convex-helpers 0.1.94 → 0.1.95

package/README.md

@@ -33,7 +33,7 @@ Table of contents:
     - [What can you do with triggers?](#what-can-you-do-with-triggers)
     - [Trigger semantics](#trigger-semantics)
   - [CORS support for HttpRouter](#cors-support-for-httprouter)
-  - [Standard Schema support](#standard-schema)
+  - [Standard Schema](#standard-schema)
 
 ## Custom Functions
 
@@ -1180,12 +1180,16 @@ const cors = corsRouter(
   http,
   // Optional configuration, can be omitted entirely
   {
+    // allowedOrigins can also be a function
+    // allowedOrigins: (req: Request) => Promise<string[]>
     allowedOrigins: ["http://localhost:8080"], // Default: ["*"]
     allowedMethods: ["GET", "POST"], // Defaults to route spec method
     allowedHeaders: ["Content-Type"], // Default: ["Content-Type"]
     exposedHeaders: ["Custom-Header"], // Default: ["Content-Range", "Accept-Ranges"]
     allowCredentials: true, // Default: false
     browserCacheMaxAge: 60, // Default: 86400 (1 day)
+    // returns a 403 if the origin is not allowed
+    enforceAllowOrigins: true, // Default: false
     debug: true, // Default: false
   },
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "convex-helpers",
-  "version": "0.1.94",
+  "version": "0.1.95",
   "description": "A collection of useful code to complement the official convex package.",
   "type": "module",
   "bin": {

package/server/cors.d.ts

@@ -31,7 +31,7 @@ export type CorsConfig = {
      * - https://example.com
      * @default ["*"]
      */
-    allowedOrigins?: string[];
+    allowedOrigins?: string[] | ((req: Request) => Promise<string[]>);
     /**
      * An array of allowed headers: what headers are allowed to be sent in
      * the request.
@@ -52,6 +52,11 @@ export type CorsConfig = {
      * @default 86400 (1 day)
      */
     browserCacheMaxAge?: number;
+    /**
+     * Whether to block requests from origins that are not in the allowedOrigins list.
+     * @default false
+     */
+    enforceAllowOrigins?: boolean;
     /**
      * Whether to log debugging information about CORS requests.
      * @default false

package/server/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAIL,UAAU,EAIV,KAAK,SAAS,EAGf,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,uBAAuB,UAInC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,iBAAiB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,UAAU,EAAE,aAAa,UAAU;;uBAK7C,iBAAiB,KAAG,IAAI;CAsD9C,CAAC;AA+DF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAIL,UAAU,EAIV,KAAK,SAAS,EAGf,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,uBAAuB,UAInC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClE;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,iBAAiB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,UAAU,EAAE,aAAa,UAAU;;uBAK7C,iBAAiB,KAAG,IAAI;CAsD9C,CAAC;AA+DF,eAAe,UAAU,CAAC"}

