naystack 1.5.28 → 1.5.30

package/dist/auth/email/client.cjs.js

@@ -116,11 +116,13 @@ var AuthWrapper = ({
 function useAuthFetch(getRefreshToken) {
   const setToken = useSetToken();
   const fetchToken = async () => {
-    fetch(getEnv("NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */), {
-      credentials: "include",
-      body: getRefreshToken ? JSON.stringify({
-        [REFRESH_COOKIE_NAME]: await getRefreshToken()
-      }) : void 0
+    const url = new URL(getEnv("NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */));
+    if (getRefreshToken) {
+      const token = await getRefreshToken();
+      if (token) url.searchParams.set(REFRESH_COOKIE_NAME, token);
+    }
+    fetch(url, {
+      credentials: "include"
     }).then((res) => res.json()).then((data) => setToken(data.accessToken));
   };
   (0, import_react.useEffect)(() => {

package/dist/auth/email/client.d.mts

@@ -43,7 +43,7 @@ declare const AuthWrapper: ({ children, onTokenUpdate, }: {
     children: React__default.ReactNode;
     onTokenUpdate?: (token: string | null) => void;
 }) => React__default.JSX.Element;
-declare function useAuthFetch(getRefreshToken?: () => Promise<string>): void;
+declare function useAuthFetch(getRefreshToken?: () => Promise<string | null>): void;
 declare function AuthApply({ data }: {
     data?: string | null;
 }): null;

package/dist/auth/email/client.d.ts

@@ -43,7 +43,7 @@ declare const AuthWrapper: ({ children, onTokenUpdate, }: {
     children: React__default.ReactNode;
     onTokenUpdate?: (token: string | null) => void;
 }) => React__default.JSX.Element;
-declare function useAuthFetch(getRefreshToken?: () => Promise<string>): void;
+declare function useAuthFetch(getRefreshToken?: () => Promise<string | null>): void;
 declare function AuthApply({ data }: {
     data?: string | null;
 }): null;

package/dist/auth/email/client.esm.js

@@ -81,11 +81,13 @@ var AuthWrapper = ({
 function useAuthFetch(getRefreshToken) {
   const setToken = useSetToken();
   const fetchToken = async () => {
-    fetch(getEnv("NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */), {
-      credentials: "include",
-      body: getRefreshToken ? JSON.stringify({
-        [REFRESH_COOKIE_NAME]: await getRefreshToken()
-      }) : void 0
+    const url = new URL(getEnv("NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */));
+    if (getRefreshToken) {
+      const token = await getRefreshToken();
+      if (token) url.searchParams.set(REFRESH_COOKIE_NAME, token);
+    }
+    fetch(url, {
+      credentials: "include"
     }).then((res) => res.json()).then((data) => setToken(data.accessToken));
   };
   useEffect(() => {

package/dist/auth/email/index.cjs.js

@@ -38,6 +38,35 @@ __export(email_exports, {
 module.exports = __toCommonJS(email_exports);
 var import_server4 = require("next/server");
 
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+
 // src/auth/email/token.ts
 var import_bcryptjs = require("bcryptjs");
 var import_jsonwebtoken = require("jsonwebtoken");
@@ -242,10 +271,8 @@ var getDeleteRoute = (options) => async (req) => {
 
 // src/auth/email/routes/get.ts
 var getGetRoute = (options) => async (req) => {
-  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value;
-  const requestBody = refresh ? null : await req.json();
-  const bodyRefresh = requestBody?.[REFRESH_COOKIE_NAME];
-  const userID = getUserIdFromRefreshToken(refresh || bodyRefresh);
+  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value || req.nextUrl.searchParams.get(REFRESH_COOKIE_NAME) || void 0;
+  const userID = getUserIdFromRefreshToken(refresh);
   if (userID) {
     if (options.onRefresh) {
       const body = await req.json();
@@ -369,33 +396,6 @@ function AuthFetch() {
 }
 
 // src/auth/email/index.ts
-function getCorsHeaders(origin, allowedOrigins) {
-  if (!origin || !allowedOrigins.includes(origin)) return null;
-  return {
-    "Access-Control-Allow-Origin": origin,
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
-    "Access-Control-Allow-Credentials": "true"
-  };
-}
-function withCors(handler, allowedOrigins) {
-  if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
-    });
-  });
-}
 function getEmailAuthRoutes(options) {
   const { allowedOrigins } = options;
   return {

package/dist/auth/email/index.esm.js

@@ -1,6 +1,35 @@
 // src/auth/email/index.ts
 import { NextResponse as NextResponse3 } from "next/server";
 
