@tekir/cors 0.1.3 → 0.1.4

package/dist/cors.d.ts

@@ -4,6 +4,10 @@ import type { CorsConfig } from './types';
  * Supports wildcard, array, string, and function-based origin validation.
  * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
  *
+ * Headers are written to `ctx.$responseHeaders` so the framework merges them
+ * onto the outgoing response right before it goes on the wire, regardless of
+ * which middleware built the response or where in the chain CORS sits.
+ *
  * @param userConfig - CORS configuration options.
  * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
  * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.

package/dist/cors.js

@@ -11,6 +11,10 @@ const defaults = {
  * Supports wildcard, array, string, and function-based origin validation.
  * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
  *
+ * Headers are written to `ctx.$responseHeaders` so the framework merges them
+ * onto the outgoing response right before it goes on the wire, regardless of
+ * which middleware built the response or where in the chain CORS sits.
+ *
  * @param userConfig - CORS configuration options.
  * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
  * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.
@@ -44,7 +48,7 @@ export function cors(userConfig = {}) {
         const origin = ctx.request.header('origin') || ctx.headers?.origin || '';
         let allowOrigin = '';
         if (cfg.origin === true) {
-            // When credentials are enabled, never use wildcard — reflect the request origin instead
+            // When credentials are enabled, never use wildcard, reflect the request origin instead.
             if (cfg.credentials && origin) {
                 allowOrigin = origin;
             }
@@ -67,87 +71,37 @@ export function cors(userConfig = {}) {
         }
         if (!allowOrigin)
             return next();
-        const method = ctx.request?.method || ctx.request?.raw?.method || '';
-        if (method === 'OPTIONS') {
-            return new Response(null, {
-                status: 204,
-                headers: {
-                    'Access-Control-Allow-Origin': allowOrigin,
-                    'Access-Control-Allow-Methods': (cfg.methods || []).join(', '),
-                    'Access-Control-Allow-Headers': cfg.headers === true
-                        ? ctx.request.header('access-control-request-headers') || '*'
-                        : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '',
-                    ...(cfg.credentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
-                    ...(cfg.maxAge ? { 'Access-Control-Max-Age': String(cfg.maxAge) } : {}),
-                    ...(cfg.exposeHeaders?.length ? { 'Access-Control-Expose-Headers': cfg.exposeHeaders.join(', ') } : {}),
-                    'Vary': 'Origin',
-                },
-            });
-        }
-        // Capture any throw from `next()` so the CORS merge below still runs
-        // even when an inner middleware caught the error and set
-        // `ctx.$result` before re-throwing. Without this guard the browser
-        // sees a "CORS error" on every error response.
-        let nextError;
-        try {
-            await next();
-        }
-        catch (err) {
-            nextError = err;
-        }
-        // When `next()` threw and nothing along the way set `$result`, do not
-        // synthesize one here. An outer error-handling middleware is the
-        // natural place to build the error response, and tekir's chain only
-        // adopts a middleware's return value when `$result` is still
-        // undefined; coercing to a 204 here would silently win over the real
-        // error response and the client would see "CORS-OK 204" instead of a
-        // 401/500. The throw still propagates, so the outer handler runs.
-        const result = ctx.$result;
