@tekir/cors 0.1.1 → 0.1.2

package/dist/cors.js

@@ -84,7 +84,18 @@ export function cors(userConfig = {}) {
                 },
             });
         }
-        await next();
+        // Capture any throw from `next()` so the CORS merge below still runs
+        // even when a downstream middleware errors and an outer error handler
+        // turned it into a Response on `ctx.$result`. Without this guard the
+        // browser sees a "CORS error" on every error response, regardless of
+        // middleware order.
+        let nextError;
+        try {
+            await next();
+        }
+        catch (err) {
+            nextError = err;
+        }
         // Inject CORS headers into the actual response. Routes return a mix of
         // Response objects (SSE streams, file downloads, custom payloads) and
         // plain values that tekir wraps automatically. Coerce both shapes into
@@ -122,5 +133,12 @@ export function cors(userConfig = {}) {
             statusText: response.statusText,
             headers: merged,
         });
+        // Re-throw so the outer error handler can still see the original error
+        // for logging or transformation. By now `ctx.$result` carries the CORS
+        // headers, so even if the outer handler builds its own error response
+        // it can copy them off the existing one. If the outer handler swallows
+        // the throw, we already wrote a coerced response above.
+        if (nextError !== undefined)
+            throw nextError;
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekir/cors",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "CORS middleware for cross-origin requests",
   "author": "dev@tekir.io",
   "license": "MIT",

package/src/cors.ts

@@ -86,7 +86,17 @@ export function cors(userConfig: CorsConfig = {}) {
       })
     }
 
-    await next()
+    // Capture any throw from `next()` so the CORS merge below still runs
+    // even when a downstream middleware errors and an outer error handler
+    // turned it into a Response on `ctx.$result`. Without this guard the
+    // browser sees a "CORS error" on every error response, regardless of
+    // middleware order.
+    let nextError: unknown
+    try {
+      await next()
+    } catch (err) {
+      nextError = err
+    }
 
     // Inject CORS headers into the actual response. Routes return a mix of
     // Response objects (SSE streams, file downloads, custom payloads) and
@@ -121,5 +131,12 @@ export function cors(userConfig: CorsConfig = {}) {
       statusText: response.statusText,
       headers: merged,
     })
+
+    // Re-throw so the outer error handler can still see the original error
+    // for logging or transformation. By now `ctx.$result` carries the CORS
+    // headers, so even if the outer handler builds its own error response
+    // it can copy them off the existing one. If the outer handler swallows
+    // the throw, we already wrote a coerced response above.
+    if (nextError !== undefined) throw nextError
   }
 }