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+
 // src/auth/email/token.ts
 import { compare } from "bcryptjs";
 import { JsonWebTokenError, sign, verify } from "jsonwebtoken";
@@ -205,10 +234,8 @@ var getDeleteRoute = (options) => async (req) => {
 
 // src/auth/email/routes/get.ts
 var getGetRoute = (options) => async (req) => {
-  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value;
-  const requestBody = refresh ? null : await req.json();
-  const bodyRefresh = requestBody?.[REFRESH_COOKIE_NAME];
-  const userID = getUserIdFromRefreshToken(refresh || bodyRefresh);
+  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value || req.nextUrl.searchParams.get(REFRESH_COOKIE_NAME) || void 0;
+  const userID = getUserIdFromRefreshToken(refresh);
   if (userID) {
     if (options.onRefresh) {
       const body = await req.json();
@@ -336,33 +363,6 @@ function AuthFetch() {
 }
 
 // src/auth/email/index.ts
-function getCorsHeaders(origin, allowedOrigins) {
-  if (!origin || !allowedOrigins.includes(origin)) return null;
-  return {
-    "Access-Control-Allow-Origin": origin,
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
-    "Access-Control-Allow-Credentials": "true"
-  };
-}
-function withCors(handler, allowedOrigins) {
-  if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
-    });
-  });
-}
 function getEmailAuthRoutes(options) {
   const { allowedOrigins } = options;
   return {

package/dist/auth/email/routes/get.cjs.js

@@ -123,10 +123,8 @@ function getUserIdFromRefreshToken(refreshToken) {
 
 // src/auth/email/routes/get.ts
 var getGetRoute = (options) => async (req) => {
-  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value;
-  const requestBody = refresh ? null : await req.json();
-  const bodyRefresh = requestBody?.[REFRESH_COOKIE_NAME];
-  const userID = getUserIdFromRefreshToken(refresh || bodyRefresh);
+  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value || req.nextUrl.searchParams.get(REFRESH_COOKIE_NAME) || void 0;
+  const userID = getUserIdFromRefreshToken(refresh);
   if (userID) {
     if (options.onRefresh) {
       const body = await req.json();

package/dist/auth/email/routes/get.esm.js

@@ -97,10 +97,8 @@ function getUserIdFromRefreshToken(refreshToken) {
 
 // src/auth/email/routes/get.ts
 var getGetRoute = (options) => async (req) => {
-  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value;
-  const requestBody = refresh ? null : await req.json();
-  const bodyRefresh = requestBody?.[REFRESH_COOKIE_NAME];
-  const userID = getUserIdFromRefreshToken(refresh || bodyRefresh);
+  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value || req.nextUrl.searchParams.get(REFRESH_COOKIE_NAME) || void 0;
+  const userID = getUserIdFromRefreshToken(refresh);
   if (userID) {
     if (options.onRefresh) {
       const body = await req.json();

package/dist/auth/index.cjs.js

@@ -44,6 +44,35 @@ module.exports = __toCommonJS(auth_exports);
 // src/auth/email/index.ts
 var import_server4 = require("next/server");
 
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+
 // src/auth/email/token.ts
 var import_bcryptjs = require("bcryptjs");
 var import_jsonwebtoken = require("jsonwebtoken");
@@ -260,10 +289,8 @@ var getDeleteRoute = (options) => async (req) => {
 
 // src/auth/email/routes/get.ts
 var getGetRoute = (options) => async (req) => {
-  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value;
-  const requestBody = refresh ? null : await req.json();
-  const bodyRefresh = requestBody?.[REFRESH_COOKIE_NAME];
-  const userID = getUserIdFromRefreshToken(refresh || bodyRefresh);
+  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value || req.nextUrl.searchParams.get(REFRESH_COOKIE_NAME) || void 0;
+  const userID = getUserIdFromRefreshToken(refresh);
   if (userID) {
     if (options.onRefresh) {
       const body = await req.json();
@@ -387,33 +414,6 @@ function AuthFetch() {
 }
 
 // src/auth/email/index.ts
-function getCorsHeaders(origin, allowedOrigins) {
-  if (!origin || !allowedOrigins.includes(origin)) return null;
-  return {
-    "Access-Control-Allow-Origin": origin,
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
-    "Access-Control-Allow-Credentials": "true"
-  };
-}
-function withCors(handler, allowedOrigins) {
-  if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
-    });
-  });
-}
 function getEmailAuthRoutes(options) {
   const { allowedOrigins } = options;
   return {

package/dist/auth/index.esm.js

@@ -1,6 +1,35 @@
 // src/auth/email/index.ts
 import { NextResponse as NextResponse3 } from "next/server";
 
