@tekir/cors 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 tekir
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,31 @@
+<p align="center">
+  <img src="https://tekir.io/logo.svg" width="80" alt="tekir" />
+</p>
+
+<h1 align="center">@tekir/cors</h1>
+
+<p align="center">CORS middleware for cross-origin requests.</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@tekir/cors"><img src="https://img.shields.io/npm/v/@tekir/cors.svg" alt="npm version" /></a>
+  <a href="https://www.npmjs.com/package/@tekir/cors"><img src="https://img.shields.io/npm/dm/@tekir/cors.svg" alt="npm downloads" /></a>
+  <a href="https://github.com/tekir-io/tekir/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/@tekir/cors.svg" alt="license" /></a>
+</p>
+
+<p align="center">
+  <a href="https://tekir.io">Website</a> · <a href="https://docs.tekir.io">Documentation</a> · <a href="https://github.com/tekir-io/tekir">GitHub</a>
+</p>
+
+---
+
+## Installation
+
+```bash
+bun add @tekir/cors
+```
+
+For full usage and configuration, see the [documentation](https://docs.tekir.io/advanced/cors).
+
+## License
+
+MIT

package/dist/cors.d.ts

@@ -0,0 +1,32 @@
+import type { CorsConfig } from './types';
+/**
+ * CORS middleware that handles preflight OPTIONS requests and sets Access-Control headers.
+ * Supports wildcard, array, string, and function-based origin validation.
+ * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
+ *
+ * @param userConfig - CORS configuration options.
+ * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
+ * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.
+ * @param userConfig.credentials - Allow credentials (cookies, auth headers). Defaults to `false`.
+ * @param userConfig.maxAge - Preflight cache duration in seconds. Defaults to `86400` (24h).
+ * @param userConfig.headers - Allowed request headers: `true` (reflect), or `string[]`.
+ * @param userConfig.exposeHeaders - Headers exposed to the browser.
+ *
+ * @example
+ * ```ts
+ * // Allow all origins
+ * app.use(cors())
+ *
+ * // Allow specific origins with credentials
+ * app.use(cors({
+ *   origin: ['https://app.com', 'https://admin.app.com'],
+ *   credentials: true,
+ * }))
+ *
+ * // Dynamic origin validation
+ * app.use(cors({
+ *   origin: (origin) => origin.endsWith('.myapp.com'),
+ * }))
+ * ```
+ */
+export declare function cors(userConfig?: CorsConfig): (ctx: any, next: () => Promise<void>) => Promise<void | Response>;

