schematic-pg 0.1.16 → 0.1.18

package/README.md

@@ -425,7 +425,7 @@ The `init` command creates everything you need to get running:
 |------------------|---------|
 | `AGENTS.md` | Agent-oriented guide for working with schematic-pg in this project |
 | `app.schema` | Starter schema (one `User` model) — edit this |
-| `.env` | `DATABASE_URL`, JWT settings |
+| `.env` | `DATABASE_URL`, JWT settings, `CORS_ORIGIN` |
 | `docker-compose.yml` | Local PostgreSQL on `:5432` |
 | `Makefile` | `make dev` — docker compose (with health wait) + `schematic-pg dev` |
 | `tsconfig.json` | TypeScript config for `generated/` and `src/routes/` |
@@ -456,9 +456,13 @@ Generated code imports the runtime from the `schematic-pg` package (`schematic-p
 | `AUTH_ACCESS_TOKEN_TTL` | `1h` | Access token lifetime (`15m`, `1h`, or seconds) |
 | `JWT_ROLE_CLAIM` | `role` | JWT claim mapped to `auth.role` |
 | `JWT_USER_ID_CLAIM` | `sub` | JWT claim mapped to `auth.user.id` |
+| `CORS_ORIGIN` | — (disabled) | Allowed browser origins. Unset disables CORS. Use `*` for any origin (no cookies), or a comma-separated list (`http://localhost:5173,https://app.example.com`). Concrete origins enable credentialed CORS |
+| `CORS_ALLOW_HEADERS` | — | Extra allowed request headers (comma-separated), merged with `Authorization`, `Content-Type`, `X-CSRF-Token` |
 
 Set these in `.env` before running `dev`, `start`, or `db:bootstrap`.
 
+Browser frontends on another origin need `CORS_ORIGIN`. The generated app reads it at runtime (no regenerate). Preflight `OPTIONS` is handled automatically; concrete origins enable cookies via `credentials: 'include'`. See [CORS](docs/rest-api.md#cors).
+
 ---
 
 ## Authentication

package/dist/api/middleware/cors.d.ts

@@ -0,0 +1,9 @@
+import type { MiddlewareHandler } from 'hono';
+import type { AppEnv } from '../types.js';
+export declare function parseCorsOrigin(raw?: string | undefined): string | string[] | null;
+/** Extra headers from `CORS_ALLOW_HEADERS` (comma-separated). Does not include defaults. */
+export declare function parseCorsAllowHeaders(raw?: string | undefined): string[];
+export declare function createCorsMiddleware(options?: {
+    origin?: string | string[] | null;
+    allowHeaders?: string[];
+}): MiddlewareHandler<AppEnv>;

package/dist/api/middleware/cors.js

@@ -0,0 +1,69 @@
+import { cors } from 'hono/cors';
+const DEFAULT_CORS_ALLOW_HEADERS = ['Authorization', 'Content-Type', 'X-CSRF-Token'];
+const CORS_ALLOW_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'];
+const CORS_MAX_AGE_SECONDS = 86400;
+function parseCommaSeparatedList(raw) {
+    const trimmed = raw?.trim() ?? '';
+    if (!trimmed) {
+        return [];
+    }
+    return trimmed
+        .split(',')
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0);
+}
+export function parseCorsOrigin(raw = process.env.CORS_ORIGIN) {
+    const trimmed = raw?.trim() ?? '';
+    if (!trimmed) {
+        return null;
+    }
+    if (trimmed === '*') {
+        return '*';
+    }
+    const origins = parseCommaSeparatedList(trimmed);
+    if (origins.length === 0) {
+        return null;
+    }
+    return origins.length === 1 ? origins[0] : origins;
+}
+/** Extra headers from `CORS_ALLOW_HEADERS` (comma-separated). Does not include defaults. */
+export function parseCorsAllowHeaders(raw = process.env.CORS_ALLOW_HEADERS) {
+    return parseCommaSeparatedList(raw);
+}
+function resolveAllowHeaders(optionsAllowHeaders) {
+    if (optionsAllowHeaders !== undefined) {
+        return optionsAllowHeaders;
+    }
+    const extras = parseCorsAllowHeaders();
+    if (extras.length === 0) {
+        return DEFAULT_CORS_ALLOW_HEADERS;
+    }
+    const seen = new Set(DEFAULT_CORS_ALLOW_HEADERS.map((header) => header.toLowerCase()));
+    const merged = [...DEFAULT_CORS_ALLOW_HEADERS];
+    for (const header of extras) {
+        const key = header.toLowerCase();
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        merged.push(header);
+    }
+    return merged;
+}
+export function createCorsMiddleware(options = {}) {
+    const origin = options.origin !== undefined ? options.origin : parseCorsOrigin();
+    if (origin == null) {
+        return async (_c, next) => {
+            await next();
+        };
+    }
+    const allowHeaders = resolveAllowHeaders(options.allowHeaders);
+    const credentials = origin !== '*';
+    return cors({
+        origin,
+        credentials,
+        allowHeaders,
+        allowMethods: CORS_ALLOW_METHODS,
+        maxAge: CORS_MAX_AGE_SECONDS,
+    });
+}

