orez-sync-cf-host 0.12.13 → 0.12.14

package/dist/host.js

@@ -170,114 +170,154 @@ function socketCloseQuietly(socket, code, reason) {
  */
 export function createSyncWorker(config) {
     validateSyncHostConfig(config);
+    const allowedOrigins = new Set(config.allowedOrigins ?? []);
+    const corsHeaders = (origin) => ({
+        'access-control-allow-origin': origin,
+        vary: 'origin',
+    });
     return {
         async fetch(request, env) {
-            const namespace = config.namespace(request);
-            if (!namespace)
-                return new Response('orez sync-cf-host', { status: 200 });
-            const route = routeAfterNamespace(new URL(request.url).pathname);
-            const isAdmin = route.startsWith('/admin/');
-            let wakeUserID = null;
-            if (route === '/wake') {
-                let wakeRequest = request;
-                const protocol = request.headers.get('sec-websocket-protocol')?.trim();
-                const encodedAuth = protocol?.startsWith('orez-auth.') === true
-                    ? protocol.slice('orez-auth.'.length)
-                    : null;
-                if (!request.headers.has('authorization') &&
-                    encodedAuth &&
-                    /^[A-Za-z0-9_-]+$/.test(encodedAuth)) {
-                    try {
-                        const base64 = encodedAuth.replaceAll('-', '+').replaceAll('_', '/');
-                        const binary = globalThis.atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, '='));
-                        const authToken = new TextDecoder().decode(Uint8Array.from(binary, (character) => character.charCodeAt(0)));
-                        if (authToken) {
-                            const wakeHeaders = new Headers(request.headers);
-                            wakeHeaders.set('authorization', `Bearer ${authToken}`);
-                            wakeRequest = new Request(request, { headers: wakeHeaders });
+            const requestOrigin = request.headers.get('origin');
+            const corsOrigin = requestOrigin && allowedOrigins.has(requestOrigin) ? requestOrigin : null;
+            // answer allowed preflights before any routing or authentication: a
+            // preflight carries no Authorization header, so the auth wall below 401s
+            // it and the browser never sends the real request.
+            if (corsOrigin &&
+                request.method === 'OPTIONS' &&
+                request.headers.has('access-control-request-method')) {
+                return new Response(null, {
+                    status: 204,
+                    headers: {
+                        ...corsHeaders(corsOrigin),
+                        'access-control-allow-methods': 'GET, POST, OPTIONS',
+                        'access-control-allow-headers': 'authorization, content-type',
+                        'access-control-max-age': '86400',
+                    },
+                });
+            }
+            const withCors = (response) => {
+                // a websocket upgrade has an immutable response; the socket handshake
+                // is not CORS-gated anyway.
+                if (!corsOrigin || response.webSocket)
+                    return response;
+                const wrapped = new Response(response.body, response);
+                for (const [name, value] of Object.entries(corsHeaders(corsOrigin))) {
+                    wrapped.headers.set(name, value);
+                }
+                return wrapped;
+            };
+            const handle = async () => {
+                const namespace = config.namespace(request);
+                if (!namespace)
+                    return new Response('orez sync-cf-host', { status: 200 });
+                const route = routeAfterNamespace(new URL(request.url).pathname);
+                const isAdmin = route.startsWith('/admin/');
+                let wakeUserID = null;
+                if (route === '/wake') {
+                    let wakeRequest = request;
+                    const protocol = request.headers.get('sec-websocket-protocol')?.trim();
+                    const encodedAuth = protocol?.startsWith('orez-auth.') === true
+                        ? protocol.slice('orez-auth.'.length)
+                        : null;
+                    if (!request.headers.has('authorization') &&
+                        encodedAuth &&
+                        /^[A-Za-z0-9_-]+$/.test(encodedAuth)) {
+                        try {
+                            const base64 = encodedAuth.replaceAll('-', '+').replaceAll('_', '/');
+                            const binary = globalThis.atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, '='));
+                            const authToken = new TextDecoder().decode(Uint8Array.from(binary, (character) => character.charCodeAt(0)));
+                            if (authToken) {
+                                const wakeHeaders = new Headers(request.headers);
+                                wakeHeaders.set('authorization', `Bearer ${authToken}`);
+                                wakeRequest = new Request(request, { headers: wakeHeaders });
+                            }
+                        }
+                        catch {
+                            // malformed subprotocol credentials remain unauthenticated
                         }
                     }
-                    catch {
-                        // malformed subprotocol credentials remain unauthenticated
+                    const wake = await config.authorizeWake(wakeRequest, env);
+                    if (!wake)
+                        return json({ error: 'missing wake capability' }, 401);
+                    if (typeof wake === 'object')
+                        wakeUserID = wake.userID;
+                    // A namespace that streams fields authorizes every subscription against
+                    // this userID, so a capability that does not carry one cannot open the
+                    // socket. Failing here names the cause; accepting it would produce a
+                    // wake-only socket whose subscriptions silently never deliver.
