mikser-io 11.5.0 → 11.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io",
-  "version": "11.5.0",
+  "version": "11.7.0",
   "files": [
     "app.js",
     "index.js",

package/src/routes.js

@@ -50,7 +50,12 @@ const DEFAULT_AUTH_LABEL = {
 // an origin is known — public --url / config.url wins (clickable,
 // shareable), localhost:port is the dev fallback — bare path when the
 // engine doesn't own a listener (external-app embedding, no url set).
-export function routeLocation(displayPath) {
+export function routeLocation(displayPath, host) {
+    // A host-scoped route HAS an origin, and it is not this server's. Printing
+    // `http://localhost:3001//drive.example.com/` names a place nothing
+    // answers. Protocol-relative because the scheme belongs to whatever
+    // terminates TLS in front, which this process does not know.
+    if (host) return `//${host}${displayPath === '/' ? '/' : displayPath}`
     const origin = runtime.options.url
         ?? (runtime.options.port ? `http://localhost:${runtime.options.port}` : null)
     return origin ? `${origin}${displayPath}` : displayPath
@@ -62,12 +67,21 @@ export function routeLocation(displayPath) {
 // '/drive') answers for its own requests rather than its parent's. Exported
 // because the CORS middleware needs the same answer Express will reach, and a
 // second implementation of "which mount is this" would drift from this one.
-export function routeFor(requestPath) {
+export function routeFor(requestPath, host) {
     if (!requestPath) return null
     let best = null
     for (const route of runtime.routes ?? []) {
+        // A host-scoped route answers for its own domain and no other.
+        if (route.host && route.host !== host) continue
         const base = route.path
-        if (requestPath !== base && !requestPath.startsWith(`${base}/`)) continue
+        // A host-scoped route mounted at `/` owns every path on that host —
+        // it IS the server there. Prefix matching cannot express that, since
+        // nothing starts with `//`. An unscoped route at `/` is left alone:
+        // it would otherwise swallow the whole site.
+        const owns = base === '/' && route.host
+            ? true
+            : requestPath === base || requestPath.startsWith(`${base}/`)
+        if (!owns) continue
         if (!best || base.length > best.path.length) best = route
     }
     return best
@@ -87,6 +101,22 @@ export function routeFor(requestPath) {
 //                 facade must disable buffering for it (Caddy
 //                 flush_interval -1, nginx proxy_buffering off).
 //                 Default false.
+//   host          when set, the mount answers only for this Host. Used
+//                 by a route that takes a domain of its own — a WebDAV
+//                 share at `/` on `drive.example.com`, say, which would
+//                 otherwise shadow every page on the site.
+//   cors          `false` to emit no CORS headers for this mount. The
+//                 same word as the global `--no-cors` /
+//                 `config.server.cors: false`, meaning the same thing,
+//                 scoped to one route. Default undefined — inherit the
+//                 global setting.
+//
+//                 For a mount whose clients are not browsers: an OS
+//                 WebDAV redirector, a CLI tool and curl never consult
+//                 CORS, so a header naming who may read the endpoint
+//                 from a web page is a claim with no beneficiary — and
+//                 on an authenticated endpoint it is better made
+//                 deliberately than inherited.
 //   methods       the HTTP verbs this mount actually serves. Two
 //                 consequences, and the second one is load-bearing:
 //                 CORS advertises these for the route instead of a
@@ -125,6 +155,8 @@ export function registerRoute({
     reachability = 'public',
     streaming = false,
     methods = null,
+    cors,
+    host,
     label,
     detail,
     displayPath,
@@ -142,8 +174,14 @@ export function registerRoute({
         throw new Error('registerRoute: `methods` must be an array of verb strings')
     }
 
+    if (cors !== undefined && cors !== false) {
+        throw new Error('registerRoute: `cors` accepts only false — omit it to inherit the global setting')
+    }
+
     const descriptor = { path, plugin, reachability, streaming }
     if (methods) descriptor.methods = methods.map(m => m.toUpperCase())
+    if (cors === false) descriptor.cors = false
+    if (host) descriptor.host = host
 
     // Dedup by path — a re-register (same path) replaces rather than
     // duplicates. Mounts happen once per process, but this keeps the
@@ -154,7 +192,7 @@ export function registerRoute({
 
     const logger = useLogger()
     if (logger) {
-        const location = routeLocation(displayPath ?? path)
+        const location = routeLocation(displayPath ?? path, host)
         const bracket  = authLabel ?? DEFAULT_AUTH_LABEL[reachability]
         logger.info('%s mounted: %s [%s]%s',
             label ?? plugin, location, bracket, detail ? ` ${detail}` : '')

package/src/server.js

@@ -223,7 +223,7 @@ export function setupServer() {
             // because routes are registered at onLoaded and this middleware
             // at onLoad — it is mounted before any of them exist, and every
             // request arrives long after they all do.
-            const route = routeFor(req.path ?? req.url)
+            const route = routeFor(req.path ?? req.url, req.hostname)
 
             // Does that mount answer OPTIONS itself?
             //
@@ -249,6 +249,52 @@ export function setupServer() {
             // PROPFIND, LOCK and the rest.
             const ownsPreflight = Boolean(route?.methods?.includes('OPTIONS'))
 
+            // A bare OPTIONS is not a preflight, and must not be answered as
+            // one.
+            //
+            // A CORS preflight is defined by its headers: the browser sends
+            // `Access-Control-Request-Method`, and without it the request is
+            // something else entirely. This middleware used to answer ALL of
+            // them — so every path on the site, routed or not, replied 204 to
+            // any OPTIONS with a list of five REST verbs and no `DAV:` header.
+            //
+            // That is a manufactured "I exist and I am not WebDAV", and it is
+            // a stronger negative than the 404 a static path would otherwise
+            // give. The Microsoft WebDAV redirector establishes a session by
+            // walking up from the path it was given, and on a mikser site
+            // every level of that walk answered no — including `/` and
+            // `/drive`, neither of which is anything. Deployments that DO map
+            // on Windows (Nextcloud at /remote.php/dav, SharePoint) sit behind
+            // hosts that simply have nothing to say at those paths.
+            //
+            // Falling through costs nothing a browser wanted: a real preflight
+            // still carries the header and is still answered below, and a
+            // non-preflight OPTIONS now reaches whatever owns the path — the
+            // mount's own discovery response, or the static handler's 404.
+            //
+            // `origin: false` is how the package steps aside: with a falsy
+            // origin it never builds an originCallback, so it calls next()
+            // without touching the response (cors/lib/index.js:210-228).
+            if (req.method === 'OPTIONS' && !req.headers['access-control-request-method']) {
+                return callback(null, { origin: false })
+            }
+
+            // A route that wants no CORS headers at all.
+            //
+            // `origin: false` is the cors package's way of emitting none — the
+            // same thing --no-cors asks for globally, scoped to one mount.
+            //
+            // It needs no preflightContinue, and passing one here was dead
+            // code: with a falsy origin the package never builds an
+            // originCallback, so it calls next() and does not touch the
+            // response at all (cors/lib/index.js:210-228). The mount's own
+            // OPTIONS is therefore reached whatever preflightContinue says —
+            // which is why removing it changed no test, and why the comment
+            // that used to claim otherwise was wrong.
+            if (route?.cors === false) {
+                return callback(null, { origin: false })
+            }
+
             callback(null, {
                 origin:         configured === true ? '*' : String(configured),
                 // The verbs the mount actually serves, when it said. A fixed