rouzer 1.0.0-beta.13 → 1.0.0-beta.14

package/dist/server/router.js

@@ -24,8 +24,9 @@ export function createRouter(config) {
     return (handlers) => middlewares.use(async function (context) {
         const request = context.request;
         const origin = request.headers.get('Origin');
-        if (allowOrigins &&
-            !(origin && allowOrigins.some(pattern => pattern.test(origin)))) {
+        if (origin &&
+            allowOrigins &&
+            !allowOrigins.some(pattern => pattern.test(origin))) {
             return new Response(null, { status: 403 });
         }
         const url = (context.url ??= new URL(request.url));
@@ -60,9 +61,9 @@ export function createRouter(config) {
                     },
                 });
             }
-            // Since we can't know if this was preceded by a preflight request, we
-            // set this header for all requests.
-            context.setHeader('Access-Control-Allow-Origin', origin ?? '*');
+            if (origin) {
+                context.setHeader('Access-Control-Allow-Origin', origin);
+            }
             if (route.path) {
                 const error = parsePathParams(context, enableStringParsing(route.path), match.params);
                 if (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rouzer",
-  "version": "1.0.0-beta.13",
+  "version": "1.0.0-beta.14",
   "type": "module",
   "exports": {
     ".": {

package/readme.md

@@ -39,6 +39,17 @@ The following request parts can be validated with Zod:
 
 Zod validation happens on both the server and client.
 
+## Route URL patterns
+
+Rouzer uses `@remix-run/route-pattern` for matching and generation. Patterns can include:
+
+- Pathname-only patterns like `blog/:slug` (default).
+- Full URLs with protocol/hostname/port like `https://:store.shopify.com/orders`.
+- Dynamic segments with `:param` names (valid JS identifiers), including multiple params in one segment like `v:major.:minor`.
+- Optional segments wrapped in parentheses, which can be nested like `api(/v:major(.:minor))`.
+- Wildcards with `*name` (captured) or `*` (uncaptured) for multi-segment paths like `assets/*path` or `files/*`.
+- Query matching with `?` to require parameters or exact values like `search?q` or `search?q=routing`.
+
 ## Server router
 
 ```ts
@@ -66,6 +77,34 @@ export const handler = createRouter({
 })
 ```
 
+## Router options
+
+```ts
+export const handler = createRouter({
+  routes,
+  middlewares,
+  basePath: 'api/',
+  cors: {
+    allowOrigins: ['example.net', 'https://*.example.com', '*://localhost:3000'],
+  },
+  debug: process.env.NODE_ENV === 'development',
+})({
+  helloRoute: {
+    GET(ctx) {
+      const message = `Hello, ${ctx.path.name}${ctx.query.excited ? '!' : '.'}`
+      return { message }
+    },
+  },
+})
+```
+
+- `basePath` is prepended to every route (leading/trailing slashes are trimmed).
+- CORS preflight (`OPTIONS`) is handled automatically for matched routes.
+- `cors.allowOrigins` restricts preflight requests to a list of origins (default is to allow any origin).
+  - Wildcards are supported for protocol and subdomain; the protocol is optional and defaults to `https`.
+- If you rely on `Cookie` or `Authorization` request headers, you must set
+  `Access-Control-Allow-Credentials` in your handler.
+
 ## Client wrapper
 
 ```ts