@telorun/http-server 0.15.0 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @telorun/http-server
 
+## 0.15.1
+
+### Patch Changes
+
+- 06c675b: Fix CORS preflight returning 404. `Http.Server` forwarded every `cors` option to `@fastify/cors`, including the ones the manifest left unset — spreading `preflight: undefined` (and friends) clobbered the plugin's own default `preflight: true`, so its `OPTIONS *` handler `callNotFound()`'d and the preflight came back 404. Browsers reject that ("Response to preflight request … does not have HTTP ok status") and block every cross-origin `POST`. Now only the fields actually set on `cors` are passed through, so unset options keep the plugin's defaults and preflight replies 204.
+
 ## 0.15.0
 
 ### Minor Changes

package/dist/http-server-controller.js

@@ -73,20 +73,31 @@ class HttpServer {
             }
         }
         if (this.resource.cors) {
-            await this.app.register(cors, {
-                origin: this.resource.cors.origin,
-                methods: this.resource.cors.methods,
-                allowedHeaders: this.resource.cors.allowedHeaders,
-                exposedHeaders: this.resource.cors.exposedHeaders,
-                credentials: this.resource.cors.credentials,
-                maxAge: this.resource.cors.maxAge,
-                cacheControl: this.resource.cors.cacheControl,
-                preflightContinue: this.resource.cors.preflightContinue,
-                optionsSuccessStatus: this.resource.cors.optionsSuccessStatus,
-                preflight: this.resource.cors.preflight,
-                strictPreflight: this.resource.cors.strictPreflight,
-                hideOptionsRoute: this.resource.cors.hideOptionsRoute,
-            });
+            // Only forward the fields the manifest actually set. Spreading `undefined`
+            // for an unset option overrides @fastify/cors's own defaults with
+            // `undefined` — notably `preflight: undefined` disables the preflight 204
+            // reply (its `OPTIONS *` handler then `callNotFound()`s → 404), which a
+            // browser reports as "preflight … does not have HTTP ok status".
+            const cfg = this.resource.cors;
+            const corsOptions = {};
+            for (const key of [
+                "origin",
+                "methods",
+                "allowedHeaders",
+                "exposedHeaders",
+                "credentials",
+                "maxAge",
+                "cacheControl",
+                "preflightContinue",
+                "optionsSuccessStatus",
+                "preflight",
+                "strictPreflight",
+                "hideOptionsRoute",
+            ]) {
+                if (cfg[key] !== undefined)
+                    corsOptions[key] = cfg[key];
+            }
+            await this.app.register(cors, corsOptions);
         }
         // Register custom error handler for validation errors
         this.app.setErrorHandler((error, request, reply) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/http-server",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Telo HTTP Server module - HTTP server and API resource kinds for Telo manifests.",
   "keywords": [
     "telo",

package/src/http-server-controller.ts

@@ -155,20 +155,30 @@ class HttpServer implements ResourceInstance {
     }
 
     if (this.resource.cors) {
-      await this.app.register(cors, {
-        origin: this.resource.cors.origin,
-        methods: this.resource.cors.methods,
-        allowedHeaders: this.resource.cors.allowedHeaders,
-        exposedHeaders: this.resource.cors.exposedHeaders,
-        credentials: this.resource.cors.credentials,
-        maxAge: this.resource.cors.maxAge,
-        cacheControl: this.resource.cors.cacheControl,
-        preflightContinue: this.resource.cors.preflightContinue,
-        optionsSuccessStatus: this.resource.cors.optionsSuccessStatus,
-        preflight: this.resource.cors.preflight,
-        strictPreflight: this.resource.cors.strictPreflight,
-        hideOptionsRoute: this.resource.cors.hideOptionsRoute,
-      });
+      // Only forward the fields the manifest actually set. Spreading `undefined`
+      // for an unset option overrides @fastify/cors's own defaults with
+      // `undefined` — notably `preflight: undefined` disables the preflight 204
+      // reply (its `OPTIONS *` handler then `callNotFound()`s → 404), which a
+      // browser reports as "preflight … does not have HTTP ok status".
+      const cfg = this.resource.cors;
+      const corsOptions: Record<string, unknown> = {};
+      for (const key of [
+        "origin",
+        "methods",
+        "allowedHeaders",
+        "exposedHeaders",
+        "credentials",
+        "maxAge",
+        "cacheControl",
+        "preflightContinue",
+        "optionsSuccessStatus",
+        "preflight",
+        "strictPreflight",
+        "hideOptionsRoute",
+      ] as const) {
+        if (cfg[key] !== undefined) corsOptions[key] = cfg[key];
+      }
+      await this.app.register(cors, corsOptions);
     }
 
     // Register custom error handler for validation errors