@decocms/runtime 1.0.0-alpha.26 → 1.0.0-alpha.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/runtime",
-  "version": "1.0.0-alpha.26",
+  "version": "1.0.0-alpha.28",
   "type": "module",
   "dependencies": {
     "@cloudflare/workers-types": "^4.20250617.0",

package/src/index.ts

@@ -238,11 +238,25 @@ export const withBindings = <TEnv>({
   return env as TEnv;
 };
 
+const DEFAULT_CORS_OPTIONS = {
+  origin: (origin: string) => {
+    // Allow localhost and configured origins
+    if (origin.includes("localhost") || origin.includes("127.0.0.1")) {
+      return origin;
+    }
+    // TODO: Configure allowed origins from environment
+    return origin;
+  },
+  credentials: true,
+  allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+  allowHeaders: ["Content-Type", "Authorization", "mcp-protocol-version"],
+};
+
 export const withRuntime = <TEnv, TSchema extends z.ZodTypeAny = never>(
   userFns: UserDefaultExport<TEnv, TSchema>,
 ) => {
   const server = createMCPServer<TEnv, TSchema>(userFns);
-  const corsOptions = userFns.cors;
+  const corsOptions = userFns.cors ?? DEFAULT_CORS_OPTIONS;
   const oauth = userFns.oauth;
   const oauthHandlers = oauth ? createOAuthHandlers(oauth) : null;
 
@@ -296,7 +310,18 @@ export const withRuntime = <TEnv, TSchema extends z.ZodTypeAny = never>(
     if (url.pathname === "/mcp") {
       // If OAuth is configured, require authentication
       if (oauthHandlers && !oauthHandlers.hasAuth(req)) {
-        return oauthHandlers.createUnauthorizedResponse(req);
+        // Clone request to check method without consuming the original body
+        const clonedReq = req.clone();
+        try {
+          const body = (await clonedReq.json()) as { method?: string };
+          // Allow tools/list to pass without auth
+          if (body?.method !== "tools/list") {
+            return oauthHandlers.createUnauthorizedResponse(req);
+          }
+        } catch {
+          // If body parsing fails, require auth
+          return oauthHandlers.createUnauthorizedResponse(req);
+        }
       }
 
       return server.fetch(req, env, ctx);