azurajs 2.7.0 → 2.7.1

package/dist/index.js

@@ -608,12 +608,28 @@ var COMMON_PROXY_RANGES = {
 
 // src/shared/plugins/CORSPlugin.ts
 function cors(opts) {
-  const { origin, methods, allowedHeaders } = opts;
-  return (ctx, next) => {
-    ctx.response.setHeader(
-      "Access-Control-Allow-Origin",
-      Array.isArray(origin) ? origin.join(",") : origin
-    );
+  const allowedOrigin = opts.origin ?? "*";
+  const methods = opts.methods ?? "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS";
+  const allowedHeaders = opts.allowedHeaders ?? "Content-Type,Authorization,Cookie,X-Requested-With,Accept";
+  const credentials = opts.credentials === true;
+  return async (ctx, next) => {
+    const requestOrigin = ctx.request.headers["origin"];
+    if (allowedOrigin === "*") {
+      if (credentials && requestOrigin) {
+        ctx.response.setHeader("Access-Control-Allow-Origin", requestOrigin);
+      } else {
+        ctx.response.setHeader("Access-Control-Allow-Origin", "*");
+      }
+    } else if (Array.isArray(allowedOrigin)) {
+      if (requestOrigin && allowedOrigin.includes(requestOrigin)) {
+        ctx.response.setHeader("Access-Control-Allow-Origin", requestOrigin);
+      }
+    } else if (allowedOrigin) {
+      ctx.response.setHeader("Access-Control-Allow-Origin", allowedOrigin);
+    }
+    if (credentials) {
+      ctx.response.setHeader("Access-Control-Allow-Credentials", "true");
+    }
     ctx.response.setHeader(
       "Access-Control-Allow-Methods",
       Array.isArray(methods) ? methods.join(",") : methods
@@ -622,9 +638,12 @@ function cors(opts) {
       "Access-Control-Allow-Headers",
       Array.isArray(allowedHeaders) ? allowedHeaders.join(",") : allowedHeaders
     );
+    ctx.response.setHeader("Vary", "Origin");
     if (ctx.request.method === "OPTIONS") {
-      ctx.response.writeHead(204);
-      return ctx.response.end();
+      ctx.response.statusCode = 204;
+      ctx.response.setHeader("Content-Length", "0");
+      ctx.response.end();
+      return;
     }
     return next();
   };
@@ -936,15 +955,23 @@ var AzuraClient = class {
       return;
     }
     if (this.opts.plugins?.cors?.enabled) {
-      cors({
+      const corsPlugin = cors({
         origin: this.opts.plugins.cors.origins,
         methods: this.opts.plugins.cors.methods,
-        allowedHeaders: this.opts.plugins.cors.allowedHeaders
+        allowedHeaders: this.opts.plugins.cors.allowedHeaders,
+        credentials: this.opts.plugins.cors.credentials
       });
+      this.middlewares.unshift((ctx) => corsPlugin(ctx, ctx.next));
       logger("info", "CORS plugin enabled");
     }
     if (this.opts.plugins?.rateLimit?.enabled) {
-      rateLimit(this.opts.plugins.rateLimit.limit, this.opts.plugins.rateLimit.timeframe);
+      const rateLimitPlugin = rateLimit(
+        this.opts.plugins.rateLimit.limit,
+        this.opts.plugins.rateLimit.timeframe
+      );
+      if (typeof rateLimitPlugin === "function") {
+        this.middlewares.unshift((ctx) => rateLimitPlugin(ctx, ctx.next));
+      }
       logger("info", "Rate Limit plugin enabled");
     }
     this.server = http.createServer();