quidproquo-webserver 0.0.86 → 0.0.88

package/lib/config/settings/api.d.ts

@@ -8,5 +8,6 @@ export interface ApiQPQWebServerConfigSetting extends QPQConfigSetting {
     onRootDomain: boolean;
     apiName: string;
     buildPath: string;
+    deprecated: boolean;
 }
 export declare const defineApi: (apiSubdomain: string, buildPath: string, options?: QPQConfigAdvancedApiSettings) => ApiQPQWebServerConfigSetting;

package/lib/config/settings/api.js

@@ -11,6 +11,7 @@ const defineApi = (apiSubdomain, buildPath, options) => {
         // advanced
         onRootDomain: (options === null || options === void 0 ? void 0 : options.onRootDomain) || false,
         apiName: (options === null || options === void 0 ? void 0 : options.apiName) || 'api',
+        deprecated: (options === null || options === void 0 ? void 0 : options.deprecated) || false,
     };
 };
 exports.defineApi = defineApi;

package/lib/utils/headerUtils.js

@@ -26,12 +26,16 @@ exports.getAllowedOrigins = getAllowedOrigins;
 const getCorsHeaders = (qpqConfig, route, reqHeaders) => {
     const origin = (0, exports.getHeaderValue)('origin', reqHeaders) || '';
     const allowedOrigins = (0, exports.getAllowedOrigins)(qpqConfig, route);
-    const allowOrigin = allowedOrigins.find((ao) => ao === origin) || allowedOrigins[0];
+    const allowCredentials = Object.keys(route.routeAuthSettings || {}).length > 0;
+    // If we have an auth endpoint, then we don't let wildcard origins access the API for security reasons
+    const allowOrigin = (!allowCredentials
+        ? allowedOrigins.find((ao) => origin === ao || ao === '*')
+        : allowedOrigins.find((ao) => origin === ao)) || allowedOrigins[0];
     return {
         'Access-Control-Allow-Headers': '*',
         'Access-Control-Allow-Methods': '*',
         'Access-Control-Allow-Origin': allowOrigin,
-        'Access-Control-Allow-Credentials': `${!!route.routeAuthSettings}`,
+        'Access-Control-Allow-Credentials': `${allowCredentials}`,
         Vary: 'Origin',
     };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quidproquo-webserver",
-  "version": "0.0.86",
+  "version": "0.0.88",
   "description": "",
   "main": "./lib/index.js",
   "types": "./lib/index.d.js",