+                    if (config.streamingManifest && !wakeUserID) {
+                        return json({ error: 'wake capability must identify a user' }, 401);
                     }
                 }
-                const wake = await config.authorizeWake(wakeRequest, env);
-                if (!wake)
-                    return json({ error: 'missing wake capability' }, 401);
-                if (typeof wake === 'object')
-                    wakeUserID = wake.userID;
-                // A namespace that streams fields authorizes every subscription against
-                // this userID, so a capability that does not carry one cannot open the
-                // socket. Failing here names the cause; accepting it would produce a
-                // wake-only socket whose subscriptions silently never deliver.
-                if (config.streamingManifest && !wakeUserID) {
-                    return json({ error: 'wake capability must identify a user' }, 401);
-                }
-            }
-            else if (route === '/notify') {
-                if (!(await config.authorizeNotify(request, env))) {
-                    return json({ error: 'forbidden' }, 403);
-                }
-            }
-            else if (isAdmin) {
-                const authorized = config.authorizeAdmin
-                    ? await config.authorizeAdmin(request, env)
-                    : Boolean(env.ADMIN_KEY) && request.headers.get('x-admin-key') === env.ADMIN_KEY;
-                if (!authorized)
-                    return json({ error: 'forbidden' }, 403);
-            }
-            const headers = new Headers(request.headers);
-            headers.delete(NAMESPACE_HEADER);
-            headers.delete(UPSTREAM_PATH_HEADER);
-            headers.delete(IDENTITY_HEADER);
-            let forwardedBody = null;
-            // /wake and /realtime/produce are both websocket upgrades and have no
-            // body to put claims in. wake authentication is normalized from its
-            // WebSocket subprotocol above; each route has its own authorization check
-            // before either reaches the Durable Object.
-            if (!isAdmin &&
-                route !== '/wake' &&
-                route !== '/notify' &&
-                route !== '/realtime/produce') {
-                const claims = await config.authenticate(request, env);
-                if (!claims || typeof claims.userID !== 'string' || claims.userID.length === 0) {
-                    return json({ error: 'missing authentication' }, 401);
+                else if (route === '/notify') {
+                    if (!(await config.authorizeNotify(request, env))) {
+                        return json({ error: 'forbidden' }, 403);
+                    }
                 }
-                if (!(await config.authorize(request, claims, namespace, env))) {
-                    return json({ error: 'forbidden' }, 403);
+                else if (isAdmin) {
+                    const authorized = config.authorizeAdmin
+                        ? await config.authorizeAdmin(request, env)
+                        : Boolean(env.ADMIN_KEY) &&
+                            request.headers.get('x-admin-key') === env.ADMIN_KEY;
+                    if (!authorized)
+                        return json({ error: 'forbidden' }, 403);
                 }
-                if ((route === '/pull' || route === '/push') && request.method === 'POST') {
-                    try {
-                        const body = await requestObject(request);
-                        forwardedBody = { claims, body };
+                const headers = new Headers(request.headers);
+                headers.delete(NAMESPACE_HEADER);
+                headers.delete(UPSTREAM_PATH_HEADER);
+                headers.delete(IDENTITY_HEADER);
+                let forwardedBody = null;
+                // /wake and /realtime/produce are both websocket upgrades and have no
+                // body to put claims in. wake authentication is normalized from its
+                // WebSocket subprotocol above; each route has its own authorization check
+                // before either reaches the Durable Object.
+                if (!isAdmin &&
+                    route !== '/wake' &&
+                    route !== '/notify' &&
+                    route !== '/realtime/produce') {
+                    const claims = await config.authenticate(request, env);
+                    if (!claims ||
+                        typeof claims.userID !== 'string' ||
+                        claims.userID.length === 0) {
+                        return json({ error: 'missing authentication' }, 401);
                     }
-                    catch (error) {
-                        return errorResponse(error);
+                    if (!(await config.authorize(request, claims, namespace, env))) {
+                        return json({ error: 'forbidden' }, 403);
+                    }
+                    if ((route === '/pull' || route === '/push') && request.method === 'POST') {
+                        try {
+                            const body = await requestObject(request);
+                            forwardedBody = { claims, body };
+                        }
+                        catch (error) {
+                            return errorResponse(error);
+                        }
                     }
                 }
-            }
-            // Only the userID travels, because it is the only part the DO must be
-            // unable to doubt. The socket also carries a clientID and clientGroupID,
-            // but those are the client's own assertion and the engine checks the
-            // group against this userID before it will read a single row, so there is
-            // nothing gained by moving them here.
