (isProduction) {
-                        if (LOCALHOST_RE.test(origin))
-                            allowedOrigin = origin;
-                    }
-                    else {
-                        if (LOCALHOST_RE.test(origin))
-                            allowedOrigin = origin;
-                    }
-                }
-            }
+            const allowedOrigin = getAllowedCorsOrigin(origin, {
+                allowedOrigins: allowlist,
+                allowAnyOriginWhenNoAllowlist: false,
+                allowLocalhostWhenNoAllowlist: true,
+            });
             // Reject preflights from disallowed cross-origin callers BEFORE
             // returning 204. Previously the OPTIONS short-circuit returned 204
             // with no ACAO header, which the browser then treats as a CORS