@jsenv/server 17.0.3 → 17.1.1

package/dist/jsenv_server.js

@@ -3863,7 +3863,7 @@ const serverPluginOpenFile = () => {
 const routeInspectorHtmlFileUrl = import.meta
   .resolve("./client/route_inspector/route_inspector.html");
 
-const serverPluginRouteInspector = () => {
+const serverPluginRouteInspector = ({ canExposeSensitiveData }) => {
   return {
     name: "jsenv:route_inspector",
     routes: [
@@ -3889,7 +3889,9 @@ const serverPluginRouteInspector = () => {
         description: "Get the routes available on this server in JSON.",
         declarationSource: import.meta.url,
         fetch: (request, helpers) => {
-          const routeJSON = helpers.router.inspect(request, helpers);
+          const routeJSON = helpers.router.inspect({
+            canExposeSensitiveData,
+          });
           return Response.json(routeJSON);
         },
       },
@@ -5378,13 +5380,18 @@ const createResourcePattern = (pattern) => {
       let decodedPathname = decodeURIComponent(pathname);
       let result;
       if (patternEndsWithSlash && !searchPattern && !hashPattern) {
-        if (!decodedPathname.startsWith(pathnamePatternString)) {
+        // also match the path without trailing slash (e.g. /foo matches /foo/)
+        const pathnamePatternWithoutSlash = pathnamePatternString.slice(0, -1);
+        if (decodedPathname === pathnamePatternWithoutSlash) {
+          result = { named: {}, stars: [""] };
+        } else if (!decodedPathname.startsWith(pathnamePatternString)) {
           return null;
+        } else {
+          result = {
+            named: {},
+            stars: [decodedPathname.slice(pathnamePatternString.length)],
+          };
         }
-        result = {
-          named: {},
-          stars: [decodedPathname.slice(pathnamePatternString.length)],
-        };
       } else {
         result = pathnamePattern.match(decodedPathname);
       }
@@ -5664,7 +5671,7 @@ const HTTP_METHODS = [
 
 const createRouter = (
   routeDescriptionArray,
-  { optionsFallback, logLevel } = {},
+  { optionsFallback, logLevel, redirect = "manual" } = {},
 ) => {
   const logger = createLogger({ logLevel });
   const routeSet = new Set();
@@ -5813,16 +5820,6 @@ const createRouter = (
 
   const match = async (request, fetchSecondArg) => {
     fetchSecondArg.router = router;
-    const wouldHaveMatched = {
-      // in case nothing matches we can produce a response with Allow: GET, POST, PUT for example
-      methodSet: new Set(),
-      requestMediaTypeSet: new Set(),
-      responseMediaTypeSet: new Set(),
-      responseLanguageSet: new Set(),
-      responseVersionSet: new Set(),
-      responseEncodingSet: new Set(),
-      upgrade: false,
-    };
 
     let currentServerPlugin;
     let currentRoutingTiming;
@@ -5897,7 +5894,6 @@ It should be set to one of route.${routePropertyName}: ${availableValues.join(",
           break;
         }
       }
-
       if (!matchesAnAvailableValue) {
         request.logger.warn(
           `The value "${responseHeaderValue}" found in response header ${responseHeaderName} is strange.
@@ -5913,217 +5909,267 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
       checkResponseContentHeader(route, responseHeaders, "encoding");
     };
 
