@tumbaland/backend-core 1.34.0 → 1.35.0

package/dist/middleware/corsMiddleware.d.ts

@@ -1,4 +1,4 @@
-import cors from 'cors';
+import type { RequestHandler } from 'express';
 export interface CorsMiddlewareOptions {
     /**
      * Comma-separated origin whitelist. Defaults to process.env.CORS_ORIGIN,
@@ -6,15 +6,26 @@ export interface CorsMiddlewareOptions {
      */
     origins?: string;
     exposedHeaders?: string[];
+    /**
+     * Path prefixes that skip the origin check entirely.
+     *
+     * For endpoints the browser *navigates* to rather than fetches — an OAuth
+     * authorize page and the consent form it posts back. CORS governs
+     * script-initiated cross-origin reads and has nothing to say about a
+     * top-level form submission, but it still blocks one: Firefox sends a
+     * literal `Origin: null` after a cross-site redirect chain, which is truthy,
+     * matches no whitelist entry, and turns a legitimate consent into a 500.
+     *
+     * Nothing is weakened by skipping them. These routes carry no XHR-readable
+     * data, and what actually protects the consent POST is its signed consent
+     * token, not the origin header.
+     */
+    bypassPaths?: string[];
 }
 /**
  * Shared CORS middleware with an explicit origin whitelist.
  * Requests without an Origin header (server-to-server, curl, health checks)
  * are always allowed; browser requests must match the whitelist.
  */
-export declare function createCorsMiddleware(options?: CorsMiddlewareOptions): (req: cors.CorsRequest, res: {
-    statusCode?: number | undefined;
-    setHeader(key: string, value: string): any;
-    end(): any;
-}, next: (err?: any) => any) => void;
+export declare function createCorsMiddleware(options?: CorsMiddlewareOptions): RequestHandler;
 //# sourceMappingURL=corsMiddleware.d.ts.map

package/dist/middleware/corsMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"corsMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/corsMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B;cAmBlE,CAAC;;;aACI,CAAC,uBAEX"}
+{"version":3,"file":"corsMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/corsMiddleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA+BxF"}

package/dist/middleware/corsMiddleware.js

@@ -12,7 +12,8 @@ const logger_1 = __importDefault(require("../logging/logger"));
  * are always allowed; browser requests must match the whitelist.
  */
 function createCorsMiddleware(options = {}) {
-    return (0, cors_1.default)({
+    const bypassPaths = options.bypassPaths ?? [];
+    const corsHandler = (0, cors_1.default)({
         origin: (origin, callback) => {
             const allowedOrigins = (options.origins ?? process.env.CORS_ORIGIN ?? '')
                 .split(',')
@@ -33,5 +34,12 @@ function createCorsMiddleware(options = {}) {
         allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'x-correlation-id', 'x-session-id'],
         exposedHeaders: options.exposedHeaders
     });
+    if (bypassPaths.length === 0)
+        return corsHandler;
+    return (req, res, next) => {
+        if (bypassPaths.some((prefix) => req.path.startsWith(prefix)))
+            return next();
+        return corsHandler(req, res, next);
+    };
 }
 //# sourceMappingURL=corsMiddleware.js.map

package/dist/middleware/corsMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"corsMiddleware.js","sourceRoot":"","sources":["../../src/middleware/corsMiddleware.ts"],"names":[],"mappings":";;;;;AAiBA,oDAsBC;AAvCD,gDAAwB;AACxB,+DAAuC;AAWvC;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,UAAiC,EAAE;IACtE,OAAO,IAAA,cAAI,EAAC;QACV,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YAC3B,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;iBACtE,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAClB,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,gBAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/C,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,uBAAuB,GAAG,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,WAAW,EAAE,IAAI;QACjB,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,kDAAkD;QAClD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7D,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,CAAC;QACzG,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"corsMiddleware.js","sourceRoot":"","sources":["../../src/middleware/corsMiddleware.ts"],"names":[],"mappings":";;;;;AAiCA,oDA+BC;AAhED,gDAAwB;AAExB,+DAAuC;AA0BvC;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,UAAiC,EAAE;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAE9C,MAAM,WAAW,GAAG,IAAA,cAAI,EAAC;QACvB,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YAC3B,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;iBACtE,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAClB,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,gBAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/C,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,uBAAuB,GAAG,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,WAAW,EAAE,IAAI;QACjB,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,kDAAkD;QAClD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7D,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,CAAC;QACzG,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAA6B,CAAC;IAEnE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7E,OAAQ,WAA8B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tumbaland/backend-core",
-  "version": "1.34.0",
+  "version": "1.35.0",
   "description": "Core shared functionality for Tumbaland backend services",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/middleware/corsMiddleware.test.ts