package/server/cors.js

@@ -146,7 +146,7 @@ const SECONDS_IN_A_DAY = 60 * 60 * 24;
  * - "https://example1.com, https://example2.com" (allow multiple specific domains)
  * - "null" (allow requests from data URLs or local files)
  */
-const handleCors = ({ originalHandler, allowedMethods = ["OPTIONS"], allowedOrigins = ["*"], allowedHeaders = ["Content-Type"], exposedHeaders = DEFAULT_EXPOSED_HEADERS, allowCredentials = false, browserCacheMaxAge = SECONDS_IN_A_DAY, debug = false, }) => {
+const handleCors = ({ originalHandler, allowedMethods = ["OPTIONS"], allowedOrigins = ["*"], allowedHeaders = ["Content-Type"], exposedHeaders = DEFAULT_EXPOSED_HEADERS, allowCredentials = false, browserCacheMaxAge = SECONDS_IN_A_DAY, enforceAllowOrigins = false, debug = false, }) => {
     const uniqueMethods = Array.from(new Set(allowedMethods.map((method) => method.toUpperCase())));
     const filteredMethods = uniqueMethods.filter((method) => ROUTABLE_HTTP_METHODS.includes(method));
     if (filteredMethods.length === 0) {
@@ -171,9 +171,17 @@ const handleCors = ({ originalHandler, allowedMethods = ["OPTIONS"], allowedOrig
     if (exposedHeaders.length > 0) {
         commonHeaders["Access-Control-Expose-Headers"] = exposedHeaders.join(", ");
     }
+    async function parseAllowedOrigins(request) {
+        return Array.isArray(allowedOrigins)
+            ? allowedOrigins
+            : await allowedOrigins(request);
+    }
     // Helper function to check if origin is allowed (including wildcard subdomain matching)
-    function isAllowedOrigin(requestOrigin) {
-        return allowedOrigins.some((allowed) => {
+    async function isAllowedOrigin(request) {
+        const requestOrigin = request.headers.get("origin");
+        if (!requestOrigin)
+            return false;
+        return (await parseAllowedOrigins(request)).some((allowed) => {
             if (allowed === "*")
                 return true;
             if (allowed === requestOrigin)
@@ -208,36 +216,48 @@ const handleCors = ({ originalHandler, allowedMethods = ["OPTIONS"], allowedOrig
             });
         }
         const requestOrigin = request.headers.get("origin");
+        const parsedAllowedOrigins = await parseAllowedOrigins(request);
+        if (debug) {
+            console.log("allowed origins", parsedAllowedOrigins);
+        }
         // Handle origin matching
         let allowOrigins = null;
-        if (allowedOrigins.includes("*") && !allowCredentials) {
-            allowOrigins = "*";
+        if (parsedAllowedOrigins.includes("*") &&
+            requestOrigin &&
+            !allowCredentials) {
+            allowOrigins = requestOrigin;
         }
         else if (requestOrigin) {
             // Check if the request origin matches any of the allowed origins
             // (including wildcard subdomain matching if configured)
-            if (isAllowedOrigin(requestOrigin)) {
+            if (await isAllowedOrigin(request)) {
                 allowOrigins = requestOrigin;
             }
         }
-        if (!allowOrigins) {
+        if (enforceAllowOrigins && !allowOrigins) {
             // Origin not allowed
-            console.error(`Request from origin ${requestOrigin} blocked, missing from allowed origins: ${allowedOrigins.join()}`);
+            console.error(`Request from origin ${requestOrigin} blocked, missing from allowed origins: ${parsedAllowedOrigins.join()}`);
             return new Response(null, { status: 403 });
         }
         /**
          * OPTIONS has no handler and just returns headers
          */
         if (request.method === "OPTIONS") {
+            const responseHeaders = new Headers({
+                ...commonHeaders,
+                ...(allowOrigins
+                    ? { "Access-Control-Allow-Origin": allowOrigins }
+                    : {}),
+                "Access-Control-Allow-Methods": allowMethods,
+                "Access-Control-Allow-Headers": allowedHeaders.join(", "),
+                "Access-Control-Max-Age": browserCacheMaxAge.toString(),
+            });
+            if (debug) {
+                console.log("CORS OPTIONS response headers", responseHeaders);
+            }
             return new Response(null, {
                 status: 204,
-                headers: new Headers({
-                    ...commonHeaders,
-                    "Access-Control-Allow-Origin": allowOrigins,
-                    "Access-Control-Allow-Methods": allowMethods,
-                    "Access-Control-Allow-Headers": allowedHeaders.join(", "),
-                    "Access-Control-Max-Age": browserCacheMaxAge.toString(),
-                }),
+                headers: responseHeaders,
             });
         }
         /**
@@ -254,16 +274,22 @@ const handleCors = ({ originalHandler, allowedMethods = ["OPTIONS"], allowedOrig
             : originalHandler);
         const originalResponse = await innerHandler(ctx, request);
         /**
-         * Second, get a copy of the original response's headers
+         * Second, get a copy of the original response's headers and add the
+         * allow origin header if it's allowed
          */
         const newHeaders = new Headers(originalResponse.headers);
-        newHeaders.set("Access-Control-Allow-Origin", allowOrigins);
+        if (allowOrigins) {
+            newHeaders.set("Access-Control-Allow-Origin", allowOrigins);
+        }
         /**
-         * Third, add or update our CORS headers
+         * Third, add or update our other CORS headers
          */
         Object.entries(commonHeaders).forEach(([key, value]) => {
             newHeaders.set(key, value);
         });
+        if (debug) {
+            console.log("CORS response headers", newHeaders);
+        }
         /**
          * Fourth, return the modified Response.
          * A Response object is immutable, so we create a new one to return here.

package/server/cors.ts

@@ -48,7 +48,7 @@ export type CorsConfig = {
    * - https://example.com
    * @default ["*"]
    */
-  allowedOrigins?: string[];
+  allowedOrigins?: string[] | ((req: Request) => Promise<string[]>);
   /**
    * An array of allowed headers: what headers are allowed to be sent in
    * the request.
@@ -69,6 +69,11 @@ export type CorsConfig = {
    * @default 86400 (1 day)
    */
   browserCacheMaxAge?: number;
+  /**
+   * Whether to block requests from origins that are not in the allowedOrigins list.
+   * @default false
+   */
+  enforceAllowOrigins?: boolean;
   /**
    * Whether to log debugging information about CORS requests.
    * @default false
@@ -240,6 +245,7 @@ const handleCors = ({
   exposedHeaders = DEFAULT_EXPOSED_HEADERS,
   allowCredentials = false,
   browserCacheMaxAge = SECONDS_IN_A_DAY,
+  enforceAllowOrigins = false,
   debug = false,
 }: {
   originalHandler?: PublicHttpAction;
@@ -279,9 +285,17 @@ const handleCors = ({
     commonHeaders["Access-Control-Expose-Headers"] = exposedHeaders.join(", ");
   }
 
