@server/next 0.21.13 → 0.21.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.21.13",
+  "version": "0.21.14",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "https://github.com/franciscop/server-next.git",

package/src/helpers/config.js

@@ -14,19 +14,26 @@ export default function config(options = {}) {
   options.cors = options.cors || env.CORS || null;
   if (options.cors) {
     if (options.cors === true) {
-      options.cors = { origin: true };
+      options.cors = { origin: options.cors };
     }
     if (typeof options.cors === "string") {
       options.cors = { origin: options.cors };
     }
+    if (Array.isArray(options.cors)) {
+      options.cors = { origin: options.cors };
+    }
+    if (Array.isArray(options.cors.origin)) {
+      options.cors.origin = options.cors.origin.join(",");
+    }
     if (typeof options.cors.origin === "string") {
       options.cors.origin = options.cors.origin.toLowerCase();
     }
+
     if (!options.cors.methods) {
-      options.cors.methods = "GET,HEAD,POST,PUT,PATCH";
+      options.cors.methods = "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS";
     }
     if (!options.cors.headers) {
-      options.cors.methods = "*";
+      options.cors.headers = "*";
     }
   }
 

package/src/helpers/cors.js

@@ -1,32 +1,24 @@
+const localhost = /^https?:\/\/localhost(:\d+)?$/;
+
 // Based on https://expressjs.com/en/resources/middleware/cors.html#configuration-options
-export default function cors(configOrigin, origin = "") {
+export default function cors(config, origin = "") {
   origin = origin.toLowerCase();
 
   // When it's true, reflect the origin
-  if (configOrigin === true) return origin || null;
+  if (config === true) return origin || null;
 
   // A star should always return a star
-  if (configOrigin === "*") return "*";
+  if (config === "*") return "*";
 
   // No origin, it's okay since that means we don't need CORS
   if (!origin) return null;
 
   // Coming from localhost
-  if (/^https?:\/\/localhost(:\d+)?$/.test(origin)) {
-    return origin;
-  }
+  if (localhost.test(origin)) return origin;
 
-  if (
-    configOrigin
-      .toLowerCase()
-      .split(/\s*,\s*/g)
-      .includes(origin)
-  ) {
-    return origin;
-  }
+  const arr = Array.isArray(config) ? config : config.split(/\s*,\s*/g);
+  if (arr.includes(origin)) return origin;
 
-  console.warn(
-    `CORS: Origin "${origin}" not allowed. Allowed origins: ${configOrigin}`,
-  );
+  console.warn(`CORS: Origin "${origin}" not allowed. Allowed "${config}"`);
   return null;
 }

package/src/helpers/cors.test.js

@@ -0,0 +1,64 @@
+import server from "../index.js";
+
+const origin = "http://localhost:3000/";
+
+describe("cors", () => {
+  it("can simply enable the cors", async () => {
+    const cors = "*";
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin } });
+
+    expect(headers).toEqual({
+      "access-control-allow-origin": "*",
+      "access-control-allow-headers": "*",
+      "access-control-allow-methods": "GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS",
+    });
+  });
+
+  it("can disable the cors", async () => {
+    const cors = false;
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin } });
+    expect(headers["access-control-allow-origin"]).toBe(undefined);
+  });
+
+  it("gets the wildcard without the origin", async () => {
+    const cors = "*";
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/");
+    expect(headers["access-control-allow-origin"]).toBe("*");
+  });
+
+  it("gets the origin with true", async () => {
+    const cors = true;
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin } });
+    expect(headers["access-control-allow-origin"]).toBe(origin);
+  });
+
+  it("gets the correct origin with multiple as string", async () => {
+    const cors = "https://a.com/,https://b.com/";
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin: "https://b.com/" } });
+    expect(headers["access-control-allow-origin"]).toBe("https://b.com/");
+  });
+
+  it("gets the correct origin with multiple as array", async () => {
+    const cors = ["https://a.com/", "https://b.com/"];
+    const { headers } = await server({ cors })
+      .get("/", () => 200)
+      .test()
+      .get("/", { headers: { origin: "https://b.com/" } });
+    expect(headers["access-control-allow-origin"]).toBe("https://b.com/");
+  });
+});