-    for (const route of routeSet) {
-      onRouteMatchStart(route);
-      const resourceMatchResult = route.matchResource(request.resource);
-      if (!resourceMatchResult) {
-        continue;
-      }
-      if (!route.matchMethod(request.method)) {
-        if (!route.isFallback) {
-          wouldHaveMatched.methodSet.add(route.method);
-        }
-        continue;
+    const resolveResponse = async (fetchReturnValue, { request, route }) => {
+      let status;
+      let statusText;
+      let statusMessage;
+      let headers;
+      let body;
+
+      if (fetchReturnValue instanceof Response) {
+        status = fetchReturnValue.status;
+        statusText = fetchReturnValue.statusText;
+        headers = Object.fromEntries(fetchReturnValue.headers);
+        body = fetchReturnValue.body;
+      } else if (
+        fetchReturnValue !== null &&
+        typeof fetchReturnValue === "object"
+      ) {
+        status = fetchReturnValue.status || 404;
+        statusText = fetchReturnValue.statusText;
+        statusMessage = fetchReturnValue.statusMessage;
+        headers = fetchReturnValue.headers || {};
+        body = fetchReturnValue.body;
+      } else {
+        throw new TypeError(
+          `response must be a Response, or an Object, received ${fetchReturnValue}`,
+        );
       }
+
       if (
-        request.method === "POST" ||
-        request.method === "PATCH" ||
-        request.method === "PUT"
+        redirect === "follow" &&
+        isRedirectStatus(status) &&
+        headers["location"]
       ) {
-        const { acceptedMediaTypes } = route;
+        const redirectUrl = new URL(headers["location"], request.url);
+        if (redirectUrl.origin === new URL(request.url).origin) {
+          const redirectRequest = {
+            ...request,
+            url: redirectUrl.href,
+            resource:
+              redirectUrl.pathname + redirectUrl.search + redirectUrl.hash,
+            // GET for 301/302/303, preserve method for 307/308
+            method: status === 307 || status === 308 ? request.method : "GET",
+            params: {},
+          };
+          const redirectedResponse = await matchRoutes(redirectRequest);
+          onRouteMatch(route);
+          onResponseHeaders(request, route, redirectedResponse.headers || {});
+          return redirectedResponse;
+        }
+        // redirect to other origins are left to the client to handle
+      }
+
+      onRouteMatch(route);
+      onResponseHeaders(request, route, headers);
+      return { status, statusText, statusMessage, headers, body };
+    };
+
+    const matchRoutes = async (request) => {
+      // in case nothing matches we can produce a response with Allow: GET, POST, PUT for example
+      const wouldHaveMatched = {
+        methodSet: new Set(),
+        requestMediaTypeSet: new Set(),
+        responseMediaTypeSet: new Set(),
+        responseLanguageSet: new Set(),
+        responseVersionSet: new Set(),
+        responseEncodingSet: new Set(),
+        upgrade: false,
+      };
+
+      for (const route of routeSet) {
+        onRouteMatchStart(route);
+        const resourceMatchResult = route.matchResource(request.resource);
+        if (!resourceMatchResult) {
+          continue;
+        }
+        if (!route.matchMethod(request.method)) {
+          if (!route.isFallback) {
+            wouldHaveMatched.methodSet.add(route.method);
+          }
+          continue;
+        }
         if (
-          acceptedMediaTypes.length &&
-          !isRequestBodyMediaTypeSupported(request, { acceptedMediaTypes })
+          request.method === "POST" ||
+          request.method === "PATCH" ||
+          request.method === "PUT"
         ) {
-          for (const acceptedMediaType of acceptedMediaTypes) {
-            wouldHaveMatched.requestMediaTypeSet.add(acceptedMediaType);
+          const { acceptedMediaTypes } = route;
+          if (
+            acceptedMediaTypes.length &&
+            !isRequestBodyMediaTypeSupported(request, { acceptedMediaTypes })
+          ) {
+            for (const acceptedMediaType of acceptedMediaTypes) {
+              wouldHaveMatched.requestMediaTypeSet.add(acceptedMediaType);
+            }
+            continue;
           }
+        }
+        const headersMatchResult = route.matchHeaders(request.headers);
+        if (!headersMatchResult) {
           continue;
         }
-      }
-      const headersMatchResult = route.matchHeaders(request.headers);
-      if (!headersMatchResult) {
-        continue;
-      }
-      if (route.isForWebSocket && request.headers["upgrade"] !== "websocket") {
-        wouldHaveMatched.upgrade = true;
-        continue;
-      }
-      // now we are "good", let's try to generate a response
-      const contentNegotiationResult = {};
-      {
-        // when content nego fails
-        // we will check the remaining accept headers to properly inform client of all the things are failing
-        // Example:
-        // client says "I want text in french"
-        // but server only provide json in english
-        // we want to tell client both text and french are not available
-        let hasFailed = false;
-        const { availableMediaTypes } = route;
-        if (availableMediaTypes.length) {
-          fetchSecondArg.injectResponseHeader("vary", "accept");
-          if (request.headers["accept"]) {
-            const mediaTypeNegotiated = pickContentType(
-              request,
-              availableMediaTypes,
-            );
-            if (!mediaTypeNegotiated) {
-              for (const availableMediaType of availableMediaTypes) {
-                wouldHaveMatched.responseMediaTypeSet.add(availableMediaType);
+        if (
+          route.isForWebSocket &&
+          request.headers["upgrade"] !== "websocket"
+        ) {
+          wouldHaveMatched.upgrade = true;
+          continue;
+        }
+        // now we are "good", let's try to generate a response
+        const contentNegotiationResult = {};
+        {
+          // when content nego fails
+          // we will check the remaining accept headers to properly inform client of all the things are failing
+          // Example:
+          // client says "I want text in french"
+          // but server only provide json in english
+          // we want to tell client both text and french are not available
+          let hasFailed = false;
+          const { availableMediaTypes } = route;
+          if (availableMediaTypes.length) {
+            fetchSecondArg.injectResponseHeader("vary", "accept");
+            if (request.headers["accept"]) {
+              const mediaTypeNegotiated = pickContentType(
+                request,
+                availableMediaTypes,
+              );
+              if (!mediaTypeNegotiated) {
+                for (const availableMediaType of availableMediaTypes) {
+                  wouldHaveMatched.responseMediaTypeSet.add(availableMediaType);
+                }
+                hasFailed = true;
               }
-              hasFailed = true;
+              contentNegotiationResult.mediaType = mediaTypeNegotiated;
+            } else {
+              contentNegotiationResult.mediaType = availableMediaTypes[0];
             }
-            contentNegotiationResult.mediaType = mediaTypeNegotiated;
-          } else {
-            contentNegotiationResult.mediaType = availableMediaTypes[0];
           }
-        }
-        const { availableLanguages } = route;
-        if (availableLanguages.length) {
-          fetchSecondArg.injectResponseHeader("vary", "accept-language");
-          if (request.headers["accept-language"]) {
-            const languageNegotiated = pickContentLanguage(
-              request,
-              availableLanguages,
-            );
-            if (!languageNegotiated) {
-              for (const availableLanguage of availableLanguages) {
-                wouldHaveMatched.responseLanguageSet.add(availableLanguage);
+          const { availableLanguages } = route;
+          if (availableLanguages.length) {
+            fetchSecondArg.injectResponseHeader("vary", "accept-language");
+            if (request.headers["accept-language"]) {
+              const languageNegotiated = pickContentLanguage(
+                request,
+                availableLanguages,
+              );
+              if (!languageNegotiated) {
+                for (const availableLanguage of availableLanguages) {
+                  wouldHaveMatched.responseLanguageSet.add(availableLanguage);
+                }
+                hasFailed = true;
               }
-              hasFailed = true;
+              contentNegotiationResult.language = languageNegotiated;
+            } else {
+              contentNegotiationResult.language = availableLanguages[0];
             }
-            contentNegotiationResult.language = languageNegotiated;
-          } else {
-            contentNegotiationResult.language = availableLanguages[0];
           }
-        }
-        const { availableVersions } = route;
