@rsdoctor/sdk 1.5.14 → 1.5.15

package/dist/index.cjs

@@ -5675,9 +5675,7 @@ var __webpack_modules__ = {
             return enc && (headers['Content-Encoding'] = enc), isEtag && (headers.ETag = `W/"${stats.size}-${stats.mtime.getTime()}"`), headers;
         }
         let common_namespaceObject = require("@rsdoctor/utils/common"), external_assert_namespaceObject = require("assert");
-        var external_assert_default = __webpack_require__.n(external_assert_namespaceObject), body_parser = __webpack_require__("../../node_modules/.pnpm/body-parser@2.2.2/node_modules/body-parser/index.js"), body_parser_default = __webpack_require__.n(body_parser);
-        let cors_index_js_namespaceObject = require("../compiled/cors/index.js");
-        var cors_index_js_default = __webpack_require__.n(cors_index_js_namespaceObject), external_stream_ = __webpack_require__("stream");
+        var external_assert_default = __webpack_require__.n(external_assert_namespaceObject), body_parser = __webpack_require__("../../node_modules/.pnpm/body-parser@2.2.2/node_modules/body-parser/index.js"), body_parser_default = __webpack_require__.n(body_parser), external_stream_ = __webpack_require__("stream");
         let external_socket_io_namespaceObject = require("socket.io");
         var external_util_ = __webpack_require__("util");
         class SocketAPILoader {
@@ -6131,10 +6129,6 @@ var __webpack_modules__ = {
             plugin_ts_metadata("design:returntype", Promise)
         ], PluginAPI.prototype, "getPluginData", null);
         var external_os_ = __webpack_require__("os"), external_os_default = __webpack_require__.n(external_os_);
-        function getLocalIpAddress() {
-            for (let iface of Object.values(external_os_default().networkInterfaces()))for (let alias of iface)if ('IPv4' === alias.family && !alias.internal) return alias.address;
-            return '127.0.0.1';
-        }
         function project_ts_decorate(decorators, target, key, desc) {
             var d, c = arguments.length, r = c < 3 ? target : null === desc ? desc = Object.getOwnPropertyDescriptor(target, key) : desc;
             if ("object" == typeof Reflect && "function" == typeof Reflect.decorate) r = Reflect.decorate(decorators, target, key, desc);
@@ -6148,7 +6142,10 @@ var __webpack_modules__ = {
             async env() {
                 let { server } = this.ctx;
                 return {
-                    ip: getLocalIpAddress(),
+                    ip: function() {
+                        for (let iface of Object.values(external_os_default().networkInterfaces()))for (let alias of iface)if ('IPv4' === alias.family && !alias.internal) return alias.address;
+                        return '127.0.0.1';
+                    }(),
                     port: server.port
                 };
             }
@@ -6273,7 +6270,12 @@ var __webpack_modules__ = {
                 return logger_namespaceObject.logger.error('Failed to open Rsdoctor URL.'), logger_namespaceObject.logger.error(err), !1;
             }
         }
-        let server_require = (0, external_module_namespaceObject.createRequire)(__rslib_import_meta_url__);
+        let server_require = (0, external_module_namespaceObject.createRequire)(__rslib_import_meta_url__), LOCAL_HOSTNAMES = new Set([
+            'localhost',
+            '127.0.0.1',
+            '[::1]',
+            '::1'
+        ]);
         class RsdoctorServer {
             constructor(sdk, port = build_namespaceObject.Server.defaultPort, config){
                 this.sdk = sdk, this.disposed = !0, this.get = (route, cb)=>{
@@ -6298,7 +6300,7 @@ var __webpack_modules__ = {
                 return this._server.app;
             }
             get host() {
-                return getLocalIpAddress();
+                return build_namespaceObject.Server.defaultHost;
             }
             get origin() {
                 return `http://${this.host}:${this.port}`;
@@ -6312,14 +6314,52 @@ var __webpack_modules__ = {
             get innerClientPath() {
                 return this._innerClientPath;
             }
+            isLocalOrigin(origin) {
+                try {
+                    let url = new URL(origin);
+                    return ('http:' === url.protocol || 'https:' === url.protocol) && LOCAL_HOSTNAMES.has(url.hostname);
+                } catch  {
+                    return !1;
+                }
+            }
+            setCorsHeaders(req, res) {
+                let origin = req.headers.origin;
+                return 'string' == typeof origin && !!this.isLocalOrigin(origin) && (res.setHeader('Access-Control-Allow-Origin', origin), res.setHeader('Vary', 'Origin'), res.setHeader('Access-Control-Allow-Headers', 'Content-Type'), res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'), !0);
+            }
+            createSecurityMiddleware() {
+                return (req, res, next)=>{
+                    let isCorsAllowed = this.setCorsHeaders(req, res);
+                    if (req.method?.toUpperCase() === 'OPTIONS') {
+                        res.statusCode = isCorsAllowed ? 204 : 403, res.end();
+                        return;
+                    }
+                    next();
+                };
+            }
+            async createInnerServer() {
+                let lastError, expectedPort = this.port;
+                for(let retry = 0; retry < 10; retry++){
+                    let port = build_namespaceObject.Server.getPortSync(expectedPort, this.host);
+                    try {
+                        return {
+                            port,
+                            server: await build_namespaceObject.Server.createServer(port, this.host)
+                        };
+                    } catch (error) {
+                        if ('EADDRINUSE' !== error.code) throw error;
+                        lastError = error, expectedPort = port + 1;
+                    }
+                }
+                throw lastError;
+            }
             async bootstrap() {
                 if (!this.disposed) return;
-                let port = build_namespaceObject.Server.getPortSync(this.port);
-                this.port = port, this._server = await build_namespaceObject.Server.createServer(port), this._socket = new Socket({
+                let { port, server } = await this.createInnerServer();
+                this.port = port, this._server = server, this._socket = new Socket({
                     sdk: this.sdk,
                     server: this._server.server,
                     port: this.port
-                }), await this._socket.bootstrap(), common_namespaceObject.GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger_namespaceObject.logger.debug(`Successfully wrote mcp.json for ${logger_namespaceObject.chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use(cors_index_js_default()()), this.app.use(body_parser_default().json({
+                }), await this._socket.bootstrap(), common_namespaceObject.GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger_namespaceObject.logger.debug(`Successfully wrote mcp.json for ${logger_namespaceObject.chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use(this.createSecurityMiddleware()), this.app.use(body_parser_default().json({
                     limit: '500mb'
                 }));
                 let clientHtmlPath = this._innerClientPath ? this._innerClientPath : server_require.resolve('@rsdoctor/client'), clientDistPath = external_path_default().resolve(clientHtmlPath, '..');
@@ -6425,7 +6465,7 @@ var __webpack_modules__ = {
                     if (req.method?.toUpperCase() === method) {
                         try {
                             let body = await cb(req, res, next);
-                            if (res.setHeader('Access-Control-Allow-Origin', '*'), res.setHeader('Access-Control-Allow-Credentials', 'true'), res.statusCode = 200, Buffer.isBuffer(body)) {
+                            if (res.statusCode = 200, Buffer.isBuffer(body)) {
                                 res.setHeader('Content-Length', body.byteLength);
                                 let ps = new external_stream_.PassThrough();
                                 ps.write(body), ps.end(), ps.pipe(res);

