@tekir/cors 0.1.2 → 0.1.3

package/dist/cors.js

@@ -85,10 +85,9 @@ export function cors(userConfig = {}) {
             });
         }
         // Capture any throw from `next()` so the CORS merge below still runs
-        // even when a downstream middleware errors and an outer error handler
-        // turned it into a Response on `ctx.$result`. Without this guard the
-        // browser sees a "CORS error" on every error response, regardless of
-        // middleware order.
+        // even when an inner middleware caught the error and set
+        // `ctx.$result` before re-throwing. Without this guard the browser
+        // sees a "CORS error" on every error response.
         let nextError;
         try {
             await next();
@@ -96,11 +95,22 @@ export function cors(userConfig = {}) {
         catch (err) {
             nextError = err;
         }
-        // Inject CORS headers into the actual response. Routes return a mix of
-        // Response objects (SSE streams, file downloads, custom payloads) and
-        // plain values that tekir wraps automatically. Coerce both shapes into
-        // a Response here so the headers always land on the wire.
+        // When `next()` threw and nothing along the way set `$result`, do not
+        // synthesize one here. An outer error-handling middleware is the
+        // natural place to build the error response, and tekir's chain only
+        // adopts a middleware's return value when `$result` is still
+        // undefined; coercing to a 204 here would silently win over the real
+        // error response and the client would see "CORS-OK 204" instead of a
+        // 401/500. The throw still propagates, so the outer handler runs.
         const result = ctx.$result;
+        if (nextError !== undefined && result == null) {
+            throw nextError;
+        }
+        // Inject CORS headers into whatever the chain produced. Routes return
+        // a mix of Response objects (SSE streams, file downloads, custom
+        // payloads) and plain values that tekir wraps automatically. Coerce
+        // both shapes into a Response here so the headers always land on the
+        // wire.
         let response;
         if (result instanceof Response) {
             response = result;
@@ -133,11 +143,10 @@ export function cors(userConfig = {}) {
             statusText: response.statusText,
             headers: merged,
         });
-        // Re-throw so the outer error handler can still see the original error
-        // for logging or transformation. By now `ctx.$result` carries the CORS
-        // headers, so even if the outer handler builds its own error response
-        // it can copy them off the existing one. If the outer handler swallows
-        // the throw, we already wrote a coerced response above.
+        // Re-throw so outer error handlers and loggers still see the original
+        // error. `$result` already carries the merged CORS headers; an outer
+        // handler that builds its own response can copy them off the existing
+        // one if it cares to.
         if (nextError !== undefined)
             throw nextError;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekir/cors",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "CORS middleware for cross-origin requests",
   "author": "dev@tekir.io",
   "license": "MIT",

package/src/cors.ts

@@ -87,10 +87,9 @@ export function cors(userConfig: CorsConfig = {}) {
     }
 
     // Capture any throw from `next()` so the CORS merge below still runs
-    // even when a downstream middleware errors and an outer error handler
-    // turned it into a Response on `ctx.$result`. Without this guard the
-    // browser sees a "CORS error" on every error response, regardless of
-    // middleware order.
+    // even when an inner middleware caught the error and set
+    // `ctx.$result` before re-throwing. Without this guard the browser
+    // sees a "CORS error" on every error response.
     let nextError: unknown
     try {
       await next()
@@ -98,11 +97,23 @@ export function cors(userConfig: CorsConfig = {}) {
       nextError = err
     }
 
-    // Inject CORS headers into the actual response. Routes return a mix of
-    // Response objects (SSE streams, file downloads, custom payloads) and
-    // plain values that tekir wraps automatically. Coerce both shapes into
-    // a Response here so the headers always land on the wire.
+    // When `next()` threw and nothing along the way set `$result`, do not
+    // synthesize one here. An outer error-handling middleware is the
+    // natural place to build the error response, and tekir's chain only
+    // adopts a middleware's return value when `$result` is still
+    // undefined; coercing to a 204 here would silently win over the real
+    // error response and the client would see "CORS-OK 204" instead of a
+    // 401/500. The throw still propagates, so the outer handler runs.
     const result = ctx.$result
+    if (nextError !== undefined && result == null) {
+      throw nextError
+    }
+
+    // Inject CORS headers into whatever the chain produced. Routes return
+    // a mix of Response objects (SSE streams, file downloads, custom
+    // payloads) and plain values that tekir wraps automatically. Coerce
+    // both shapes into a Response here so the headers always land on the
+    // wire.
     let response: Response
     if (result instanceof Response) {
       response = result
@@ -132,11 +143,10 @@ export function cors(userConfig: CorsConfig = {}) {
       headers: merged,
     })
 
-    // Re-throw so the outer error handler can still see the original error
-    // for logging or transformation. By now `ctx.$result` carries the CORS
-    // headers, so even if the outer handler builds its own error response
-    // it can copy them off the existing one. If the outer handler swallows
-    // the throw, we already wrote a coerced response above.
+    // Re-throw so outer error handlers and loggers still see the original
+    // error. `$result` already carries the merged CORS headers; an outer
+    // handler that builds its own response can copy them off the existing
+    // one if it cares to.
     if (nextError !== undefined) throw nextError
   }
 }