-        if (availableVersions.length) {
-          fetchSecondArg.injectResponseHeader("vary", "accept-version");
-          if (request.headers["accept-version"]) {
-            const versionNegotiated = pickContentVersion(
-              request,
-              availableVersions,
-            );
-            if (!versionNegotiated) {
-              for (const availableVersion of availableVersions) {
-                wouldHaveMatched.responseVersionSet.add(availableVersion);
+          const { availableVersions } = route;
+          if (availableVersions.length) {
+            fetchSecondArg.injectResponseHeader("vary", "accept-version");
+            if (request.headers["accept-version"]) {
+              const versionNegotiated = pickContentVersion(
+                request,
+                availableVersions,
+              );
+              if (!versionNegotiated) {
+                for (const availableVersion of availableVersions) {
+                  wouldHaveMatched.responseVersionSet.add(availableVersion);
+                }
+                hasFailed = true;
               }
-              hasFailed = true;
+              contentNegotiationResult.version = versionNegotiated;
+            } else {
+              contentNegotiationResult.version = availableVersions[0];
             }
-            contentNegotiationResult.version = versionNegotiated;
-          } else {
-            contentNegotiationResult.version = availableVersions[0];
           }
-        }
-        const { availableEncodings } = route;
-        if (availableEncodings.length) {
-          fetchSecondArg.injectResponseHeader("vary", "accept-encoding");
-          if (request.headers["accept-encoding"]) {
-            const encodingNegotiated = pickContentEncoding(
-              request,
-              availableEncodings,
-            );
-            if (!encodingNegotiated) {
-              for (const availableEncoding of availableEncodings) {
-                wouldHaveMatched.responseEncodingSet.add(availableEncoding);
+          const { availableEncodings } = route;
+          if (availableEncodings.length) {
+            fetchSecondArg.injectResponseHeader("vary", "accept-encoding");
+            if (request.headers["accept-encoding"]) {
+              const encodingNegotiated = pickContentEncoding(
+                request,
+                availableEncodings,
+              );
+              if (!encodingNegotiated) {
+                for (const availableEncoding of availableEncodings) {
+                  wouldHaveMatched.responseEncodingSet.add(availableEncoding);
+                }
+                hasFailed = true;
               }
-              hasFailed = true;
+              contentNegotiationResult.encoding = encodingNegotiated;
+            } else {
+              contentNegotiationResult.encoding = availableEncodings[0];
             }
-            contentNegotiationResult.encoding = encodingNegotiated;
-          } else {
-            contentNegotiationResult.encoding = availableEncodings[0];
           }
+          if (hasFailed) {
+            continue;
+          }
+        }
+        const { named, stars = [] } = PATTERN.composeTwoMatchResults(
+          resourceMatchResult,
+          headersMatchResult,
+        );
+        Object.assign(request.params, named, stars);
+        fetchSecondArg.contentNegotiation = contentNegotiationResult;
+        let fetchReturnValue = route.fetch(request, fetchSecondArg);
+        if (
+          fetchReturnValue !== null &&
+          typeof fetchReturnValue === "object" &&
+          typeof fetchReturnValue.then === "function"
+        ) {
+          fetchReturnValue = await fetchReturnValue;
         }
-        if (hasFailed) {
+        // route decided not to handle in the end
+        if (fetchReturnValue === null || fetchReturnValue === undefined) {
           continue;
         }
+        return resolveResponse(fetchReturnValue, { request, route });
+      }
+      // nothing has matched fully
+      // if nothing matches at all we'll send 404
+      // but if url matched but METHOD was not supported we send 405
+      if (wouldHaveMatched.methodSet.size) {
+        return createMethodNotAllowedResponse(request, {
+          allowedMethods: [...wouldHaveMatched.methodSet],
+        });
+      }
+      if (wouldHaveMatched.requestMediaTypeSet.size) {
+        return createUnsupportedMediaTypeResponse(request, {
+          acceptedMediaTypes: [...wouldHaveMatched.requestMediaTypeSet],
+        });
       }
-      const { named, stars = [] } = PATTERN.composeTwoMatchResults(
-        resourceMatchResult,
-        headersMatchResult,
-      );
-      Object.assign(request.params, named, stars);
-      fetchSecondArg.contentNegotiation = contentNegotiationResult;
-      let fetchReturnValue = route.fetch(request, fetchSecondArg);
       if (
-        fetchReturnValue !== null &&
-        typeof fetchReturnValue === "object" &&
-        typeof fetchReturnValue.then === "function"
+        wouldHaveMatched.responseMediaTypeSet.size ||
+        wouldHaveMatched.responseLanguageSet.size ||
+        wouldHaveMatched.responseVersionSet.size ||
+        wouldHaveMatched.responseEncodingSet.size
       ) {
-        fetchReturnValue = await fetchReturnValue;
-      }
-      // route decided not to handle in the end
-      if (fetchReturnValue === null || fetchReturnValue === undefined) {
-        continue;
-      }
-      onRouteMatch(route);
-      if (fetchReturnValue instanceof Response) {
-        const headers = Object.fromEntries(fetchReturnValue.headers);
-        onResponseHeaders(request, route, headers);
-        return {
-          status: fetchReturnValue.status,
-          statusText: fetchReturnValue.statusText,
-          headers,
-          body: fetchReturnValue.body,
-        };
+        return createNotAcceptableResponse(request, {
+          availableMediaTypes: [...wouldHaveMatched.responseMediaTypeSet],
+          availableLanguages: [...wouldHaveMatched.responseLanguageSet],
+          availableVersions: [...wouldHaveMatched.responseVersionSet],
+          availableEncodings: [...wouldHaveMatched.responseEncodingSet],
+        });
       }
-      if (fetchReturnValue !== null && typeof fetchReturnValue === "object") {
-        const headers = fetchReturnValue.headers || {};
-        onResponseHeaders(request, route, headers);
+      if (wouldHaveMatched.upgrade) {
         return {
-          status: fetchReturnValue.status || 404,
-          statusText: fetchReturnValue.statusText,
-          statusMessage: fetchReturnValue.statusMessage,
-          headers,
-          body: fetchReturnValue.body,
+          status: 426,
+          statusText: "Upgrade Required",
+          statusMessage: `The request requires the upgrade to a webSocket connection`,
         };
       }
-      throw new TypeError(
-        `response must be a Response, or an Object, received ${fetchReturnValue}`,
-      );
-    }
-    // nothing has matched fully
-    // if nothing matches at all we'll send 404
-    // but if url matched but METHOD was not supported we send 405
-    if (wouldHaveMatched.methodSet.size) {
-      return createMethodNotAllowedResponse(request, {
-        allowedMethods: [...wouldHaveMatched.methodSet],
-      });
-    }
-    if (wouldHaveMatched.requestMediaTypeSet.size) {
-      return createUnsupportedMediaTypeResponse(request, {
-        acceptedMediaTypes: [...wouldHaveMatched.requestMediaTypeSet],
-      });
-    }
-    if (
-      wouldHaveMatched.responseMediaTypeSet.size ||
-      wouldHaveMatched.responseLanguageSet.size ||
-      wouldHaveMatched.responseVersionSet.size ||
-      wouldHaveMatched.responseEncodingSet.size
-    ) {
-      return createNotAcceptableResponse(request, {
-        availableMediaTypes: [...wouldHaveMatched.responseMediaTypeSet],
-        availableLanguages: [...wouldHaveMatched.responseLanguageSet],
-        availableVersions: [...wouldHaveMatched.responseVersionSet],
-        availableEncodings: [...wouldHaveMatched.responseEncodingSet],
-      });
-    }
-    if (wouldHaveMatched.upgrade) {
-      return {
-        status: 426,
-        statusText: "Upgrade Required",
-        statusMessage: `The request requires the upgrade to a webSocket connection`,
-      };
-    }
-    constructAvailableEndpoints();
-    return createRouteNotFoundResponse(request);
+      constructAvailableEndpoints();
+      return createRouteNotFoundResponse(request);
+    }; // end matchRoutes
+
+    return matchRoutes(request);
   };
-  const inspect = () => {
+  const inspect = ({ canExposeSensitiveData }) => {
     // I want all the info I can gather about the routes
     const data = [];
     for (const route of routeSet) {
-      data.push(route.toJSON());
+      data.push(route.toJSON({ canExposeSensitiveData }));
     }
     return data;
   };
@@ -6248,10 +6294,10 @@ const createRoute = ({
     toString: () => {
       return `${method} ${resource}`;
     },
-    toJSON: () => {
+    toJSON: ({ canExposeSensitiveData }) => {
       const meta = {};
 