+  async function parseAllowedOrigins(request: Request): Promise<string[]> {
+    return Array.isArray(allowedOrigins)
+      ? allowedOrigins
+      : await allowedOrigins(request);
+  }
+
   // Helper function to check if origin is allowed (including wildcard subdomain matching)
-  function isAllowedOrigin(requestOrigin: string): boolean {
-    return allowedOrigins.some((allowed) => {
+  async function isAllowedOrigin(request: Request): Promise<boolean> {
+    const requestOrigin = request.headers.get("origin");
+    if (!requestOrigin) return false;
+    return (await parseAllowedOrigins(request)).some((allowed) => {
       if (allowed === "*") return true;
       if (allowed === requestOrigin) return true;
       if (allowed.startsWith("*.")) {
@@ -317,23 +331,32 @@ const handleCors = ({
         });
       }
       const requestOrigin = request.headers.get("origin");
+      const parsedAllowedOrigins = await parseAllowedOrigins(request);
+
+      if (debug) {
+        console.log("allowed origins", parsedAllowedOrigins);
+      }
 
       // Handle origin matching
       let allowOrigins: string | null = null;
-      if (allowedOrigins.includes("*") && !allowCredentials) {
-        allowOrigins = "*";
+      if (
+        parsedAllowedOrigins.includes("*") &&
+        requestOrigin &&
+        !allowCredentials
+      ) {
+        allowOrigins = requestOrigin;
       } else if (requestOrigin) {
         // Check if the request origin matches any of the allowed origins
         // (including wildcard subdomain matching if configured)
-        if (isAllowedOrigin(requestOrigin)) {
+        if (await isAllowedOrigin(request)) {
           allowOrigins = requestOrigin;
         }
       }
 
-      if (!allowOrigins) {
+      if (enforceAllowOrigins && !allowOrigins) {
         // Origin not allowed
         console.error(
-          `Request from origin ${requestOrigin} blocked, missing from allowed origins: ${allowedOrigins.join()}`,
+          `Request from origin ${requestOrigin} blocked, missing from allowed origins: ${parsedAllowedOrigins.join()}`,
         );
         return new Response(null, { status: 403 });
       }
@@ -341,15 +364,21 @@ const handleCors = ({
        * OPTIONS has no handler and just returns headers
        */
       if (request.method === "OPTIONS") {
+        const responseHeaders = new Headers({
+          ...commonHeaders,
+          ...(allowOrigins
+            ? { "Access-Control-Allow-Origin": allowOrigins }
+            : {}),
+          "Access-Control-Allow-Methods": allowMethods,
+          "Access-Control-Allow-Headers": allowedHeaders.join(", "),
+          "Access-Control-Max-Age": browserCacheMaxAge.toString(),
+        });
+        if (debug) {
+          console.log("CORS OPTIONS response headers", responseHeaders);
+        }
         return new Response(null, {
           status: 204,
-          headers: new Headers({
-            ...commonHeaders,
-            "Access-Control-Allow-Origin": allowOrigins,
-            "Access-Control-Allow-Methods": allowMethods,
-            "Access-Control-Allow-Headers": allowedHeaders.join(", "),
-            "Access-Control-Max-Age": browserCacheMaxAge.toString(),
-          }),
+          headers: responseHeaders,
         });
       }
 
@@ -372,18 +401,25 @@ const handleCors = ({
       const originalResponse = await innerHandler(ctx, request);
 
       /**
-       * Second, get a copy of the original response's headers
+       * Second, get a copy of the original response's headers and add the
+       * allow origin header if it's allowed
        */
       const newHeaders = new Headers(originalResponse.headers);
-      newHeaders.set("Access-Control-Allow-Origin", allowOrigins);
+      if (allowOrigins) {
+        newHeaders.set("Access-Control-Allow-Origin", allowOrigins);
+      }
 
       /**
-       * Third, add or update our CORS headers
+       * Third, add or update our other CORS headers
        */
       Object.entries(commonHeaders).forEach(([key, value]) => {
         newHeaders.set(key, value);
       });
 
+      if (debug) {
+        console.log("CORS response headers", newHeaders);
+      }
+
       /**
        * Fourth, return the modified Response.
        * A Response object is immutable, so we create a new one to return here.