adminizer 4.3.0-build.127 → 4.3.0-build.129

package/index.d.ts

@@ -27,3 +27,4 @@ export * from "./models/MediaManagerMetaAP";
 export * from "./models/NavigationAP";
 export * from "./migrations";
 export * from "./system/bindNavigation";
+export * from "./lib/helper/jwt";

package/index.js

@@ -27,3 +27,4 @@ export * from "./models/MediaManagerMetaAP";
 export * from "./models/NavigationAP";
 export * from "./migrations";
 export * from "./system/bindNavigation";
+export * from "./lib/helper/jwt";

package/interfaces/adminpanelConfig.d.ts

@@ -193,7 +193,7 @@ export interface AdminpanelConfig {
     };
     cors?: {
         enabled: boolean;
-        origin?: string;
+        origin?: string[];
         credentials?: boolean;
         methods?: string[];
         allowedHeaders?: string[];

package/lib/Adminizer.js

@@ -178,22 +178,45 @@ export class Adminizer {
             }
         };
         // Middleware для всех API маршрутов
-        const allowedOrigin = process.env.FRONTEND_URL || 'http://localhost:8080';
+        const defaultOrigin = process.env.FRONTEND_URL || 'http://localhost:8080';
         if (config?.cors?.enabled) {
             const corsConfig = config.cors;
+            // Поддерживаем массив разрешенных origin
+            const allowedOrigins = Array.isArray(corsConfig.origin)
+                ? corsConfig.origin
+                : [corsConfig.origin || defaultOrigin];
             this.app.all(`${this.config.routePrefix}/api/*`, (req, res, next) => {
-                // Устанавливаем CORS заголовки
-                res.header('Access-Control-Allow-Origin', corsConfig.origin || allowedOrigin);
-                res.header('Access-Control-Allow-Credentials', corsConfig.credentials !== false ? 'true' : 'false');
-                res.header('Access-Control-Allow-Methods', corsConfig.methods?.join(',') || 'GET,POST,PUT,DELETE,OPTIONS');
-                res.header('Access-Control-Allow-Headers', corsConfig.allowedHeaders?.join(',') || 'Content-Type,Authorization,X-Requested-With,X-CSRF-Token,x-xsrf-token');
-                // Если это OPTIONS запрос - сразу отвечаем
+                const requestOrigin = req.headers.origin;
+                // Проверяем разрешен ли origin
+                const isOriginAllowed = !requestOrigin || allowedOrigins.includes(requestOrigin);
+                if (requestOrigin && !isOriginAllowed) {
+                    console.log(`❌ CORS: Blocked request from ${requestOrigin}`);
+                    if (req.method === 'OPTIONS') {
+                        // Для preflight - 200 без CORS headers
+                        return res.status(200).end();
+                    }
+                    else {
+                        // Для основных запросов - ошибка
+                        return res.status(403).json({
+                            error: 'CORS policy: Origin not allowed'
+                        });
+                    }
+                }
+                // Запрос с разрешенного origin или без Origin
+                if (isOriginAllowed) {
+                    // Для CORS запросов возвращаем тот же origin (или первый из списка)
+                    const allowOrigin = requestOrigin || allowedOrigins[0];
+                    res.header('Access-Control-Allow-Origin', allowOrigin);
+                    res.header('Access-Control-Allow-Credentials', corsConfig.credentials !== false ? 'true' : 'false');
+                    res.header('Access-Control-Allow-Methods', corsConfig.methods?.join(',') || 'GET,POST,PUT,DELETE,OPTIONS');
+                    res.header('Access-Control-Allow-Headers', corsConfig.allowedHeaders?.join(',') || 'Content-Type,Authorization,X-Requested-With,X-CSRF-Token,x-xsrf-token');
+                }
                 if (req.method === 'OPTIONS') {
                     return res.status(200).end();
                 }
                 next();
             });
-            console.log('✅  API CORS middleware enabled');
+            console.log('✅ API CORS middleware enabled. Allowed origins:', allowedOrigins);
         }
         // set cookie parser
         this.app.use(cookieParser());

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "adminizer",
   "type": "module",
-  "version": "4.3.0-build.127",
+  "version": "4.3.0-build.129",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
@@ -16,6 +16,7 @@
     "dev:no-seed-clean": "cross-env VITE_ENV=dev NO_SEED_DATA=true CLEAN_TMP=true ORM=sequelize tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
     "dev:waterline": "cross-env VITE_ENV=dev ORM=waterline tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
     "dev:waterline:no-seed": "cross-env VITE_ENV=dev NO_SEED_DATA=true ORM=waterline tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
+    "dev:cors": "cross-env VITE_ENV=dev NO_SEED_DATA=true ORM=waterline FRONTEND_URL=http://localhost:8080 tsx watch --tsconfig ./fixture/tsconfig.json ./fixture/index.ts",
     "build:assets": "vite build",
     "compile:backend": "tsc -p src/tsconfig.json",
     "compile:ui": "tsc -p tsconfig.ui.json",