-      if (declarationSource) {
+      if (declarationSource && canExposeSensitiveData) {
         meta.declarationLink = {
           url: `javascript:window.fetch("/.internal/open_file/${encodeURIComponent(declarationSource)}")`,
           text: declarationSource,
@@ -6279,7 +6325,6 @@ const createRoute = ({
           } catch {}
         }
       }
-
       return {
         method,
         resource,
@@ -6296,7 +6341,9 @@ const createRoute = ({
             : typeof clientCodeExample === "string"
               ? clientCodeExample
               : undefined,
-        declarationSource,
+        declarationSource: canExposeSensitiveData
+          ? declarationSource
+          : undefined,
         meta,
       };
     },
@@ -6308,6 +6355,9 @@ const createRoute = ({
   return route;
 };
 
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const isRedirectStatus = (status) => REDIRECT_STATUSES.has(status);
+
 const isRequestBodyMediaTypeSupported = (request, { acceptedMediaTypes }) => {
   const requestBodyContentType = request.headers["content-type"];
   if (!requestBodyContentType) {
@@ -6749,6 +6799,12 @@ const startServer = async ({
   keepProcessAlive = true,
   routes = [],
   plugins = [],
+  // When enabled, the server gives more power:
+  // - each route show the source where it was declared
+  // - server can be requested to open a file on the machine
+  // - client can subscribe to server to detect when it restarts
+  // This param should be enabled ONLY during development on your machine
+  canExposeSensitiveData = false,
   nagle = true,
   serverTiming = false,
   requestWaitingMs = 0,
@@ -6823,11 +6879,11 @@ const startServer = async ({
   }
 
   plugins = [
-    serverPluginOpenFile(),
+    ...(canExposeSensitiveData ? [serverPluginOpenFile()] : []),
     serverPluginDefaultBody4xx5xx(),
-    serverPluginRouteInspector(),
-    serverPluginInternalClientFiles(),
-    serverPluginAutoreloadOnRestart(),
+    serverPluginRouteInspector({ canExposeSensitiveData }),
+    ...(canExposeSensitiveData ? [serverPluginInternalClientFiles()] : []),
+    ...(canExposeSensitiveData ? [serverPluginAutoreloadOnRestart()] : []),
     ...plugins,
   ];
 
@@ -7949,17 +8005,32 @@ const generateAccessControlHeaders = ({
 } = {}) => {
   const vary = [];
 
-  const allowedOriginArray = [...accessControlAllowedOrigins];
-  if (accessControlAllowRequestOrigin) {
-    if ("origin" in headers && headers.origin !== "null") {
-      allowedOriginArray.push(headers.origin);
+  // Access-Control-Allow-Origin must be a single value (not a list).
+  // We reflect back the request's origin if it is in the allowed list.
+  // If no origin matches we fall back to "*" (only when not using credentials).
+  let allowOrigin = null;
+
+  const requestOrigin =
+    "origin" in headers && headers.origin !== "null"
+      ? headers.origin
+      : "referer" in headers
+        ? new URL(headers.referer).origin
+        : null;
+
+  if (requestOrigin) {
+    if (accessControlAllowedOrigins.includes(requestOrigin)) {
+      allowOrigin = requestOrigin;
+      vary.push("origin");
+    } else if (accessControlAllowRequestOrigin) {
+      allowOrigin = requestOrigin;
       vary.push("origin");
-    } else if ("referer" in headers) {
-      allowedOriginArray.push(new URL(headers.referer).origin);
-      vary.push("referer");
-    } else {
-      allowedOriginArray.push("*");
     }
+  } else if (accessControlAllowRequestOrigin) {
+    allowOrigin = "*";
+  }
+
+  if (allowOrigin === null) {
+    allowOrigin = accessControlAllowedOrigins[0] ?? "*";
   }
 
   const allowedMethodArray = [...accessControlAllowedMethods];
@@ -7993,16 +8064,14 @@ const generateAccessControlHeaders = ({
   }
 
   return {
-    "access-control-allow-origin": allowedOriginArray.join(", "),
+    "access-control-allow-origin": allowOrigin,
     "access-control-allow-methods": allowedMethodArray.join(", "),
     "access-control-allow-headers": allowedHeaderArray.join(", "),
     ...(accessControlAllowCredentials
       ? { "access-control-allow-credentials": true }
       : {}),
     "access-control-max-age": accessControlMaxAge,
-    ...(timingAllowOrigin
-      ? { "timing-allow-origin": allowedOriginArray.join(", ") }
-      : {}),
+    ...(timingAllowOrigin ? { "timing-allow-origin": allowOrigin } : {}),
     ...(vary.length ? { vary: vary.join(", ") } : {}),
   };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/server",
-  "version": "17.0.3",
+  "version": "17.1.1",
   "description": "A modern Node.js HTTP server with declarative routing, content negotiation, and WebSocket support",
   "repository": {
     "type": "git",

package/src/plugins/cors/server_plugin_cors.js

@@ -75,17 +75,32 @@ const generateAccessControlHeaders = ({
 } = {}) => {
   const vary = [];
 
