@easy-cms/core 0.1.0 → 0.2.0

package/dist/index.d.ts

@@ -412,6 +412,12 @@ interface Config {
      * so frontends on other origins can use them. Default: relative URLs.
      */
     readonly serverURL?: string;
+    /**
+     * Origins whose browser code may call the REST API (CORS), e.g. a Vite or React app on
+     * another origin. `'*'` allows any origin for anonymous requests. Origins in
+     * `auth.trustedOrigins` are always allowed, with cookies. Default: none.
+     */
+    readonly cors?: readonly string[] | '*';
     readonly routes?: RoutesConfig;
     readonly admin?: AdminConfig;
     readonly upload?: UploadConfig;
@@ -425,7 +431,8 @@ interface Config {
     readonly plugins?: readonly Plugin[];
 }
 /** The config after plugins ran, validation passed and defaults were applied. */
-interface ResolvedConfig extends Omit<Config, 'routes' | 'admin' | 'upload' | 'auth' | 'collections' | 'globals' | 'plugins'> {
+interface ResolvedConfig extends Omit<Config, 'cors' | 'routes' | 'admin' | 'upload' | 'auth' | 'collections' | 'globals' | 'plugins'> {
+    readonly cors: readonly string[] | '*';
     readonly routes: Required<RoutesConfig>;
     readonly admin: Required<AdminConfig>;
     readonly upload: Required<Omit<UploadConfig, 'storage'>> & Pick<UploadConfig, 'storage'>;

