@voyant-travel/hono 0.131.2 → 0.133.0

package/dist/app.js

@@ -377,8 +377,30 @@ export function mountApp(config) {
     app.use("*", requestId);
     // Structured logger
     app.use("*", logger(config.logger));
-    // CORS (allowlist via env CORS_ALLOWLIST)
-    app.use("*", cors());
+    // CORS (allowlist via env CORS_ALLOWLIST). The customer realm additionally
+    // supports per-storefront dynamic CORS when the auth integration provides a
+    // `resolveCorsOrigin` authorizer: an operator-configured storefront authorizes
+    // its own declared origins (exact + `https://*.host`) for direct cross-origin
+    // SPA/native clients, while admin/dash surfaces keep the static allowlist.
+    const resolveCorsOrigin = composedAuth?.resolveCorsOrigin;
+    app.use("*", resolveCorsOrigin
+        ? cors({
+            resolveDynamicOrigin: (c) => resolveCorsOrigin({
+                request: c.req.raw,
+                // The composed app's bindings ARE TBindings at runtime; the shared
+                // cors() signature only knows the VoyantBindings base.
+                env: c.env,
+                ctx: tryGetExecutionCtx(c),
+            }),
+            isDynamicPath: (pathname) => {
+                const p = normalizePathname(pathname, { basePath: config.basePath });
+                return (p === "/v1/public" ||
+                    p.startsWith("/v1/public/") ||
+                    p === "/auth/customer" ||
+                    p.startsWith("/auth/customer/"));
+            },
+        })
+        : cors());
     if (config.securityHeaders !== false) {
         app.use("*", securityHeaders(config.securityHeaders));
     }

package/dist/middleware/cors.d.ts

@@ -1,5 +1,25 @@
 import type { MiddlewareHandler } from "hono";
 import type { VoyantBindings } from "../types.js";
-export declare function cors(): MiddlewareHandler<{
+/**
+ * Resolve the exact origin to echo for a customer-realm request, or `null` to
+ * fall back to the static allowlist. Runs before the db middleware, so it owns
+ * any db access. Provided by the auth integration (`resolveCorsOrigin`).
+ */
+export type DynamicCorsOriginResolver = (c: Parameters<MiddlewareHandler<{
+    Bindings: VoyantBindings;
+}>>[0]) => Promise<string | null> | string | null;
+export interface CorsOptions {
+    /**
+     * Per-storefront dynamic origin authorizer for the customer realm. When it
+     * returns an origin, that specific origin is echoed with credentials — never
+     * `*`. When it returns `null`, the request falls back to the static
+     * `CORS_ALLOWLIST`. Only consulted for {@link CorsOptions.isDynamicPath}
+     * matches, so admin/dash surfaces stay on the static allowlist.
+     */
+    resolveDynamicOrigin?: DynamicCorsOriginResolver;
+    /** Whether a pathname is eligible for dynamic per-storefront CORS. */
+    isDynamicPath?: (pathname: string) => boolean;
+}
+export declare function cors(options?: CorsOptions): MiddlewareHandler<{
     Bindings: VoyantBindings;
 }>;

package/dist/middleware/cors.js

@@ -51,6 +51,7 @@ const DEFAULT_ALLOWED_REQUEST_HEADERS = new Set([
     "x-request-id",
     "x-voyant-checkout-capability",
     "x-voyant-guest-booking-access",
+    "x-voyant-storefront-origin",
 ]);
 function allowedRequestHeaders(requested) {
     if (!requested)
@@ -61,11 +62,21 @@ function allowedRequestHeaders(requested) {
         .filter((header) => DEFAULT_ALLOWED_REQUEST_HEADERS.has(header));
     return allowed.length > 0 ? allowed.join(", ") : "content-type, authorization";
 }
-export function cors() {
+export function cors(options = {}) {
+    const { resolveDynamicOrigin, isDynamicPath } = options;
     return async (c, next) => {
         const origin = c.req.header("origin") || "";
         const allowlist = compileAllowlist(c.env.CORS_ALLOWLIST);
-        const allowed = isAllowedOrigin(origin, allowlist);
+        // Per-storefront dynamic CORS for the customer realm: an operator-configured
+        // storefront authorizes its own declared origins via the resolver, so a
+        // direct cross-origin SPA works without the origin sitting in the static env
+        // allowlist. The resolver echoes only the specific request origin (never
+        // `*`), and preflight is authorized without a key/cookie. A `null` result
+        // means "no storefront allows this origin" — fall back to the static list.
+        const dynamicEligible = Boolean(origin && resolveDynamicOrigin && (isDynamicPath?.(c.req.path) ?? true));
+        const dynamicOrigin = dynamicEligible ? await resolveDynamicOrigin(c) : null;
+        const allowed = dynamicOrigin !== null || isAllowedOrigin(origin, allowlist);
+        const echoOrigin = dynamicOrigin ?? origin;
         if (origin && !allowed) {
             console.warn("[CORS] Origin not in allowlist - CORS headers will NOT be set", {
                 origin,
@@ -76,7 +87,7 @@ export function cors() {
         }
         if (c.req.method === "OPTIONS") {
             if (allowed) {
-                c.header("Access-Control-Allow-Origin", origin);
+                c.header("Access-Control-Allow-Origin", echoOrigin);
                 c.header("Vary", "Origin");
                 c.header("Access-Control-Allow-Credentials", "true");
                 c.header("Access-Control-Allow-Headers", allowedRequestHeaders(c.req.header("access-control-request-headers")));
@@ -86,7 +97,7 @@ export function cors() {
         }
         await next();
         if (allowed) {
-            c.header("Access-Control-Allow-Origin", origin);
+            c.header("Access-Control-Allow-Origin", echoOrigin);
             c.header("Vary", "Origin");
             c.header("Access-Control-Allow-Credentials", "true");
         }