package/dist/index.js

@@ -14,7 +14,6 @@ import node_path, { join, normalize, resolve as external_node_path_resolve, sep
 import fs, { readdirSync, statSync } from "fs";
 import { Algorithm, Bundle, Data, GlobalConfig, Lodash, decycle } from "@rsdoctor/utils/common";
 import assert from "assert";
-import cors from "../compiled/cors/index.js";
 import { PassThrough } from "stream";
 import { Server as external_socket_io_Server } from "socket.io";
 import { isDeepStrictEqual } from "util";
@@ -6138,10 +6137,6 @@ class PluginAPI extends BaseAPI {
         });
     }
 }
-function getLocalIpAddress() {
-    for (let iface of Object.values(os.networkInterfaces()))for (let alias of iface)if ('IPv4' === alias.family && !alias.internal) return alias.address;
-    return '127.0.0.1';
-}
 function project_ts_decorate(decorators, target, key, desc) {
     var d, c = arguments.length, r = c < 3 ? target : null === desc ? desc = Object.getOwnPropertyDescriptor(target, key) : desc;
     if ("object" == typeof Reflect && "function" == typeof Reflect.decorate) r = Reflect.decorate(decorators, target, key, desc);
@@ -6166,7 +6161,10 @@ class ProjectAPI extends BaseAPI {
     async env() {
         let { server } = this.ctx;
         return {
-            ip: getLocalIpAddress(),
+            ip: function() {
+                for (let iface of Object.values(os.networkInterfaces()))for (let alias of iface)if ('IPv4' === alias.family && !alias.internal) return alias.address;
+                return '127.0.0.1';
+            }(),
             port: server.port
         };
     }
@@ -6293,7 +6291,12 @@ async function openBrowser(url, needEncodeURI = !0) {
 }
 let body_parser = __webpack_require__("../../node_modules/.pnpm/body-parser@2.2.2/node_modules/body-parser/index.js");
 var body_parser_default = __webpack_require__.n(body_parser);
-let server_require = createRequire(import.meta.url);
+let server_require = createRequire(import.meta.url), LOCAL_HOSTNAMES = new Set([
+    'localhost',
+    '127.0.0.1',
+    '[::1]',
+    '::1'
+]);
 class RsdoctorServer {
     constructor(sdk, port = Server.defaultPort, config){
         this.sdk = sdk, this.disposed = !0, this.get = (route, cb)=>{
@@ -6318,7 +6321,7 @@ class RsdoctorServer {
         return this._server.app;
     }
     get host() {
-        return getLocalIpAddress();
+        return Server.defaultHost;
     }
     get origin() {
         return `http://${this.host}:${this.port}`;
@@ -6332,14 +6335,52 @@ class RsdoctorServer {
     get innerClientPath() {
         return this._innerClientPath;
     }
+    isLocalOrigin(origin) {
+        try {
+            let url = new URL(origin);
+            return ('http:' === url.protocol || 'https:' === url.protocol) && LOCAL_HOSTNAMES.has(url.hostname);
+        } catch  {
+            return !1;
+        }
+    }
+    setCorsHeaders(req, res) {
+        let origin = req.headers.origin;
+        return 'string' == typeof origin && !!this.isLocalOrigin(origin) && (res.setHeader('Access-Control-Allow-Origin', origin), res.setHeader('Vary', 'Origin'), res.setHeader('Access-Control-Allow-Headers', 'Content-Type'), res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'), !0);
+    }
+    createSecurityMiddleware() {
+        return (req, res, next)=>{
+            let isCorsAllowed = this.setCorsHeaders(req, res);
+            if (req.method?.toUpperCase() === 'OPTIONS') {
+                res.statusCode = isCorsAllowed ? 204 : 403, res.end();
+                return;
+            }
+            next();
+        };
+    }
+    async createInnerServer() {
+        let lastError, expectedPort = this.port;
+        for(let retry = 0; retry < 10; retry++){
+            let port = Server.getPortSync(expectedPort, this.host);
+            try {
+                return {
+                    port,
+                    server: await Server.createServer(port, this.host)
