fumadocs-openapi 9.0.3 → 9.0.4

package/dist/server/proxy.d.ts

@@ -4,9 +4,24 @@ type Proxy = {
     [K in (typeof keys)[number]]: (req: NextRequest) => Promise<Response>;
 };
 interface CreateProxyOptions {
+    /**
+     * Filter by prefixes of request url
+     *
+     * @deprecated Use `allowedOrigins` for filtering origins, or `filterRequest` for more detailed rules.
+     */
     allowedUrls?: string[];
     /**
-     * Override original request/response with yours
+     * List of allowed origins to proxy to.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Determine if the proxied request is allowed.
+     *
+     * @returns true if allowed, otherwise forbidden.
+     */
+    filterRequest?: (request: Request) => boolean;
+    /**
+     * Override proxied request/response with yours
      */
     overrides?: {
         request?: (request: Request) => Request;

package/dist/server/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/server/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,QAAA,MAAM,IAAI,4DAA6D,CAAC;AAExE,KAAK,KAAK,GAAG;KACV,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC;CACtE,CAAC;AAEF,UAAU,kBAAkB;IAC1B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QACxC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;KAC7C,CAAC;CACH;AAED,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,KAAK,CA8EnE"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/server/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,QAAA,MAAM,IAAI,4DAA6D,CAAC;AAExE,KAAK,KAAK,GAAG;KACV,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC;CACtE,CAAC;AAEF,UAAU,kBAAkB;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAE9C;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QACxC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;KAC7C,CAAC;CACH;AAED,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,KAAK,CAmGnE"}

package/dist/server/proxy.js

@@ -1,39 +1,53 @@
 const keys = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD'];
 export function createProxy(options = {}) {
-    const { allowedUrls, overrides } = options;
+    const { allowedOrigins, allowedUrls, filterRequest = (req) => {
+        return (!allowedUrls || allowedUrls.some((item) => req.url.startsWith(item)));
+    }, overrides, } = options;
     const handlers = {};
     async function handler(req) {
         const url = req.nextUrl.searchParams.get('url');
         if (!url) {
-            return Response.json('A `url` query parameter is required for proxy url', {
+            return Response.json('[Proxy] A `url` query parameter is required for proxy url', {
                 status: 400,
             });
         }
-        if (allowedUrls &&
-            allowedUrls.every((allowedUrl) => !allowedUrl.startsWith(url))) {
-            return Response.json('The given `url` query parameter is not allowed', {
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(url);
+        }
+        catch {
+            return Response.json('[Proxy] Invalid `url` parameter value.', {
+                status: 400,
+            });
+        }
+        if (allowedOrigins && !allowedOrigins.includes(parsedUrl.origin)) {
+            return Response.json(`[Proxy] The origin "${parsedUrl.origin}" is not allowed.`, {
                 status: 400,
             });
         }
-        let clonedReq = new Request(url, {
+        let proxied = new Request(parsedUrl, {
             ...req,
             cache: 'no-cache',
             mode: 'cors',
         });
         if (overrides?.request) {
-            clonedReq = overrides.request(clonedReq);
+            proxied = overrides.request(proxied);
         }
-        clonedReq.headers.forEach((_value, originalKey) => {
+        if (!filterRequest(proxied)) {
+            return Response.json('[Proxy] The proxied request is not allowed', {
+                status: 403,
+            });
+        }
+        proxied.headers.forEach((_value, originalKey) => {
             const key = originalKey.toLowerCase();
-            const notAllowed = key === 'origin';
-            if (notAllowed) {
-                clonedReq.headers.delete(originalKey);
+            if (key === 'origin') {
+                proxied.headers.delete(originalKey);
             }
         });
-        let res = await fetch(clonedReq).catch((e) => new Error(e.toString()));
+        let res = await fetch(proxied).catch((e) => new Error(e.toString()));
         if (res instanceof Error) {
-            return Response.json(`Failed to proxy request: ${res.message}`, {
-                status: 400,
+            return Response.json(`[Proxy] Failed to proxy request: ${res.message}`, {
+                status: 500,
             });
         }
         if (overrides?.response) {
@@ -42,14 +56,14 @@ export function createProxy(options = {}) {
         const headers = new Headers(res.headers);
         headers.forEach((_value, originalKey) => {
             const key = originalKey.toLowerCase();
-            const notAllowed = key.startsWith('access-control-') || key === 'content-encoding';
-            if (notAllowed) {
+            if (key.startsWith('access-control-') || key === 'content-encoding') {
                 headers.delete(originalKey);
             }
         });
         headers.set('X-Forwarded-Host', res.url);
         return new Response(res.body, {
-            ...res,
+            status: res.status,
+            statusText: res.statusText,
             headers,
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fumadocs-openapi",
-  "version": "9.0.3",
+  "version": "9.0.4",
   "description": "Generate MDX docs for your OpenAPI spec",
   "keywords": [
     "NextJs",