@tekir/cors 0.1.2 → 0.1.4

package/dist/cors.d.ts

@@ -4,6 +4,10 @@ import type { CorsConfig } from './types';
  * Supports wildcard, array, string, and function-based origin validation.
  * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
  *
+ * Headers are written to `ctx.$responseHeaders` so the framework merges them
+ * onto the outgoing response right before it goes on the wire, regardless of
+ * which middleware built the response or where in the chain CORS sits.
+ *
  * @param userConfig - CORS configuration options.
  * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
  * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.

package/dist/cors.js

@@ -11,6 +11,10 @@ const defaults = {
  * Supports wildcard, array, string, and function-based origin validation.
  * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
  *
+ * Headers are written to `ctx.$responseHeaders` so the framework merges them
+ * onto the outgoing response right before it goes on the wire, regardless of
+ * which middleware built the response or where in the chain CORS sits.
+ *
  * @param userConfig - CORS configuration options.
  * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
  * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.
@@ -44,7 +48,7 @@ export function cors(userConfig = {}) {
         const origin = ctx.request.header('origin') || ctx.headers?.origin || '';
         let allowOrigin = '';
         if (cfg.origin === true) {
-            // When credentials are enabled, never use wildcard — reflect the request origin instead
+            // When credentials are enabled, never use wildcard, reflect the request origin instead.
             if (cfg.credentials && origin) {
                 allowOrigin = origin;
             }
@@ -67,78 +71,37 @@ export function cors(userConfig = {}) {
         }
         if (!allowOrigin)
             return next();
-        const method = ctx.request?.method || ctx.request?.raw?.method || '';
-        if (method === 'OPTIONS') {
-            return new Response(null, {
-                status: 204,
-                headers: {
-                    'Access-Control-Allow-Origin': allowOrigin,
-                    'Access-Control-Allow-Methods': (cfg.methods || []).join(', '),
-                    'Access-Control-Allow-Headers': cfg.headers === true
-                        ? ctx.request.header('access-control-request-headers') || '*'
-                        : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '',
-                    ...(cfg.credentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
-                    ...(cfg.maxAge ? { 'Access-Control-Max-Age': String(cfg.maxAge) } : {}),
-                    ...(cfg.exposeHeaders?.length ? { 'Access-Control-Expose-Headers': cfg.exposeHeaders.join(', ') } : {}),
-                    'Vary': 'Origin',
-                },
-            });
-        }
-        // Capture any throw from `next()` so the CORS merge below still runs
-        // even when a downstream middleware errors and an outer error handler
-        // turned it into a Response on `ctx.$result`. Without this guard the
-        // browser sees a "CORS error" on every error response, regardless of
-        // middleware order.
-        let nextError;
-        try {
-            await next();
-        }
-        catch (err) {
-            nextError = err;
-        }
-        // Inject CORS headers into the actual response. Routes return a mix of
-        // Response objects (SSE streams, file downloads, custom payloads) and
-        // plain values that tekir wraps automatically. Coerce both shapes into
-        // a Response here so the headers always land on the wire.
-        const result = ctx.$result;
-        let response;
-        if (result instanceof Response) {
-            response = result;
-        }
-        else if (result == null) {
-            response = new Response(null, { status: 204 });
-        }
-        else if (typeof result === 'object') {
-            response = Response.json(result);
-        }
-        else {
-            response = new Response(String(result));
-        }
-        const merged = new Headers(response.headers);
-        merged.set('Access-Control-Allow-Origin', allowOrigin);
+        // Stash the negotiated CORS headers on ctx so the framework merges them
+        // onto whatever response goes out. Writing here (instead of mutating
+        // `ctx.$result` after `next()`) makes CORS ordering-independent: it
+        // works whether `cors()` sits before or after error handlers and slots
+        // headers onto framework-handled 404s and 500s alike.
+        const headers = (ctx.$responseHeaders ??= new Headers());
+        headers.set('Access-Control-Allow-Origin', allowOrigin);
         if (cfg.credentials)
-            merged.set('Access-Control-Allow-Credentials', 'true');
+            headers.set('Access-Control-Allow-Credentials', 'true');
         if (cfg.exposeHeaders?.length)
-            merged.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '));
+            headers.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '));
         // Vary: Origin keeps caches honest when the allow-origin is request-derived.
-        const existingVary = merged.get('Vary');
+        const existingVary = headers.get('Vary');
         if (!existingVary) {
-            merged.set('Vary', 'Origin');
+            headers.set('Vary', 'Origin');
         }
         else if (!existingVary.split(',').map(s => s.trim().toLowerCase()).includes('origin')) {
-            merged.set('Vary', `${existingVary}, Origin`);
+            headers.set('Vary', `${existingVary}, Origin`);
+        }
+        const method = ctx.request?.method || ctx.request?.raw?.method || '';
+        if (method === 'OPTIONS') {
+            headers.set('Access-Control-Allow-Methods', (cfg.methods || []).join(', '));
+            headers.set('Access-Control-Allow-Headers', cfg.headers === true
+                ? ctx.request.header('access-control-request-headers') || '*'
+                : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '');
+            if (cfg.maxAge)
+                headers.set('Access-Control-Max-Age', String(cfg.maxAge));
+            // Short-circuit the chain. Framework merges $responseHeaders onto this
+            // bare 204, so the preflight response carries all the negotiated bits.
+            return new Response(null, { status: 204 });
         }
-        ctx.$result = new Response(response.body, {
-            status: response.status,
-            statusText: response.statusText,
-            headers: merged,
-        });
-        // Re-throw so the outer error handler can still see the original error
-        // for logging or transformation. By now `ctx.$result` carries the CORS
-        // headers, so even if the outer handler builds its own error response
-        // it can copy them off the existing one. If the outer handler swallows
-        // the throw, we already wrote a coerced response above.
-        if (nextError !== undefined)
-            throw nextError;
+        await next();
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekir/cors",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "CORS middleware for cross-origin requests",
   "author": "dev@tekir.io",
   "license": "MIT",

