naystack 1.5.32 → 1.5.34

package/dist/auth/email/index.cjs.js

@@ -36,7 +36,10 @@ __export(email_exports, {
   getEmailAuthRoutes: () => getEmailAuthRoutes
 });
 module.exports = __toCommonJS(email_exports);
-var import_server4 = require("next/server");
+var import_server5 = require("next/server");
+
+// src/utils/route.ts
+var import_server = require("next/server");
 
 // src/auth/constants.ts
 var REFRESH_COOKIE_NAME = "refresh";
@@ -54,20 +57,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new import_server.NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 
@@ -76,7 +77,7 @@ var import_bcryptjs = require("bcryptjs");
 var import_jsonwebtoken = require("jsonwebtoken");
 var import_headers = require("next/headers");
 var import_navigation = require("next/navigation");
-var import_server = require("next/server");
+var import_server2 = require("next/server");
 
 // src/env.ts
 var getEnvValue = (key) => {
@@ -138,7 +139,7 @@ function generateRefreshToken(id, refreshKey) {
 }
 function getTokenizedResponse(accessToken, refreshToken) {
   const body = { accessToken, refreshToken };
-  const response = import_server.NextResponse.json(body, {
+  const response = import_server2.NextResponse.json(body, {
     status: 200
   });
   if (!accessToken) {
@@ -185,11 +186,11 @@ async function checkAuthStatus(redirectUnauthorizedURL) {
 var import_jsonwebtoken2 = require("jsonwebtoken");
 
 // src/auth/utils/errors.ts
-var import_server2 = require("next/server");
+var import_server3 = require("next/server");
 function handleError(status, message, onError) {
   const res = onError?.({ status, message });
   if (res) return res;
-  return new import_server2.NextResponse(message, { status });
+  return new import_server3.NextResponse(message, { status });
 }
 
 // src/auth/email/utils.ts
@@ -410,7 +411,7 @@ function getEmailAuthRoutes(options) {
           req.headers.get("origin"),
           allowedOrigins
         );
-        return new import_server4.NextResponse(null, {
+        return new import_server5.NextResponse(null, {
           status: 204,
           headers: corsHeaders ?? void 0
         });

package/dist/auth/email/index.esm.js

@@ -1,5 +1,8 @@
 // src/auth/email/index.ts
-import { NextResponse as NextResponse3 } from "next/server";
+import { NextResponse as NextResponse4 } from "next/server";
+
+// src/utils/route.ts
+import { NextResponse } from "next/server";
 
 // src/auth/constants.ts
 var REFRESH_COOKIE_NAME = "refresh";
@@ -17,20 +20,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 
@@ -39,7 +40,7 @@ import { compare } from "bcryptjs";
 import { JsonWebTokenError, sign, verify } from "jsonwebtoken";
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
-import { NextResponse } from "next/server";
+import { NextResponse as NextResponse2 } from "next/server";
 
 // src/env.ts
 var getEnvValue = (key) => {
@@ -101,7 +102,7 @@ function generateRefreshToken(id, refreshKey) {
 }
 function getTokenizedResponse(accessToken, refreshToken) {
   const body = { accessToken, refreshToken };
-  const response = NextResponse.json(body, {
+  const response = NextResponse2.json(body, {
     status: 200
   });
   if (!accessToken) {
@@ -148,11 +149,11 @@ async function checkAuthStatus(redirectUnauthorizedURL) {
 import { verify as verify2 } from "jsonwebtoken";
 
 // src/auth/utils/errors.ts
-import { NextResponse as NextResponse2 } from "next/server";
+import { NextResponse as NextResponse3 } from "next/server";
 function handleError(status, message, onError) {
   const res = onError?.({ status, message });
   if (res) return res;
-  return new NextResponse2(message, { status });
+  return new NextResponse3(message, { status });
 }
 
 // src/auth/email/utils.ts
@@ -377,7 +378,7 @@ function getEmailAuthRoutes(options) {
           req.headers.get("origin"),
           allowedOrigins
         );
-        return new NextResponse3(null, {
+        return new NextResponse4(null, {
           status: 204,
           headers: corsHeaders ?? void 0
         });

package/dist/auth/index.cjs.js

@@ -42,7 +42,10 @@ __export(auth_exports, {
 module.exports = __toCommonJS(auth_exports);
 
