npm - openlearn-next - Versions diffs - 0.3.1 → 0.3.3 - Mend

openlearn-next 0.3.1 → 0.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (30) hide show

package/dist/assets/{index-C8sCKzmN.js → index-Vr-_Vpp3.js} RENAMED Viewed

@@ -1,2 +1,2 @@
 const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index-B-YxO39A.css"])))=>i.map(i=>d[i]);
-import{_ as e}from"./vendor-pdf-Cp-cYteE.js";import{r as t}from"./vendor-react-0Lg0vA-4.js";const i=t.lazy(()=>e(()=>import("./InteractiveCoursewareViewer-CS5BqfJZ.js"),__vite__mapDeps([0])).then(r=>({default:r.InteractiveCoursewareViewer})));export{i as CoursewareViewer};
+import{_ as e}from"./vendor-pdf-Cp-cYteE.js";import{r as t}from"./vendor-react-0Lg0vA-4.js";const i=t.lazy(()=>e(()=>import("./InteractiveCoursewareViewer-C8uZcebL.js"),__vite__mapDeps([0])).then(r=>({default:r.InteractiveCoursewareViewer})));export{i as CoursewareViewer};

package/dist/index.html CHANGED Viewed

@@ -15,7 +15,7 @@
       }
     }
     </script>
-    <script type="module" crossorigin src="/assets/index-CYzNsYZB.js"></script>
+    <script type="module" crossorigin src="/assets/index-Cwf8LQbY.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B-YxO39A.css">
   </head>
   <body>

package/dist/server.cjs CHANGED Viewed

@@ -3337,7 +3337,6 @@ var import_express3 = __toESM(require("express"), 1);
 var import_path15 = __toESM(require("path"), 1);
 var import_fs14 = __toESM(require("fs"), 1);
 var import_dotenv = __toESM(require("dotenv"), 1);
-var import_vite = require("vite");
 var import_http = require("http");
 var import_socket = require("socket.io");
@@ -7678,7 +7677,6 @@ var import_express = __toESM(require("express"), 1);
 var import_node_url = require("node:url");
 // packages/core/esm-loader/install-utils.ts
-var esbuild = __toESM(require("esbuild"), 1);
 var import_jszip = __toESM(require("jszip"), 1);
 var fs3 = __toESM(require("fs"), 1);
 var os2 = __toESM(require("os"), 1);
@@ -7686,6 +7684,7 @@ var path4 = __toESM(require("path"), 1);
 var import_uuid10 = require("uuid");
 var MAX_UNCOMPRESSED_SIZE = 300 * 1024 * 1024;
 async function bundlePlugin(entryCode, resolveDir) {
+  const esbuild = await import("esbuild");
   const result = await esbuild.build({
     stdin: {
       contents: entryCode,
@@ -7701,8 +7700,8 @@ async function bundlePlugin(entryCode, resolveDir) {
     plugins: [
       {
         name: "openlearn-token-enforcer",
-        setup(build2) {
-          build2.onResolve({ filter: /.*/ }, (args) => {
+        setup(build) {
+          build.onResolve({ filter: /.*/ }, (args) => {
             if (args.path.includes("core/di/interfaces")) {
               const tsPath = path4.resolve(process.cwd(), "packages/core/di/interfaces.ts");
               if (fs3.existsSync(tsPath)) {
@@ -24541,6 +24540,36 @@ async function startServer() {
   app.use(import_express3.default.urlencoded({ limit: "10mb", extended: true }));
   app.use("/uploads", import_express3.default.static(import_path15.default.join(process.cwd(), "uploads")));
   app.use("/plugins", import_express3.default.static(import_path15.default.join(process.cwd(), "plugins")));
+  const configuredOrigins = process.env.ALLOWED_ORIGINS ? process.env.ALLOWED_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : [];
+  const isOriginAllowed = (origin, hostHeader) => {
+    if (!origin) return true;
+    if (configuredOrigins.length > 0) {
+      if (configuredOrigins.includes("*") || configuredOrigins.includes(origin)) {
+        return true;
+      }
+    }
+    if (hostHeader) {
+      try {
+        const originUrl = new URL(origin);
+        if (originUrl.host === hostHeader) {
+          return true;
+        }
+      } catch {
+      }
+    }
+    try {
+      const originUrl = new URL(origin);
+      const hostname = originUrl.hostname;
+      if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "0.0.0.0") {
+        return true;
+      }
+    } catch {
+    }
+    if (process.env.NODE_ENV !== "production") {
+      return true;
+    }
+    return false;
+  };
   app.use((req, res, next) => {
     const origin = req.headers.origin;
     if (origin === "null" || origin === void 0) {
@@ -24548,6 +24577,12 @@ async function startServer() {
       res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
       res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With");
       res.setHeader("Access-Control-Max-Age", "86400");
+    } else if (isOriginAllowed(origin, req.headers.host)) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Access-Control-Allow-Credentials", "true");
+      res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With");
+      res.setHeader("Access-Control-Max-Age", "86400");
     }
     if (req.method === "OPTIONS") {
       return res.sendStatus(204);
@@ -24570,21 +24605,16 @@ async function startServer() {
     activityRegistry
   };
   const httpServer = (0, import_http.createServer)(app);
-  const allowedOrigins = process.env.ALLOWED_ORIGINS ? process.env.ALLOWED_ORIGINS.split(",").map((s) => s.trim()) : process.env.NODE_ENV === "production" ? [] : ["http://localhost:5173", "http://localhost:9000", "http://localhost:4173"];
   const io = new import_socket.Server(httpServer, {
-    cors: {
-      origin: (origin, callback) => {
-        if (!origin) return callback(null, true);
-        if (allowedOrigins.length === 0) {
-          return callback(new Error("CORS not allowed"));
-        }
-        if (allowedOrigins.includes(origin) || allowedOrigins.includes("*")) {
-          return callback(null, true);
-        }
-        return callback(new Error("Not allowed by CORS"));
-      },
-      methods: ["GET", "POST"],
-      credentials: true
+    cors: (req, callback) => {
+      const origin = req.headers.origin;
+      const host = req.headers.host;
+      const allowed = isOriginAllowed(origin, host);
+      callback(null, {
+        origin: allowed ? origin || true : false,
+        methods: ["GET", "POST"],
+        credentials: true
+      });
     }
   });
   io.use((socket, next) => {
@@ -24640,7 +24670,8 @@ async function startServer() {
   setupRealtimeBridge({ eventBus: kernelContainer.eventBus, io, db: kernelContainer.db });
   setupPresence({ io, eventBus: kernelContainer.eventBus });
   if (process.env.NODE_ENV !== "production") {
-    const vite = await (0, import_vite.createServer)({
+    const { createServer: createViteServer } = await import("vite");
+    const vite = await createViteServer({
       server: {
         middlewareMode: true,
         hmr: process.env.DISABLE_HMR !== "true",

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "openlearn-next",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "private": false,
   "description": "A plugin-driven Educational OS / LMS platform with AI agent teaching assistant",
   "keywords": [
@@ -61,6 +61,7 @@
     "better-sqlite3": "^12.11.1",
     "chokidar": "^5.0.0",
     "dotenv": "^17.2.3",
+    "esbuild": "^0.25.0",
     "express": "^4.21.2",
     "express-rate-limit": "^8.5.2",
     "helmet": "^8.2.0",
@@ -106,7 +107,6 @@
     "@typescript-eslint/parser": "^8.62.0",
     "@vitejs/plugin-react": "^5.0.4",
     "autoprefixer": "^10.4.21",
-    "esbuild": "^0.25.0",
     "eslint": "^10.5.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "globals": "^17.8.0",