-            if (wakeUserID)
-                headers.set(IDENTITY_HEADER, encodeURIComponent(wakeUserID));
-            headers.set(NAMESPACE_HEADER, await namespaceHash(namespace));
-            if (config.upstream) {
-                const namespacePath = typeof config.upstream.namespacePath === 'function'
-                    ? config.upstream.namespacePath(namespace)
-                    : config.upstream.namespacePath;
-                if (!namespacePath.startsWith('/')) {
-                    return json({ error: 'upstream namespacePath must be an absolute path' }, 500);
+                // Only the userID travels, because it is the only part the DO must be
+                // unable to doubt. The socket also carries a clientID and clientGroupID,
+                // but those are the client's own assertion and the engine checks the
+                // group against this userID before it will read a single row, so there is
+                // nothing gained by moving them here.
+                if (wakeUserID)
+                    headers.set(IDENTITY_HEADER, encodeURIComponent(wakeUserID));
+                headers.set(NAMESPACE_HEADER, await namespaceHash(namespace));
+                if (config.upstream) {
+                    const namespacePath = typeof config.upstream.namespacePath === 'function'
+                        ? config.upstream.namespacePath(namespace)
+                        : config.upstream.namespacePath;
+                    if (!namespacePath.startsWith('/')) {
+                        return json({ error: 'upstream namespacePath must be an absolute path' }, 500);
+                    }
+                    headers.set(UPSTREAM_PATH_HEADER, namespacePath.replace(/\/$/, ''));
                 }
-                headers.set(UPSTREAM_PATH_HEADER, namespacePath.replace(/\/$/, ''));
-            }
-            const forwarded = forwardedBody
-                ? jsonBodyRequest(request, headers, forwardedBody)
-                : new Request(request, { headers });
-            const id = env.SYNC_DO.idFromName(namespace);
-            return env.SYNC_DO.get(id).fetch(forwarded);
+                const forwarded = forwardedBody
+                    ? jsonBodyRequest(request, headers, forwardedBody)
+                    : new Request(request, { headers });
+                const id = env.SYNC_DO.idFromName(namespace);
+                return env.SYNC_DO.get(id).fetch(forwarded);
+            };
+            return withCors(await handle());
         },
     };
 }
@@ -1314,7 +1354,10 @@ export function createSyncDurableObject(config) {
                     // pull that records it.
                     if (result.ownsGroup)
                         return { status: 'pending' };
-                    return { status: 'denied', reason: 'row is not in this client group' };
+                    return {
+                        status: 'denied',
+                        reason: 'row is not in this client group',
+                    };
                 },
             });
             return this.#realtime;
@@ -1392,7 +1435,10 @@ export function createSyncDurableObject(config) {
                     clientGroupID,
                 }
                 : undefined;
-            server.serializeAttachment({ clientID, identity });
+            server.serializeAttachment({
+                clientID,
+                identity,
+            });
             this.ctx.acceptWebSocket(server, [`client:${clientID}`]);
             if (identity) {
                 const host = this.#realtimeHost();
@@ -1447,7 +1493,9 @@ export function createSyncDurableObject(config) {
                     if (typeof query !== 'string')
                         return json({ error: 'query is required' }, 400);
                     try {
-                        return json({ rows: this.#directSql.query(query, decodeSqlParams(params)) });
+                        return json({
+                            rows: this.#directSql.query(query, decodeSqlParams(params)),
+                        });
                     }
                     catch (error) {
                         if (error instanceof TypeError && error.message.startsWith('params')) {

package/dist/types.d.ts

@@ -129,4 +129,14 @@ export type SyncHostConfig<Env extends SyncHostEnv = SyncHostEnv, S extends Sche
     /** per-query guard for recursive transaction query materialization. */
     transactionQueryBudget?: Partial<TransactionQueryBudget>;
     authorizeAdmin?: (request: Request, env: Env) => boolean | Promise<boolean>;
+    /**
+     * Browser origins (exact match, e.g. `https://ios-myapp.example.com`) allowed
+     * to call this host cross-origin. The host answers their CORS preflights
+     * before authentication (a preflight carries no credentials, so an auth-first
+     * router 401s it and the browser never sends the real request) and stamps
+     * allow-origin on their responses. Clients authenticate with a bearer
+     * Authorization header, so no cookie credentials are allowed or needed.
+     * Absent means same-origin consumers only.
+     */
+    allowedOrigins?: readonly string[];
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orez-sync-cf-host",
-  "version": "0.12.13",
+  "version": "0.12.14",
   "description": "Internal orez Cloudflare sync host. Do not import directly: consumers use orez-lite/cloudflare/sync.",
   "type": "module",
   "exports": {
@@ -58,7 +58,7 @@
     "test:large-data": "bun run build:dist && bun large-data-test.mjs"
   },
   "dependencies": {
-    "orez-sync-executor": "0.12.13"
+    "orez-sync-executor": "0.12.14"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "4.20260617.1",