package/src/cors.ts

@@ -14,6 +14,10 @@ const defaults: CorsConfig = {
  * Supports wildcard, array, string, and function-based origin validation.
  * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
  *
+ * Headers are written to `ctx.$responseHeaders` so the framework merges them
+ * onto the outgoing response right before it goes on the wire, regardless of
+ * which middleware built the response or where in the chain CORS sits.
+ *
  * @param userConfig - CORS configuration options.
  * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
  * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.
@@ -49,7 +53,7 @@ export function cors(userConfig: CorsConfig = {}) {
 
     let allowOrigin = ''
     if (cfg.origin === true) {
-      // When credentials are enabled, never use wildcard — reflect the request origin instead
+      // When credentials are enabled, never use wildcard, reflect the request origin instead.
       if (cfg.credentials && origin) {
         allowOrigin = origin
       } else {
@@ -68,75 +72,35 @@ export function cors(userConfig: CorsConfig = {}) {
 
     if (!allowOrigin) return next()
 
-    const method = ctx.request?.method || ctx.request?.raw?.method || ''
-    if (method === 'OPTIONS') {
-      return new Response(null, {
-        status: 204,
-        headers: {
-          'Access-Control-Allow-Origin': allowOrigin,
-          'Access-Control-Allow-Methods': (cfg.methods || []).join(', '),
-          'Access-Control-Allow-Headers': cfg.headers === true
-            ? ctx.request.header('access-control-request-headers') || '*'
-            : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '',
-          ...(cfg.credentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
-          ...(cfg.maxAge ? { 'Access-Control-Max-Age': String(cfg.maxAge) } : {}),
-          ...(cfg.exposeHeaders?.length ? { 'Access-Control-Expose-Headers': cfg.exposeHeaders.join(', ') } : {}),
-          'Vary': 'Origin',
-        },
-      })
-    }
-
-    // Capture any throw from `next()` so the CORS merge below still runs
-    // even when a downstream middleware errors and an outer error handler
-    // turned it into a Response on `ctx.$result`. Without this guard the
-    // browser sees a "CORS error" on every error response, regardless of
-    // middleware order.
-    let nextError: unknown
-    try {
-      await next()
-    } catch (err) {
-      nextError = err
-    }
-
-    // Inject CORS headers into the actual response. Routes return a mix of
-    // Response objects (SSE streams, file downloads, custom payloads) and
-    // plain values that tekir wraps automatically. Coerce both shapes into
-    // a Response here so the headers always land on the wire.
-    const result = ctx.$result
-    let response: Response
-    if (result instanceof Response) {
-      response = result
-    } else if (result == null) {
-      response = new Response(null, { status: 204 })
-    } else if (typeof result === 'object') {
-      response = Response.json(result)
-    } else {
-      response = new Response(String(result))
-    }
-
-    const merged = new Headers(response.headers)
-    merged.set('Access-Control-Allow-Origin', allowOrigin)
-    if (cfg.credentials) merged.set('Access-Control-Allow-Credentials', 'true')
-    if (cfg.exposeHeaders?.length) merged.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '))
+    // Stash the negotiated CORS headers on ctx so the framework merges them
+    // onto whatever response goes out. Writing here (instead of mutating
+    // `ctx.$result` after `next()`) makes CORS ordering-independent: it
+    // works whether `cors()` sits before or after error handlers and slots
+    // headers onto framework-handled 404s and 500s alike.
+    const headers: Headers = (ctx.$responseHeaders ??= new Headers())
+    headers.set('Access-Control-Allow-Origin', allowOrigin)
+    if (cfg.credentials) headers.set('Access-Control-Allow-Credentials', 'true')
+    if (cfg.exposeHeaders?.length) headers.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '))
     // Vary: Origin keeps caches honest when the allow-origin is request-derived.
-    const existingVary = merged.get('Vary')
+    const existingVary = headers.get('Vary')
     if (!existingVary) {
-      merged.set('Vary', 'Origin')
+      headers.set('Vary', 'Origin')
     } else if (!existingVary.split(',').map(s => s.trim().toLowerCase()).includes('origin')) {
-      merged.set('Vary', `${existingVary}, Origin`)
+      headers.set('Vary', `${existingVary}, Origin`)
     }
 
-    ctx.$result = new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: merged,
-    })
+    const method = ctx.request?.method || ctx.request?.raw?.method || ''
+    if (method === 'OPTIONS') {
+      headers.set('Access-Control-Allow-Methods', (cfg.methods || []).join(', '))
+      headers.set('Access-Control-Allow-Headers', cfg.headers === true
+        ? ctx.request.header('access-control-request-headers') || '*'
+        : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '')
+      if (cfg.maxAge) headers.set('Access-Control-Max-Age', String(cfg.maxAge))
+      // Short-circuit the chain. Framework merges $responseHeaders onto this
+      // bare 204, so the preflight response carries all the negotiated bits.
+      return new Response(null, { status: 204 })
+    }
 
-    // Re-throw so the outer error handler can still see the original error
-    // for logging or transformation. By now `ctx.$result` carries the CORS
-    // headers, so even if the outer handler builds its own error response
-    // it can copy them off the existing one. If the outer handler swallows
-    // the throw, we already wrote a coerced response above.
-    if (nextError !== undefined) throw nextError
+    await next()
   }
 }