 // src/auth/email/index.ts
-var import_server4 = require("next/server");
+var import_server5 = require("next/server");
+
+// src/utils/route.ts
+var import_server = require("next/server");
 
 // src/auth/constants.ts
 var REFRESH_COOKIE_NAME = "refresh";
@@ -60,20 +63,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new import_server.NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 
@@ -82,7 +83,7 @@ var import_bcryptjs = require("bcryptjs");
 var import_jsonwebtoken = require("jsonwebtoken");
 var import_headers = require("next/headers");
 var import_navigation = require("next/navigation");
-var import_server = require("next/server");
+var import_server2 = require("next/server");
 
 // src/env.ts
 var getEnvValue = (key) => {
@@ -144,7 +145,7 @@ function generateRefreshToken(id, refreshKey) {
 }
 function getTokenizedResponse(accessToken, refreshToken) {
   const body = { accessToken, refreshToken };
-  const response = import_server.NextResponse.json(body, {
+  const response = import_server2.NextResponse.json(body, {
     status: 200
   });
   if (!accessToken) {
@@ -203,11 +204,11 @@ async function checkAuthStatus(redirectUnauthorizedURL) {
 var import_jsonwebtoken2 = require("jsonwebtoken");
 
 // src/auth/utils/errors.ts
-var import_server2 = require("next/server");
+var import_server3 = require("next/server");
 function handleError(status, message, onError) {
   const res = onError?.({ status, message });
   if (res) return res;
-  return new import_server2.NextResponse(message, { status });
+  return new import_server3.NextResponse(message, { status });
 }
 
 // src/auth/email/utils.ts
@@ -428,7 +429,7 @@ function getEmailAuthRoutes(options) {
           req.headers.get("origin"),
           allowedOrigins
         );
-        return new import_server4.NextResponse(null, {
+        return new import_server5.NextResponse(null, {
           status: 204,
           headers: corsHeaders ?? void 0
         });
@@ -439,7 +440,7 @@ function getEmailAuthRoutes(options) {
 
 // src/auth/google/get.ts
 var import_googleapis = require("googleapis");
-var import_server6 = require("next/server");
+var import_server7 = require("next/server");
 var import_uuid = require("uuid");
 var getGoogleGetRoute = ({
   getUserIdFromEmail,
@@ -469,7 +470,7 @@ var getGoogleGetRoute = ({
         prompt: "consent",
         redirect_uri: url
       });
-      const res = import_server6.NextResponse.redirect(authorizationUrl);
+      const res = import_server7.NextResponse.redirect(authorizationUrl);
       res.cookies.set("state", state2, {
         httpOnly: true,
         secure: true
@@ -478,12 +479,12 @@ var getGoogleGetRoute = ({
     }
     const errorURL = errorRedirectURL || redirectURL;
     if (error) {
-      return import_server6.NextResponse.redirect(errorURL);
+      return import_server7.NextResponse.redirect(errorURL);
     }
     const state = req.nextUrl.searchParams.get("state") || void 0;
     if (code && state) {
       const localState = req.cookies.get("state")?.value;
-      if (localState !== state) return import_server6.NextResponse.redirect(errorURL);
+      if (localState !== state) return import_server7.NextResponse.redirect(errorURL);
       const { tokens } = await oauth2Client.getToken(code);
       oauth2Client.setCredentials(tokens);
       const userInfoRequest = await import_googleapis.google.oauth2({
@@ -495,7 +496,7 @@ var getGoogleGetRoute = ({
         const { data } = JSON.parse(localState);
         const id = await getUserIdFromEmail(user, data);
         if (id) {
-          const res = import_server6.NextResponse.redirect(redirectURL);
+          const res = import_server7.NextResponse.redirect(redirectURL);
           res.cookies.set(
             REFRESH_COOKIE_NAME,
             generateRefreshToken(id, getEnv("REFRESH_KEY" /* REFRESH_KEY */)),
@@ -513,7 +514,7 @@ var getGoogleGetRoute = ({
         }
       }
     }
-    return import_server6.NextResponse.redirect(errorURL);
+    return import_server7.NextResponse.redirect(errorURL);
   };
 };
 
