adminizer 4.3.0-build.126 → 4.3.0-build.128

package/index.d.ts

@@ -27,3 +27,4 @@ export * from "./models/MediaManagerMetaAP";
 export * from "./models/NavigationAP";
 export * from "./migrations";
 export * from "./system/bindNavigation";
+export * from "./lib/helper/jwt";

package/index.js

@@ -27,3 +27,4 @@ export * from "./models/MediaManagerMetaAP";
 export * from "./models/NavigationAP";
 export * from "./migrations";
 export * from "./system/bindNavigation";
+export * from "./lib/helper/jwt";

package/interfaces/adminpanelConfig.d.ts

@@ -191,6 +191,13 @@ export interface AdminpanelConfig {
     notifications?: {
         enabled: boolean;
     };
+    cors?: {
+        enabled: boolean;
+        origin?: string[];
+        credentials?: boolean;
+        methods?: string[];
+        allowedHeaders?: string[];
+    };
 }
 export interface ModelConfig {
     adapter?: string;

package/lib/Adminizer.js

@@ -150,16 +150,9 @@ export class Adminizer {
             chalk.blue('\nAccess your app at http://localhost:3000'));
     }
     async init(config) {
-        // set cookie parser
-        this.app.use(cookieParser());
         if (!config || Object.keys(config).length === 0) {
             Adminizer.log.warn(`Adminizer init > Adminizer config is emtpy`);
         }
-        // Set vite middleware
-        const isViteDev = process.env.VITE_ENV === "dev";
-        if (isViteDev)
-            await this.viteMiddleware();
-        this.emitter.emit('adminizer:init');
         if (this.config && Object.keys(this.config).length > 0) {
             throw new Error("Config has already been initialized");
         }
@@ -184,6 +177,48 @@ export class Adminizer {
                 set: configForms.set ?? defaultForms.set
             }
         };
+        // Middleware для всех API маршрутов
+        const defaultOrigin = process.env.FRONTEND_URL || 'http://localhost:8080';
+        if (config?.cors?.enabled) {
+            const corsConfig = config.cors;
+            // Поддерживаем массив разрешенных origin
+            const allowedOrigins = Array.isArray(corsConfig.origin)
+                ? corsConfig.origin
+                : [corsConfig.origin || defaultOrigin];
+            this.app.all(`${this.config.routePrefix}/api/*`, (req, res, next) => {
+                const requestOrigin = req.headers.origin;
+                // Проверяем разрешен ли origin
+                const isOriginAllowed = !requestOrigin || allowedOrigins.includes(requestOrigin);
+                if (requestOrigin && !isOriginAllowed) {
+                    console.log(`❌ CORS: Blocked request from ${requestOrigin}`);
+                    if (req.method === 'OPTIONS') {
+                        return res.status(200).end();
+                    }
+                    return next();
+                }
+                // Запрос с разрешенного origin или без Origin
+                if (isOriginAllowed) {
+                    // Для CORS запросов возвращаем тот же origin (или первый из списка)
+                    const allowOrigin = requestOrigin || allowedOrigins[0];
+                    res.header('Access-Control-Allow-Origin', allowOrigin);
+                    res.header('Access-Control-Allow-Credentials', corsConfig.credentials !== false ? 'true' : 'false');
+                    res.header('Access-Control-Allow-Methods', corsConfig.methods?.join(',') || 'GET,POST,PUT,DELETE,OPTIONS');
+                    res.header('Access-Control-Allow-Headers', corsConfig.allowedHeaders?.join(',') || 'Content-Type,Authorization,X-Requested-With,X-CSRF-Token,x-xsrf-token');
+                }
+                if (req.method === 'OPTIONS') {
+                    return res.status(200).end();
+                }
+                next();
+            });
+            console.log('✅ API CORS middleware enabled. Allowed origins:', allowedOrigins);
+        }
+        // set cookie parser
+        this.app.use(cookieParser());
+        // Set vite middleware
+        const isViteDev = process.env.VITE_ENV === "dev";
+        if (isViteDev)
+            await this.viteMiddleware();
+        this.emitter.emit('adminizer:init');
         this.modelHandler = new ModelHandler();
         // TODO: 'hot reload' unbind models & unbind forms
         await bindModels(this);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "adminizer",
   "type": "module",
-  "version": "4.3.0-build.126",
+  "version": "4.3.0-build.128",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
@@ -16,6 +16,7 @@
     "dev:no-seed-clean": "cross-env VITE_ENV=dev NO_SEED_DATA=true CLEAN_TMP=true ORM=sequelize tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
     "dev:waterline": "cross-env VITE_ENV=dev ORM=waterline tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
     "dev:waterline:no-seed": "cross-env VITE_ENV=dev NO_SEED_DATA=true ORM=waterline tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
+    "dev:cors": "cross-env VITE_ENV=dev NO_SEED_DATA=true ORM=waterline FRONTEND_URL=http://localhost:4173 tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
     "build:assets": "vite build",
     "compile:backend": "tsc -p src/tsconfig.json",
     "compile:ui": "tsc -p tsconfig.ui.json",

package/system/bindInertia.js

@@ -102,7 +102,7 @@ export function bindInertia(adminizer) {
             enabled: true,
             cookieName: 'XSRF-TOKEN',
             headerName: 'x-xsrf-token'
-        },
+        }
     }));
     adminizer.app.use((req, _, next) => {
         checkAuth(req, adminizer);

package/system/defaults.js

@@ -141,6 +141,9 @@ let adminpanelConfig = {
     notifications: {
         enabled: false
     },
+    cors: {
+        enabled: false,
+    },
     mediamanager: {
         fileStoragePath: '.tmp/public',
     }