mikser-io 11.4.0 → 11.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io",
-  "version": "11.4.0",
+  "version": "11.6.0",
   "files": [
     "app.js",
     "index.js",

package/src/routes.js

@@ -56,6 +56,23 @@ export function routeLocation(displayPath) {
     return origin ? `${origin}${displayPath}` : displayPath
 }
 
+// The registered route a request path falls inside, or null.
+//
+// Longest prefix wins, so a mount nested under another ('/drive/notes' under
+// '/drive') answers for its own requests rather than its parent's. Exported
+// because the CORS middleware needs the same answer Express will reach, and a
+// second implementation of "which mount is this" would drift from this one.
+export function routeFor(requestPath) {
+    if (!requestPath) return null
+    let best = null
+    for (const route of runtime.routes ?? []) {
+        const base = route.path
+        if (requestPath !== base && !requestPath.startsWith(`${base}/`)) continue
+        if (!best || base.length > best.path.length) best = route
+    }
+    return best
+}
+
 // Declare a mounted route. Records the proxy-relevant descriptor on
 // runtime.routes AND emits the standard mount log.
 //
@@ -70,6 +87,26 @@ export function routeLocation(displayPath) {
 //                 facade must disable buffering for it (Caddy
 //                 flush_interval -1, nginx proxy_buffering off).
 //                 Default false.
+//   cors          `false` to emit no CORS headers for this mount. The
+//                 same word as the global `--no-cors` /
+//                 `config.server.cors: false`, meaning the same thing,
+//                 scoped to one route. Default undefined — inherit the
+//                 global setting.
+//
+//                 For a mount whose clients are not browsers: an OS
+//                 WebDAV redirector, a CLI tool and curl never consult
+//                 CORS, so a header naming who may read the endpoint
+//                 from a web page is a claim with no beneficiary — and
+//                 on an authenticated endpoint it is better made
+//                 deliberately than inherited.
+//   methods       the HTTP verbs this mount actually serves. Two
+//                 consequences, and the second one is load-bearing:
+//                 CORS advertises these for the route instead of a
+//                 fixed five, and listing OPTIONS declares that the
+//                 mount answers OPTIONS ITSELF — so the global
+//                 preflight steps aside rather than terminating it.
+//                 Default null, meaning "ordinary REST verbs, and the
+//                 preflight is CORS's to answer".
 //   label         log prefix. Defaults to `plugin`.
 //   detail        optional already-formatted log suffix, e.g.
 //                 '(ops=[list,subscribe])'.
@@ -99,6 +136,8 @@ export function registerRoute({
     plugin,
     reachability = 'public',
     streaming = false,
+    methods = null,
+    cors,
     label,
     detail,
     displayPath,
@@ -112,7 +151,17 @@ export function registerRoute({
         )
     }
 
+    if (methods != null && (!Array.isArray(methods) || methods.some(m => typeof m !== 'string'))) {
+        throw new Error('registerRoute: `methods` must be an array of verb strings')
+    }
+
+    if (cors !== undefined && cors !== false) {
+        throw new Error('registerRoute: `cors` accepts only false — omit it to inherit the global setting')
+    }
+
     const descriptor = { path, plugin, reachability, streaming }
+    if (methods) descriptor.methods = methods.map(m => m.toUpperCase())
+    if (cors === false) descriptor.cors = false
 
     // Dedup by path — a re-register (same path) replaces rather than
     // duplicates. Mounts happen once per process, but this keeps the

package/src/server.js

@@ -28,6 +28,7 @@ import { createServer } from 'node:net'
 import runtime from './runtime.js'
 import { useLogger } from './engine/index.js'
 import { onInitialized, onLoad, onLoaded } from './lifecycle.js'
+import { routeFor } from './routes.js'
 
 // Every non-loopback IPv4 address this machine answers on.
 //
@@ -217,11 +218,64 @@ export function setupServer() {
             // `origin: false` is how the cors package emits no CORS headers at all, which is
             // what --no-cors / config.server.cors:false asks for.
             if (!configured) return callback(null, { origin: false })
+
+            // The mount this request falls inside, if any. Asked per request
+            // because routes are registered at onLoaded and this middleware
+            // at onLoad — it is mounted before any of them exist, and every
+            // request arrives long after they all do.
+            const route = routeFor(req.path ?? req.url)
+
+            // Does that mount answer OPTIONS itself?
+            //
+            // The cors package defaults to preflightContinue: false, so it
+            // ENDS every OPTIONS in the process — 204, CORS headers, no
+            // next(). For a browser preflight that is exactly right, and it is
+            // what /mcp and /app want: their clients are browsers completing a
+            // Streamable HTTP handshake, which is why the mcp plugin pushes
+            // mcp-session-id into corsAllowHeaders.
+            //
+            // WebDAV is not that. The Microsoft WebDAV redirector decides
+            // whether a URL is a share at all from the `DAV:` header on
+            // OPTIONS — it is DISCOVERY, not a preflight. Answering it here
+            // returned 204 with no DAV header and five REST verbs, so Explorer
+            // reported ERROR_BAD_NET_NAME (0x80070043) and never even asked
+            // for credentials. Every other DAV client works, because Finder,
+            // curl, Cyberduck and gvfs do not gate on that header — so this
+            // read as "WebDAV is broken on Windows" with the mount logged
+            // happily and a 204 that looks like a normal preflight.
+            //
+            // nephele already computes the right answer and had it thrown
+            // away: its OPTIONS builds `DAV: 1, 3, 2` and an Allow list with
+            // PROPFIND, LOCK and the rest.
+            const ownsPreflight = Boolean(route?.methods?.includes('OPTIONS'))
+
+            // A route that wants no CORS headers at all.
+            //
+            // `origin: false` is the cors package's way of emitting none — the
+            // same thing --no-cors asks for globally, scoped to one mount.
+            //
+            // It needs no preflightContinue, and passing one here was dead
+            // code: with a falsy origin the package never builds an
+            // originCallback, so it calls next() and does not touch the
+            // response at all (cors/lib/index.js:210-228). The mount's own
+            // OPTIONS is therefore reached whatever preflightContinue says —
+            // which is why removing it changed no test, and why the comment
+            // that used to claim otherwise was wrong.
+            if (route?.cors === false) {
+                return callback(null, { origin: false })
+            }
+
             callback(null, {
                 origin:         configured === true ? '*' : String(configured),
-                methods:        ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+                // The verbs the mount actually serves, when it said. A fixed
+                // five advertised DELETE on a read-only mount and hid
+                // PROPFIND on a DAV one.
+                methods:        route?.methods ?? ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
                 allowedHeaders: runtime.options.corsAllowHeaders,
                 exposedHeaders: runtime.options.corsExposeHeaders,
+                // Set the CORS headers, then hand the request on to the mount
+                // instead of ending it here.
+                preflightContinue: ownsPreflight,
             })
         }))
     })