@@ -525,7 +526,7 @@ function initGoogleAuth(props) {
 }
 
 // src/auth/instagram/route.ts
-var import_server8 = require("next/server");
+var import_server9 = require("next/server");
 
 // src/auth/instagram/utils.ts
 async function getRefreshedInstagramAccessToken(token) {
@@ -587,7 +588,7 @@ var getInstagramUser = (token, id, fields) => {
 };
 
 // src/socials/meta-webhook.ts
-var import_server7 = require("next/server");
+var import_server8 = require("next/server");
 
 // src/auth/instagram/route.ts
 var getInstagramRoute = ({
@@ -595,7 +596,7 @@ var getInstagramRoute = ({
   errorRedirectURL,
   onUser
 }) => {
-  const handleError2 = (message) => import_server8.NextResponse.redirect(`${errorRedirectURL}?error=${message}`);
+  const handleError2 = (message) => import_server9.NextResponse.redirect(`${errorRedirectURL}?error=${message}`);
   return async (req) => {
     const accessCode = req.nextUrl.searchParams.get("code");
     const error = req.nextUrl.searchParams.get("error");
@@ -619,7 +620,7 @@ var getInstagramRoute = ({
       instagramData.accessToken
     );
     if (errorMessage) return handleError2(errorMessage);
-    return import_server8.NextResponse.redirect(redirectURL);
+    return import_server9.NextResponse.redirect(redirectURL);
   };
 };
 

package/dist/auth/index.esm.js

@@ -1,5 +1,8 @@
 // src/auth/email/index.ts
-import { NextResponse as NextResponse3 } from "next/server";
+import { NextResponse as NextResponse4 } from "next/server";
+
+// src/utils/route.ts
+import { NextResponse } from "next/server";
 
 // src/auth/constants.ts
 var REFRESH_COOKIE_NAME = "refresh";
@@ -17,20 +20,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 
@@ -39,7 +40,7 @@ import { compare } from "bcryptjs";
 import { JsonWebTokenError, sign, verify } from "jsonwebtoken";
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
-import { NextResponse } from "next/server";
+import { NextResponse as NextResponse2 } from "next/server";
 
 // src/env.ts
 var getEnvValue = (key) => {
@@ -101,7 +102,7 @@ function generateRefreshToken(id, refreshKey) {
 }
 function getTokenizedResponse(accessToken, refreshToken) {
   const body = { accessToken, refreshToken };
-  const response = NextResponse.json(body, {
+  const response = NextResponse2.json(body, {
     status: 200
   });
   if (!accessToken) {
@@ -160,11 +161,11 @@ async function checkAuthStatus(redirectUnauthorizedURL) {
 import { verify as verify2 } from "jsonwebtoken";
 
 // src/auth/utils/errors.ts
-import { NextResponse as NextResponse2 } from "next/server";
+import { NextResponse as NextResponse3 } from "next/server";
 function handleError(status, message, onError) {
   const res = onError?.({ status, message });
   if (res) return res;
-  return new NextResponse2(message, { status });
+  return new NextResponse3(message, { status });
 }
 
 // src/auth/email/utils.ts
@@ -389,7 +390,7 @@ function getEmailAuthRoutes(options) {
           req.headers.get("origin"),
           allowedOrigins
         );
-        return new NextResponse3(null, {
+        return new NextResponse4(null, {
           status: 204,
           headers: corsHeaders ?? void 0
         });
@@ -400,7 +401,7 @@ function getEmailAuthRoutes(options) {
 
