@tekir/cors 0.1.1 → 0.1.3

package/dist/cors.js

@@ -84,12 +84,33 @@ export function cors(userConfig = {}) {
                 },
             });
         }
-        await next();
-        // Inject CORS headers into the actual response. Routes return a mix of
-        // Response objects (SSE streams, file downloads, custom payloads) and
-        // plain values that tekir wraps automatically. Coerce both shapes into
-        // a Response here so the headers always land on the wire.
+        // Capture any throw from `next()` so the CORS merge below still runs
+        // even when an inner middleware caught the error and set
+        // `ctx.$result` before re-throwing. Without this guard the browser
+        // sees a "CORS error" on every error response.
+        let nextError;
+        try {
+            await next();
+        }
+        catch (err) {
+            nextError = err;
+        }
+        // When `next()` threw and nothing along the way set `$result`, do not
+        // synthesize one here. An outer error-handling middleware is the
+        // natural place to build the error response, and tekir's chain only
+        // adopts a middleware's return value when `$result` is still
+        // undefined; coercing to a 204 here would silently win over the real
+        // error response and the client would see "CORS-OK 204" instead of a
+        // 401/500. The throw still propagates, so the outer handler runs.
         const result = ctx.$result;
+        if (nextError !== undefined && result == null) {
+            throw nextError;
+        }
+        // Inject CORS headers into whatever the chain produced. Routes return
+        // a mix of Response objects (SSE streams, file downloads, custom
+        // payloads) and plain values that tekir wraps automatically. Coerce
+        // both shapes into a Response here so the headers always land on the
+        // wire.
         let response;
         if (result instanceof Response) {
             response = result;
@@ -122,5 +143,11 @@ export function cors(userConfig = {}) {
             statusText: response.statusText,
             headers: merged,
         });
+        // Re-throw so outer error handlers and loggers still see the original
+        // error. `$result` already carries the merged CORS headers; an outer
+        // handler that builds its own response can copy them off the existing
+        // one if it cares to.
+        if (nextError !== undefined)
+            throw nextError;
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekir/cors",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "CORS middleware for cross-origin requests",
   "author": "dev@tekir.io",
   "license": "MIT",

package/src/cors.ts

@@ -86,13 +86,34 @@ export function cors(userConfig: CorsConfig = {}) {
       })
     }
 
-    await next()
+    // Capture any throw from `next()` so the CORS merge below still runs
+    // even when an inner middleware caught the error and set
+    // `ctx.$result` before re-throwing. Without this guard the browser
+    // sees a "CORS error" on every error response.
+    let nextError: unknown
+    try {
+      await next()
+    } catch (err) {
+      nextError = err
+    }
 
-    // Inject CORS headers into the actual response. Routes return a mix of
-    // Response objects (SSE streams, file downloads, custom payloads) and
-    // plain values that tekir wraps automatically. Coerce both shapes into
-    // a Response here so the headers always land on the wire.
+    // When `next()` threw and nothing along the way set `$result`, do not
+    // synthesize one here. An outer error-handling middleware is the
+    // natural place to build the error response, and tekir's chain only
+    // adopts a middleware's return value when `$result` is still
+    // undefined; coercing to a 204 here would silently win over the real
+    // error response and the client would see "CORS-OK 204" instead of a
+    // 401/500. The throw still propagates, so the outer handler runs.
     const result = ctx.$result
+    if (nextError !== undefined && result == null) {
+      throw nextError
+    }
+
+    // Inject CORS headers into whatever the chain produced. Routes return
+    // a mix of Response objects (SSE streams, file downloads, custom
+    // payloads) and plain values that tekir wraps automatically. Coerce
+    // both shapes into a Response here so the headers always land on the
+    // wire.
     let response: Response
     if (result instanceof Response) {
       response = result
@@ -121,5 +142,11 @@ export function cors(userConfig: CorsConfig = {}) {
       statusText: response.statusText,
       headers: merged,
     })
+
+    // Re-throw so outer error handlers and loggers still see the original
+    // error. `$result` already carries the merged CORS headers; an outer
+    // handler that builds its own response can copy them off the existing
+    // one if it cares to.
+    if (nextError !== undefined) throw nextError
   }
 }