@middy/http-cors 7.1.0 → 7.1.2

package/README.md

@@ -1,5 +1,5 @@
 <div align="center">
-  <h1>Middy CORS middleware</h1>
+  <h1>Middy `http-cors` middleware</h1>
   <img alt="Middy logo" src="https://raw.githubusercontent.com/middyjs/middy/main/docs/img/middy-logo.svg"/>
   <p><strong>CORS middleware for the middy framework, the stylish Node.js middleware engine for AWS Lambda</strong></p>
   <p>

package/index.d.ts

@@ -15,6 +15,7 @@ export interface Options {
 	requestHeaders?: string[];
 	requestMethods?: string[];
 	cacheControl?: string;
+	vary?: string;
 }
 
 declare function httpCors(options?: Options): middy.MiddlewareObj;

package/index.js

@@ -2,6 +2,25 @@
 // SPDX-License-Identifier: MIT
 import { normalizeHttpResponse } from "@middy/util";
 
+const hostnameToPunycode = (hostname) => {
+	const placeholder = "-_ANY_-";
+	const tempHostname = hostname.replace(/\*/g, placeholder);
+	try {
+		const url = new URL(`https://${tempHostname}`);
+		return url.host.replaceAll(placeholder.toLowerCase(), "*");
+	} catch {
+		return hostname;
+	}
+};
+
+const originToPunycode = (origin) => {
+	if (!origin || origin === "*") return origin;
+	const match = origin.match(/^(https?:\/\/)(.+)$/);
+	if (!match) return origin;
+	const [, protocol, host] = match;
+	return protocol + hostnameToPunycode(host);
+};
+
 // CORS-safelisted request headers
 // https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted_request_header
 const corsSafelistedRequestHeaders = [
@@ -43,7 +62,6 @@ const httpCorsMiddleware = (opts = {}) => {
 			if (originDynamic.some((regExp) => regExp.test(incomingOrigin))) {
 				return incomingOrigin;
 			}
-			// TODO v8 deprecate `else`
 		} else {
 			if (incomingOrigin && options.credentials && options.origin === "*") {
 				return incomingOrigin;
@@ -58,6 +76,22 @@ const httpCorsMiddleware = (opts = {}) => {
 		...opts,
 	};
 
+	if (
+		options.requestHeaders !== undefined &&
+		!Array.isArray(options.requestHeaders)
+	) {
+		throw new Error("requestHeaders must be an array", {
+			cause: { package: "@middy/http-cors" },
+		});
+	}
+	if (
+		options.requestMethods !== undefined &&
+		!Array.isArray(options.requestMethods)
+	) {
+		throw new Error("requestMethods must be an array", {
+			cause: { package: "@middy/http-cors" },
+		});
+	}
 	options.requestHeaders = options.requestHeaders?.map((v) => v.toLowerCase());
 	options.requestMethods = options.requestMethods?.map((v) => v.toUpperCase());
 
@@ -66,10 +100,11 @@ const httpCorsMiddleware = (opts = {}) => {
 	const originStatic = {};
 	const originDynamic = [];
 
-	for (const origin of [options.origin, ...options.origins]) {
+	for (let origin of [options.origin, ...options.origins]) {
 		if (!origin) {
 			continue;
 		}
+		origin = originToPunycode(origin);
 		// All
 		if (origin === "*") {
 			originAny = true;
@@ -82,7 +117,6 @@ const httpCorsMiddleware = (opts = {}) => {
 		}
 		originMany = true;
 		// Dynamic
-		// TODO: IDN -> puncycode not handled, add in if requested
 		const regExpStr = origin
 			.replace(/[.+?^${}()|[\]\\]/g, "\\$&")
 			.replaceAll("*", "[^.]*");
@@ -227,7 +261,7 @@ const getVersionHttpMethod = {
 	"2.0": (event) => event.requestContext.http.method,
 };
 
-// header in offical name, lowercase varient handeled
+// header in official name, lowercase variant handled
 const addHeaderPart = (headers, header, value) => {
 	if (!value) return;
 	const headerLower = header.toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@middy/http-cors",
-	"version": "7.1.0",
+	"version": "7.1.2",
 	"description": "CORS (Cross-Origin Resource Sharing) middleware for the middy framework",
 	"type": "module",
 	"engines": {
@@ -65,9 +65,10 @@
 	},
 	"gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431",
 	"dependencies": {
-		"@middy/util": "7.1.0"
+		"@middy/util": "7.1.2"
 	},
 	"devDependencies": {
-		"@middy/core": "7.1.0"
+		"@middy/core": "7.1.2",
+		"@types/aws-lambda": "^8.0.0"
 	}
 }