package/src/index.js

@@ -224,7 +224,7 @@ server.prototype.test = function () {
   const fetch = async (path, options = {}) => {
     if (!options.headers) options.headers = {};
     if (options.body && typeof options.body !== "string") {
-      options.headers["content-type"] = "application/json; charset=utf-8";
+      options.headers["content-type"] = "application/json";
       options.body = JSON.stringify(options.body);
     }
     if (cookie && !options.headers.cookie) {

package/src/index.test.js

@@ -75,13 +75,13 @@ describe("simple post works", () => {
     const { body, status, headers } = await api.post("/", "New Data");
     expect(status).toBe(201);
     expect(body).toBe("New Data");
-    expect(headers["content-type"]).toBe("text/plain; charset=utf-8");
+    expect(headers["content-type"]).toBe("text/plain");
   });
 
   it("will return JSON", async () => {
     const { body, status, headers } = await api.post("/", { hello: "world" });
     expect(status).toBe(201);
     expect(body).toEqual({ hello: "world" });
-    expect(headers["content-type"]).toBe("application/json; charset=utf-8");
+    expect(headers["content-type"]).toBe("application/json");
   });
 });

package/src/parseResponse.js

@@ -44,11 +44,11 @@ export default async function parseResponse(out, ctx) {
     // Set the proper CORS headers
     const origin = cors(ctx.options.cors.origin, ctx.headers.origin);
     if (origin) {
-      headers.set("Access-Control-Allow-Methods", ctx.options.cors.methods);
-      headers.set("Access-Control-Allow-Headers", ctx.options.cors.headers);
-      headers.set("Access-Control-Allow-Origin", origin);
+      out.headers.set("Access-Control-Allow-Origin", origin);
+      out.headers.set("Access-Control-Allow-Methods", ctx.options.cors.methods);
+      out.headers.set("Access-Control-Allow-Headers", ctx.options.cors.headers);
       if (ctx.options.cors.credentials) {
-        headers.set("Access-Control-Allow-Credentials", "true");
+        out.headers.set("Access-Control-Allow-Credentials", "true");
       }
     }
   }

package/src/reply.js

@@ -56,7 +56,7 @@ Reply.prototype.cookies = function (cookies) {
 // FINAL
 Reply.prototype.json = function (body) {
   return this.headers({
-    "content-type": "application/json; charset=utf-8",
+    "content-type": "application/json",
   }).send(JSON.stringify(body));
 };
 
@@ -95,9 +95,7 @@ Reply.prototype.send = function (body = "") {
     // Not yet set, so infer the type from type of string
     if (!this.res.headers["content-type"]) {
       const isHtml = body.startsWith("<");
-      this.res.headers["content-type"] = isHtml
-        ? "text/html; charset=utf-8"
-        : "text/plain; charset=utf-8";
+      this.res.headers["content-type"] = isHtml ? "text/html" : "text/plain";
     }
 
     const headers = this.generateHeaders();

package/src/url.test.js

@@ -9,7 +9,7 @@ describe("can match the url", () => {
 
     const { body, headers } = await api.get("/hello");
     expect(body).toEqual({ id: "hello" });
-    expect(headers["content-type"]).toEqual("application/json; charset=utf-8");
+    expect(headers["content-type"]).toEqual("application/json");
   });
 
   it("but it doesn't if it's a use", async () => {
@@ -21,6 +21,6 @@ describe("can match the url", () => {
 
     const { body, headers, ...rest } = await api.get("/hello");
     expect(body).toEqual({ id: "hello" });
-    expect(headers["content-type"]).toEqual("application/json; charset=utf-8");
+    expect(headers["content-type"]).toEqual("application/json");
   });
 });