@tatara/http 0.1.2 → 0.1.3

package/dist/index.d.mts

@@ -67,6 +67,11 @@ interface CreateAppOptions<E extends HttpEnv> {
   /** origins are exact (`https://app.example.com`) or one-label patterns (`https://*.example.com`) */
   cors: {
     origins: string[];
+    /**
+     * For origins not in `origins`: true allows it. For origins kept in the database, such as a
+     * game's web build address; cache the lookup, since it runs on cross-origin requests.
+     */
+    allowOrigin?: (origin: string) => boolean | Promise<boolean>;
     exposeHeaders?: string[];
     allowHeaders?: string[];
   };

package/dist/index.mjs

@@ -145,13 +145,16 @@ function corsOrigin(origins) {
 	});
 	return (origin) => exact.has(origin) || patterns.some((p) => p.test(origin)) ? origin : null;
 }
+function allowedOrigin(listed, check) {
+	return async (origin) => listed(origin) ?? (origin && check && await check(origin) ? origin : null);
+}
 /** A plain OpenAPIHono app with request context, secure headers, CORS, body limit, /health and /ready. */
 function createApp(options) {
 	const app = new OpenAPIHono({ defaultHook: validationHook });
 	app.use(requestContext(options.logger, options.defaults));
 	app.use(secureHeaders());
 	app.use(cors({
-		origin: corsOrigin(options.cors.origins),
+		origin: allowedOrigin(corsOrigin(options.cors.origins), options.cors.allowOrigin),
 		credentials: true,
 		allowHeaders: options.cors.allowHeaders ?? [
 			"Content-Type",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/http",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "tatara HTTP: Hono app setup, errors, envelope, OpenAPI docs and route mounting",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "@hono/zod-openapi": "^1.6.3",
     "@hono/node-server": "^2.1.5",
     "@scalar/hono-api-reference": "^0.12.12",
-    "@tatara/core": "^0.1.2",
+    "@tatara/core": "^0.1.3",
     "pino": "^10.4.0",
     "zod": "^4.6.7"
   },

package/src/app.ts

@@ -44,7 +44,16 @@ export function requestContext<E extends HttpEnv>(logger: CoreLogger, defaults:
 export interface CreateAppOptions<E extends HttpEnv> {
 	logger: CoreLogger;
 	/** origins are exact (`https://app.example.com`) or one-label patterns (`https://*.example.com`) */
-	cors: { origins: string[]; exposeHeaders?: string[]; allowHeaders?: string[] };
+	cors: {
+		origins: string[];
+		/**
+		 * For origins not in `origins`: true allows it. For origins kept in the database, such as a
+		 * game's web build address; cache the lookup, since it runs on cross-origin requests.
+		 */
+		allowOrigin?: (origin: string) => boolean | Promise<boolean>;
+		exposeHeaders?: string[];
+		allowHeaders?: string[];
+	};
 	bodyLimitBytes: number;
 	/** a limit on how long a handler may take, with longer ones for slow paths */
 	timeouts?: TimeoutOptions;
@@ -66,6 +75,14 @@ export function corsOrigin(origins: string[]): (origin: string) => string | null
 	return (origin) => (exact.has(origin) || patterns.some((p) => p.test(origin)) ? origin : null);
 }
 
+function allowedOrigin(
+	listed: (origin: string) => string | null,
+	check?: (origin: string) => boolean | Promise<boolean>,
+): (origin: string) => Promise<string | null> {
+	return async (origin) =>
+		listed(origin) ?? (origin && check && (await check(origin)) ? origin : null);
+}
+
 /** A plain OpenAPIHono app with request context, secure headers, CORS, body limit, /health and /ready. */
 export function createApp<E extends HttpEnv>(options: CreateAppOptions<E>): OpenAPIHono<E> {
 	const app = new OpenAPIHono<E>({ defaultHook: validationHook });
@@ -73,7 +90,7 @@ export function createApp<E extends HttpEnv>(options: CreateAppOptions<E>): Open
 	app.use(secureHeaders());
 	app.use(
 		cors({
-			origin: corsOrigin(options.cors.origins),
+			origin: allowedOrigin(corsOrigin(options.cors.origins), options.cors.allowOrigin),
 			credentials: true,
 			allowHeaders: options.cors.allowHeaders ?? [
 				"Content-Type",