maxserver 0.2.4 → 0.2.6

package/bin/watcher.js

@@ -29,7 +29,7 @@ function start() {
 
 function restart() {
 	console.clear();
-	console.log(`devserver restart`);
+	//console.log(`devserver restart`);
 	if (child) child.kill();
 	start();
 }
@@ -41,7 +41,7 @@ fs.watch(".", { recursive: true }, (event, file) => {
 	if (file.startsWith(".")) return;
 	if (!file.endsWith(".js") && !file.endsWith(".json")) return;
 
-	console.log("\nupdated: ", file);
+	//console.log("\nupdated: ", file);
 	restart();
 });
 

package/index.d.ts

@@ -9,7 +9,7 @@ declare global {
 	var global: typeof globalThis;
 
 	/** Casts a string ID to a MongoDB ObjectId using the global helper [cite: 2026-02-15]. */
-	var oid: (id: string) => import("mongodb").ObjectId;
+	var oid: (id?: string) => import("mongodb").ObjectId;
 
 	/** Access to the global MongoDB database instance [cite: 2026-02-15]. */
 	var db: import("mongodb").Db;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "maxserver",
-	"version": "0.2.4",
+	"version": "0.2.6",
 	"description": "Node server setup based fastify",
 	"author": "Max Matinpalo",
 	"type": "module",

package/src/index.js

@@ -15,6 +15,9 @@ import { setupDocs } from "./setupDocs.js";
 import { setupRoutes } from "./setupRoutes.js";
 import { setupDevSounds } from "./devSounds.js";
 
+
+
+
 export default async function maxserver(config = {}) {
 
 
@@ -26,7 +29,7 @@ export default async function maxserver(config = {}) {
 		mongodb = process.env.MONGODB,
 		docs = process.env.DOCS !== "false",
 		cors = process.env.CORS || "*",
-		env = process.env.NODE_ENV || "development",
+		env = process.env.NODE_ENV || "development", // should be removed, define via env only
 		routesDir = process.env.ROUTESDIR || "src",
 		scalar = {},
 		openapiInfo,
@@ -69,7 +72,7 @@ export default async function maxserver(config = {}) {
 		const port = this.maxserver.port ?? 3000;
 		const host = this.maxserver.public ? '0.0.0.0' : '127.0.0.1';
 		await this.listen({ port, host });
-		console.log('Server running at ', getAddress(this));
+		console.log('🟢 ', getAddress(this));
 	});
 
 	await setupDevSounds(app);

package/src/setup.js

@@ -21,16 +21,27 @@ export async function setupHelmet(app) {
 }
 
 
+
 export async function setupCors(app) {
 	const isProd = app.maxserver.env === "production";
-	const origin = app.maxserver.cors ?? "*";
-	if (isProd && origin === "*") {
-		app.log.warn("CORS: allowing all origins (*) in production");
-	}
-	await app.register(cors, { origin });
+	let origin = app.maxserver.cors ?? "*";
+
+	// Fix: Credentials + "*" = Browser Error
+	// If no origin is defined in dev, we should allow the specific requester
+	if (origin === "*" && !isProd)
+		origin = true; // Fastify-cors treats 'true' as "reflect the request origin"
+
+	if (isProd && (origin === "*" || origin === true))
+		app.log.warn("CORS: allowing all origins in production with credentials is risky");
+
+	await app.register(cors, {
+		origin,
+		credentials: true
+	});
 }
 
 
+
 export async function setupCookie(app) {
 	await app.register(cookie, {
 		secret: app.maxserver.secret,