-  const allowedOriginArray = [...accessControlAllowedOrigins];
-  if (accessControlAllowRequestOrigin) {
-    if ("origin" in headers && headers.origin !== "null") {
-      allowedOriginArray.push(headers.origin);
+  // Access-Control-Allow-Origin must be a single value (not a list).
+  // We reflect back the request's origin if it is in the allowed list.
+  // If no origin matches we fall back to "*" (only when not using credentials).
+  let allowOrigin = null;
+
+  const requestOrigin =
+    "origin" in headers && headers.origin !== "null"
+      ? headers.origin
+      : "referer" in headers
+        ? new URL(headers.referer).origin
+        : null;
+
+  if (requestOrigin) {
+    if (accessControlAllowedOrigins.includes(requestOrigin)) {
+      allowOrigin = requestOrigin;
+      vary.push("origin");
+    } else if (accessControlAllowRequestOrigin) {
+      allowOrigin = requestOrigin;
       vary.push("origin");
-    } else if ("referer" in headers) {
-      allowedOriginArray.push(new URL(headers.referer).origin);
-      vary.push("referer");
-    } else {
-      allowedOriginArray.push("*");
     }
+  } else if (accessControlAllowRequestOrigin) {
+    allowOrigin = "*";
+  }
+
+  if (allowOrigin === null) {
+    allowOrigin = accessControlAllowedOrigins[0] ?? "*";
   }
 
   const allowedMethodArray = [...accessControlAllowedMethods];
@@ -119,16 +134,14 @@ const generateAccessControlHeaders = ({
   }
 
   return {
-    "access-control-allow-origin": allowedOriginArray.join(", "),
+    "access-control-allow-origin": allowOrigin,
     "access-control-allow-methods": allowedMethodArray.join(", "),
     "access-control-allow-headers": allowedHeaderArray.join(", "),
     ...(accessControlAllowCredentials
       ? { "access-control-allow-credentials": true }
       : {}),
     "access-control-max-age": accessControlMaxAge,
-    ...(timingAllowOrigin
-      ? { "timing-allow-origin": allowedOriginArray.join(", ") }
-      : {}),
+    ...(timingAllowOrigin ? { "timing-allow-origin": allowOrigin } : {}),
     ...(vary.length ? { vary: vary.join(", ") } : {}),
   };
 };

package/src/plugins/route_inspector/server_plugin_route_inspector.js

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 const routeInspectorHtmlFileUrl = import.meta
   .resolve("./client/route_inspector.html");
 
-export const serverPluginRouteInspector = () => {
+export const serverPluginRouteInspector = ({ canExposeSensitiveData }) => {
   return {
     name: "jsenv:route_inspector",
     routes: [
@@ -29,7 +29,9 @@ export const serverPluginRouteInspector = () => {
         description: "Get the routes available on this server in JSON.",
         declarationSource: import.meta.url,
         fetch: (request, helpers) => {
-          const routeJSON = helpers.router.inspect(request, helpers);
+          const routeJSON = helpers.router.inspect({
+            canExposeSensitiveData,
+          });
           return Response.json(routeJSON);
         },
       },

package/src/router/router.js

@@ -28,7 +28,7 @@ const HTTP_METHODS = [
 
 export const createRouter = (
   routeDescriptionArray,
-  { optionsFallback, logLevel } = {},
+  { optionsFallback, logLevel, redirect = "manual" } = {},
 ) => {
   const logger = createLogger({ logLevel });
   const routeSet = new Set();
@@ -177,16 +177,6 @@ export const createRouter = (
 
   const match = async (request, fetchSecondArg) => {
     fetchSecondArg.router = router;
-    const wouldHaveMatched = {
-      // in case nothing matches we can produce a response with Allow: GET, POST, PUT for example
-      methodSet: new Set(),
-      requestMediaTypeSet: new Set(),
-      responseMediaTypeSet: new Set(),
-      responseLanguageSet: new Set(),
-      responseVersionSet: new Set(),
-      responseEncodingSet: new Set(),
-      upgrade: false,
-    };
 
     let currentServerPlugin;
     let currentRoutingTiming;
@@ -261,7 +251,6 @@ It should be set to one of route.${routePropertyName}: ${availableValues.join(",
           break;
         }
       }
-
       if (!matchesAnAvailableValue) {
         request.logger.warn(
           `The value "${responseHeaderValue}" found in response header ${responseHeaderName} is strange.
@@ -277,220 +266,270 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
       checkResponseContentHeader(route, responseHeaders, "encoding");
     };
 
