@solidxai/core 0.1.6-beta.25 → 0.1.6-beta.26
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cors.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/cors.helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"cors.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/cors.helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAKnC,wBAAgB,uBAAuB,IAAI,WAAW,CAuCrD"}
|
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.buildDefaultCorsOptions = buildDefaultCorsOptions;
|
|
4
|
-
const
|
|
4
|
+
const common_1 = require("@nestjs/common");
|
|
5
|
+
const logger = new common_1.Logger('CorsHelper');
|
|
5
6
|
function buildDefaultCorsOptions() {
|
|
6
7
|
const rawOrigins = process.env.SECURITY_CORS_ORIGINS ?? '*';
|
|
7
|
-
|
|
8
|
+
logger.log(`CORS allowed origins: ${rawOrigins}`);
|
|
8
9
|
const allowed = rawOrigins.split(',').map(s => s.trim()).filter(Boolean);
|
|
9
10
|
const escapeRx = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
10
11
|
const patternToRegex = (pattern) => {
|
|
@@ -18,10 +19,13 @@ function buildDefaultCorsOptions() {
|
|
|
18
19
|
return new RegExp(`^${schemePart}${escaped}(?::\\d+)?$`, 'i');
|
|
19
20
|
};
|
|
20
21
|
const matchers = allowed.map(patternToRegex);
|
|
21
|
-
|
|
22
|
+
logger.log(`CORS regexes: ${matchers.map(r => r.toString()).join(', ')}`);
|
|
22
23
|
const isAllowed = (origin) => matchers.length > 0 && matchers.some(rx => rx.test(origin));
|
|
23
24
|
return {
|
|
24
25
|
origin: (origin, cb) => {
|
|
26
|
+
logger.debug(`CORS origin callback received origin=${origin ?? '<empty>'}; regex checks: ${matchers
|
|
27
|
+
.map(rx => `${rx.toString()}=${origin ? rx.test(origin) : 'skipped'}`)
|
|
28
|
+
.join(', ')}`);
|
|
25
29
|
if (!origin)
|
|
26
30
|
return cb(null, true);
|
|
27
31
|
if (isAllowed(origin))
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cors.helper.js","sourceRoot":"","sources":["../../src/helpers/cors.helper.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"cors.helper.js","sourceRoot":"","sources":["../../src/helpers/cors.helper.ts"],"names":[],"mappings":";;AAMA,0DAuCC;AA7CD,2CAAwC;AAGxC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,YAAY,CAAC,CAAC;AAGxC,SAAgB,uBAAuB;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC;IAC5D,MAAM,CAAC,GAAG,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,CAAC,OAAe,EAAU,EAAE;QACjD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACpD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;aAC9B,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3B,OAAO,IAAI,MAAM,CAAC,IAAI,UAAU,GAAG,OAAO,aAAa,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,iBAAiB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE1E,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CACnC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9D,OAAO;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE;YACrB,MAAM,CAAC,KAAK,CACV,wCAAwC,MAAM,IAAI,SAAS,mBAAmB,QAAQ;iBACnF,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;iBACrE,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YAEF,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,MAAM,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7D,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;QACjD,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC","sourcesContent":["import { Logger } from '@nestjs/common';\nimport { CorsOptions } from 'cors';\n\nconst logger = new Logger('CorsHelper');\n\n/** Build CorsOptions from env; supports wildcards like https://*.example.com */\nexport function buildDefaultCorsOptions(): CorsOptions {\n const rawOrigins = process.env.SECURITY_CORS_ORIGINS ?? '*';\n logger.log(`CORS allowed origins: ${rawOrigins}`);\n\n const allowed = rawOrigins.split(',').map(s => s.trim()).filter(Boolean);\n\n const escapeRx = (s: string) => s.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n const patternToRegex = (pattern: string): RegExp => {\n const hasScheme = /^https?:\\/\\//i.test(pattern);\n const schemePart = hasScheme ? '' : 'https?:\\\\/\\\\/';\n if (pattern === '*' || pattern === '.*') return /^.*$/i;\n const escaped = escapeRx(pattern)\n .replace(/^https?:\\/\\//i, '') // strip scheme if present\n .replace(/\\*/g, '[^.]+'); // * => one subdomain segment\n return new RegExp(`^${schemePart}${escaped}(?::\\\\d+)?$`, 'i');\n };\n\n const matchers = allowed.map(patternToRegex);\n logger.log(`CORS regexes: ${matchers.map(r => r.toString()).join(', ')}`);\n\n const isAllowed = (origin: string) =>\n matchers.length > 0 && matchers.some(rx => rx.test(origin));\n\n return {\n origin: (origin, cb) => {\n logger.debug(\n `CORS origin callback received origin=${origin ?? '<empty>'}; regex checks: ${matchers\n .map(rx => `${rx.toString()}=${origin ? rx.test(origin) : 'skipped'}`)\n .join(', ')}`,\n );\n\n if (!origin) return cb(null, true); // allow no-origin (CLI/mobile/internal)\n if (isAllowed(origin)) return cb(null, true);\n return cb(new Error(`Origin ${origin} not allowed by CORS. Allowed origins: ${allowed.join(', ')}`), false);\n },\n methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n allowedHeaders: ['Content-Type', 'Authorization'],\n credentials: true,\n };\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@solidxai/core",
|
|
3
|
-
"version": "0.1.6-beta.
