@h-ai/serv 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/index.js

@@ -651,6 +651,8 @@ function createApp(options) {
     return cachedSpec;
   };
   app.use("*", securityHeaders());
+  if (options.middlewares)
+    mountCustomMiddlewares(app, options.middlewares);
   if (options.transport) {
     const mgr = options.transport.crypto.transport.createServer({ maxClients: options.transport.maxClients });
     if (!mgr.success) {
@@ -663,8 +665,6 @@ function createApp(options) {
     const keyExchangePath = `${http.apiPrefix}${options.transport.keyExchangePath ?? "/_hai/key-exchange"}`;
     app.use("*", createTransportMiddleware(mgr.data, keyExchangePath, options.transport.excludePaths));
   }
-  if (options.middlewares)
-    mountCustomMiddlewares(app, options.middlewares);
   if (http.health !== false)
     mountHealthRoutes(app, http.health);
   if (options.refreshCookie)
@@ -776,6 +776,90 @@ function isOrpcValidationErrorPayload(value) {
   return Array.isArray(issues);
 }
 
+// src/serv-cors.ts
+var DEFAULT_CORS_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE", "OPTIONS"];
+var DEFAULT_CORS_ALLOWED_HEADERS = ["Authorization", "Content-Type", "X-Requested-With"];
+var DEFAULT_CORS_MAX_AGE = 86400;
+function cors(config = {}) {
+  const methods = [...config.methods ?? DEFAULT_CORS_METHODS];
+  const allowedHeaders = [...config.allowedHeaders ?? DEFAULT_CORS_ALLOWED_HEADERS];
+  const exposedHeaders = [...config.exposedHeaders ?? []];
+  const credentials = config.credentials ?? false;
+  const maxAge = config.maxAge ?? DEFAULT_CORS_MAX_AGE;
+  const originConfig = config.origin ?? "*";
+  return async (c, next) => {
+    const allowedOrigin = resolveCorsOrigin(c.req.header("Origin"), originConfig);
+    if (c.req.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders({
+          allowedOrigin,
+          allowedHeaders,
+          credentials,
+          exposedHeaders,
+          maxAge,
+          methods,
+          request: c.req.raw
+        })
+      });
+    }
+    await next();
+    const corsHeaders = buildCorsHeaders({
+      allowedOrigin,
+      allowedHeaders,
+      credentials,
+      exposedHeaders,
+      maxAge,
+      methods,
+      request: c.req.raw
+    });
+    for (const [key, value] of corsHeaders) {
+      if (key.toLowerCase() === "vary") {
+        c.res.headers.append(key, value);
+        continue;
+      }
+      c.res.headers.set(key, value);
+    }
+    return void 0;
+  };
+}
+function resolveCorsOrigin(origin, configOrigin) {
+  if (!origin)
+    return null;
+  if (configOrigin === "*")
+    return "*";
+  if (typeof configOrigin === "string")
+    return origin === configOrigin ? origin : null;
+  if (Array.isArray(configOrigin))
+    return configOrigin.includes(origin) ? origin : null;
+  if (typeof configOrigin === "function")
+    return configOrigin(origin) ? origin : null;
+  return null;
+}
+function buildCorsHeaders(options) {
+  const headers = new Headers();
+  if (!options.allowedOrigin)
+    return headers;
+  const requestedHeaders = options.request.headers.get("Access-Control-Request-Headers");
+  headers.set("Access-Control-Allow-Origin", options.allowedOrigin);
+  if (options.credentials)
+    headers.set("Access-Control-Allow-Credentials", "true");
+  if (options.allowedOrigin !== "*") {
+    headers.set(
+      "Vary",
+      requestedHeaders ? "Origin, Access-Control-Request-Headers" : "Origin"
+    );
+  }
+  if (options.exposedHeaders.length > 0)
+    headers.set("Access-Control-Expose-Headers", options.exposedHeaders.join(", "));
+  if (options.request.method === "OPTIONS") {
+    headers.set("Access-Control-Allow-Methods", options.methods.join(", "));
+    headers.set("Access-Control-Allow-Headers", requestedHeaders ?? options.allowedHeaders.join(", "));
+    headers.set("Access-Control-Max-Age", String(options.maxAge));
+  }
+  return headers;
+}
+
 // src/serv-main.ts
 var serv = {
   // 应用与上下文
@@ -786,6 +870,7 @@ var serv = {
   // 运行时适配器
   listen,
   toFetch,
+  cors,
   // OpenAPI / 导出
   generateSpec,
   // Procedure 装配（contract 路由定义统一使用 `apiContract.route`）。