@server/next 0.21.12 → 0.21.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.21.12",
+  "version": "0.21.14",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "https://github.com/franciscop/server-next.git",

package/src/helpers/config.js

@@ -12,20 +12,29 @@ export default function config(options = {}) {
 
   // CORS
   options.cors = options.cors || env.CORS || null;
-  if (options.cors === true) {
-    options.cors = { origin: options.domain || "*" };
-  }
-  if (typeof options.cors === "string") {
-    options.cors = { origin: options.cors };
-  }
-  if (options.cors && typeof options.cors.origin === "string") {
-    options.cors.origin = options.cors.origin.toLowerCase();
-  }
-  if (options.cors && !options.cors.methods) {
-    options.cors.methods = "GET,HEAD,POST,PUT,PATCH";
-  }
-  if (options.cors && !options.cors.headers) {
-    options.cors.methods = "*";
+  if (options.cors) {
+    if (options.cors === true) {
+      options.cors = { origin: options.cors };
+    }
+    if (typeof options.cors === "string") {
+      options.cors = { origin: options.cors };
+    }
+    if (Array.isArray(options.cors)) {
+      options.cors = { origin: options.cors };
+    }
+    if (Array.isArray(options.cors.origin)) {
+      options.cors.origin = options.cors.origin.join(",");
+    }
+    if (typeof options.cors.origin === "string") {
+      options.cors.origin = options.cors.origin.toLowerCase();
+    }
+
+    if (!options.cors.methods) {
+      options.cors.methods = "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS";
+    }
+    if (!options.cors.headers) {
+      options.cors.headers = "*";
+    }
   }
 
   // Bucket

package/src/helpers/cors.js

@@ -1,24 +1,24 @@
-export default function cors(configOrigin, origin = "") {
-  // A star should always return a star
-  if (configOrigin === "*") return "*";
+const localhost = /^https?:\/\/localhost(:\d+)?$/;
 
+// Based on https://expressjs.com/en/resources/middleware/cors.html#configuration-options
+export default function cors(config, origin = "") {
   origin = origin.toLowerCase();
 
-  // No origin
-  if (!origin) {
-    console.warn("CORS: Missing Origin header");
-    return null;
-  }
+  // When it's true, reflect the origin
+  if (config === true) return origin || null;
+
+  // A star should always return a star
+  if (config === "*") return "*";
+
+  // No origin, it's okay since that means we don't need CORS
+  if (!origin) return null;
 
   // Coming from localhost
-  if (/^https?:\/\/localhost(:\d+)?$/.test(origin)) {
-    return origin;
-  }
+  if (localhost.test(origin)) return origin;
 
-  if (configOrigin.toLowerCase().split(/\,\s/g).includes(origin)) {
-    return origin;
-  }
+  const arr = Array.isArray(config) ? config : config.split(/\s*,\s*/g);
+  if (arr.includes(origin)) return origin;
 
-  console.warn(`CORS: Origin "${origin}" is not allowed`);
+  console.warn(`CORS: Origin "${origin}" not allowed. Allowed "${config}"`);
   return null;
 }

package/src/helpers/cors.test.js

@@ -0,0 +1,64 @@
+import server from "../index.js";
+
+const origin = "http://localhost:3000/";
+
+describe("cors", () => {
+  it("can simply enable the cors", async () => {
+    const cors = "*";
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin } });
+
+    expect(headers).toEqual({
+      "access-control-allow-origin": "*",
+      "access-control-allow-headers": "*",
+      "access-control-allow-methods": "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS",
+    });
+  });
+
+  it("can disable the cors", async () => {
+    const cors = false;
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin } });
+    expect(headers["access-control-allow-origin"]).toBe(undefined);
+  });
+
+  it("gets the wildcard without the origin", async () => {
+    const cors = "*";
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/");
+    expect(headers["access-control-allow-origin"]).toBe("*");
+  });
+
+  it("gets the origin with true", async () => {
+    const cors = true;
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin } });
+    expect(headers["access-control-allow-origin"]).toBe(origin);
+  });
+
+  it("gets the correct origin with multiple as string", async () => {
+    const cors = "https://a.com/,https://b.com/";
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin: "https://b.com/" } });
+    expect(headers["access-control-allow-origin"]).toBe("https://b.com/");
+  });
+
+  it("gets the correct origin with multiple as array", async () => {
+    const cors = ["https://a.com/", "https://b.com/"];
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin: "https://b.com/" } });
+    expect(headers["access-control-allow-origin"]).toBe("https://b.com/");
+  });
+});

