azurajs 2.7.0 → 2.7.1

package/dist/plugins.js

@@ -8,12 +8,28 @@ import { createHash, randomBytes, createHmac, timingSafeEqual } from 'crypto';
 
 // src/shared/plugins/CORSPlugin.ts
 function cors(opts) {
-  const { origin, methods, allowedHeaders } = opts;
-  return (ctx, next) => {
-    ctx.response.setHeader(
-      "Access-Control-Allow-Origin",
-      Array.isArray(origin) ? origin.join(",") : origin
-    );
+  const allowedOrigin = opts.origin ?? "*";
+  const methods = opts.methods ?? "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS";
+  const allowedHeaders = opts.allowedHeaders ?? "Content-Type,Authorization,Cookie,X-Requested-With,Accept";
+  const credentials = opts.credentials === true;
+  return async (ctx, next) => {
+    const requestOrigin = ctx.request.headers["origin"];
+    if (allowedOrigin === "*") {
+      if (credentials && requestOrigin) {
+        ctx.response.setHeader("Access-Control-Allow-Origin", requestOrigin);
+      } else {
+        ctx.response.setHeader("Access-Control-Allow-Origin", "*");
+      }
+    } else if (Array.isArray(allowedOrigin)) {
+      if (requestOrigin && allowedOrigin.includes(requestOrigin)) {
+        ctx.response.setHeader("Access-Control-Allow-Origin", requestOrigin);
+      }
+    } else if (allowedOrigin) {
+      ctx.response.setHeader("Access-Control-Allow-Origin", allowedOrigin);
+    }
+    if (credentials) {
+      ctx.response.setHeader("Access-Control-Allow-Credentials", "true");
+    }
     ctx.response.setHeader(
       "Access-Control-Allow-Methods",
       Array.isArray(methods) ? methods.join(",") : methods
@@ -22,9 +38,12 @@ function cors(opts) {
       "Access-Control-Allow-Headers",
       Array.isArray(allowedHeaders) ? allowedHeaders.join(",") : allowedHeaders
     );
+    ctx.response.setHeader("Vary", "Origin");
     if (ctx.request.method === "OPTIONS") {
-      ctx.response.writeHead(204);
-      return ctx.response.end();
+      ctx.response.statusCode = 204;
+      ctx.response.setHeader("Content-Length", "0");
+      ctx.response.end();
+      return;
     }
     return next();
   };