befly 3.4.14 → 3.4.16

package/config/env.ts

@@ -87,17 +87,17 @@ export interface EnvConfig {
 
     // ========== CORS 配置 ==========
     /** 允许的来源 */
-    ALLOWED_ORIGIN: string;
+    CORS_ALLOWED_ORIGIN: string;
     /** 允许的方法 */
-    ALLOWED_METHODS: string;
+    CORS_ALLOWED_METHODS: string;
     /** 允许的头部 */
-    ALLOWED_HEADERS: string;
+    CORS_ALLOWED_HEADERS: string;
     /** 暴露的头部 */
-    EXPOSE_HEADERS: string;
+    CORS_EXPOSE_HEADERS: string;
     /** 预检请求缓存时间（秒） */
-    MAX_AGE: number;
+    CORS_MAX_AGE: number;
     /** 是否允许凭证 */
-    ALLOW_CREDENTIALS: string;
+    CORS_ALLOW_CREDENTIALS: string;
 
     // ========== 邮件配置 ==========
     /** 邮件服务器主机 */
@@ -183,12 +183,12 @@ export const Env: EnvConfig = {
     JWT_ALGORITHM: getEnv('JWT_ALGORITHM', 'HS256'),
 
     // ========== CORS 配置 ==========
-    ALLOWED_ORIGIN: getEnv('ALLOWED_ORIGIN', '*'),
-    ALLOWED_METHODS: getEnv('ALLOWED_METHODS', 'GET, POST, PUT, DELETE, OPTIONS'),
-    ALLOWED_HEADERS: getEnv('ALLOWED_HEADERS', 'Content-Type, Authorization, authorization, token'),
-    EXPOSE_HEADERS: getEnv('EXPOSE_HEADERS', 'Content-Range, X-Content-Range, Authorization, authorization, token'),
-    MAX_AGE: getEnvNumber('MAX_AGE', 86400),
-    ALLOW_CREDENTIALS: getEnv('ALLOW_CREDENTIALS', 'true'),
+    CORS_ALLOWED_ORIGIN: getEnv('CORS_ALLOWED_ORIGIN', '*'),
+    CORS_ALLOWED_METHODS: getEnv('CORS_ALLOWED_METHODS', 'GET, POST, PUT, DELETE, OPTIONS'),
+    CORS_ALLOWED_HEADERS: getEnv('CORS_ALLOWED_HEADERS', 'Content-Type, Authorization, authorization, token'),
+    CORS_EXPOSE_HEADERS: getEnv('CORS_EXPOSE_HEADERS', 'Content-Range, X-Content-Range, Authorization, authorization, token'),
+    CORS_MAX_AGE: getEnvNumber('CORS_MAX_AGE', 86400),
+    CORS_ALLOW_CREDENTIALS: getEnv('CORS_ALLOW_CREDENTIALS', 'true'),
 
     // ========== 邮件配置 ==========
     MAIL_HOST: getEnv('MAIL_HOST', ''),

package/lib/middleware.ts

@@ -50,18 +50,50 @@ export interface CorsResult {
 /**
  * 设置 CORS 选项
  * 根据环境变量或请求头动态设置跨域配置
+ *
+ * 注意：Access-Control-Allow-Origin 只能返回单个源，不能用逗号分隔多个源
+ * 如果配置了多个允许的源，需要根据请求的 Origin 动态返回匹配的源
+ *
  * @param req - 请求对象
  * @returns CORS 配置对象
  */
 export const setCorsOptions = (req: Request): CorsResult => {
+    const requestOrigin = req.headers.get('origin');
+    let allowedOrigin = '*';
+
+    // 如果配置了 CORS_ALLOWED_ORIGIN
+    if (Env.CORS_ALLOWED_ORIGIN) {
+        // 如果配置为 *，使用请求的 origin（而不是返回 *）
+        if (Env.CORS_ALLOWED_ORIGIN === '*') {
+            allowedOrigin = requestOrigin || '*';
+        } else {
+            // 支持多个源，用逗号分隔
+            const allowedOrigins = Env.CORS_ALLOWED_ORIGIN.split(',').map((origin) => origin.trim());
+
+            // 如果请求的 origin 在允许列表中，返回该 origin
+            if (requestOrigin && allowedOrigins.includes(requestOrigin)) {
+                allowedOrigin = requestOrigin;
+            } else if (allowedOrigins.length === 1) {
+                // 如果只配置了一个源，直接使用
+                allowedOrigin = allowedOrigins[0];
+            } else {
+                // 多个源但请求源不在列表中，不允许跨域
+                allowedOrigin = 'null';
+            }
+        }
+    } else if (requestOrigin) {
+        // 没有配置 CORS_ALLOWED_ORIGIN，使用请求的 origin
+        allowedOrigin = requestOrigin;
+    }
+
     return {
         headers: {
-            'Access-Control-Allow-Origin': Env.ALLOWED_ORIGIN || req.headers.get('origin') || '*',
-            'Access-Control-Allow-Methods': Env.ALLOWED_METHODS || 'GET, POST, PUT, DELETE, OPTIONS',
-            'Access-Control-Allow-Headers': Env.ALLOWED_HEADERS || 'Content-Type, Authorization, authorization, token',
-            'Access-Control-Expose-Headers': Env.EXPOSE_HEADERS || 'Content-Range, X-Content-Range, Authorization, authorization, token',
-            'Access-Control-Max-Age': Env.MAX_AGE || 86400,
-            'Access-Control-Allow-Credentials': Env.ALLOW_CREDENTIALS || 'true'
+            'Access-Control-Allow-Origin': allowedOrigin,
+            'Access-Control-Allow-Methods': Env.CORS_ALLOWED_METHODS || 'GET, POST, PUT, DELETE, OPTIONS',
+            'Access-Control-Allow-Headers': Env.CORS_ALLOWED_HEADERS || 'Content-Type, Authorization, authorization, token',
+            'Access-Control-Expose-Headers': Env.CORS_EXPOSE_HEADERS || 'Content-Range, X-Content-Range, Authorization, authorization, token',
+            'Access-Control-Max-Age': Env.CORS_MAX_AGE || 86400,
+            'Access-Control-Allow-Credentials': Env.CORS_ALLOW_CREDENTIALS || 'true'
         }
     };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "befly",
-    "version": "3.4.14",
+    "version": "3.4.16",
     "description": "Befly - 为 Bun 专属打造的 TypeScript API 接口框架核心引擎",
     "type": "module",
     "private": false,
@@ -81,5 +81,5 @@
         "ora": "^9.0.0",
         "pathe": "^2.0.3"
     },
-    "gitHead": "8ced9f183b280460e8136eb00985c0fb83e63bc1"
+    "gitHead": "e1533f0a123ef756790fad4fc34dd9690a30f72e"
 }

package/router/api.ts

@@ -21,6 +21,7 @@ import type { BeflyContext } from '../types/befly.js';
 export function apiHandler(apiRoutes: Map<string, ApiRoute>, pluginLists: Plugin[], appContext: BeflyContext) {
     return async (req: Request): Promise<Response> => {
         const corsOptions = setCorsOptions(req);
+        console.log('🔥[ corsOptions ]-24', corsOptions);
         let ctx: RequestContext | null = null;
         let api: ApiRoute | undefined;
         let apiPath = '';