package/dist/index.js

@@ -867,6 +867,7 @@ function validateConfig(config) {
   validateAdmin(config, add);
   validateUpload(config, add);
   validateAuth(config, add);
+  validateCors(config.cors, add);
   const collections = asArray(config.collections, "collections", add);
   const globals = asArray(config.globals, "globals", add);
   const collectionSlugs = /* @__PURE__ */ new Set([...BUILTIN_COLLECTIONS]);
@@ -896,7 +897,11 @@ function validateConfig(config) {
 function validateSecret(secret, add) {
   const hint = `set EASY_CMS_SECRET to a random string of at least ${MIN_SECRET_LENGTH} characters, e.g. \`openssl rand -hex 32\``;
   if (typeof secret !== "string" || secret.length === 0) {
-    add("secret", "is required", hint);
+    add(
+      "secret",
+      "is required",
+      `${hint}. In production, set it in the server's environment: not every server reads .env (Nuxt's does not)`
+    );
   } else if (secret.length < MIN_SECRET_LENGTH) {
     add("secret", `must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length})`, hint);
   }
@@ -939,6 +944,21 @@ function validateAuth(config, add) {
     }
   }
 }
+function validateCors(cors, add) {
+  if (cors === void 0 || cors === "*") return;
+  if (!Array.isArray(cors)) {
+    add("cors", 'must be a list of origins or "*"', 'cors: ["https://my-site.com"]');
+    return;
+  }
+  for (const [i, origin] of cors.entries()) {
+    if (typeof origin !== "string" || !/^https?:\/\/[^/]+$/.test(origin)) {
+      add(
+        `cors[${i}]`,
+        `must be an origin like "https://example.com" (got ${JSON.stringify(origin)})`
+      );
+    }
+  }
+}
 function validateUpload(config, add) {
   const upload = config.upload;
   if (upload === void 0) return;
@@ -1121,6 +1141,7 @@ async function resolveConfig(input) {
   const { plugins: _plugins, ...rest } = config;
   const result = {
     ...rest,
+    cors: config.cors ?? [],
     routes: { api: `/${(config.routes?.api ?? DEFAULT_API_PATH).replace(/^\/+|\/+$/g, "")}` },
     admin: {
       path: config.admin?.path ?? DEFAULT_ADMIN_PATH,
@@ -1156,8 +1177,15 @@ var CONFIG_FILE_NAMES = [
 ];
 function findConfigFile(cwd = process.cwd()) {
   for (const name of CONFIG_FILE_NAMES) {
-    const path = resolve(cwd, name);
-    if (existsSync(path)) return path;
+    const path = resolve(
+      /* turbopackIgnore: true */
+      cwd,
+      name
+    );
+    if (existsSync(
+      /* turbopackIgnore: true */
+      path
+    )) return path;
   }
   return void 0;
 }
@@ -1361,9 +1389,16 @@ function collectSlots(fields, data, bySlug, slots) {
 import { mkdir, readFile, rm, stat, writeFile } from "fs/promises";
 import { dirname, isAbsolute, join, normalize, resolve as resolve2, sep } from "path";
 function localStorage(options = {}) {
-  let root = resolve2(options.dir ?? "uploads");
+  let root = resolve2(
+    /* turbopackIgnore: true */
+    options.dir ?? "uploads"
+  );
   const pathOf = (key2) => {
-    const path = normalize(join(root, key2));
+    const path = normalize(join(
+      /* turbopackIgnore: true */
+      root,
+      key2
+    ));
     if (!path.startsWith(root + sep)) throw new Error(`Invalid storage key "${key2}"`);
     return path;
   };
@@ -1371,7 +1406,11 @@ function localStorage(options = {}) {
     name: "local",
     init({ cwd }) {
       const dir = options.dir ?? "uploads";
-      root = isAbsolute(dir) ? dir : resolve2(cwd, dir);
+      root = isAbsolute(dir) ? dir : resolve2(
+        /* turbopackIgnore: true */
+        cwd,
+        dir
+      );
     },
     async put(key2, data) {
       const path = pathOf(key2);
@@ -2206,6 +2245,13 @@ function createRestHandler(instance, options = {}) {
   const basePath = (options.basePath ?? cms.config.routes.api).replace(/\/+$/, "");
   const production = process.env.NODE_ENV === "production";
   return async (request) => {
+    const cors = corsHeaders(cms, request);
+    if (request.method.toUpperCase() === "OPTIONS") {
+      return new Response(null, { status: 204, headers: cors });
+    }
+    return withHeaders(await handle(request), cors);
+  };
+  async function handle(request) {
     const headers = new Headers({
       "content-type": "application/json; charset=utf-8",
       "cache-control": "no-store",
@@ -2221,14 +2267,44 @@ function createRestHandler(instance, options = {}) {
       const user = token ? await cms.auth.verify(token) : null;
       const ctx = { request, url, user, via: user ? via : null, token, headers };
       const method = request.method.toUpperCase();
-      if (method !== "GET" && method !== "HEAD" && method !== "OPTIONS") checkCsrf(cms, ctx);
+      if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
       const result = await route(cms, ctx, method, segments, options);
       if (result.body instanceof Response) return result.body;
       return new Response(JSON.stringify(result.body), { status: result.status ?? 200, headers });
     } catch (error) {
       return errorResponse(cms, error, headers, production);
     }
-  };
+  }
+}
+var CORS_METHODS = "GET, HEAD, POST, PATCH, PUT, DELETE";
+var CORS_HEADERS = `authorization, content-type, ${CSRF_HEADER}`;
+function corsHeaders(cms, request) {
+  const headers = new Headers({ vary: "Origin" });
+  const origin = request.headers.get("origin");
+  if (!origin) return headers;
+  const { cors, auth } = cms.config;
+  const trusted = auth.trustedOrigins.includes(origin);
+  if (!trusted && cors !== "*" && !cors.includes(origin)) return headers;
+  headers.set("access-control-allow-origin", origin);
+  if (trusted) headers.set("access-control-allow-credentials", "true");
+  if (request.method.toUpperCase() === "OPTIONS") {
+    headers.set("access-control-allow-methods", CORS_METHODS);
+    headers.set("access-control-allow-headers", CORS_HEADERS);
+    headers.set("access-control-max-age", "600");
+  }
+  return headers;
+}
+function withHeaders(response, extra) {
+  const headers = new Headers(response.headers);
+  extra.forEach((value, key2) => {
+    if (key2 === "vary") headers.append("vary", value);
+    else headers.set(key2, value);
+  });
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
 async function route(cms, ctx, method, segments, options) {
   const [first, second, third] = segments;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",