maxserver 0.2.3 → 0.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "maxserver",
-	"version": "0.2.3",
+	"version": "0.2.5",
 	"description": "Node server setup based fastify",
 	"author": "Max Matinpalo",
 	"type": "module",

package/src/setup.js

@@ -21,16 +21,27 @@ export async function setupHelmet(app) {
 }
 
 
+
 export async function setupCors(app) {
 	const isProd = app.maxserver.env === "production";
-	const origin = app.maxserver.cors ?? "*";
-	if (isProd && origin === "*") {
-		app.log.warn("CORS: allowing all origins (*) in production");
-	}
-	await app.register(cors, { origin });
+	let origin = app.maxserver.cors ?? "*";
+
+	// Fix: Credentials + "*" = Browser Error
+	// If no origin is defined in dev, we should allow the specific requester
+	if (origin === "*" && !isProd)
+		origin = true; // Fastify-cors treats 'true' as "reflect the request origin"
+
+	if (isProd && (origin === "*" || origin === true))
+		app.log.warn("CORS: allowing all origins in production with credentials is risky");
+
+	await app.register(cors, {
+		origin,
+		credentials: true
+	});
 }
 
 
+
 export async function setupCookie(app) {
 	await app.register(cookie, {
 		secret: app.maxserver.secret,

package/src/setupDocs.js

@@ -85,6 +85,13 @@ export async function setupDocs(app) {
 					preferredSecurityScheme: 'bearerAuth',
 					apiKey: { token: "" }
 				},
+				customCss: `
+				.darklight-reference a[href*="scalar.com"] {
+							 display: none !important;
+				},
+				.text-sidebar-c-2 {
+					display: none !important;
+				}`,
 				...app.maxserver.scalar
 			}
 		});