 // src/auth/google/get.ts
 import { google } from "googleapis";
-import { NextResponse as NextResponse4 } from "next/server";
+import { NextResponse as NextResponse5 } from "next/server";
 import { v4 } from "uuid";
 var getGoogleGetRoute = ({
   getUserIdFromEmail,
@@ -430,7 +431,7 @@ var getGoogleGetRoute = ({
         prompt: "consent",
         redirect_uri: url
       });
-      const res = NextResponse4.redirect(authorizationUrl);
+      const res = NextResponse5.redirect(authorizationUrl);
       res.cookies.set("state", state2, {
         httpOnly: true,
         secure: true
@@ -439,12 +440,12 @@ var getGoogleGetRoute = ({
     }
     const errorURL = errorRedirectURL || redirectURL;
     if (error) {
-      return NextResponse4.redirect(errorURL);
+      return NextResponse5.redirect(errorURL);
     }
     const state = req.nextUrl.searchParams.get("state") || void 0;
     if (code && state) {
       const localState = req.cookies.get("state")?.value;
-      if (localState !== state) return NextResponse4.redirect(errorURL);
+      if (localState !== state) return NextResponse5.redirect(errorURL);
       const { tokens } = await oauth2Client.getToken(code);
       oauth2Client.setCredentials(tokens);
       const userInfoRequest = await google.oauth2({
@@ -456,7 +457,7 @@ var getGoogleGetRoute = ({
         const { data } = JSON.parse(localState);
         const id = await getUserIdFromEmail(user, data);
         if (id) {
-          const res = NextResponse4.redirect(redirectURL);
+          const res = NextResponse5.redirect(redirectURL);
           res.cookies.set(
             REFRESH_COOKIE_NAME,
             generateRefreshToken(id, getEnv("REFRESH_KEY" /* REFRESH_KEY */)),
@@ -474,7 +475,7 @@ var getGoogleGetRoute = ({
         }
       }
     }
-    return NextResponse4.redirect(errorURL);
+    return NextResponse5.redirect(errorURL);
   };
 };
 
@@ -486,7 +487,7 @@ function initGoogleAuth(props) {
 }
 
 // src/auth/instagram/route.ts
-import { NextResponse as NextResponse6 } from "next/server";
+import { NextResponse as NextResponse7 } from "next/server";
 
 // src/auth/instagram/utils.ts
 async function getRefreshedInstagramAccessToken(token) {
@@ -548,7 +549,7 @@ var getInstagramUser = (token, id, fields) => {
 };
 
 // src/socials/meta-webhook.ts
-import { NextResponse as NextResponse5 } from "next/server";
+import { NextResponse as NextResponse6 } from "next/server";
 
 // src/auth/instagram/route.ts
 var getInstagramRoute = ({
@@ -556,7 +557,7 @@ var getInstagramRoute = ({
   errorRedirectURL,
   onUser
 }) => {
-  const handleError2 = (message) => NextResponse6.redirect(`${errorRedirectURL}?error=${message}`);
+  const handleError2 = (message) => NextResponse7.redirect(`${errorRedirectURL}?error=${message}`);
   return async (req) => {
     const accessCode = req.nextUrl.searchParams.get("code");
     const error = req.nextUrl.searchParams.get("error");
@@ -580,7 +581,7 @@ var getInstagramRoute = ({
       instagramData.accessToken
     );
     if (errorMessage) return handleError2(errorMessage);
-    return NextResponse6.redirect(redirectURL);
+    return NextResponse7.redirect(redirectURL);
   };
 };
 

package/dist/graphql/index.cjs.js

@@ -571,10 +571,10 @@ function GQLError(status, message) {
 
 // src/graphql/init.ts
 var import_reflect_metadata = require("reflect-metadata");
-var import_server3 = require("@apollo/server");
+var import_server4 = require("@apollo/server");
 var import_default = require("@apollo/server/plugin/landingPage/default");
 var import_next = require("@as-integrations/next");
-var import_server4 = require("next/server");
+var import_server5 = require("next/server");
 var import_type_graphql = require("type-graphql");
 
 // src/env.ts
@@ -626,6 +626,9 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
+// src/utils/route.ts
+var import_server = require("next/server");
+
 // src/auth/constants.ts
 var REFRESH_COOKIE_NAME = "refresh";
 var REFRESH_HEADER_NAME = "X-Refresh-Token";
@@ -642,20 +645,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new import_server.NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 
@@ -667,7 +668,7 @@ var import_bcryptjs = require("bcryptjs");
 var import_jsonwebtoken = require("jsonwebtoken");
 var import_headers = require("next/headers");
 var import_navigation = require("next/navigation");
-var import_server = require("next/server");
+var import_server2 = require("next/server");
 function getUserIdFromRefreshToken(refreshToken) {
   if (refreshToken)
     try {
@@ -682,7 +683,7 @@ function getUserIdFromRefreshToken(refreshToken) {
 }
 