@@ -94,3 +94,42 @@ describe('createCorsMiddleware', () => {
     process.env = ORIGINAL_ENV;
   });
 });
+
+describe('bypassPaths', () => {
+  const run = (middleware: ReturnType<typeof createCorsMiddleware>, path: string, origin?: string) => {
+    const req = { path, method: 'POST', headers: origin ? { origin } : {} } as never;
+    const res = { setHeader: jest.fn(), getHeader: jest.fn(), end: jest.fn() } as never;
+    const next = jest.fn();
+    middleware(req, res, next);
+    return next;
+  };
+
+  it('lets a bypassed path through with an origin that would otherwise be blocked', () => {
+    // Firefox sends a literal `Origin: null` on the consent form POST after the
+    // login redirect. It is truthy, matches no whitelist entry, and turned an
+    // approved consent into a 500.
+    const middleware = createCorsMiddleware({ origins: 'https://app.example', bypassPaths: ['/oauth'] });
+
+    const next = run(middleware, '/oauth/authorize', 'null');
+
+    expect(next).toHaveBeenCalledWith();
+  });
+
+  it('still checks the origin on every other path', () => {
+    const middleware = createCorsMiddleware({ origins: 'https://app.example', bypassPaths: ['/oauth'] });
+
+    const next = run(middleware, '/auth/profile', 'null');
+
+    expect(next).toHaveBeenCalledWith(expect.objectContaining({ message: expect.stringContaining('CORS') }));
+  });
+
+  it('matches by prefix, so nested oauth routes are covered too', () => {
+    const middleware = createCorsMiddleware({ origins: 'https://app.example', bypassPaths: ['/oauth'] });
+    expect(run(middleware, '/oauth/token', 'null')).toHaveBeenCalledWith();
+  });
+
+  it('changes nothing when no bypass is configured', () => {
+    const middleware = createCorsMiddleware({ origins: 'https://app.example' });
+    expect(run(middleware, '/oauth/authorize', 'null')).toHaveBeenCalledWith(expect.any(Error));
+  });
+});

package/src/middleware/corsMiddleware.ts

@@ -1,4 +1,5 @@
 import cors from 'cors';
+import type { RequestHandler } from 'express';
 import logger from '../logging/logger';
 
 export interface CorsMiddlewareOptions {
@@ -8,6 +9,21 @@ export interface CorsMiddlewareOptions {
    */
   origins?: string;
   exposedHeaders?: string[];
+  /**
+   * Path prefixes that skip the origin check entirely.
+   *
+   * For endpoints the browser *navigates* to rather than fetches — an OAuth
+   * authorize page and the consent form it posts back. CORS governs
+   * script-initiated cross-origin reads and has nothing to say about a
+   * top-level form submission, but it still blocks one: Firefox sends a
+   * literal `Origin: null` after a cross-site redirect chain, which is truthy,
+   * matches no whitelist entry, and turns a legitimate consent into a 500.
+   *
+   * Nothing is weakened by skipping them. These routes carry no XHR-readable
+   * data, and what actually protects the consent POST is its signed consent
+   * token, not the origin header.
+   */
+  bypassPaths?: string[];
 }
 
 /**
@@ -15,8 +31,10 @@ export interface CorsMiddlewareOptions {
  * Requests without an Origin header (server-to-server, curl, health checks)
  * are always allowed; browser requests must match the whitelist.
  */
-export function createCorsMiddleware(options: CorsMiddlewareOptions = {}) {
-  return cors({
+export function createCorsMiddleware(options: CorsMiddlewareOptions = {}): RequestHandler {
+  const bypassPaths = options.bypassPaths ?? [];
+
+  const corsHandler = cors({
     origin: (origin, callback) => {
       const allowedOrigins = (options.origins ?? process.env.CORS_ORIGIN ?? '')
         .split(',')
@@ -37,4 +55,11 @@ export function createCorsMiddleware(options: CorsMiddlewareOptions = {}) {
     allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'x-correlation-id', 'x-session-id'],
     exposedHeaders: options.exposedHeaders
   });
+
+  if (bypassPaths.length === 0) return corsHandler as RequestHandler;
+
+  return (req, res, next) => {
+    if (bypassPaths.some((prefix) => req.path.startsWith(prefix))) return next();
+    return (corsHandler as RequestHandler)(req, res, next);
+  };
 }