@middy/http-cors 5.3.4 → 5.4.0

package/index.js

@@ -1,22 +1,8 @@
 import { normalizeHttpResponse } from '@middy/util'
 
-const getOrigin = (incomingOrigin, options = {}) => {
-  if (options.origins.length > 0) {
-    if (incomingOrigin && options.origins.includes(incomingOrigin)) {
-      return incomingOrigin
-    }
-  } else {
-    if (incomingOrigin && options.credentials && options.origin === '*') {
-      return incomingOrigin
-    }
-    return options.origin
-  }
-  return null
-}
-
 const defaults = {
   disableBeforePreflightResponse: true,
-  getOrigin,
+  getOrigin: undefined, // default inserted below
   credentials: undefined,
   headers: undefined,
   methods: undefined,
@@ -30,10 +16,56 @@ const defaults = {
   vary: undefined
 }
 const httpCorsMiddleware = (opts = {}) => {
+  let originAny = false
+  const originStatic = {}
+  const originDynamic = []
+  const getOrigin = (incomingOrigin, options = {}) => {
+    if (options.origins.length > 0) {
+      if (originStatic[incomingOrigin]) {
+        return incomingOrigin
+      }
+      if (originAny) {
+        if (options.credentials) {
+          return incomingOrigin
+        } else {
+          return '*'
+        }
+      }
+      if (originDynamic.some((regExp) => regExp.test(incomingOrigin))) {
+        return incomingOrigin
+      }
+      // TODO deprecate `else` in v6
+    } else {
+      if (incomingOrigin && options.credentials && options.origin === '*') {
+        return incomingOrigin
+      }
+      return options.origin
+    }
+    return null
+  }
   const options = {
     ...defaults,
+    getOrigin,
     ...opts
   }
+
+  for (const origin of options.origins) {
+    // Static
+    if (origin.indexOf('*') < 0) {
+      originStatic[origin] = true
+      continue
+    }
+    // All
+    if (origin === '*') {
+      originAny = true
+      continue
+    }
+    // Dynamic
+    // TODO: IDN -> puncycode not handled, add in if requested
+    const regExpStr = origin.replaceAll('.', '\\.').replaceAll('*', '[^.]*')
+    originDynamic.push(new RegExp(`^${regExpStr}$`))
+  }
+
   const httpCorsMiddlewareBefore = async (request) => {
     if (options.disableBeforePreflightResponse) return
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@middy/http-cors",
-  "version": "5.3.4",
+  "version": "5.4.0",
   "description": "CORS (Cross-Origin Resource Sharing) middleware for the middy framework",
   "type": "module",
   "engines": {
@@ -58,11 +58,11 @@
     "type": "github",
     "url": "https://github.com/sponsors/willfarrell"
   },
-  "gitHead": "37632cf8463e8834c09e91bff14817b7e1e2e8ee",
+  "gitHead": "593d40bc87996159c29367ab39d7d415940d9fba",
   "dependencies": {
-    "@middy/util": "5.3.4"
+    "@middy/util": "5.4.0"
   },
   "devDependencies": {
-    "@middy/core": "5.3.4"
+    "@middy/core": "5.4.0"
   }
 }