@easy-cms/core 0.1.1 → 0.2.0

package/dist/index.d.ts

@@ -412,6 +412,12 @@ interface Config {
      * so frontends on other origins can use them. Default: relative URLs.
      */
     readonly serverURL?: string;
+    /**
+     * Origins whose browser code may call the REST API (CORS), e.g. a Vite or React app on
+     * another origin. `'*'` allows any origin for anonymous requests. Origins in
+     * `auth.trustedOrigins` are always allowed, with cookies. Default: none.
+     */
+    readonly cors?: readonly string[] | '*';
     readonly routes?: RoutesConfig;
     readonly admin?: AdminConfig;
     readonly upload?: UploadConfig;
@@ -425,7 +431,8 @@ interface Config {
     readonly plugins?: readonly Plugin[];
 }
 /** The config after plugins ran, validation passed and defaults were applied. */
-interface ResolvedConfig extends Omit<Config, 'routes' | 'admin' | 'upload' | 'auth' | 'collections' | 'globals' | 'plugins'> {
+interface ResolvedConfig extends Omit<Config, 'cors' | 'routes' | 'admin' | 'upload' | 'auth' | 'collections' | 'globals' | 'plugins'> {
+    readonly cors: readonly string[] | '*';
     readonly routes: Required<RoutesConfig>;
     readonly admin: Required<AdminConfig>;
     readonly upload: Required<Omit<UploadConfig, 'storage'>> & Pick<UploadConfig, 'storage'>;

package/dist/index.js

@@ -867,6 +867,7 @@ function validateConfig(config) {
   validateAdmin(config, add);
   validateUpload(config, add);
   validateAuth(config, add);
+  validateCors(config.cors, add);
   const collections = asArray(config.collections, "collections", add);
   const globals = asArray(config.globals, "globals", add);
   const collectionSlugs = /* @__PURE__ */ new Set([...BUILTIN_COLLECTIONS]);
@@ -943,6 +944,21 @@ function validateAuth(config, add) {
     }
   }
 }
+function validateCors(cors, add) {
+  if (cors === void 0 || cors === "*") return;
+  if (!Array.isArray(cors)) {
+    add("cors", 'must be a list of origins or "*"', 'cors: ["https://my-site.com"]');
+    return;
+  }
+  for (const [i, origin] of cors.entries()) {
+    if (typeof origin !== "string" || !/^https?:\/\/[^/]+$/.test(origin)) {
+      add(
+        `cors[${i}]`,
+        `must be an origin like "https://example.com" (got ${JSON.stringify(origin)})`
+      );
+    }
+  }
+}
 function validateUpload(config, add) {
   const upload = config.upload;
   if (upload === void 0) return;
@@ -1125,6 +1141,7 @@ async function resolveConfig(input) {
   const { plugins: _plugins, ...rest } = config;
   const result = {
     ...rest,
+    cors: config.cors ?? [],
     routes: { api: `/${(config.routes?.api ?? DEFAULT_API_PATH).replace(/^\/+|\/+$/g, "")}` },
     admin: {
       path: config.admin?.path ?? DEFAULT_ADMIN_PATH,
@@ -2228,6 +2245,13 @@ function createRestHandler(instance, options = {}) {
   const basePath = (options.basePath ?? cms.config.routes.api).replace(/\/+$/, "");
   const production = process.env.NODE_ENV === "production";
   return async (request) => {
+    const cors = corsHeaders(cms, request);
+    if (request.method.toUpperCase() === "OPTIONS") {
+      return new Response(null, { status: 204, headers: cors });
+    }
+    return withHeaders(await handle(request), cors);
+  };
+  async function handle(request) {
     const headers = new Headers({
       "content-type": "application/json; charset=utf-8",
       "cache-control": "no-store",
@@ -2243,14 +2267,44 @@ function createRestHandler(instance, options = {}) {
       const user = token ? await cms.auth.verify(token) : null;
       const ctx = { request, url, user, via: user ? via : null, token, headers };
       const method = request.method.toUpperCase();
-      if (method !== "GET" && method !== "HEAD" && method !== "OPTIONS") checkCsrf(cms, ctx);
+      if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
       const result = await route(cms, ctx, method, segments, options);
       if (result.body instanceof Response) return result.body;
       return new Response(JSON.stringify(result.body), { status: result.status ?? 200, headers });
     } catch (error) {
       return errorResponse(cms, error, headers, production);
     }
-  };
+  }
+}
+var CORS_METHODS = "GET, HEAD, POST, PATCH, PUT, DELETE";
+var CORS_HEADERS = `authorization, content-type, ${CSRF_HEADER}`;
+function corsHeaders(cms, request) {
+  const headers = new Headers({ vary: "Origin" });
+  const origin = request.headers.get("origin");
+  if (!origin) return headers;
+  const { cors, auth } = cms.config;
+  const trusted = auth.trustedOrigins.includes(origin);
+  if (!trusted && cors !== "*" && !cors.includes(origin)) return headers;
+  headers.set("access-control-allow-origin", origin);
+  if (trusted) headers.set("access-control-allow-credentials", "true");
+  if (request.method.toUpperCase() === "OPTIONS") {
+    headers.set("access-control-allow-methods", CORS_METHODS);
+    headers.set("access-control-allow-headers", CORS_HEADERS);
+    headers.set("access-control-max-age", "600");
+  }
+  return headers;
+}
+function withHeaders(response, extra) {
+  const headers = new Headers(response.headers);
+  extra.forEach((value, key2) => {
+    if (key2 === "vary") headers.append("vary", value);
+    else headers.set(key2, value);
+  });
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
 async function route(cms, ctx, method, segments, options) {
   const [first, second, third] = segments;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",