@workerdeck/server 0.12.0 → 0.13.0

package/build/index.d.mts

@@ -433,7 +433,27 @@ type WorkerServerOptions = {
    *
    * Upgrades are not routed here: anything outside `basePath` is still refused.
    */
-  fallback?: (req: IncomingMessage, res: ServerResponse) => void | Promise<void>; /** Max JSON body size in bytes. Default 1 MiB. */
+  fallback?: (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
+  /**
+   * Browser origins allowed to call this API cross-origin — for a dashboard
+   * served somewhere other than this gateway.
+   *
+   * Off unless configured, and even then it is *sharing policy, not a
+   * credential*: preflights are answered before auth (browsers strip
+   * credentials from them, so they would otherwise 401), but every real request
+   * still goes through `authenticate`, and an allowlisted page that does not
+   * hold the key gets nothing.
+   *
+   * Two rules the implementation must keep: **exact origins only**, no
+   * wildcards or suffix matching; and `Access-Control-Allow-Credentials` is
+   * **never** sent, which is what keeps an ambient cookie from becoming
+   * cross-origin authority. WebSocket upgrades are exempt from CORS entirely
+   * and are unaffected by this — their credential is whatever the host's
+   * `authenticate` accepts on the handshake.
+   */
+  cors?: {
+    origins: string[];
+  }; /** Max JSON body size in bytes. Default 1 MiB. */
   maxBodyBytes?: number;
   /**
    * Server-wide bypass policy: refuse `permissionMode: 'bypassPermissions'` on

package/build/index.mjs

@@ -1454,6 +1454,7 @@ function createWorkerServer(options = {}) {
 	if (!options.authenticate && !options.allowUnauthenticated) throw new Error("createWorkerServer: provide `authenticate` or explicitly set `allowUnauthenticated: true`");
 	const basePath = options.basePath ?? "/v1";
 	const fallback = options.fallback;
+	const corsOrigins = options.cors?.origins.length ? new Set(options.cors.origins) : void 0;
 	const maxBodyBytes = options.maxBodyBytes ?? 1024 * 1024;
 	/** The engine's adapter, honoring the test-only `engines` override. */
 	const adapterFor = (engine) => options.engines?.[engine ?? "claude"] ?? getEngineAdapter(engine);
@@ -2545,6 +2546,26 @@ function createWorkerServer(options = {}) {
 	};
 	const handleRequest = async (req, res) => {
 		const pathname = new URL(req.url ?? "/", "http://internal").pathname;
+		const origin = req.headers.origin;
+		const originAllowed = typeof origin === "string" && corsOrigins !== void 0 && corsOrigins.has(origin);
+		if (originAllowed) {
+			res.setHeader("access-control-allow-origin", origin);
+			res.setHeader("vary", "origin");
+		}
+		if (req.method === "OPTIONS" && req.headers["access-control-request-method"] !== void 0) {
+			if (!originAllowed) {
+				res.writeHead(403);
+				res.end();
+				return;
+			}
+			res.setHeader("access-control-allow-methods", "GET, HEAD, POST, PATCH, PUT, DELETE");
+			res.setHeader("access-control-allow-headers", "authorization, content-type, x-workerdeck-key");
+			res.setHeader("access-control-max-age", "600");
+			if (req.headers["access-control-request-private-network"] === "true") res.setHeader("access-control-allow-private-network", "true");
+			res.writeHead(204);
+			res.end();
+			return;
+		}
 		if (fallback && pathname !== basePath && !pathname.startsWith(basePath + "/")) {
 			await fallback(req, res);
 			return;