@getstrata/core 2.0.4 → 2.0.6

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 2.0.6
+
+- Dispatch registered Bun route preflights through CORS
+
+## 2.0.5
+
+- Allow explicitly approved application headers in CORS
+
 ## 2.0.4
 
 - Place cache rollout guidance beside outbox docs without overlapping API additions

package/dist/core/http/corsMiddleware.d.ts

@@ -5,6 +5,11 @@ interface CorsConfig {
     allowedHeaders: string[];
     maxAgeSeconds: number;
 }
-declare function resolveCorsConfig(): CorsConfig;
-declare function createCorsMiddleware(): Middleware;
+/** Additional application-approved request headers; defaults and origins remain unchanged. */
+interface CorsOptions {
+    additionalAllowedHeaders?: readonly string[];
+}
+declare function resolveCorsConfig(options?: CorsOptions): CorsConfig;
+declare function createCorsMiddleware(options?: CorsOptions): Middleware;
+export type { CorsConfig, CorsOptions };
 export { createCorsMiddleware, resolveCorsConfig };

package/dist/entries/http/corsMiddleware.js

@@ -86,10 +86,28 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/corsMiddleware.ts
+function additionalHeaders(options) {
+  const configured = process.env.CORS_ADDITIONAL_ALLOWED_HEADERS?.trim();
+  const supplied = options.additionalAllowedHeaders === undefined ? [] : options.additionalAllowedHeaders;
+  if (!Array.isArray(supplied)) {
+    throw new TypeError("CORS additionalAllowedHeaders must be an array of header names.");
+  }
+  const names = [
+    ...configured ? configured.split(",").map((name) => name.trim()) : [],
+    ...supplied
+  ];
+  return names.map((name) => {
+    if (typeof name !== "string" || name === "*" || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) {
+      throw new TypeError("CORS additional headers must be explicit valid HTTP header names; wildcards are not allowed.");
+    }
+    return name;
+  });
+}
 function defaultAllowedOrigins() {
   return appUrl();
 }
-function resolveCorsConfig() {
+function resolveCorsConfig(options = {}) {
+  const extraHeaders = additionalHeaders(options);
   return {
     allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? defaultAllowedOrigins()).split(",").map((origin) => origin.trim()).filter(Boolean),
     allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
@@ -102,22 +120,27 @@ function resolveCorsConfig() {
       "X-Authenticated-User-Role",
       "If-Match",
       "If-None-Match",
-      "X-CSRF-Token"
-    ],
+      "X-CSRF-Token",
+      ...extraHeaders
+    ].filter((name, index, names) => names.findIndex((other) => other.toLowerCase() === name.toLowerCase()) === index),
     maxAgeSeconds: 86400
   };
 }
-function createCorsMiddleware() {
+function createCorsMiddleware(options = {}) {
+  resolveCorsConfig(options);
+  const captured = {
+    additionalAllowedHeaders: [...options.additionalAllowedHeaders ?? []]
+  };
   return async (request, next) => {
     if (request.method === "OPTIONS") {
       return new Response(null, {
         status: 204,
-        headers: buildCorsHeaders(request)
+        headers: buildCorsHeaders(request, captured)
       });
     }
     const response = await next();
     const headers = new Headers(response.headers);
-    for (const [key, value] of buildCorsHeaders(request)) {
+    for (const [key, value] of buildCorsHeaders(request, captured)) {
       headers.set(key, value);
     }
     return new Response(response.body, {
@@ -127,10 +150,10 @@ function createCorsMiddleware() {
     });
   };
 }
-function buildCorsHeaders(request) {
+function buildCorsHeaders(request, options) {
   const headers = new Headers;
   const origin = request.headers.get("origin");
-  const corsConfig = resolveCorsConfig();
+  const corsConfig = resolveCorsConfig(options);
   const allowedOrigins = corsConfig.allowedOrigins;
   headers.set("Vary", "Origin");
   const allowOrigin = allowedOrigins.includes("*") ? "*" : origin && allowedOrigins.includes(origin) ? origin : null;