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+
 // src/auth/email/token.ts
 import { compare } from "bcryptjs";
 import { JsonWebTokenError, sign, verify } from "jsonwebtoken";
@@ -217,10 +246,8 @@ var getDeleteRoute = (options) => async (req) => {
 
 // src/auth/email/routes/get.ts
 var getGetRoute = (options) => async (req) => {
-  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value;
-  const requestBody = refresh ? null : await req.json();
-  const bodyRefresh = requestBody?.[REFRESH_COOKIE_NAME];
-  const userID = getUserIdFromRefreshToken(refresh || bodyRefresh);
+  const refresh = req.cookies.get(REFRESH_COOKIE_NAME)?.value || req.nextUrl.searchParams.get(REFRESH_COOKIE_NAME) || void 0;
+  const userID = getUserIdFromRefreshToken(refresh);
   if (userID) {
     if (options.onRefresh) {
       const body = await req.json();
@@ -348,33 +375,6 @@ function AuthFetch() {
 }
 
 // src/auth/email/index.ts
-function getCorsHeaders(origin, allowedOrigins) {
-  if (!origin || !allowedOrigins.includes(origin)) return null;
-  return {
-    "Access-Control-Allow-Origin": origin,
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
-    "Access-Control-Allow-Credentials": "true"
-  };
-}
-function withCors(handler, allowedOrigins) {
-  if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
-    });
-  });
-}
 function getEmailAuthRoutes(options) {
   const { allowedOrigins } = options;
   return {

package/dist/graphql/index.cjs.js

@@ -625,6 +625,35 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+
 // src/auth/email/utils.ts
 var import_jsonwebtoken2 = require("jsonwebtoken");
 
@@ -683,7 +712,8 @@ async function initGraphQLServer({
   authChecker,
   resolvers,
   plugins,
-  getContext: overrideGetContext
+  getContext: overrideGetContext,
+  allowedOrigins
 }) {
   const { typeDefs, resolvers: builtResolvers } = await (0, import_type_graphql.buildTypeDefsAndResolvers)({
     validate: true,
@@ -710,8 +740,8 @@ async function initGraphQLServer({
     context: overrideGetContext || getContext
   });
   return {
-    GET: (request) => handler(request),
-    POST: (request) => handler(request)
+    GET: withCors((request) => handler(request), allowedOrigins),
+    POST: withCors((request) => handler(request), allowedOrigins)
   };
 }
 

package/dist/graphql/index.esm.js

@@ -612,6 +612,35 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+
 // src/auth/email/utils.ts
 import { verify as verify2 } from "jsonwebtoken";
 
@@ -670,7 +699,8 @@ async function initGraphQLServer({
   authChecker,
   resolvers,
   plugins,
-  getContext: overrideGetContext
+  getContext: overrideGetContext,
+  allowedOrigins
 }) {
   const { typeDefs, resolvers: builtResolvers } = await buildTypeDefsAndResolvers({
     validate: true,
@@ -697,8 +727,8 @@ async function initGraphQLServer({
     context: overrideGetContext || getContext
   });
   return {
-    GET: (request) => handler(request),
-    POST: (request) => handler(request)
+    GET: withCors((request) => handler(request), allowedOrigins),
+    POST: withCors((request) => handler(request), allowedOrigins)
   };
 }
 

package/dist/graphql/init.cjs.js

@@ -78,6 +78,35 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+
 // src/auth/email/utils.ts
 var import_jsonwebtoken2 = require("jsonwebtoken");
 
@@ -136,7 +165,8 @@ async function initGraphQLServer({
   authChecker,
   resolvers,
   plugins,
-  getContext: overrideGetContext
+  getContext: overrideGetContext,
+  allowedOrigins
 }) {
   const { typeDefs, resolvers: builtResolvers } = await (0, import_type_graphql.buildTypeDefsAndResolvers)({
     validate: true,
@@ -163,8 +193,8 @@ async function initGraphQLServer({
     context: overrideGetContext || getContext
   });
   return {
-    GET: (request) => handler(request),
-    POST: (request) => handler(request)
+    GET: withCors((request) => handler(request), allowedOrigins),
+    POST: withCors((request) => handler(request), allowedOrigins)
   };
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/graphql/init.d.mts