package/dist/cors.js

@@ -0,0 +1,94 @@
+const defaults = {
+    enabled: true,
+    origin: true,
+    methods: ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'],
+    headers: true,
+    credentials: false,
+    maxAge: 86400,
+};
+/**
+ * CORS middleware that handles preflight OPTIONS requests and sets Access-Control headers.
+ * Supports wildcard, array, string, and function-based origin validation.
+ * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
+ *
+ * @param userConfig - CORS configuration options.
+ * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
+ * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.
+ * @param userConfig.credentials - Allow credentials (cookies, auth headers). Defaults to `false`.
+ * @param userConfig.maxAge - Preflight cache duration in seconds. Defaults to `86400` (24h).
+ * @param userConfig.headers - Allowed request headers: `true` (reflect), or `string[]`.
+ * @param userConfig.exposeHeaders - Headers exposed to the browser.
+ *
+ * @example
+ * ```ts
+ * // Allow all origins
+ * app.use(cors())
+ *
+ * // Allow specific origins with credentials
+ * app.use(cors({
+ *   origin: ['https://app.com', 'https://admin.app.com'],
+ *   credentials: true,
+ * }))
+ *
+ * // Dynamic origin validation
+ * app.use(cors({
+ *   origin: (origin) => origin.endsWith('.myapp.com'),
+ * }))
+ * ```
+ */
+export function cors(userConfig = {}) {
+    const cfg = { ...defaults, ...userConfig };
+    return async (ctx, next) => {
+        if (!cfg.enabled)
+            return next();
+        const origin = ctx.request.header('origin') || ctx.headers?.origin || '';
+        let allowOrigin = '';
+        if (cfg.origin === true) {
+            // When credentials are enabled, never use wildcard — reflect the request origin instead
+            if (cfg.credentials && origin) {
+                allowOrigin = origin;
+            }
+            else {
+                allowOrigin = origin || '*';
+            }
+        }
+        else if (cfg.origin === false) {
+            allowOrigin = '';
+        }
+        else if (typeof cfg.origin === 'string') {
+            allowOrigin = cfg.origin;
+        }
+        else if (Array.isArray(cfg.origin)) {
+            const lowerOrigin = origin.toLowerCase();
+            allowOrigin = cfg.origin.some(o => o.toLowerCase() === lowerOrigin) ? origin : '';
+        }
+        else if (typeof cfg.origin === 'function') {
+            allowOrigin = cfg.origin(origin) ? origin : '';
+        }
+        if (!allowOrigin)
+            return next();
+        const method = ctx.request?.method || ctx.request?.raw?.method || '';
+        if (method === 'OPTIONS') {
+            return new Response(null, {
+                status: 204,
+                headers: {
+                    'Access-Control-Allow-Origin': allowOrigin,
+                    'Access-Control-Allow-Methods': (cfg.methods || []).join(', '),
+                    'Access-Control-Allow-Headers': cfg.headers === true
+                        ? ctx.request.header('access-control-request-headers') || '*'
+                        : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '',
+                    ...(cfg.credentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
+                    ...(cfg.maxAge ? { 'Access-Control-Max-Age': String(cfg.maxAge) } : {}),
+                    ...(cfg.exposeHeaders?.length ? { 'Access-Control-Expose-Headers': cfg.exposeHeaders.join(', ') } : {}),
+                },
+            });
+        }
+        ctx.store = ctx.store || {};
+        ctx.store.__corsHeaders = {
+            'Access-Control-Allow-Origin': allowOrigin,
+            ...(cfg.credentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
+            ...(cfg.exposeHeaders?.length ? { 'Access-Control-Expose-Headers': cfg.exposeHeaders.join(', ') } : {}),
+        };
+        await next();
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export type { CorsConfig } from './types';
+export { cors } from './cors';

package/dist/index.js

@@ -0,0 +1 @@
+export { cors } from './cors';

package/dist/types.d.ts

@@ -0,0 +1,9 @@
+export interface CorsConfig {
+    enabled?: boolean;
+    origin?: boolean | string | string[] | ((origin: string) => boolean);
+    methods?: string[];
+    headers?: boolean | string[];
+    exposeHeaders?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@tekir/cors",
+  "version": "0.1.0",
+  "description": "CORS middleware for cross-origin requests",
+  "author": "dev@tekir.io",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tekir-io/tekir.git",
+    "directory": "packages/tekir-cors"
+  },
+  "homepage": "https://github.com/tekir-io/tekir/tree/main/packages/tekir-cors",
+  "keywords": [
+    "tekir",
+    "bun",
+    "typescript",
+    "framework",
+    "nodejs",
+    "fullstack"
+  ],
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "src/index.ts",
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "types": "dist/index.d.ts",
+    "exports": {
+      ".": {
+        "types": "./dist/index.d.ts",
+        "import": "./dist/index.js",
+        "default": "./dist/index.js"
+      }
+    }
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc --noEmit false",
+    "prepublishOnly": "bun run build"
+  },
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "types": "./src/index.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  }
+}