package/dist/api-generator/app-generator.js

@@ -46,6 +46,7 @@ export class AppGenerator {
             `import { createAuthMiddleware } from '${PACKAGE_NAME}/api/auth/middleware';`,
             `import { createJwtResolver } from '${PACKAGE_NAME}/api/auth/jwt-resolver';`,
             `import type { AuthResolver } from '${PACKAGE_NAME}/api/auth/types';`,
+            `import { createCorsMiddleware } from '${PACKAGE_NAME}/api/middleware/cors';`,
             `import { createDbMiddleware } from '${PACKAGE_NAME}/api/middleware/db';`,
             `import { handleError } from '${PACKAGE_NAME}/api/middleware/errors';`,
             `import { mountApiDocs } from '${PACKAGE_NAME}/api/openapi';`,
@@ -61,6 +62,7 @@ export class AppGenerator {
             '',
             'export function createApp(options: CreateAppOptions = {}): Hono<AppEnv> {',
             '  const app = new Hono<AppEnv>();',
+            '  app.use(createCorsMiddleware());',
             '  mountApiDocs(app, openApiDocument);',
             '  app.use(logger());',
             '  app.use(prettyJSON());',

package/dist/cli/templates/agents.md

@@ -25,7 +25,7 @@ my-app/
 ├── app.schema              # Source of truth — edit this
 ├── schema.sql              # Generated PostgreSQL DDL (read-only)
 ├── AGENTS.md               # This file
-├── .env                    # DATABASE_URL, JWT_* settings
+├── .env                    # DATABASE_URL, JWT_*, CORS_ORIGIN
 ├── docker-compose.yml      # Local PostgreSQL
 ├── generated/              # Generated — do not edit
 │   ├── db.ts               # createDbClient(pool)
@@ -59,6 +59,8 @@ npx schematic-pg dev
 | `JWT_SECRET` | HMAC secret for Bearer JWT auth |
 | `JWT_ROLE_CLAIM` | JWT claim for role (default `role`) |
 | `JWT_USER_ID_CLAIM` | JWT claim for user id (default `sub`) |
+| `CORS_ORIGIN` | Allowed browser origins (`*` or comma-separated). Unset disables CORS. Concrete origins enable credentialed CORS (cookies); `*` does not |
+| `CORS_ALLOW_HEADERS` | Extra allowed request headers (comma-separated), merged with Authorization, Content-Type, X-CSRF-Token |
 
 ## Schema DSL Essentials
 

package/dist/cli/templates.d.ts

@@ -1,6 +1,6 @@
 export declare const AGENTS_TEMPLATE: string;
 export declare const APP_SCHEMA_TEMPLATE = "extensions {\n\n}\n\nenums {\n  UserRole { ADMIN, USER }\n}\n\nmodels {\n  model User {\n    id:           UUID         @id @default(gen_random_uuid())\n    email:        VARCHAR(255) @unique @regex(pattern: \"^[\\w.-]+@[\\w.-]+\\.\\w+$\", message: \"Invalid email address\")\n    name:         VARCHAR(150)?\n    role:         UserRole     @default(USER)\n    passwordHash: VARCHAR(255)? @omit @unfilterable\n    createdAt:    TIMESTAMP    @default(now())\n\n    @rest(except: [create, update, delete])\n    @policy(role: USER, allow: [select], where: \"id = {{auth.user.id}}\")\n    @policy(role: ADMIN, allow: all)\n  }\n}\n";
-export declare const ENV_TEMPLATE = "DATABASE_URL=postgresql://postgrest:postgrest@localhost:5432/postgrest\nJWT_SECRET=\nAUTH_PEPPER=\nAUTH_ACCESS_TOKEN_TTL=1h\nJWT_ROLE_CLAIM=role\nJWT_USER_ID_CLAIM=sub\n";
+export declare const ENV_TEMPLATE = "DATABASE_URL=postgresql://postgrest:postgrest@localhost:5432/postgrest\nJWT_SECRET=\nAUTH_PEPPER=\nAUTH_ACCESS_TOKEN_TTL=1h\nJWT_ROLE_CLAIM=role\nJWT_USER_ID_CLAIM=sub\nCORS_ORIGIN=\nCORS_ALLOW_HEADERS=\n";
 export declare const GITIGNORE_TEMPLATE = "node_modules/\ndist/\n.env\ndocker_data/\n.DS_Store\n*.log\nnpm-debug.log*\n";
 export declare const DOCKER_COMPOSE_TEMPLATE = "services:\n  postgres:\n    image: postgres:18.4-bookworm\n    container_name: schematic-pg\n    restart: unless-stopped\n    ports:\n      - \"5432:5432\"\n    environment:\n      POSTGRES_USER: postgrest\n      POSTGRES_PASSWORD: postgrest\n      POSTGRES_DB: postgrest\n    volumes:\n      - ./docker_data/postgres:/var/lib/postgresql\n    healthcheck:\n      test: [\"CMD-SHELL\", \"pg_isready -U postgrest -d postgrest\"]\n      interval: 5s\n      timeout: 5s\n      retries: 5\n";
 export declare const TSCONFIG_TEMPLATE = "{\n  \"compilerOptions\": {\n    \"target\": \"ES2022\",\n    \"module\": \"NodeNext\",\n    \"moduleResolution\": \"NodeNext\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true,\n    \"outDir\": \"dist\",\n    \"rootDir\": \".\"\n  },\n  \"include\": [\"generated/**/*\", \"src/**/*\"]\n}\n";

package/dist/cli/templates.js

@@ -33,6 +33,8 @@ AUTH_PEPPER=
 AUTH_ACCESS_TOKEN_TTL=1h
 JWT_ROLE_CLAIM=role
 JWT_USER_ID_CLAIM=sub
+CORS_ORIGIN=
+CORS_ALLOW_HEADERS=
 `;
 export const GITIGNORE_TEMPLATE = `node_modules/
 dist/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "schematic-pg",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Single-file backend framework for PostgreSQL and Node.js",
   "type": "module",
   "license": "MIT",