@mandujs/core 0.54.23 → 0.54.25

package/src/filling/filling.ts

@@ -606,7 +606,27 @@ export class ManduFilling<TLoaderData = unknown> {
       if (this.config.handlers.has("GET") && !allowed.includes("HEAD")) {
         allowed.push("HEAD");
       }
-      return ctx.json({ status: "error", message: `Method ${method} not allowed`, allowed }, 405);
+      // RFC 7231 §4.3.7: auto-respond to a plain OPTIONS request (no explicit
+      // OPTIONS handler) with 204 + an `Allow` header. CORS preflights — which
+      // carry `Access-Control-Request-Method` — are left to the normal flow so
+      // CORS middleware can attach its Access-Control-* headers.
+      if (
+        method === "OPTIONS" &&
+        !normalizedRequest.headers.get("access-control-request-method")
+      ) {
+        const optionsAllowed = allowed.includes("OPTIONS") ? allowed : [...allowed, "OPTIONS"];
+        return new Response(null, {
+          status: 204,
+          headers: { Allow: optionsAllowed.join(", ") },
+        });
+      }
+      // RFC 7231 §6.5.5: a 405 response MUST include an `Allow` header listing
+      // every supported method (not just the body field). ctx.json() cannot
+      // attach headers, so build the response directly here.
+      return Response.json(
+        { status: "error", message: `Method ${method} not allowed`, allowed },
+        { status: 405, headers: { Allow: allowed.join(", ") } },
+      );
     }
     const lifecycleWithDefaults = this.createLifecycleWithDefaults(routeContext);
     const runHandler = async () => {

package/src/filling/head-method.test.ts

@@ -69,4 +69,86 @@ describe("Filling HEAD handling (#319)", () => {
     expect(body.allowed).toContain("GET");
     expect(body.allowed).toContain("HEAD");
   });
+
+  // Issue #321: 405 responses MUST carry an `Allow` header listing every
+  // supported method — for multi-method routes too, not just single-method.
+  it("sets the Allow header to a single method route's methods", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "PUT" }),
+    );
+
+    expect(putRes.status).toBe(405);
+    const allow = putRes.headers.get("Allow") ?? "";
+    expect(allow.split(", ")).toContain("GET");
+    expect(allow.split(", ")).toContain("HEAD");
+  });
+
+  it("sets the Allow header to ALL methods for a multi-method route (#321)", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .post((ctx) => ctx.json({ ok: true }))
+      .delete((ctx) => ctx.json({ ok: true }));
+
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "PUT" }),
+    );
+
+    expect(putRes.status).toBe(405);
+    const allow = putRes.headers.get("Allow") ?? "";
+    const methods = allow.split(", ");
+    expect(methods).toContain("GET");
+    expect(methods).toContain("POST");
+    expect(methods).toContain("DELETE");
+    // HEAD is implied by GET.
+    expect(methods).toContain("HEAD");
+  });
+
+  // RFC 7231 §4.3.7: a plain OPTIONS request (no explicit OPTIONS handler)
+  // should return 204 with an Allow header, not 405.
+  it("auto-responds to a plain OPTIONS request with 204 + Allow", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .post((ctx) => ctx.json({ ok: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "OPTIONS" }),
+    );
+
+    expect(res.status).toBe(204);
+    const methods = (res.headers.get("Allow") ?? "").split(", ");
+    expect(methods).toContain("GET");
+    expect(methods).toContain("POST");
+    expect(methods).toContain("HEAD");
+    expect(methods).toContain("OPTIONS");
+  });
+
+  it("defers CORS preflight OPTIONS (Access-Control-Request-Method) instead of auto-answering", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", {
+        method: "OPTIONS",
+        headers: { "Access-Control-Request-Method": "GET", Origin: "https://x" },
+      }),
+    );
+
+    // No CORS middleware registered → falls through to 405 (not the 204
+    // auto-OPTIONS path), leaving preflight handling to CORS middleware.
+    expect(res.status).toBe(405);
+  });
+
+  it("an explicit OPTIONS handler still takes precedence", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .options((ctx) => ctx.json({ custom: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "OPTIONS" }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ custom: true });
+  });
 });

package/src/runtime/handlers.ts

@@ -76,6 +76,16 @@ function createMethodDispatcher(module: RouteModule, routeId: string) {
       if (typeof module.GET === "function" && !allow.includes("HEAD")) {
         allow.push("HEAD");
       }
+      // RFC 7231 §4.3.7: auto-respond to a plain OPTIONS request (no explicit
+      // OPTIONS export) with 204 + an `Allow` header. CORS preflights (which
+      // carry `Access-Control-Request-Method`) are left to the normal flow.
+      if (method === "OPTIONS" && !req.headers.get("access-control-request-method")) {
+        const optionsAllow = allow.includes("OPTIONS") ? allow : [...allow, "OPTIONS"];
+        return new Response(null, {
+          status: 204,
+          headers: { Allow: optionsAllow.join(", ") },
+        });
+      }
       return Response.json(
         {
           error: `Method ${method} not allowed for route ${routeId}`,