-    for (const route of routeSet) {
-      onRouteMatchStart(route);
-      const resourceMatchResult = route.matchResource(request.resource);
-      if (!resourceMatchResult) {
-        continue;
-      }
-      if (!route.matchMethod(request.method)) {
-        if (!route.isFallback) {
-          wouldHaveMatched.methodSet.add(route.method);
-        }
-        continue;
+    const resolveResponse = async (fetchReturnValue, { request, route }) => {
+      let status;
+      let statusText;
+      let statusMessage;
+      let headers;
+      let body;
+
+      if (fetchReturnValue instanceof Response) {
+        status = fetchReturnValue.status;
+        statusText = fetchReturnValue.statusText;
+        headers = Object.fromEntries(fetchReturnValue.headers);
+        body = fetchReturnValue.body;
+      } else if (
+        fetchReturnValue !== null &&
+        typeof fetchReturnValue === "object"
+      ) {
+        status = fetchReturnValue.status || 404;
+        statusText = fetchReturnValue.statusText;
+        statusMessage = fetchReturnValue.statusMessage;
+        headers = fetchReturnValue.headers || {};
+        body = fetchReturnValue.body;
+      } else {
+        throw new TypeError(
+          `response must be a Response, or an Object, received ${fetchReturnValue}`,
+        );
       }
+
       if (
-        request.method === "POST" ||
-        request.method === "PATCH" ||
-        request.method === "PUT"
+        redirect === "follow" &&
+        isRedirectStatus(status) &&
+        headers["location"]
       ) {
-        const { acceptedMediaTypes } = route;
+        const redirectUrl = new URL(headers["location"], request.url);
+        if (redirectUrl.origin === new URL(request.url).origin) {
+          const redirectRequest = {
+            ...request,
+            url: redirectUrl.href,
+            resource:
+              redirectUrl.pathname + redirectUrl.search + redirectUrl.hash,
+            // GET for 301/302/303, preserve method for 307/308
+            method: status === 307 || status === 308 ? request.method : "GET",
+            params: {},
+          };
+          const redirectedResponse = await matchRoutes(redirectRequest);
+          onRouteMatch(route);
+          onResponseHeaders(request, route, redirectedResponse.headers || {});
+          return redirectedResponse;
+        }
+        // redirect to other origins are left to the client to handle
+      }
+
+      onRouteMatch(route);
+      onResponseHeaders(request, route, headers);
+      return { status, statusText, statusMessage, headers, body };
+    };
+
+    const matchRoutes = async (request) => {
+      // in case nothing matches we can produce a response with Allow: GET, POST, PUT for example
+      const wouldHaveMatched = {
+        methodSet: new Set(),
+        requestMediaTypeSet: new Set(),
+        responseMediaTypeSet: new Set(),
+        responseLanguageSet: new Set(),
+        responseVersionSet: new Set(),
+        responseEncodingSet: new Set(),
+        upgrade: false,
+      };
+
+      for (const route of routeSet) {
+        onRouteMatchStart(route);
+        const resourceMatchResult = route.matchResource(request.resource);
+        if (!resourceMatchResult) {
+          continue;
+        }
+        if (!route.matchMethod(request.method)) {
+          if (!route.isFallback) {
+            wouldHaveMatched.methodSet.add(route.method);
+          }
+          continue;
+        }
         if (
-          acceptedMediaTypes.length &&
-          !isRequestBodyMediaTypeSupported(request, { acceptedMediaTypes })
+          request.method === "POST" ||
+          request.method === "PATCH" ||
+          request.method === "PUT"
         ) {
-          for (const acceptedMediaType of acceptedMediaTypes) {
-            wouldHaveMatched.requestMediaTypeSet.add(acceptedMediaType);
+          const { acceptedMediaTypes } = route;
+          if (
+            acceptedMediaTypes.length &&
+            !isRequestBodyMediaTypeSupported(request, { acceptedMediaTypes })
+          ) {
+            for (const acceptedMediaType of acceptedMediaTypes) {
+              wouldHaveMatched.requestMediaTypeSet.add(acceptedMediaType);
+            }
+            continue;
           }
+        }
+        const headersMatchResult = route.matchHeaders(request.headers);
+        if (!headersMatchResult) {
           continue;
         }
-      }
-      const headersMatchResult = route.matchHeaders(request.headers);
-      if (!headersMatchResult) {
-        continue;
-      }
-      if (route.isForWebSocket && request.headers["upgrade"] !== "websocket") {
-        wouldHaveMatched.upgrade = true;
-        continue;
-      }
-      // now we are "good", let's try to generate a response
-      const contentNegotiationResult = {};
-      content_negotiation: {
-        // when content nego fails
-        // we will check the remaining accept headers to properly inform client of all the things are failing
-        // Example:
-        // client says "I want text in french"
-        // but server only provide json in english
-        // we want to tell client both text and french are not available
-        let hasFailed = false;
-        const { availableMediaTypes } = route;
-        if (availableMediaTypes.length) {
-          fetchSecondArg.injectResponseHeader("vary", "accept");
-          if (request.headers["accept"]) {
-            const mediaTypeNegotiated = pickContentType(
-              request,
-              availableMediaTypes,
-            );
-            if (!mediaTypeNegotiated) {
-              for (const availableMediaType of availableMediaTypes) {
-                wouldHaveMatched.responseMediaTypeSet.add(availableMediaType);
+        if (
+          route.isForWebSocket &&
+          request.headers["upgrade"] !== "websocket"
+        ) {
+          wouldHaveMatched.upgrade = true;
+          continue;
+        }
+        // now we are "good", let's try to generate a response
+        const contentNegotiationResult = {};
+        content_negotiation: {
+          // when content nego fails
+          // we will check the remaining accept headers to properly inform client of all the things are failing
+          // Example:
+          // client says "I want text in french"
+          // but server only provide json in english
+          // we want to tell client both text and french are not available
+          let hasFailed = false;
+          const { availableMediaTypes } = route;
+          if (availableMediaTypes.length) {
+            fetchSecondArg.injectResponseHeader("vary", "accept");
+            if (request.headers["accept"]) {
+              const mediaTypeNegotiated = pickContentType(
+                request,
+                availableMediaTypes,
+              );
+              if (!mediaTypeNegotiated) {
+                for (const availableMediaType of availableMediaTypes) {
+                  wouldHaveMatched.responseMediaTypeSet.add(availableMediaType);
+                }
+                hasFailed = true;
               }
-              hasFailed = true;
+              contentNegotiationResult.mediaType = mediaTypeNegotiated;
+            } else {
+              contentNegotiationResult.mediaType = availableMediaTypes[0];
             }
-            contentNegotiationResult.mediaType = mediaTypeNegotiated;
-          } else {
-            contentNegotiationResult.mediaType = availableMediaTypes[0];
           }
-        }
-        const { availableLanguages } = route;
-        if (availableLanguages.length) {
-          fetchSecondArg.injectResponseHeader("vary", "accept-language");
-          if (request.headers["accept-language"]) {
-            const languageNegotiated = pickContentLanguage(
-              request,
-              availableLanguages,
-            );
-            if (!languageNegotiated) {
-              for (const availableLanguage of availableLanguages) {
-                wouldHaveMatched.responseLanguageSet.add(availableLanguage);
+          const { availableLanguages } = route;
+          if (availableLanguages.length) {
+            fetchSecondArg.injectResponseHeader("vary", "accept-language");
+            if (request.headers["accept-language"]) {
+              const languageNegotiated = pickContentLanguage(
+                request,
+                availableLanguages,
+              );
+              if (!languageNegotiated) {
+                for (const availableLanguage of availableLanguages) {
+                  wouldHaveMatched.responseLanguageSet.add(availableLanguage);
+                }
+                hasFailed = true;
               }
-              hasFailed = true;
+              contentNegotiationResult.language = languageNegotiated;
+            } else {
+              contentNegotiationResult.language = availableLanguages[0];
             }
-            contentNegotiationResult.language = languageNegotiated;
-          } else {
-            contentNegotiationResult.language = availableLanguages[0];
           }
-        }
-        const { availableVersions } = route;
-        if (availableVersions.length) {
-          fetchSecondArg.injectResponseHeader("vary", "accept-version");