@@ -35,11 +35,12 @@ import { AuthChecker, NonEmptyArray } from 'type-graphql';
  *
  * @category GraphQL
  */
-declare function initGraphQLServer({ authChecker, resolvers, plugins, getContext: overrideGetContext, }: {
+declare function initGraphQLServer({ authChecker, resolvers, plugins, getContext: overrideGetContext, allowedOrigins, }: {
     authChecker?: AuthChecker<any>;
     resolvers: NonEmptyArray<Function>;
     plugins?: ApolloServerPlugin[];
     getContext?: (req: NextRequest) => Promise<any> | any;
+    allowedOrigins?: string[];
 }): Promise<{
     GET: (request: NextRequest) => Promise<Response>;
     POST: (request: NextRequest) => Promise<Response>;

package/dist/graphql/init.d.ts

@@ -35,11 +35,12 @@ import { AuthChecker, NonEmptyArray } from 'type-graphql';
  *
  * @category GraphQL
  */
-declare function initGraphQLServer({ authChecker, resolvers, plugins, getContext: overrideGetContext, }: {
+declare function initGraphQLServer({ authChecker, resolvers, plugins, getContext: overrideGetContext, allowedOrigins, }: {
     authChecker?: AuthChecker<any>;
     resolvers: NonEmptyArray<Function>;
     plugins?: ApolloServerPlugin[];
     getContext?: (req: NextRequest) => Promise<any> | any;
+    allowedOrigins?: string[];
 }): Promise<{
     GET: (request: NextRequest) => Promise<Response>;
     POST: (request: NextRequest) => Promise<Response>;

package/dist/graphql/init.esm.js

@@ -59,6 +59,35 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+
 // src/auth/email/utils.ts
 import { verify as verify2 } from "jsonwebtoken";
 
@@ -117,7 +146,8 @@ async function initGraphQLServer({
   authChecker,
   resolvers,
   plugins,
-  getContext: overrideGetContext
+  getContext: overrideGetContext,
+  allowedOrigins
 }) {
   const { typeDefs, resolvers: builtResolvers } = await buildTypeDefsAndResolvers({
     validate: true,
@@ -144,8 +174,8 @@ async function initGraphQLServer({
     context: overrideGetContext || getContext
   });
   return {
-    GET: (request) => handler(request),
-    POST: (request) => handler(request)
+    GET: withCors((request) => handler(request), allowedOrigins),
+    POST: withCors((request) => handler(request), allowedOrigins)
   };
 }
 export {

package/dist/utils/route.cjs.js

@@ -0,0 +1,58 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/utils/route.ts
+var route_exports = {};
+__export(route_exports, {
+  getCorsHeaders: () => getCorsHeaders,
+  withCors: () => withCors
+});
+module.exports = __toCommonJS(route_exports);
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getCorsHeaders,
+  withCors
+});

package/dist/utils/route.d.mts

@@ -0,0 +1,11 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+declare function getCorsHeaders(origin: string | null, allowedOrigins: string[]): {
+    "Access-Control-Allow-Origin": string;
+    "Access-Control-Allow-Methods": string;
+    "Access-Control-Allow-Headers": string;
+    "Access-Control-Allow-Credentials": string;
+} | null;
+declare function withCors<T extends (req: NextRequest) => Promise<NextResponse | Response | undefined>>(handler: T, allowedOrigins?: string[]): T;
+
+export { getCorsHeaders, withCors };

package/dist/utils/route.d.ts

@@ -0,0 +1,11 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+declare function getCorsHeaders(origin: string | null, allowedOrigins: string[]): {
+    "Access-Control-Allow-Origin": string;
+    "Access-Control-Allow-Methods": string;
+    "Access-Control-Allow-Headers": string;
+    "Access-Control-Allow-Credentials": string;
+} | null;
+declare function withCors<T extends (req: NextRequest) => Promise<NextResponse | Response | undefined>>(handler: T, allowedOrigins?: string[]): T;
+
+export { getCorsHeaders, withCors };

package/dist/utils/route.esm.js

@@ -0,0 +1,32 @@
+// src/utils/route.ts
+function getCorsHeaders(origin, allowedOrigins) {
+  if (!origin || !allowedOrigins.includes(origin)) return null;
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+function withCors(handler, allowedOrigins) {
+  if (!allowedOrigins?.length) return handler;
+  return ((req) => {
+    return handler(req).then((response) => {
+      if (!response) return response;
+      const corsHeaders = getCorsHeaders(
+        req.headers.get("origin"),
+        allowedOrigins
+      );
+      if (corsHeaders) {
+        Object.entries(corsHeaders).forEach(([key, value]) => {
+          response.headers.set(key, value);
+        });
+      }
+      return response;
+    });
+  });
+}
+export {
+  getCorsHeaders,
+  withCors
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naystack",
-  "version": "1.5.28",
+  "version": "1.5.30",
   "description": "A stack built with Next + GraphQL + S3 + Auth",
   "main": "dist/index.cjs.js",
   "module": "dist/index.esm.js",