 // src/auth/utils/errors.ts
-var import_server2 = require("next/server");
+var import_server3 = require("next/server");
 
 // src/auth/email/utils.ts
 var getContext = (req) => {
@@ -720,7 +721,7 @@ async function initGraphQLServer({
     authChecker: authChecker || (({ context }) => !!context.userId),
     resolvers
   });
-  const server = new import_server3.ApolloServer({
+  const server = new import_server4.ApolloServer({
     typeDefs,
     resolvers: builtResolvers,
     plugins: [
@@ -742,18 +743,10 @@ async function initGraphQLServer({
   return {
     GET: withCors((request) => handler(request), allowedOrigins),
     POST: withCors((request) => handler(request), allowedOrigins),
-    ...allowedOrigins?.length ? {
-      OPTIONS: (req) => {
-        const corsHeaders = getCorsHeaders(
-          req.headers.get("origin"),
-          allowedOrigins
-        );
-        return new import_server4.NextResponse(null, {
-          status: 204,
-          headers: corsHeaders ?? void 0
-        });
-      }
-    } : {}
+    OPTIONS: withCors(
+      () => new import_server5.NextResponse(null, { status: 204 }),
+      allowedOrigins
+    )
   };
 }
 

package/dist/graphql/index.esm.js

@@ -559,7 +559,7 @@ import {
   ApolloServerPluginLandingPageProductionDefault
 } from "@apollo/server/plugin/landingPage/default";
 import { startServerAndCreateNextHandler } from "@as-integrations/next";
-import { NextResponse as NextResponse3 } from "next/server";
+import { NextResponse as NextResponse4 } from "next/server";
 import {
   buildTypeDefsAndResolvers
 } from "type-graphql";
@@ -613,6 +613,9 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
+// src/utils/route.ts
+import { NextResponse } from "next/server";
+
 // src/auth/constants.ts
 var REFRESH_COOKIE_NAME = "refresh";
 var REFRESH_HEADER_NAME = "X-Refresh-Token";
@@ -629,20 +632,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 
@@ -654,7 +655,7 @@ import { compare } from "bcryptjs";
 import { JsonWebTokenError, sign, verify } from "jsonwebtoken";
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
-import { NextResponse } from "next/server";
+import { NextResponse as NextResponse2 } from "next/server";
 function getUserIdFromRefreshToken(refreshToken) {
   if (refreshToken)
     try {
@@ -669,7 +670,7 @@ function getUserIdFromRefreshToken(refreshToken) {
 }
 
 // src/auth/utils/errors.ts
-import { NextResponse as NextResponse2 } from "next/server";
+import { NextResponse as NextResponse3 } from "next/server";
 
 // src/auth/email/utils.ts
 var getContext = (req) => {
@@ -729,18 +730,10 @@ async function initGraphQLServer({
   return {
     GET: withCors((request) => handler(request), allowedOrigins),
     POST: withCors((request) => handler(request), allowedOrigins),
-    ...allowedOrigins?.length ? {
-      OPTIONS: (req) => {
-        const corsHeaders = getCorsHeaders(
-          req.headers.get("origin"),
-          allowedOrigins
-        );
-        return new NextResponse3(null, {
-          status: 204,
-          headers: corsHeaders ?? void 0
-        });
-      }
-    } : {}
+    OPTIONS: withCors(
+      () => new NextResponse4(null, { status: 204 }),
+      allowedOrigins
+    )
   };
 }
 

package/dist/graphql/init.cjs.js

@@ -24,10 +24,10 @@ __export(init_exports, {
 });
 module.exports = __toCommonJS(init_exports);
 var import_reflect_metadata = require("reflect-metadata");
-var import_server3 = require("@apollo/server");
+var import_server4 = require("@apollo/server");
 var import_default = require("@apollo/server/plugin/landingPage/default");
 var import_next = require("@as-integrations/next");
-var import_server4 = require("next/server");
+var import_server5 = require("next/server");
 var import_type_graphql = require("type-graphql");
 