-        if (nextError !== undefined && result == null) {
-            throw nextError;
-        }
-        // Inject CORS headers into whatever the chain produced. Routes return
-        // a mix of Response objects (SSE streams, file downloads, custom
-        // payloads) and plain values that tekir wraps automatically. Coerce
-        // both shapes into a Response here so the headers always land on the
-        // wire.
-        let response;
-        if (result instanceof Response) {
-            response = result;
-        }
-        else if (result == null) {
-            response = new Response(null, { status: 204 });
-        }
-        else if (typeof result === 'object') {
-            response = Response.json(result);
-        }
-        else {
-            response = new Response(String(result));
-        }
-        const merged = new Headers(response.headers);
-        merged.set('Access-Control-Allow-Origin', allowOrigin);
+        // Stash the negotiated CORS headers on ctx so the framework merges them
+        // onto whatever response goes out. Writing here (instead of mutating
+        // `ctx.$result` after `next()`) makes CORS ordering-independent: it
+        // works whether `cors()` sits before or after error handlers and slots
+        // headers onto framework-handled 404s and 500s alike.
+        const headers = (ctx.$responseHeaders ??= new Headers());
+        headers.set('Access-Control-Allow-Origin', allowOrigin);
         if (cfg.credentials)
-            merged.set('Access-Control-Allow-Credentials', 'true');
+            headers.set('Access-Control-Allow-Credentials', 'true');
         if (cfg.exposeHeaders?.length)
-            merged.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '));
+            headers.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '));
         // Vary: Origin keeps caches honest when the allow-origin is request-derived.
-        const existingVary = merged.get('Vary');
+        const existingVary = headers.get('Vary');
         if (!existingVary) {
-            merged.set('Vary', 'Origin');
+            headers.set('Vary', 'Origin');
         }
         else if (!existingVary.split(',').map(s => s.trim().toLowerCase()).includes('origin')) {
-            merged.set('Vary', `${existingVary}, Origin`);
+            headers.set('Vary', `${existingVary}, Origin`);
+        }
+        const method = ctx.request?.method || ctx.request?.raw?.method || '';
+        if (method === 'OPTIONS') {
+            headers.set('Access-Control-Allow-Methods', (cfg.methods || []).join(', '));
+            headers.set('Access-Control-Allow-Headers', cfg.headers === true
+                ? ctx.request.header('access-control-request-headers') || '*'
+                : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '');
+            if (cfg.maxAge)
+                headers.set('Access-Control-Max-Age', String(cfg.maxAge));
+            // Short-circuit the chain. Framework merges $responseHeaders onto this
+            // bare 204, so the preflight response carries all the negotiated bits.
+            return new Response(null, { status: 204 });
         }
-        ctx.$result = new Response(response.body, {
-            status: response.status,
-            statusText: response.statusText,
-            headers: merged,
-        });
-        // Re-throw so outer error handlers and loggers still see the original
-        // error. `$result` already carries the merged CORS headers; an outer
-        // handler that builds its own response can copy them off the existing
-        // one if it cares to.
-        if (nextError !== undefined)
-            throw nextError;
+        await next();
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekir/cors",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "CORS middleware for cross-origin requests",
   "author": "dev@tekir.io",
   "license": "MIT",

