@rpcbase/server 0.212.0 → 0.213.0

package/boot/index.js

@@ -14,11 +14,8 @@ const {SERVER_PORT} = process.env
 const app = express()
 const server = http.createServer(app)
 
-
 realtime_state(server)
 
-
-
 server.listen(SERVER_PORT, "0.0.0.0", () => {
   console.log(`listening on 0.0.0.0:${SERVER_PORT}`)
 })

package/express/custom_cors.js

@@ -0,0 +1,74 @@
+/* @flow */
+const debug = require("debug")
+const cors = require("cors")
+
+const is_production = process.env.IS_PRODUCTION === "yes"
+
+const {RB_SKIP_CORS_PATHS, APP_DOMAIN, CLIENT_PORT} = process.env
+
+const custom_cors = (app) => {
+
+  const skip_paths = (RB_SKIP_CORS_PATHS || "").split(",")
+
+  // CORS
+  const cors_origins = is_production ?
+    // https://stackoverflow.com/questions/14003332/access-control-allow-origin-wildcard-subdomains-ports-and-protocols
+    // production
+    [
+      `https://www.${APP_DOMAIN}`,
+      `https://${APP_DOMAIN}`,
+      `https://admin.${APP_DOMAIN}`,
+      // This is used for the posthog player to retrieve the css and assets files
+      `https://app.posthog.com`,
+      `https://eu.posthog.com`,
+    ] :
+    // local dev origins
+    // TODO: fixme, make this dynamic!
+    [
+      `http://127.0.0.1:${CLIENT_PORT}`,
+      `http://localhost:${CLIENT_PORT}`,
+      // `http://192.168.1.83:${CLIENT_PORT}`,
+      // `http://192.168.1.140:${CLIENT_PORT}`,
+      `http://admin.localhost:${CLIENT_PORT}`,
+      // TODO: WARNING: TMP hardcoded port
+      "http://127.0.0.1:8090", // TMP: used by inspected app from admin
+      "http://127.0.0.1:8091", // TMP: used by inspected app from admin
+      "http://127.0.0.1:9292", // TMP
+      // disgusting, sort this out
+      "http://localhost:8090", // TMP: used by inspected app from admin
+      "http://localhost:8091", // TMP: used by inspected app from admin
+      "http://localhost:9292", // TMP
+      // posthog
+      `https://app.posthog.com`,
+      `https://eu.posthog.com`,
+    ]
+
+    if (APP_DOMAIN) {
+      cors_origins.push(`http://${APP_DOMAIN}`)
+      cors_origins.push(`https://${APP_DOMAIN}`)
+    }
+
+
+  console.log("setting up cors with origins", JSON.stringify(cors_origins))
+
+  const cors_middleware = cors({
+    origin: cors_origins,
+    methods: ["GET", "POST"],
+    credentials: true // IMPORTANT: required to enable set-cookie
+  })
+
+  app.use((req, res, next) => {
+    for (const skip_path of skip_paths) {
+      if (req.url.startsWith(skip_path)) {
+        console.log("SKIPPING CORS FOR:", req.url)
+        next()
+        return
+      }
+    }
+
+    cors_middleware(req, res, next)
+  })
+
+}
+
+module.exports = custom_cors

package/express/index.js

@@ -1,6 +1,5 @@
 /* @flow */
 const debug = require("debug")
-const cors = require("cors")
 const express = require("express")
 const body_parser = require("body-parser")
 const request_ip = require("request-ip")
@@ -10,7 +9,7 @@ const auth = require("../src/auth")
 const sessions = require("../src/sessions")
 
 const dev_save_coverage = require("./dev_save_coverage")
-
+const custom_cors = require("./custom_cors")
 
 const log = debug("rb:server")
 
@@ -43,53 +42,7 @@ module.exports = () => {
     next()
   })
 
-
-  // CORS
-  const cors_origins = is_production ?
-    // https://stackoverflow.com/questions/14003332/access-control-allow-origin-wildcard-subdomains-ports-and-protocols
-    // production
-    [
-      `https://www.${APP_DOMAIN}`,
-      `https://${APP_DOMAIN}`,
-      `https://admin.${APP_DOMAIN}`,
-      `https://app.posthog.com`,
-      `https://eu.posthog.com`,
-    ] :
-    // local dev origins
-    // TODO: fixme, make this dynamic!
-    [
-      `http://127.0.0.1:${CLIENT_PORT}`,
-      `http://localhost:${CLIENT_PORT}`,
-      // `http://192.168.1.83:${CLIENT_PORT}`,
-      // `http://192.168.1.140:${CLIENT_PORT}`,
-      `http://admin.localhost:${CLIENT_PORT}`,
-      // TODO: WARNING: TMP hardcoded port
-      "http://127.0.0.1:8090", // TMP: used by inspected app from admin
-      "http://127.0.0.1:8091", // TMP: used by inspected app from admin
-      "http://127.0.0.1:9292", // TMP
-      // disgusting, sort this out
-      "http://localhost:8090", // TMP: used by inspected app from admin
-      "http://localhost:8091", // TMP: used by inspected app from admin
-      "http://localhost:9292", // TMP
-      // posthog
-      `https://app.posthog.com`,
-      `https://eu.posthog.com`,
-    ]
-
-    if (APP_DOMAIN) {
-      cors_origins.push(`http://${APP_DOMAIN}`)
-      cors_origins.push(`https://${APP_DOMAIN}`)
-    }
-
-
-  log("setting up cors with origins", JSON.stringify(cors_origins))
-
-  app.use(cors({
-    origin: cors_origins,
-    methods: ["GET", "POST"],
-    credentials: true // IMPORTANT: required to enable set-cookie
-  }))
-
+  custom_cors(app)
 
   sessions(app)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpcbase/server",
-  "version": "0.212.0",
+  "version": "0.213.0",
   "license": "SSPL-1.0",
   "main": "./index.js",
   "bin": {

package/src/sessions/index.js

@@ -17,8 +17,6 @@ module.exports = (app) => {
       app.use(require("./warning_proxy_middleware"))
     }
 
-
-
     const session_proxy_middleware = require("./session_proxy_middleware")
     app.use(session_proxy_middleware)
   }