adminizer 4.3.0-build.133 → 4.3.0-build.135

package/interfaces/adminpanelConfig.d.ts

@@ -194,7 +194,8 @@ export interface AdminpanelConfig {
     };
     cors?: {
         enabled: boolean;
-        origin?: string[];
+        origin: string[] | string;
+        path: string;
         credentials?: boolean;
         methods?: string[];
         allowedHeaders?: string[];

package/lib/Adminizer.js

@@ -31,6 +31,7 @@ import { CatalogHandler } from "./catalog/CatalogHandler";
 import { v4 as uuid } from "uuid";
 import { bindNotifications } from "../system/bindNotifications";
 import { MediaManagerHandler } from "./media-manager/MediaManagerHandler";
+import { bindCors } from "../system/bindCors";
 export class Adminizer {
     // Preconfigures
     /**
@@ -177,47 +178,8 @@ export class Adminizer {
                 set: configForms.set ?? defaultForms.set
             }
         };
-        // Middleware для всех API маршрутов
-        const defaultOrigin = process.env.FRONTEND_URL || 'http://localhost:8080';
-        if (config?.cors?.enabled) {
-            const corsConfig = config.cors;
-            // Поддерживаем массив разрешенных origin
-            const allowedOrigins = Array.isArray(corsConfig.origin)
-                ? corsConfig.origin
-                : [corsConfig.origin || defaultOrigin];
-            this.app.all(`${this.config.routePrefix}/api/*`, (req, res, next) => {
-                const requestOrigin = req.headers.origin;
-                // Проверяем разрешен ли origin
-                const isOriginAllowed = !requestOrigin || allowedOrigins.includes(requestOrigin);
-                if (requestOrigin && !isOriginAllowed) {
-                    console.log(`❌ CORS: Blocked request from ${requestOrigin}`);
-                    if (req.method === 'OPTIONS') {
-                        // Для preflight - 200 без CORS headers
-                        return res.status(200).end();
-                    }
-                    else {
-                        // Для основных запросов - ошибка
-                        return res.status(403).json({
-                            error: 'CORS policy: Origin not allowed'
-                        });
-                    }
-                }
-                // Запрос с разрешенного origin или без Origin
-                if (isOriginAllowed) {
-                    // Для CORS запросов возвращаем тот же origin (или первый из списка)
-                    const allowOrigin = requestOrigin || allowedOrigins[0];
-                    res.header('Access-Control-Allow-Origin', allowOrigin);
-                    res.header('Access-Control-Allow-Credentials', corsConfig.credentials !== false ? 'true' : 'false');
-                    res.header('Access-Control-Allow-Methods', corsConfig.methods?.join(',') || 'GET,POST,PUT,DELETE,OPTIONS');
-                    res.header('Access-Control-Allow-Headers', corsConfig.allowedHeaders?.join(',') || 'Content-Type,Authorization,X-Requested-With,X-CSRF-Token,x-xsrf-token');
-                }
-                if (req.method === 'OPTIONS') {
-                    return res.status(200).end();
-                }
-                next();
-            });
-            console.log('✅ API CORS middleware enabled. Allowed origins:', allowedOrigins);
-        }
+        // Bind cors
+        bindCors(this);
         // set cookie parser
         this.app.use(cookieParser());
         // Set vite middleware

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "adminizer",
   "type": "module",
-  "version": "4.3.0-build.133",
+  "version": "4.3.0-build.135",
   "main": "index.js",
   "exports": {
     ".": "./index.js",

package/system/Router.js

@@ -67,7 +67,9 @@ export default class Router {
          * Edit form
          * */
         adminizer.app.all(`${adminizer.config.routePrefix}/form/:slug`, adminizer.policyManager.bindPolicies(policies, _form));
-        // Create a base entity route
+        /**
+         *  Create a base entity route
+         */
         let baseRoute = `${adminizer.config.routePrefix}/:entityType(form|model)/:entityName`;
         /**
          * Catalog

package/system/bindCors.d.ts

@@ -0,0 +1,2 @@
+import { Adminizer } from "../lib/Adminizer";
+export declare function bindCors(adminizer: Adminizer): void;

package/system/bindCors.js

@@ -0,0 +1,41 @@
+export function bindCors(adminizer) {
+    if (adminizer.config?.cors?.enabled) {
+        const corsConfig = adminizer.config.cors;
+        // Поддерживаем массив разрешенных origin
+        const allowedOrigins = Array.isArray(corsConfig.origin)
+            ? corsConfig.origin
+            : [corsConfig.origin];
+        adminizer.app.all(`${adminizer.config.routePrefix}/${corsConfig.path}`, (req, res, next) => {
+            const requestOrigin = req.headers.origin;
+            // Проверяем разрешен ли origin
+            const isOriginAllowed = !requestOrigin || allowedOrigins.includes(requestOrigin);
+            if (requestOrigin && !isOriginAllowed) {
+                console.log(`❌ CORS: Blocked request from ${requestOrigin}`);
+                if (req.method === 'OPTIONS') {
+                    // Для preflight - 200 без CORS headers
+                    return res.status(200).end();
+                }
+                else {
+                    // Для основных запросов - ошибка
+                    return res.status(403).json({
+                        error: 'CORS policy: Origin not allowed'
+                    });
+                }
+            }
+            // Запрос с разрешенного origin или без Origin
+            if (isOriginAllowed) {
+                // Для CORS запросов возвращаем тот же origin (или первый из списка)
+                const allowOrigin = requestOrigin || allowedOrigins[0];
+                res.header('Access-Control-Allow-Origin', allowOrigin);
+                res.header('Access-Control-Allow-Credentials', corsConfig.credentials !== false ? 'true' : 'false');
+                res.header('Access-Control-Allow-Methods', corsConfig.methods?.join(',') || 'GET,POST,PUT,DELETE,OPTIONS');
+                res.header('Access-Control-Allow-Headers', corsConfig.allowedHeaders?.join(',') || 'Content-Type,Authorization,X-Requested-With,X-CSRF-Token,x-xsrf-token');
+            }
+            if (req.method === 'OPTIONS') {
+                return res.status(200).end();
+            }
+            next();
+        });
+        console.log('✅ API CORS middleware enabled. Allowed origins:', allowedOrigins);
+    }
+}

package/system/defaults.js

@@ -143,6 +143,8 @@ let adminpanelConfig = {
     },
     cors: {
         enabled: false,
+        origin: 'http://localhost:8080',
+        path: 'api/*'
     },
     mediamanager: {
         fileStoragePath: '.tmp/public',