package/src/cors.ts

@@ -0,0 +1,97 @@
+import type { CorsConfig } from './types'
+
+const defaults: CorsConfig = {
+  enabled: true,
+  origin: true,
+  methods: ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'],
+  headers: true,
+  credentials: false,
+  maxAge: 86400,
+}
+
+/**
+ * CORS middleware that handles preflight OPTIONS requests and sets Access-Control headers.
+ * Supports wildcard, array, string, and function-based origin validation.
+ * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
+ *
+ * @param userConfig - CORS configuration options.
+ * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
+ * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.
+ * @param userConfig.credentials - Allow credentials (cookies, auth headers). Defaults to `false`.
+ * @param userConfig.maxAge - Preflight cache duration in seconds. Defaults to `86400` (24h).
+ * @param userConfig.headers - Allowed request headers: `true` (reflect), or `string[]`.
+ * @param userConfig.exposeHeaders - Headers exposed to the browser.
+ *
+ * @example
+ * ```ts
+ * // Allow all origins
+ * app.use(cors())
+ *
+ * // Allow specific origins with credentials
+ * app.use(cors({
+ *   origin: ['https://app.com', 'https://admin.app.com'],
+ *   credentials: true,
+ * }))
+ *
+ * // Dynamic origin validation
+ * app.use(cors({
+ *   origin: (origin) => origin.endsWith('.myapp.com'),
+ * }))
+ * ```
+ */
+export function cors(userConfig: CorsConfig = {}) {
+  const cfg = { ...defaults, ...userConfig }
+
+  return async (ctx: any, next: () => Promise<void>) => {
+    if (!cfg.enabled) return next()
+
+    const origin = ctx.request.header('origin') || ctx.headers?.origin || ''
+
+    let allowOrigin = ''
+    if (cfg.origin === true) {
+      // When credentials are enabled, never use wildcard — reflect the request origin instead
+      if (cfg.credentials && origin) {
+        allowOrigin = origin
+      } else {
+        allowOrigin = origin || '*'
+      }
+    } else if (cfg.origin === false) {
+      allowOrigin = ''
+    } else if (typeof cfg.origin === 'string') {
+      allowOrigin = cfg.origin
+    } else if (Array.isArray(cfg.origin)) {
+      const lowerOrigin = origin.toLowerCase()
+      allowOrigin = cfg.origin.some(o => o.toLowerCase() === lowerOrigin) ? origin : ''
+    } else if (typeof cfg.origin === 'function') {
+      allowOrigin = cfg.origin(origin) ? origin : ''
+    }
+
+    if (!allowOrigin) return next()
+
+    const method = ctx.request?.method || ctx.request?.raw?.method || ''
+    if (method === 'OPTIONS') {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          'Access-Control-Allow-Origin': allowOrigin,
+          'Access-Control-Allow-Methods': (cfg.methods || []).join(', '),
+          'Access-Control-Allow-Headers': cfg.headers === true
+            ? ctx.request.header('access-control-request-headers') || '*'
+            : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '',
+          ...(cfg.credentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
+          ...(cfg.maxAge ? { 'Access-Control-Max-Age': String(cfg.maxAge) } : {}),
+          ...(cfg.exposeHeaders?.length ? { 'Access-Control-Expose-Headers': cfg.exposeHeaders.join(', ') } : {}),
+        },
+      })
+    }
+
+    ctx.store = ctx.store || {}
+    ctx.store.__corsHeaders = {
+      'Access-Control-Allow-Origin': allowOrigin,
+      ...(cfg.credentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
+      ...(cfg.exposeHeaders?.length ? { 'Access-Control-Expose-Headers': cfg.exposeHeaders.join(', ') } : {}),
+    }
+
+    await next()
+  }
+}

package/src/index.ts

@@ -0,0 +1,2 @@
+export type { CorsConfig } from './types'
+export { cors } from './cors'

package/src/types.ts

@@ -0,0 +1,9 @@
+export interface CorsConfig {
+  enabled?: boolean
+  origin?: boolean | string | string[] | ((origin: string) => boolean)
+  methods?: string[]
+  headers?: boolean | string[]
+  exposeHeaders?: string[]
+  credentials?: boolean
+  maxAge?: number
+}