 // src/env.ts
@@ -79,6 +79,9 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
+// src/utils/route.ts
+var import_server = require("next/server");
+
 // src/auth/constants.ts
 var REFRESH_COOKIE_NAME = "refresh";
 var REFRESH_HEADER_NAME = "X-Refresh-Token";
@@ -95,20 +98,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new import_server.NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 
@@ -120,7 +121,7 @@ var import_bcryptjs = require("bcryptjs");
 var import_jsonwebtoken = require("jsonwebtoken");
 var import_headers = require("next/headers");
 var import_navigation = require("next/navigation");
-var import_server = require("next/server");
+var import_server2 = require("next/server");
 function getUserIdFromRefreshToken(refreshToken) {
   if (refreshToken)
     try {
@@ -135,7 +136,7 @@ function getUserIdFromRefreshToken(refreshToken) {
 }
 
 // src/auth/utils/errors.ts
-var import_server2 = require("next/server");
+var import_server3 = require("next/server");
 
 // src/auth/email/utils.ts
 var getContext = (req) => {
@@ -173,7 +174,7 @@ async function initGraphQLServer({
     authChecker: authChecker || (({ context }) => !!context.userId),
     resolvers
   });
-  const server = new import_server3.ApolloServer({
+  const server = new import_server4.ApolloServer({
     typeDefs,
     resolvers: builtResolvers,
     plugins: [
@@ -195,18 +196,10 @@ async function initGraphQLServer({
   return {
     GET: withCors((request) => handler(request), allowedOrigins),
     POST: withCors((request) => handler(request), allowedOrigins),
-    ...allowedOrigins?.length ? {
-      OPTIONS: (req) => {
-        const corsHeaders = getCorsHeaders(
-          req.headers.get("origin"),
-          allowedOrigins
-        );
-        return new import_server4.NextResponse(null, {
-          status: 204,
-          headers: corsHeaders ?? void 0
-        });
-      }
-    } : {}
+    OPTIONS: withCors(
+      () => new import_server5.NextResponse(null, { status: 204 }),
+      allowedOrigins
+    )
   };
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/graphql/init.d.mts

@@ -42,9 +42,9 @@ declare function initGraphQLServer({ authChecker, resolvers, plugins, getContext
     getContext?: (req: NextRequest) => Promise<any> | any;
     allowedOrigins?: string[];
 }): Promise<{
-    OPTIONS?: ((req: NextRequest) => NextResponse<unknown>) | undefined;
     GET: (request: NextRequest) => Promise<Response>;
     POST: (request: NextRequest) => Promise<Response>;
+    OPTIONS: () => NextResponse<unknown>;
 }>;
 
 export { initGraphQLServer };

package/dist/graphql/init.d.ts

@@ -42,9 +42,9 @@ declare function initGraphQLServer({ authChecker, resolvers, plugins, getContext
     getContext?: (req: NextRequest) => Promise<any> | any;
     allowedOrigins?: string[];
 }): Promise<{
-    OPTIONS?: ((req: NextRequest) => NextResponse<unknown>) | undefined;
     GET: (request: NextRequest) => Promise<Response>;
     POST: (request: NextRequest) => Promise<Response>;
+    OPTIONS: () => NextResponse<unknown>;
 }>;
 
 export { initGraphQLServer };

package/dist/graphql/init.esm.js

@@ -6,7 +6,7 @@ import {
   ApolloServerPluginLandingPageProductionDefault
 } from "@apollo/server/plugin/landingPage/default";
 import { startServerAndCreateNextHandler } from "@as-integrations/next";
-import { NextResponse as NextResponse3 } from "next/server";
+import { NextResponse as NextResponse4 } from "next/server";
 import {
   buildTypeDefsAndResolvers
 } from "type-graphql";
@@ -60,6 +60,9 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
+// src/utils/route.ts
+import { NextResponse } from "next/server";
+
 // src/auth/constants.ts
 var REFRESH_COOKIE_NAME = "refresh";
 var REFRESH_HEADER_NAME = "X-Refresh-Token";
@@ -76,20 +79,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 
@@ -101,7 +102,7 @@ import { compare } from "bcryptjs";
 import { JsonWebTokenError, sign, verify } from "jsonwebtoken";
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
-import { NextResponse } from "next/server";
+import { NextResponse as NextResponse2 } from "next/server";
 function getUserIdFromRefreshToken(refreshToken) {
   if (refreshToken)
     try {
@@ -116,7 +117,7 @@ function getUserIdFromRefreshToken(refreshToken) {
 }
 