-          if (request.headers["accept-version"]) {
-            const versionNegotiated = pickContentVersion(
-              request,
-              availableVersions,
-            );
-            if (!versionNegotiated) {
-              for (const availableVersion of availableVersions) {
-                wouldHaveMatched.responseVersionSet.add(availableVersion);
+          const { availableVersions } = route;
+          if (availableVersions.length) {
+            fetchSecondArg.injectResponseHeader("vary", "accept-version");
+            if (request.headers["accept-version"]) {
+              const versionNegotiated = pickContentVersion(
+                request,
+                availableVersions,
+              );
+              if (!versionNegotiated) {
+                for (const availableVersion of availableVersions) {
+                  wouldHaveMatched.responseVersionSet.add(availableVersion);
+                }
+                hasFailed = true;
               }
-              hasFailed = true;
+              contentNegotiationResult.version = versionNegotiated;
+            } else {
+              contentNegotiationResult.version = availableVersions[0];
             }
-            contentNegotiationResult.version = versionNegotiated;
-          } else {
-            contentNegotiationResult.version = availableVersions[0];
           }
-        }
-        const { availableEncodings } = route;
-        if (availableEncodings.length) {
-          fetchSecondArg.injectResponseHeader("vary", "accept-encoding");
-          if (request.headers["accept-encoding"]) {
-            const encodingNegotiated = pickContentEncoding(
-              request,
-              availableEncodings,
-            );
-            if (!encodingNegotiated) {
-              for (const availableEncoding of availableEncodings) {
-                wouldHaveMatched.responseEncodingSet.add(availableEncoding);
+          const { availableEncodings } = route;
+          if (availableEncodings.length) {
+            fetchSecondArg.injectResponseHeader("vary", "accept-encoding");
+            if (request.headers["accept-encoding"]) {
+              const encodingNegotiated = pickContentEncoding(
+                request,
+                availableEncodings,
+              );
+              if (!encodingNegotiated) {
+                for (const availableEncoding of availableEncodings) {
+                  wouldHaveMatched.responseEncodingSet.add(availableEncoding);
+                }
+                hasFailed = true;
               }
-              hasFailed = true;
+              contentNegotiationResult.encoding = encodingNegotiated;
+            } else {
+              contentNegotiationResult.encoding = availableEncodings[0];
             }
-            contentNegotiationResult.encoding = encodingNegotiated;
-          } else {
-            contentNegotiationResult.encoding = availableEncodings[0];
           }
+          if (hasFailed) {
+            continue;
+          }
+        }
+        const { named, stars = [] } = PATTERN.composeTwoMatchResults(
+          resourceMatchResult,
+          headersMatchResult,
+        );
+        Object.assign(request.params, named, stars);
+        fetchSecondArg.contentNegotiation = contentNegotiationResult;
+        let fetchReturnValue = route.fetch(request, fetchSecondArg);
+        if (
+          fetchReturnValue !== null &&
+          typeof fetchReturnValue === "object" &&
+          typeof fetchReturnValue.then === "function"
+        ) {
+          fetchReturnValue = await fetchReturnValue;
         }
-        if (hasFailed) {
+        // route decided not to handle in the end
+        if (fetchReturnValue === null || fetchReturnValue === undefined) {
           continue;
         }
+        return resolveResponse(fetchReturnValue, { request, route });
       }
-      const { named, stars = [] } = PATTERN.composeTwoMatchResults(
-        resourceMatchResult,
-        headersMatchResult,
-      );
-      Object.assign(request.params, named, stars);
-      fetchSecondArg.contentNegotiation = contentNegotiationResult;
-      let fetchReturnValue = route.fetch(request, fetchSecondArg);
-      if (
-        fetchReturnValue !== null &&
-        typeof fetchReturnValue === "object" &&
-        typeof fetchReturnValue.then === "function"
-      ) {
-        fetchReturnValue = await fetchReturnValue;
+      // nothing has matched fully
+      // if nothing matches at all we'll send 404
+      // but if url matched but METHOD was not supported we send 405
+      if (wouldHaveMatched.methodSet.size) {
+        return createMethodNotAllowedResponse(request, {
+          allowedMethods: [...wouldHaveMatched.methodSet],
+        });
       }
-      // route decided not to handle in the end
-      if (fetchReturnValue === null || fetchReturnValue === undefined) {
-        continue;
+      if (wouldHaveMatched.requestMediaTypeSet.size) {
+        return createUnsupportedMediaTypeResponse(request, {
+          acceptedMediaTypes: [...wouldHaveMatched.requestMediaTypeSet],
+        });
       }
-      onRouteMatch(route);
-      if (fetchReturnValue instanceof Response) {
-        const headers = Object.fromEntries(fetchReturnValue.headers);
-        onResponseHeaders(request, route, headers);
-        return {
-          status: fetchReturnValue.status,
-          statusText: fetchReturnValue.statusText,
-          headers,
-          body: fetchReturnValue.body,
-        };
+      if (
+        wouldHaveMatched.responseMediaTypeSet.size ||
+        wouldHaveMatched.responseLanguageSet.size ||
+        wouldHaveMatched.responseVersionSet.size ||
+        wouldHaveMatched.responseEncodingSet.size
+      ) {
+        return createNotAcceptableResponse(request, {
+          availableMediaTypes: [...wouldHaveMatched.responseMediaTypeSet],
+          availableLanguages: [...wouldHaveMatched.responseLanguageSet],
+          availableVersions: [...wouldHaveMatched.responseVersionSet],
+          availableEncodings: [...wouldHaveMatched.responseEncodingSet],
+        });
       }
-      if (fetchReturnValue !== null && typeof fetchReturnValue === "object") {
-        const headers = fetchReturnValue.headers || {};
-        onResponseHeaders(request, route, headers);
+      if (wouldHaveMatched.upgrade) {
         return {
-          status: fetchReturnValue.status || 404,
-          statusText: fetchReturnValue.statusText,
-          statusMessage: fetchReturnValue.statusMessage,
-          headers,
-          body: fetchReturnValue.body,
+          status: 426,
+          statusText: "Upgrade Required",
+          statusMessage: `The request requires the upgrade to a webSocket connection`,
         };
       }
-      throw new TypeError(
-        `response must be a Response, or an Object, received ${fetchReturnValue}`,
+      const availableEndpoints = constructAvailableEndpoints(
+        request,
+        fetchSecondArg,
       );
-    }
-    // nothing has matched fully
-    // if nothing matches at all we'll send 404
-    // but if url matched but METHOD was not supported we send 405
-    if (wouldHaveMatched.methodSet.size) {
-      return createMethodNotAllowedResponse(request, {
-        allowedMethods: [...wouldHaveMatched.methodSet],
-      });
-    }
-    if (wouldHaveMatched.requestMediaTypeSet.size) {
-      return createUnsupportedMediaTypeResponse(request, {
-        acceptedMediaTypes: [...wouldHaveMatched.requestMediaTypeSet],
-      });
-    }
-    if (
-      wouldHaveMatched.responseMediaTypeSet.size ||
-      wouldHaveMatched.responseLanguageSet.size ||
-      wouldHaveMatched.responseVersionSet.size ||
-      wouldHaveMatched.responseEncodingSet.size
-    ) {
-      return createNotAcceptableResponse(request, {
-        availableMediaTypes: [...wouldHaveMatched.responseMediaTypeSet],
-        availableLanguages: [...wouldHaveMatched.responseLanguageSet],
-        availableVersions: [...wouldHaveMatched.responseVersionSet],
-        availableEncodings: [...wouldHaveMatched.responseEncodingSet],
-      });
-    }
-    if (wouldHaveMatched.upgrade) {
-      return {
-        status: 426,
-        statusText: "Upgrade Required",
-        statusMessage: `The request requires the upgrade to a webSocket connection`,
-      };
-    }
-    const availableEndpoints = constructAvailableEndpoints(
-      request,
-      fetchSecondArg,
-    );
-    return createRouteNotFoundResponse(request, { availableEndpoints });
+      return createRouteNotFoundResponse(request, { availableEndpoints });
+    }; // end matchRoutes
+
+    return matchRoutes(request);
   };
-  const inspect = () => {
+  const inspect = ({ canExposeSensitiveData }) => {
     // I want all the info I can gather about the routes
     const data = [];
     for (const route of routeSet) {
-      data.push(route.toJSON());
+      data.push(route.toJSON({ canExposeSensitiveData }));
     }
     return data;
   };
@@ -615,10 +654,10 @@ const createRoute = ({
     toString: () => {
       return `${method} ${resource}`;
     },
-    toJSON: () => {
+    toJSON: ({ canExposeSensitiveData }) => {
       const meta = {};
 
