npm - openlearn-next - Versions diffs - 0.3.2 → 0.3.3 - Mend

openlearn-next 0.3.2 → 0.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (29) hide show

package/dist/assets/{index-Bve0X_Y7.js → index-Vr-_Vpp3.js} RENAMED Viewed

@@ -1,2 +1,2 @@
 const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index-B-YxO39A.css"])))=>i.map(i=>d[i]);
-import{_ as e}from"./vendor-pdf-Cp-cYteE.js";import{r as t}from"./vendor-react-0Lg0vA-4.js";const i=t.lazy(()=>e(()=>import("./InteractiveCoursewareViewer-DBCbyDmo.js"),__vite__mapDeps([0])).then(r=>({default:r.InteractiveCoursewareViewer})));export{i as CoursewareViewer};
+import{_ as e}from"./vendor-pdf-Cp-cYteE.js";import{r as t}from"./vendor-react-0Lg0vA-4.js";const i=t.lazy(()=>e(()=>import("./InteractiveCoursewareViewer-C8uZcebL.js"),__vite__mapDeps([0])).then(r=>({default:r.InteractiveCoursewareViewer})));export{i as CoursewareViewer};

package/dist/index.html CHANGED Viewed

@@ -15,7 +15,7 @@
       }
     }
     </script>
-    <script type="module" crossorigin src="/assets/index-CerSuw-h.js"></script>
+    <script type="module" crossorigin src="/assets/index-Cwf8LQbY.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B-YxO39A.css">
   </head>
   <body>

package/dist/server.cjs CHANGED Viewed

@@ -24540,6 +24540,36 @@ async function startServer() {
   app.use(import_express3.default.urlencoded({ limit: "10mb", extended: true }));
   app.use("/uploads", import_express3.default.static(import_path15.default.join(process.cwd(), "uploads")));
   app.use("/plugins", import_express3.default.static(import_path15.default.join(process.cwd(), "plugins")));
+  const configuredOrigins = process.env.ALLOWED_ORIGINS ? process.env.ALLOWED_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : [];
+  const isOriginAllowed = (origin, hostHeader) => {
+    if (!origin) return true;
+    if (configuredOrigins.length > 0) {
+      if (configuredOrigins.includes("*") || configuredOrigins.includes(origin)) {
+        return true;
+      }
+    }
+    if (hostHeader) {
+      try {
+        const originUrl = new URL(origin);
+        if (originUrl.host === hostHeader) {
+          return true;
+        }
+      } catch {
+      }
+    }
+    try {
+      const originUrl = new URL(origin);
+      const hostname = originUrl.hostname;
+      if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "0.0.0.0") {
+        return true;
+      }
+    } catch {
+    }
+    if (process.env.NODE_ENV !== "production") {
+      return true;
+    }
+    return false;
+  };
   app.use((req, res, next) => {
     const origin = req.headers.origin;
     if (origin === "null" || origin === void 0) {
@@ -24547,6 +24577,12 @@ async function startServer() {
       res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
       res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With");
       res.setHeader("Access-Control-Max-Age", "86400");
+    } else if (isOriginAllowed(origin, req.headers.host)) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Access-Control-Allow-Credentials", "true");
+      res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With");
+      res.setHeader("Access-Control-Max-Age", "86400");
     }
     if (req.method === "OPTIONS") {
       return res.sendStatus(204);
@@ -24569,21 +24605,16 @@ async function startServer() {
     activityRegistry
   };
   const httpServer = (0, import_http.createServer)(app);
-  const allowedOrigins = process.env.ALLOWED_ORIGINS ? process.env.ALLOWED_ORIGINS.split(",").map((s) => s.trim()) : process.env.NODE_ENV === "production" ? [] : ["http://localhost:5173", "http://localhost:9000", "http://localhost:4173"];
   const io = new import_socket.Server(httpServer, {
-    cors: {
-      origin: (origin, callback) => {
-        if (!origin) return callback(null, true);
-        if (allowedOrigins.length === 0) {
-          return callback(new Error("CORS not allowed"));
-        }
-        if (allowedOrigins.includes(origin) || allowedOrigins.includes("*")) {
-          return callback(null, true);
-        }
-        return callback(new Error("Not allowed by CORS"));
-      },
-      methods: ["GET", "POST"],
-      credentials: true
+    cors: (req, callback) => {
+      const origin = req.headers.origin;
+      const host = req.headers.host;
+      const allowed = isOriginAllowed(origin, host);
+      callback(null, {
+        origin: allowed ? origin || true : false,
+        methods: ["GET", "POST"],
+        credentials: true
+      });
     }
   });
   io.use((socket, next) => {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "openlearn-next",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "private": false,
   "description": "A plugin-driven Educational OS / LMS platform with AI agent teaching assistant",
   "keywords": [