@threadbase-sh/streamer 1.25.0 → 1.26.0

package/dist/index.cjs

@@ -375,6 +375,15 @@ function loadPublicUrl() {
   }
   return void 0;
 }
+function loadBrowserCors() {
+  try {
+    const content = (0, import_fs.readFileSync)(configFile(), "utf-8");
+    const match = content.match(/browser_cors:\s*(.+)/);
+    if (match?.[1]) return match[1].trim();
+  } catch {
+  }
+  return void 0;
+}
 function loadCacheDir() {
   try {
     const content = (0, import_fs.readFileSync)(configFile(), "utf-8");
@@ -2612,25 +2621,55 @@ var authMiddleware = (deps) => async (c, next) => {
 };
 
 // src/api/middleware/cors.middleware.ts
-var ALLOWED_ORIGINS = /* @__PURE__ */ new Set([
+var DEFAULT_DEV_ORIGINS = [
   "http://localhost:8081",
   "http://localhost:19006",
   "http://localhost:3000"
-]);
-var corsMiddleware = () => async (c, next) => {
-  const origin = c.req.header("origin");
-  const allowedOrigin = origin && ALLOWED_ORIGINS.has(origin) ? origin : null;
-  if (allowedOrigin) {
-    c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
-    c.res.headers.set("Vary", "Origin");
-    c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
-    c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
-    c.res.headers.set("Access-Control-Expose-Headers", "ETag");
-  }
-  if (c.req.method === "OPTIONS") {
-    return c.newResponse(null, allowedOrigin ? 204 : 403);
-  }
-  await next();
+];
+function resolveAllowedOrigins(raw) {
+  if (!raw) return null;
+  const trimmed = raw.trim();
+  const lower = trimmed.toLowerCase();
+  if (lower === "0" || lower === "false" || lower === "no" || lower === "off" || trimmed === "") {
+    return null;
+  }
+  const origins = new Set(DEFAULT_DEV_ORIGINS);
+  if (!["1", "true", "yes", "on"].includes(lower)) {
+    for (const o of trimmed.split(",")) {
+      const origin = o.trim();
+      if (origin) origins.add(origin);
+    }
+  }
+  return origins;
+}
+var corsMiddleware = (configValue) => {
+  const allowedOrigins = resolveAllowedOrigins(
+    process.env.THREADBASE_ALLOW_BROWSER_CORS ?? configValue
+  );
+  return async (c, next) => {
+    const origin = c.req.header("origin");
+    const allowedOrigin = allowedOrigins && origin && allowedOrigins.has(origin) ? origin : null;
+    if (allowedOrigin) {
+      const raw = c.env.outgoing;
+      raw.setHeader("Access-Control-Allow-Origin", allowedOrigin);
+      raw.setHeader("Vary", "Origin");
+      raw.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
+      raw.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
+      raw.setHeader("Access-Control-Expose-Headers", "ETag");
+      c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+      c.res.headers.set("Vary", "Origin");
+      c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
+      c.res.headers.set(
+        "Access-Control-Allow-Headers",
+        "Authorization, Content-Type, If-None-Match"
+      );
+      c.res.headers.set("Access-Control-Expose-Headers", "ETag");
+    }
+    if (c.req.method === "OPTIONS") {
+      return c.newResponse(null, allowedOrigin ? 204 : 403);
+    }
+    await next();
+  };
 };
 
 // src/api/middleware/error.middleware.ts
@@ -3045,7 +3084,7 @@ var createHonoApp = (deps, upgradeWebSocket) => {
       event: "http.request"
     });
   });
-  app.use("*", corsMiddleware());
+  app.use("*", corsMiddleware(deps.browserCors));
   app.use("*", authMiddleware(deps));
   app.onError(errorMiddleware);
   app.route("/healthz", createHealthRoutes());
@@ -5101,6 +5140,7 @@ var StreamerServer = class {
   disableDb = false;
   browseRoot = null;
   publicUrl = null;
+  browserCors;
   pairTokens = new PairTokenStore();
   exchangeAttempts = /* @__PURE__ */ new Map();
   sessionStartAttempts = /* @__PURE__ */ new Map();
@@ -5186,6 +5226,7 @@ var StreamerServer = class {
         this.log.warn(`Warning: ${result.error}`, { error: result.error });
       }
     }
+    this.browserCors = config.browserCors ?? loadBrowserCors();
     this.sessionStore = new SessionStore();
     this.wsHub = new WSHub();
     this.fileWatcher = new ConversationWatcher({
@@ -5340,6 +5381,7 @@ var StreamerServer = class {
       rotateApiKey: () => this.rotateApiKey(),
       publicUrl: this.publicUrl,
       browseRoot: this.browseRoot,
+      browserCors: this.browserCors,
       ptyManager: this.ptyManager,
       sessionStore: this.sessionStore,
       wsHub: this.wsHub,