package/dist/middleware/rate-limit.d.ts

@@ -125,6 +125,7 @@ export declare function createMemoryRateLimitStore(options?: {
 }): RateLimitStore;
 export interface RedisRateLimitStoreOptions {
     client?: LazyRedisClient;
+    keyPrefix?: string;
 }
 export declare function createRedisRateLimitStore(redisUrl: string, options?: RedisRateLimitStoreOptions): RateLimitStore;
 /** Test-only: re-arm the once-per-isolate missing-store warning. */

package/dist/middleware/rate-limit.js

@@ -67,14 +67,31 @@ export function createMemoryRateLimitStore(options) {
         },
     };
 }
+function normalizeRedisRateLimitKeyPrefix(keyPrefix) {
+    if (keyPrefix === undefined || keyPrefix.length === 0)
+        return "";
+    if (hasControlCharacter(keyPrefix)) {
+        throw new Error("Redis rate-limit keyPrefix must not contain control characters.");
+    }
+    return keyPrefix;
+}
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
 export function createRedisRateLimitStore(redisUrl, options = {}) {
     const lazyClient = options.client ?? createLazyRedisClient(redisUrl);
+    const keyPrefix = normalizeRedisRateLimitKeyPrefix(options.keyPrefix);
     return {
         async limit(key, { max, windowSeconds }) {
             const client = await lazyClient.get();
             const nowSeconds = Math.floor(Date.now() / 1000);
             const windowKey = Math.floor(nowSeconds / windowSeconds);
-            const storageKey = `${key}:${windowKey}`;
+            const storageKey = `${keyPrefix}${key}:${windowKey}`;
             const count = await client.incr(storageKey);
             if (count === 1) {
                 await client.expire(storageKey, Math.max(1, windowSeconds * 2));

package/dist/types.d.ts

@@ -175,6 +175,14 @@ export interface VoyantAuthIntegration<TBindings extends VoyantBindings = Voyant
     hasPermission?: (args: VoyantAuthPermissionArgs<TBindings>) => Promise<boolean> | boolean;
     validateApiKey?: (args: VoyantAuthApiKeyValidationArgs<TBindings>) => Promise<boolean> | boolean;
     onUnauthorized?: (args: VoyantAuthUnauthorizedArgs<TBindings>) => Promise<Response | null> | Response | null;
+    /**
+     * Authorize a customer-realm cross-origin request for dynamic CORS. Returns
+     * the exact request origin to echo in `Access-Control-Allow-Origin` (dynamic,
+     * per-storefront), or `null` to fall back to the static `CORS_ALLOWLIST`.
+     * Runs before the db middleware, so implementations own any db access. Only
+     * consulted for the customer surface; admin/dash keep the static allowlist.
+     */
+    resolveCorsOrigin?: (args: VoyantAuthUnauthorizedArgs<TBindings>) => Promise<string | null> | string | null;
 }
 export interface VoyantAppConfig<TBindings extends VoyantBindings = VoyantBindings> {
     db: DbFactory<TBindings>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.131.2",
+  "version": "0.133.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -131,16 +131,16 @@
     "hono": "^4.12.27",
     "zod": "^4.4.3",
     "@voyant-travel/core": "^0.130.0",
-    "@voyant-travel/db": "^0.117.0",
+    "@voyant-travel/db": "^0.117.1",
     "@voyant-travel/types": "^0.109.8",
-    "@voyant-travel/utils": "^0.108.0",
-    "@voyant-travel/workflows": "^0.122.11"
+    "@voyant-travel/utils": "^0.109.0",
+    "@voyant-travel/workflows": "^0.122.18"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.122.11"
+    "@voyant-travel/workflows-orchestrator": "^0.122.18"
   },
   "files": [
     "dist"