@decocms/runtime 1.0.0-alpha.14 → 1.0.0-alpha.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/runtime",
-  "version": "1.0.0-alpha.14",
+  "version": "1.0.0-alpha.16",
   "type": "module",
   "dependencies": {
     "@cloudflare/workers-types": "^4.20250617.0",

package/src/cors.ts

@@ -0,0 +1,140 @@
+export type CORSOrigin =
+  | string
+  | string[]
+  | ((origin: string, req: Request) => string | null | undefined);
+
+export interface CORSOptions {
+  /**
+   * The value of "Access-Control-Allow-Origin" CORS header.
+   * Can be a string, array of strings, or a function that returns the allowed origin.
+   * @default '*'
+   */
+  origin?: CORSOrigin;
+  /**
+   * The value of "Access-Control-Allow-Methods" CORS header.
+   * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']
+   */
+  allowMethods?: string[];
+  /**
+   * The value of "Access-Control-Allow-Headers" CORS header.
+   * @default []
+   */
+  allowHeaders?: string[];
+  /**
+   * The value of "Access-Control-Max-Age" CORS header (in seconds).
+   */
+  maxAge?: number;
+  /**
+   * The value of "Access-Control-Allow-Credentials" CORS header.
+   */
+  credentials?: boolean;
+  /**
+   * The value of "Access-Control-Expose-Headers" CORS header.
+   * @default []
+   */
+  exposeHeaders?: string[];
+}
+
+const DEFAULT_ALLOW_METHODS = ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"];
+
+const resolveOrigin = (
+  origin: CORSOrigin | undefined,
+  requestOrigin: string | null,
+  req: Request,
+): string | null => {
+  if (!requestOrigin) return null;
+
+  if (origin === undefined || origin === "*") {
+    return "*";
+  }
+
+  if (typeof origin === "string") {
+    return origin === requestOrigin ? origin : null;
+  }
+
+  if (Array.isArray(origin)) {
+    return origin.includes(requestOrigin) ? requestOrigin : null;
+  }
+
+  if (typeof origin === "function") {
+    return origin(requestOrigin, req) ?? null;
+  }
+
+  return null;
+};
+
+const setCORSHeaders = (
+  headers: Headers,
+  req: Request,
+  options: CORSOptions,
+): void => {
+  const requestOrigin = req.headers.get("Origin");
+  const allowedOrigin = resolveOrigin(options.origin, requestOrigin, req);
+
+  if (allowedOrigin) {
+    headers.set("Access-Control-Allow-Origin", allowedOrigin);
+  }
+
+  if (options.credentials) {
+    headers.set("Access-Control-Allow-Credentials", "true");
+  }
+
+  if (options.exposeHeaders?.length) {
+    headers.set(
+      "Access-Control-Expose-Headers",
+      options.exposeHeaders.join(", "),
+    );
+  }
+};
+
+export const handlePreflight = (
+  req: Request,
+  options: CORSOptions,
+): Response => {
+  const headers = new Headers();
+  const requestOrigin = req.headers.get("Origin");
+  const allowedOrigin = resolveOrigin(options.origin, requestOrigin, req);
+
+  if (allowedOrigin) {
+    headers.set("Access-Control-Allow-Origin", allowedOrigin);
+  }
+
+  if (options.credentials) {
+    headers.set("Access-Control-Allow-Credentials", "true");
+  }
+
+  const allowMethods = options.allowMethods ?? DEFAULT_ALLOW_METHODS;
+  headers.set("Access-Control-Allow-Methods", allowMethods.join(", "));
+
+  const requestHeaders = req.headers.get("Access-Control-Request-Headers");
+  if (options.allowHeaders?.length) {
+    headers.set(
+      "Access-Control-Allow-Headers",
+      options.allowHeaders.join(", "),
+    );
+  } else if (requestHeaders) {
+    // Mirror the requested headers if no explicit allowHeaders configured
+    headers.set("Access-Control-Allow-Headers", requestHeaders);
+  }
+
+  if (options.maxAge !== undefined) {
+    headers.set("Access-Control-Max-Age", options.maxAge.toString());
+  }
+
+  return new Response(null, { status: 204, headers });
+};
+
+export const withCORS = (
+  response: Response,
+  req: Request,
+  options: CORSOptions,
+): Response => {
+  const newHeaders = new Headers(response.headers);
+  setCORSHeaders(newHeaders, req, options);
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: newHeaders,
+  });
+};

package/src/index.ts

@@ -10,12 +10,14 @@ import {
   MCPServer,
 } from "./tools.ts";
 import type { Binding, ContractBinding, MCPBinding } from "./wrangler.ts";
+import { type CORSOptions, handlePreflight, withCORS } from "./cors.ts";
 export { proxyConnectionForId } from "./bindings.ts";
 export {
   createMCPFetchStub,
   type CreateStubAPIOptions,
   type ToolBinder,
 } from "./mcp.ts";
+export { type CORSOptions, type CORSOrigin } from "./cors.ts";
 
 export interface DefaultEnv<TSchema extends z.ZodTypeAny = any> {
   MESH_REQUEST_CONTEXT: RequestContext<TSchema>;
@@ -56,6 +58,11 @@ export interface UserDefaultExport<
     env: TEnv,
     ctx: ExecutionContext,
   ) => Promise<Response> | Response;
+  /**
+   * CORS configuration options.
+   * Set to `false` to disable CORS handling entirely.
+   */
+  cors?: CORSOptions | false;
 }
 
 // 1. Map binding type to its interface
@@ -228,6 +235,8 @@ export const withRuntime = <TEnv, TSchema extends z.ZodTypeAny = never>(
   userFns: UserDefaultExport<TEnv, TSchema>,
 ): ExportedHandler<TEnv & DefaultEnv<TSchema>> => {
   const server = createMCPServer<TEnv, TSchema>(userFns);
+  const corsOptions = userFns.cors;
+
   const fetcher = async (
     req: Request,
     env: TEnv & DefaultEnv<TSchema>,
@@ -265,22 +274,38 @@ export const withRuntime = <TEnv, TSchema extends z.ZodTypeAny = never>(
       new Response("Not found", { status: 404 })
     );
   };
+
   return {
     fetch: async (
       req: Request,
       env: TEnv & DefaultEnv<TSchema>,
       ctx: ExecutionContext,
     ) => {
+      // Handle CORS preflight (OPTIONS) requests
+      if (corsOptions !== false && req.method === "OPTIONS") {
+        const options = corsOptions ?? {};
+        return handlePreflight(req, options);
+      }
+
       const bindings = withBindings({
         env,
         server,
         tokenOrContext: req.headers.get("x-mesh-token") ?? undefined,
         url: req.url,
       });
-      return await State.run(
+
+      const response = await State.run(
         { req, env: bindings, ctx },
         async () => await fetcher(req, bindings, ctx),
       );
+
+      // Add CORS headers to response
+      if (corsOptions !== false) {
+        const options = corsOptions ?? {};
+        return withCORS(response, req, options);
+      }
+
+      return response;
     },
   };
 };