-      if (declarationSource) {
+      if (declarationSource && canExposeSensitiveData) {
         meta.declarationLink = {
           url: `javascript:window.fetch("/.internal/open_file/${encodeURIComponent(declarationSource)}")`,
           text: declarationSource,
@@ -646,7 +685,6 @@ const createRoute = ({
           } catch {}
         }
       }
-
       return {
         method,
         resource,
@@ -663,7 +701,9 @@ const createRoute = ({
             : typeof clientCodeExample === "string"
               ? clientCodeExample
               : undefined,
-        declarationSource,
+        declarationSource: canExposeSensitiveData
+          ? declarationSource
+          : undefined,
         meta,
       };
     },
@@ -675,6 +715,9 @@ const createRoute = ({
   return route;
 };
 
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const isRedirectStatus = (status) => REDIRECT_STATUSES.has(status);
+
 const isRequestBodyMediaTypeSupported = (request, { acceptedMediaTypes }) => {
   const requestBodyContentType = request.headers["content-type"];
   if (!requestBodyContentType) {

package/src/start_server.js

@@ -79,6 +79,12 @@ export const startServer = async ({
   keepProcessAlive = true,
   routes = [],
   plugins = [],
+  // When enabled, the server gives more power:
+  // - each route show the source where it was declared
+  // - server can be requested to open a file on the machine
+  // - client can subscribe to server to detect when it restarts
+  // This param should be enabled ONLY during development on your machine
+  canExposeSensitiveData = false,
   nagle = true,
   serverTiming = false,
   requestWaitingMs = 0,
@@ -153,11 +159,11 @@ export const startServer = async ({
   }
 
   plugins = [
-    serverPluginOpenFile(),
+    ...(canExposeSensitiveData ? [serverPluginOpenFile()] : []),
     serverPluginDefaultBody4xx5xx(),
-    serverPluginRouteInspector(),
-    serverPluginInternalClientFiles(),
-    serverPluginAutoreloadOnRestart(),
+    serverPluginRouteInspector({ canExposeSensitiveData }),
+    ...(canExposeSensitiveData ? [serverPluginInternalClientFiles()] : []),
+    ...(canExposeSensitiveData ? [serverPluginAutoreloadOnRestart()] : []),
     ...plugins,
   ];