package/src/cors.ts

@@ -14,6 +14,10 @@ const defaults: CorsConfig = {
  * Supports wildcard, array, string, and function-based origin validation.
  * When `credentials: true` with `origin: true`, reflects the request origin instead of using `*`.
  *
+ * Headers are written to `ctx.$responseHeaders` so the framework merges them
+ * onto the outgoing response right before it goes on the wire, regardless of
+ * which middleware built the response or where in the chain CORS sits.
+ *
  * @param userConfig - CORS configuration options.
  * @param userConfig.origin - Allowed origins: `true` (all), `false` (none), `string`, `string[]`, or `(origin) => boolean`.
  * @param userConfig.methods - Allowed HTTP methods. Defaults to `['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']`.
@@ -49,7 +53,7 @@ export function cors(userConfig: CorsConfig = {}) {
 
     let allowOrigin = ''
     if (cfg.origin === true) {
-      // When credentials are enabled, never use wildcard — reflect the request origin instead
+      // When credentials are enabled, never use wildcard, reflect the request origin instead.
       if (cfg.credentials && origin) {
         allowOrigin = origin
       } else {
@@ -68,85 +72,35 @@ export function cors(userConfig: CorsConfig = {}) {
 
     if (!allowOrigin) return next()
 
-    const method = ctx.request?.method || ctx.request?.raw?.method || ''
-    if (method === 'OPTIONS') {
-      return new Response(null, {
-        status: 204,
-        headers: {
-          'Access-Control-Allow-Origin': allowOrigin,
-          'Access-Control-Allow-Methods': (cfg.methods || []).join(', '),
-          'Access-Control-Allow-Headers': cfg.headers === true
-            ? ctx.request.header('access-control-request-headers') || '*'
-            : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '',
-          ...(cfg.credentials ? { 'Access-Control-Allow-Credentials': 'true' } : {}),
-          ...(cfg.maxAge ? { 'Access-Control-Max-Age': String(cfg.maxAge) } : {}),
-          ...(cfg.exposeHeaders?.length ? { 'Access-Control-Expose-Headers': cfg.exposeHeaders.join(', ') } : {}),
-          'Vary': 'Origin',
-        },
-      })
-    }
-
-    // Capture any throw from `next()` so the CORS merge below still runs
-    // even when an inner middleware caught the error and set
-    // `ctx.$result` before re-throwing. Without this guard the browser
-    // sees a "CORS error" on every error response.
-    let nextError: unknown
-    try {
-      await next()
-    } catch (err) {
-      nextError = err
-    }
-
-    // When `next()` threw and nothing along the way set `$result`, do not
-    // synthesize one here. An outer error-handling middleware is the
-    // natural place to build the error response, and tekir's chain only
-    // adopts a middleware's return value when `$result` is still
-    // undefined; coercing to a 204 here would silently win over the real
-    // error response and the client would see "CORS-OK 204" instead of a
-    // 401/500. The throw still propagates, so the outer handler runs.
-    const result = ctx.$result
-    if (nextError !== undefined && result == null) {
-      throw nextError
-    }
-
-    // Inject CORS headers into whatever the chain produced. Routes return
-    // a mix of Response objects (SSE streams, file downloads, custom
-    // payloads) and plain values that tekir wraps automatically. Coerce
-    // both shapes into a Response here so the headers always land on the
-    // wire.
-    let response: Response
-    if (result instanceof Response) {
-      response = result
-    } else if (result == null) {
-      response = new Response(null, { status: 204 })
-    } else if (typeof result === 'object') {
-      response = Response.json(result)
-    } else {
-      response = new Response(String(result))
-    }
-
-    const merged = new Headers(response.headers)
-    merged.set('Access-Control-Allow-Origin', allowOrigin)
-    if (cfg.credentials) merged.set('Access-Control-Allow-Credentials', 'true')
-    if (cfg.exposeHeaders?.length) merged.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '))
+    // Stash the negotiated CORS headers on ctx so the framework merges them
+    // onto whatever response goes out. Writing here (instead of mutating
+    // `ctx.$result` after `next()`) makes CORS ordering-independent: it
+    // works whether `cors()` sits before or after error handlers and slots
+    // headers onto framework-handled 404s and 500s alike.
+    const headers: Headers = (ctx.$responseHeaders ??= new Headers())
+    headers.set('Access-Control-Allow-Origin', allowOrigin)
+    if (cfg.credentials) headers.set('Access-Control-Allow-Credentials', 'true')
+    if (cfg.exposeHeaders?.length) headers.set('Access-Control-Expose-Headers', cfg.exposeHeaders.join(', '))
     // Vary: Origin keeps caches honest when the allow-origin is request-derived.
-    const existingVary = merged.get('Vary')
+    const existingVary = headers.get('Vary')
     if (!existingVary) {
-      merged.set('Vary', 'Origin')
+      headers.set('Vary', 'Origin')
     } else if (!existingVary.split(',').map(s => s.trim().toLowerCase()).includes('origin')) {
-      merged.set('Vary', `${existingVary}, Origin`)
+      headers.set('Vary', `${existingVary}, Origin`)
     }
 
-    ctx.$result = new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: merged,
-    })
+    const method = ctx.request?.method || ctx.request?.raw?.method || ''
+    if (method === 'OPTIONS') {
+      headers.set('Access-Control-Allow-Methods', (cfg.methods || []).join(', '))
+      headers.set('Access-Control-Allow-Headers', cfg.headers === true
+        ? ctx.request.header('access-control-request-headers') || '*'
+        : Array.isArray(cfg.headers) ? cfg.headers.join(', ') : '')
+      if (cfg.maxAge) headers.set('Access-Control-Max-Age', String(cfg.maxAge))
+      // Short-circuit the chain. Framework merges $responseHeaders onto this
+      // bare 204, so the preflight response carries all the negotiated bits.
+      return new Response(null, { status: 204 })
+    }
 
-    // Re-throw so outer error handlers and loggers still see the original
-    // error. `$result` already carries the merged CORS headers; an outer
-    // handler that builds its own response can copy them off the existing
-    // one if it cares to.
-    if (nextError !== undefined) throw nextError
+    await next()
   }
 }