+                };
+            } catch (error) {
+                if ('EADDRINUSE' !== error.code) throw error;
+                lastError = error, expectedPort = port + 1;
+            }
+        }
+        throw lastError;
+    }
     async bootstrap() {
         if (!this.disposed) return;
-        let port = Server.getPortSync(this.port);
-        this.port = port, this._server = await Server.createServer(port), this._socket = new Socket({
+        let { port, server } = await this.createInnerServer();
+        this.port = port, this._server = server, this._socket = new Socket({
             sdk: this.sdk,
             server: this._server.server,
             port: this.port
-        }), await this._socket.bootstrap(), GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger.debug(`Successfully wrote mcp.json for ${chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use(cors()), this.app.use(body_parser_default().json({
+        }), await this._socket.bootstrap(), GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger.debug(`Successfully wrote mcp.json for ${chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use(this.createSecurityMiddleware()), this.app.use(body_parser_default().json({
             limit: '500mb'
         }));
         let clientHtmlPath = this._innerClientPath ? this._innerClientPath : server_require.resolve('@rsdoctor/client'), clientDistPath = path_0.resolve(clientHtmlPath, '..');
@@ -6444,7 +6485,7 @@ class RsdoctorServer {
             if (req.method?.toUpperCase() === method) {
                 try {
                     let body = await cb(req, res, next);
-                    if (res.setHeader('Access-Control-Allow-Origin', '*'), res.setHeader('Access-Control-Allow-Credentials', 'true'), res.statusCode = 200, Buffer.isBuffer(body)) {
+                    if (res.statusCode = 200, Buffer.isBuffer(body)) {
                         res.setHeader('Content-Length', body.byteLength);
                         let ps = new PassThrough();
                         ps.write(body), ps.end(), ps.pipe(res);

package/dist/sdk/server/index.d.cts

@@ -22,6 +22,10 @@ export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     get origin(): string;
     get socketUrl(): ISocketType;
     get innerClientPath(): string;
+    private isLocalOrigin;
+    private setCorsHeaders;
+    private createSecurityMiddleware;
+    private createInnerServer;
     bootstrap(): Promise<void>;
     protected wrapNextHandleFunction(method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): Thirdparty.connect.NextHandleFunction;
     proxy(api: SDK.ServerAPI.API, method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): void;

package/dist/sdk/server/index.d.ts

@@ -22,6 +22,10 @@ export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     get origin(): string;
     get socketUrl(): ISocketType;
     get innerClientPath(): string;
+    private isLocalOrigin;
+    private setCorsHeaders;
+    private createSecurityMiddleware;
+    private createInnerServer;
     bootstrap(): Promise<void>;
     protected wrapNextHandleFunction(method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): Thirdparty.connect.NextHandleFunction;
     proxy(api: SDK.ServerAPI.API, method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rsdoctor/sdk",
-  "version": "1.5.14",
+  "version": "1.5.15",
   "repository": {
     "type": "git",
     "url": "https://github.com/web-infra-dev/rsdoctor",
@@ -32,10 +32,10 @@
     "safer-buffer": "2.1.2",
     "socket.io": "4.8.1",
     "tapable": "2.3.3",
-    "@rsdoctor/client": "1.5.14",
-    "@rsdoctor/graph": "1.5.14",
-    "@rsdoctor/types": "1.5.14",
-    "@rsdoctor/utils": "1.5.14"
+    "@rsdoctor/client": "1.5.15",
+    "@rsdoctor/types": "1.5.15",
+    "@rsdoctor/utils": "1.5.15",
+    "@rsdoctor/graph": "1.5.15"
   },
   "devDependencies": {
     "@types/body-parser": "1.19.6",