package/src/index.js

@@ -224,7 +224,7 @@ server.prototype.test = function () {
   const fetch = async (path, options = {}) => {
     if (!options.headers) options.headers = {};
     if (options.body && typeof options.body !== "string") {
-      options.headers["content-type"] = "application/json; charset=utf-8";
+      options.headers["content-type"] = "application/json";
       options.body = JSON.stringify(options.body);
     }
     if (cookie && !options.headers.cookie) {

package/src/index.test.js

@@ -75,13 +75,13 @@ describe("simple post works", () => {
     const { body, status, headers } = await api.post("/", "New Data");
     expect(status).toBe(201);
     expect(body).toBe("New Data");
-    expect(headers["content-type"]).toBe("text/plain; charset=utf-8");
+    expect(headers["content-type"]).toBe("text/plain");
   });
 
   it("will return JSON", async () => {
     const { body, status, headers } = await api.post("/", { hello: "world" });
     expect(status).toBe(201);
     expect(body).toEqual({ hello: "world" });
-    expect(headers["content-type"]).toBe("application/json; charset=utf-8");
+    expect(headers["content-type"]).toBe("application/json");
   });
 });

package/src/parseResponse.js

@@ -42,11 +42,14 @@ export default async function parseResponse(out, ctx) {
   // If we have CORS, set it up
   if (ctx.options.cors) {
     // Set the proper CORS headers
-    const origin = cors(ctx.options.cors, ctx.headers.origin);
+    const origin = cors(ctx.options.cors.origin, ctx.headers.origin);
     if (origin) {
-      headers.set("Access-Control-Allow-Methods", options.methods);
-      headers.set("Access-Control-Allow-Headers", options.headers);
-      headers.set("Access-Control-Allow-Origin", origin);
+      out.headers.set("Access-Control-Allow-Origin", origin);
+      out.headers.set("Access-Control-Allow-Methods", ctx.options.cors.methods);
+      out.headers.set("Access-Control-Allow-Headers", ctx.options.cors.headers);
+      if (ctx.options.cors.credentials) {
+        out.headers.set("Access-Control-Allow-Credentials", "true");
+      }
     }
   }
 

package/src/reply.js

@@ -56,7 +56,7 @@ Reply.prototype.cookies = function (cookies) {
 // FINAL
 Reply.prototype.json = function (body) {
   return this.headers({
-    "content-type": "application/json; charset=utf-8",
+    "content-type": "application/json",
   }).send(JSON.stringify(body));
 };
 
@@ -95,9 +95,7 @@ Reply.prototype.send = function (body = "") {
     // Not yet set, so infer the type from type of string
     if (!this.res.headers["content-type"]) {
       const isHtml = body.startsWith("<");
-      this.res.headers["content-type"] = isHtml
-        ? "text/html; charset=utf-8"
-        : "text/plain; charset=utf-8";
+      this.res.headers["content-type"] = isHtml ? "text/html" : "text/plain";
     }
 
     const headers = this.generateHeaders();

package/src/url.test.js

@@ -9,7 +9,7 @@ describe("can match the url", () => {
 
     const { body, headers } = await api.get("/hello");
     expect(body).toEqual({ id: "hello" });
-    expect(headers["content-type"]).toEqual("application/json; charset=utf-8");
+    expect(headers["content-type"]).toEqual("application/json");
   });
 
   it("but it doesn't if it's a use", async () => {
@@ -21,6 +21,6 @@ describe("can match the url", () => {
 
     const { body, headers, ...rest } = await api.get("/hello");
     expect(body).toEqual({ id: "hello" });
-    expect(headers["content-type"]).toEqual("application/json; charset=utf-8");
+    expect(headers["content-type"]).toEqual("application/json");
   });
 });