azurajs 2.7.0 → 2.7.1

package/src/infra/Server.ts

@@ -87,24 +87,34 @@ export class AzuraClient {
     }
 
     if (this.opts.plugins?.cors?.enabled) {
-      cors({
+      const corsPlugin = cors({
         origin: this.opts.plugins.cors.origins,
         methods: this.opts.plugins.cors.methods,
         allowedHeaders: this.opts.plugins.cors.allowedHeaders,
+        credentials: this.opts.plugins.cors.credentials,
       });
+
+      this.middlewares.unshift((ctx: any) => corsPlugin(ctx, ctx.next));
       logger("info", "CORS plugin enabled");
     }
 
     if (this.opts.plugins?.rateLimit?.enabled) {
-      rateLimit(this.opts.plugins.rateLimit.limit, this.opts.plugins.rateLimit.timeframe);
+      const rateLimitPlugin = rateLimit(
+        this.opts.plugins.rateLimit.limit,
+        this.opts.plugins.rateLimit.timeframe,
+      );
+
+      if (typeof rateLimitPlugin === "function") {
+        this.middlewares.unshift((ctx: any) => rateLimitPlugin(ctx, ctx.next));
+      }
       logger("info", "Rate Limit plugin enabled");
     }
 
     // Create server WITHOUT handler to allow upgrade events to work properly
     this.server = http.createServer();
-    
+
     // Add request handler manually
-    this.server.on('request', (req, res) => {
+    this.server.on("request", (req, res) => {
       this.handle(req as any, res as any);
     });
   }

package/src/shared/config/ConfigModule.ts

@@ -45,6 +45,7 @@ export type ConfigTypes = {
       origins: string | string[];
       methods: string | string[];
       allowedHeaders: string | string[];
+      credentials: boolean;
     };
   };
   logging?: {
@@ -135,4 +136,4 @@ export class ConfigModule {
   get<T extends keyof ConfigTypes>(key: T): ConfigTypes[T] {
     return this.config[key];
   }
-}
+}

package/src/shared/plugins/CORSPlugin.ts

@@ -2,25 +2,50 @@ import type { HttpContext } from "../../types/common.type";
 import type { CorsOptions } from "../../types/plugins/cors.type";
 
 export function cors(opts: CorsOptions) {
-  const { origin, methods, allowedHeaders } = opts;
+  const allowedOrigin = opts.origin ?? "*";
+  const methods = opts.methods ?? "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS";
+  const allowedHeaders =
+    opts.allowedHeaders ?? "Content-Type,Authorization,Cookie,X-Requested-With,Accept";
+  const credentials = opts.credentials === true;
+
+  return async (ctx: HttpContext, next: () => Promise<void>) => {
+    const requestOrigin = ctx.request.headers["origin"] as string;
+
+    if (allowedOrigin === "*") {
+      if (credentials && requestOrigin) {
+        ctx.response.setHeader("Access-Control-Allow-Origin", requestOrigin);
+      } else {
+        ctx.response.setHeader("Access-Control-Allow-Origin", "*");
+      }
+    } else if (Array.isArray(allowedOrigin)) {
+      if (requestOrigin && allowedOrigin.includes(requestOrigin)) {
+        ctx.response.setHeader("Access-Control-Allow-Origin", requestOrigin);
+      }
+    } else if (allowedOrigin) {
+      ctx.response.setHeader("Access-Control-Allow-Origin", allowedOrigin as string);
+    }
+
+    if (credentials) {
+      ctx.response.setHeader("Access-Control-Allow-Credentials", "true");
+    }
 
-  return (ctx: HttpContext, next: () => Promise<void>) => {
-    ctx.response.setHeader(
-      "Access-Control-Allow-Origin",
-      Array.isArray(origin) ? origin.join(",") : origin,
-    );
     ctx.response.setHeader(
       "Access-Control-Allow-Methods",
       Array.isArray(methods) ? methods.join(",") : methods,
     );
+
     ctx.response.setHeader(
       "Access-Control-Allow-Headers",
       Array.isArray(allowedHeaders) ? allowedHeaders.join(",") : allowedHeaders,
     );
 
+    ctx.response.setHeader("Vary", "Origin");
+
     if (ctx.request.method === "OPTIONS") {
-      ctx.response.writeHead(204);
-      return ctx.response.end();
+      ctx.response.statusCode = 204;
+      ctx.response.setHeader("Content-Length", "0");
+      ctx.response.end();
+      return;
     }
 
     return next();

package/src/types/plugins/cors.type.ts

@@ -2,4 +2,5 @@ export interface CorsOptions {
   origin: string | string[];
   methods: string | string[];
   allowedHeaders: string | string[];
+  credentials: boolean;
 }