 // src/auth/utils/errors.ts
-import { NextResponse as NextResponse2 } from "next/server";
+import { NextResponse as NextResponse3 } from "next/server";
 
 // src/auth/email/utils.ts
 var getContext = (req) => {
@@ -176,18 +177,10 @@ async function initGraphQLServer({
   return {
     GET: withCors((request) => handler(request), allowedOrigins),
     POST: withCors((request) => handler(request), allowedOrigins),
-    ...allowedOrigins?.length ? {
-      OPTIONS: (req) => {
-        const corsHeaders = getCorsHeaders(
-          req.headers.get("origin"),
-          allowedOrigins
-        );
-        return new NextResponse3(null, {
-          status: 204,
-          headers: corsHeaders ?? void 0
-        });
-      }
-    } : {}
+    OPTIONS: withCors(
+      () => new NextResponse4(null, { status: 204 }),
+      allowedOrigins
+    )
   };
 }
 export {

package/dist/utils/route.cjs.js

@@ -24,6 +24,7 @@ __export(route_exports, {
   withCors: () => withCors
 });
 module.exports = __toCommonJS(route_exports);
+var import_server = require("next/server");
 
 // src/auth/constants.ts
 var REFRESH_HEADER_NAME = "X-Refresh-Token";
@@ -40,20 +41,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new import_server.NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/utils/route.d.mts

@@ -6,6 +6,6 @@ declare function getCorsHeaders(origin: string | null, allowedOrigins: string[])
     "Access-Control-Allow-Headers": string;
     "Access-Control-Allow-Credentials": string;
 } | null;
-declare function withCors<T extends (req: NextRequest) => Promise<NextResponse | Response | undefined>>(handler: T, allowedOrigins?: string[]): T;
+declare function withCors<T extends (req: NextRequest) => Promise<NextResponse | Response | undefined> | NextResponse | Response | undefined>(handler: T, allowedOrigins?: string[]): T;
 
 export { getCorsHeaders, withCors };

package/dist/utils/route.d.ts

@@ -6,6 +6,6 @@ declare function getCorsHeaders(origin: string | null, allowedOrigins: string[])
     "Access-Control-Allow-Headers": string;
     "Access-Control-Allow-Credentials": string;
 } | null;
-declare function withCors<T extends (req: NextRequest) => Promise<NextResponse | Response | undefined>>(handler: T, allowedOrigins?: string[]): T;
+declare function withCors<T extends (req: NextRequest) => Promise<NextResponse | Response | undefined> | NextResponse | Response | undefined>(handler: T, allowedOrigins?: string[]): T;
 
 export { getCorsHeaders, withCors };

package/dist/utils/route.esm.js

@@ -1,3 +1,6 @@
+// src/utils/route.ts
+import { NextResponse } from "next/server";
+
 // src/auth/constants.ts
 var REFRESH_HEADER_NAME = "X-Refresh-Token";
 
@@ -13,20 +16,18 @@ function getCorsHeaders(origin, allowedOrigins) {
 }
 function withCors(handler, allowedOrigins) {
   if (!allowedOrigins?.length) return handler;
-  return ((req) => {
-    return handler(req).then((response) => {
-      if (!response) return response;
-      const corsHeaders = getCorsHeaders(
-        req.headers.get("origin"),
-        allowedOrigins
-      );
-      if (corsHeaders) {
-        Object.entries(corsHeaders).forEach(([key, value]) => {
-          response.headers.set(key, value);
-        });
-      }
-      return response;
+  return (async (req) => {
+    const origin = req.headers.get("origin");
+    const corsHeaders = getCorsHeaders(origin, allowedOrigins);
+    if (origin && !corsHeaders) {
+      return new NextResponse(null, { status: 403 });
+    }
+    const response = await handler(req);
+    if (!response || !corsHeaders) return response;
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+      response.headers.set(key, value);
     });
+    return response;
   });
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naystack",
-  "version": "1.5.32",
+  "version": "1.5.34",
   "description": "A stack built with Next + GraphQL + S3 + Auth",
   "main": "dist/index.cjs.js",
   "module": "dist/index.esm.js",