package/dist/framework/public-api.d.ts

@@ -81,7 +81,7 @@ export { conditionalJsonResponse } from "../core/http/conditionalResponse.ts";
 export type { ContentSecurityPolicyDirectives, ContentSecurityPolicyOptions, } from "../core/http/contentSecurityPolicy.ts";
 export { configureContentSecurityPolicy, generateCspNonce, HTMX_2_0_4_INDICATOR_STYLE_HASH, resetContentSecurityPolicyForTests, resolveContentSecurityPolicy, resolveHtmlContentSecurityPolicy, serverHtmxContentSecurityPolicy, spaContentSecurityPolicy, strictApiContentSecurityPolicy, } from "../core/http/contentSecurityPolicy.ts";
 export { readBunRequestCookie, readRequestCookie } from "../core/http/cookies.ts";
-export { createCorsMiddleware } from "../core/http/corsMiddleware.ts";
+export { type CorsConfig, type CorsOptions, createCorsMiddleware, } from "../core/http/corsMiddleware.ts";
 export { createCsrfMiddleware } from "../core/http/csrfMiddleware.ts";
 export { createCsrfProtection } from "../core/http/csrfProtection.ts";
 export { createCsrfTokenCookie, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, } from "../core/http/csrfToken.ts";

package/dist/index.js

@@ -9466,10 +9466,28 @@ function readBunRequestCookie(request, name) {
   return request.cookies.get(name) ?? readRequestCookie(request, name);
 }
 // ../../src/core/http/corsMiddleware.ts
+function additionalHeaders(options) {
+  const configured = process.env.CORS_ADDITIONAL_ALLOWED_HEADERS?.trim();
+  const supplied = options.additionalAllowedHeaders === undefined ? [] : options.additionalAllowedHeaders;
+  if (!Array.isArray(supplied)) {
+    throw new TypeError("CORS additionalAllowedHeaders must be an array of header names.");
+  }
+  const names = [
+    ...configured ? configured.split(",").map((name) => name.trim()) : [],
+    ...supplied
+  ];
+  return names.map((name) => {
+    if (typeof name !== "string" || name === "*" || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) {
+      throw new TypeError("CORS additional headers must be explicit valid HTTP header names; wildcards are not allowed.");
+    }
+    return name;
+  });
+}
 function defaultAllowedOrigins() {
   return appUrl();
 }
-function resolveCorsConfig() {
+function resolveCorsConfig(options = {}) {
+  const extraHeaders = additionalHeaders(options);
   return {
     allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? defaultAllowedOrigins()).split(",").map((origin) => origin.trim()).filter(Boolean),
     allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
@@ -9482,22 +9500,27 @@ function resolveCorsConfig() {
       "X-Authenticated-User-Role",
       "If-Match",
       "If-None-Match",
-      "X-CSRF-Token"
-    ],
+      "X-CSRF-Token",
+      ...extraHeaders
+    ].filter((name, index, names) => names.findIndex((other) => other.toLowerCase() === name.toLowerCase()) === index),
     maxAgeSeconds: 86400
   };
 }
-function createCorsMiddleware() {
+function createCorsMiddleware(options = {}) {
+  resolveCorsConfig(options);
+  const captured = {
+    additionalAllowedHeaders: [...options.additionalAllowedHeaders ?? []]
+  };
   return async (request, next) => {
     if (request.method === "OPTIONS") {
       return new Response(null, {
         status: 204,
-        headers: buildCorsHeaders(request)
+        headers: buildCorsHeaders(request, captured)
       });
     }
     const response = await next();
     const headers = new Headers(response.headers);
-    for (const [key, value] of buildCorsHeaders(request)) {
+    for (const [key, value] of buildCorsHeaders(request, captured)) {
       headers.set(key, value);
     }
     return new Response(response.body, {
@@ -9507,10 +9530,10 @@ function createCorsMiddleware() {
     });
   };
 }
-function buildCorsHeaders(request) {
+function buildCorsHeaders(request, options) {
   const headers = new Headers;
   const origin = request.headers.get("origin");
-  const corsConfig = resolveCorsConfig();
+  const corsConfig = resolveCorsConfig(options);
   const allowedOrigins = corsConfig.allowedOrigins;
   headers.set("Vary", "Origin");
   const allowOrigin = allowedOrigins.includes("*") ? "*" : origin && allowedOrigins.includes(origin) ? origin : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",