@specific.dev/spectest 0.98.0 → 0.100.0

package/src/harness/ingress-table.ts

@@ -42,6 +42,7 @@
  * yet.
  */
 
+import type { CorsMode } from "../ingress.js";
 import { certCovers, isWildcard, wildcardSuffix } from "./hostmatch";
 
 /**
@@ -53,7 +54,7 @@ import { certCovers, isWildcard, wildcardSuffix } from "./hostmatch";
  */
 export type Route<F = unknown> =
   | { kind: "fake"; fake: F }
-  | { kind: "proxy"; service: string; port: number; http2?: boolean };
+  | { kind: "proxy"; service: string; port: number; http2?: boolean; cors?: CorsMode };
 
 /** A PEM leaf + key, as handed to `Bun.serve`'s TLS config. */
 export interface Leaf {

package/src/index.ts

@@ -190,6 +190,7 @@ export {
   SELF_SERVICE_TOKEN,
 } from "./ingress.js";
 export type {
+  CorsMode,
   CertificateDecl,
   DnsDecl,
   ProxyDecl,
@@ -197,7 +198,7 @@ export type {
   DnsTarget,
   LoweredIngress,
 } from "./ingress.js";
-import type { DnsTarget } from "./ingress.js";
+import { validateCorsMode, type CorsMode, type DnsTarget } from "./ingress.js";
 import type {
   InterceptHandler,
   InterceptNext,
@@ -1164,6 +1165,9 @@ export interface ServiceTls {
   /** Accept HTTP/2 over TLS and forward it as plaintext HTTP/2 (h2c).
    * Required for gRPC. HTTP/1.1 continues to use the existing HTTP proxy. */
   http2?: boolean;
+  /** Preserve upstream CORS policy by default. "permissive" opts HTTP/1
+   * ingress into answering preflights and adding credentialed CORS headers. */
+  cors?: CorsMode;
 }
 
 /** @internal Normalized wire representation; legacy definitions remain accepted. */
@@ -1665,6 +1669,7 @@ function validateEnvironmentConfig<S extends ServicesMap>(
         );
       }
       if (entry.http2 !== undefined && typeof entry.http2 !== "boolean") throw new Error(`service "${name}" tls http2 must be a boolean`);
+      validateCorsMode(entry.cors);
       const h = entry.hostname.toLowerCase();
       if (!HOSTNAME_RE.test(hostPatternBody(h))) {
         throw new Error(
@@ -2144,6 +2149,9 @@ export interface FakeDefinition<
   hostnames: readonly string[];
   /** TCP port the fake listens on. Default `80`. */
   port?: number;
+  /** Preserve handler/interceptor CORS policy by default. "permissive"
+   * answers preflights and adds credentialed CORS headers at ingress. */
+  cors?: CorsMode;
   /**
    * Build the fake's initial state. Called once when the project loads.
    * The returned value lives in daemon memory for the rest of the
@@ -2227,6 +2235,7 @@ export function defineFake<
       );
     }
   }
+  validateCorsMode(opts.cors);
   if (typeof opts.handler !== "function") {
     throw new Error(`defineFake(${opts.name}): \`handler\` is required`);
   }

package/src/ingress.ts

@@ -25,6 +25,17 @@ import type { FakeDefinition, Project, ServiceConfig } from "./index.js";
  *  live IP on spectest-net (a plain peer alias, no daemon hop). */
 export type DnsTarget = { ingress: true } | { service: string };
 
+/** Passthrough preserves application CORS policy (the default). Permissive
+ * answers preflights and adds credentialed CORS headers at HTTP/1 ingress. */
+export type CorsMode = "passthrough" | "permissive";
+
+/** @internal Validate JavaScript config as well as TypeScript callers. */
+export function validateCorsMode(cors: unknown): void {
+  if (cors !== undefined && cors !== "passthrough" && cors !== "permissive") {
+    throw new Error('cors must be "passthrough" or "permissive"');
+  }
+}
+
 export interface CertificateDecl {
   kind: "certificate";
   /** Hostnames the leaf cert's SANs cover. One cert is minted per decl. */
@@ -40,7 +51,7 @@ export interface DnsDecl {
 export interface ProxyDecl {
   kind: "proxy";
   hostname: string;
-  upstream: { service: string; port: number; http2?: boolean };
+  upstream: { service: string; port: number; http2?: boolean; cors?: CorsMode };
 }
 
 export type IngressDecl = CertificateDecl | DnsDecl | ProxyDecl;
@@ -137,7 +148,7 @@ export function dnsName(hostname: string, target: DnsTarget): DnsDecl {
  */
 export function proxy(
   hostname: string,
-  upstream: { service: string; port: number; http2?: boolean },
+  upstream: { service: string; port: number; http2?: boolean; cors?: CorsMode },
 ): ProxyDecl {
   assertNameOrWildcard(hostname, "proxy()");
   if (!upstream || typeof upstream.service !== "string" || typeof upstream.port !== "number") {
@@ -146,6 +157,7 @@ export function proxy(
     );
   }
   if (upstream.http2 !== undefined && typeof upstream.http2 !== "boolean") throw new Error("proxy(): http2 must be a boolean");
+  validateCorsMode(upstream.cors);
   return { kind: "proxy", hostname: hostname.toLowerCase(), upstream };
 }
 
@@ -198,7 +210,7 @@ export interface LoweredIngress {
   /** One leaf cert per group; SANs = the group's hostnames. */
   certificates: { hostnames: string[] }[];
   /** Reverse-proxy routes: hostname → upstream service:port. */
-  proxies: { hostname: string; service: string; port: number; http2?: boolean }[];
+  proxies: { hostname: string; service: string; port: number; http2?: boolean; cors?: CorsMode }[];
   /** Hostnames that resolve to the daemon ingress gateway (DNS registry
    *  + `--add-host` on every container). Covers fakes, TLS proxies, and
    *  any `dnsName(h, { ingress: true })`. */
@@ -227,7 +239,7 @@ function resolveSelf(service: string, selfKey: string): string {
  */
 export function lowerIngress(project: Project): LoweredIngress {
   const certificates: { hostnames: string[] }[] = [];
-  const proxies: { hostname: string; service: string; port: number; http2?: boolean }[] = [];
+  const proxies: { hostname: string; service: string; port: number; http2?: boolean; cors?: CorsMode }[] = [];
   const ingressSet = new Set<string>();
   const aliasesByService: Record<string, string[]> = {};
   const wildcards: { pattern: string; target: DnsTarget }[] = [];
@@ -242,7 +254,7 @@ export function lowerIngress(project: Project): LoweredIngress {
         break;
       case "proxy": {
         const service = resolveSelf(decl.upstream.service, selfKey);
-        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}) });
+        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}), ...(decl.upstream.cors ? { cors: decl.upstream.cors } : {}) });
         // A proxied hostname must route to the daemon. A wildcard one can
         // only be answered by the resolver (there is no `--add-host` for a
         // pattern), so it goes in the wildcard table pointed at the ingress.
@@ -279,7 +291,7 @@ export function lowerIngress(project: Project): LoweredIngress {
     // `tls: [{ hostname, port }]` → cert + TLS-terminated reverse proxy.
     for (const entry of (svc as ServiceConfig).tls ?? []) {
       applyDecl(certificate([entry.hostname]), name);
-      applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}) }), name);
+      applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}), ...(entry.cors ? { cors: entry.cors } : {}) }), name);
     }
     // `hostnames: [h]` → plain peer alias (no daemon hop).
     for (const h of (svc as ServiceConfig).hostnames ?? []) {