|
|
3
|
+
"version": "0.1.6-beta.26",
|
|
4
4
|
"description": "This module is a NestJS module containing all the required core providers required by a Solid application",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -1,10 +1,12 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { Logger } from '@nestjs/common';
|
|
2
2
|
import { CorsOptions } from 'cors';
|
|
3
3
|
|
|
4
|
+
const logger = new Logger('CorsHelper');
|
|
5
|
+
|
|
4
6
|
/** Build CorsOptions from env; supports wildcards like https://*.example.com */
|
|
5
7
|
export function buildDefaultCorsOptions(): CorsOptions {
|
|
6
8
|
const rawOrigins = process.env.SECURITY_CORS_ORIGINS ?? '*';
|
|
7
|
-
log(`CORS allowed origins: ${rawOrigins}`);
|
|
9
|
+
logger.log(`CORS allowed origins: ${rawOrigins}`);
|
|
8
10
|
|
|
9
11
|
const allowed = rawOrigins.split(',').map(s => s.trim()).filter(Boolean);
|
|
10
12
|
|
|
@@ -20,13 +22,19 @@ export function buildDefaultCorsOptions(): CorsOptions {
|
|
|
20
22
|
};
|
|
21
23
|
|
|
22
24
|
const matchers = allowed.map(patternToRegex);
|
|
23
|
-
log(`CORS regexes: ${matchers.map(r => r.toString()).join(', ')}`);
|
|
25
|
+
logger.log(`CORS regexes: ${matchers.map(r => r.toString()).join(', ')}`);
|
|
24
26
|
|
|
25
27
|
const isAllowed = (origin: string) =>
|
|
26
28
|
matchers.length > 0 && matchers.some(rx => rx.test(origin));
|
|
27
29
|
|
|
28
30
|
return {
|
|
29
31
|
origin: (origin, cb) => {
|
|
32
|
+
logger.debug(
|
|
33
|
+
`CORS origin callback received origin=${origin ?? '<empty>'}; regex checks: ${matchers
|
|
34
|
+
.map(rx => `${rx.toString()}=${origin ? rx.test(origin) : 'skipped'}`)
|
|
35
|
+
.join(', ')}`,
|
|
36
|
+
);
|
|
37
|
+
|
|
30
38
|
if (!origin) return cb(null, true); // allow no-origin (CLI/mobile/internal)
|
|
31
39
|
if (isAllowed(origin)) return cb(null, true);
|
|
32
40
|
return cb(new Error(`Origin ${origin} not allowed by CORS. Allowed origins: ${allowed.join(', ')}`), false);
|
|
@@ -35,4 +43,4 @@ export function buildDefaultCorsOptions(): CorsOptions {
|
|
|
35
43
|
allowedHeaders: ['Content-Type', 'Authorization'],
|
|
36
44
|
credentials: true,
|
|
37
45
|
};
|
|
38
|
-
}
|
|
46
|
+
}
|