schematic-pg 0.1.17 → 0.1.18

package/README.md

@@ -456,11 +456,12 @@ Generated code imports the runtime from the `schematic-pg` package (`schematic-p
 | `AUTH_ACCESS_TOKEN_TTL` | `1h` | Access token lifetime (`15m`, `1h`, or seconds) |
 | `JWT_ROLE_CLAIM` | `role` | JWT claim mapped to `auth.role` |
 | `JWT_USER_ID_CLAIM` | `sub` | JWT claim mapped to `auth.user.id` |
-| `CORS_ORIGIN` | — (disabled) | Allowed browser origins. Unset disables CORS. Use `*` for any origin, or a comma-separated list (`http://localhost:5173,https://app.example.com`) |
+| `CORS_ORIGIN` | — (disabled) | Allowed browser origins. Unset disables CORS. Use `*` for any origin (no cookies), or a comma-separated list (`http://localhost:5173,https://app.example.com`). Concrete origins enable credentialed CORS |
+| `CORS_ALLOW_HEADERS` | — | Extra allowed request headers (comma-separated), merged with `Authorization`, `Content-Type`, `X-CSRF-Token` |
 
 Set these in `.env` before running `dev`, `start`, or `db:bootstrap`.
 
-Browser frontends on another origin need `CORS_ORIGIN`. The generated app reads it at runtime (no regenerate). Preflight `OPTIONS` is handled automatically; `Authorization` and `Content-Type` are allowed. See [CORS](docs/rest-api.md#cors).
+Browser frontends on another origin need `CORS_ORIGIN`. The generated app reads it at runtime (no regenerate). Preflight `OPTIONS` is handled automatically; concrete origins enable cookies via `credentials: 'include'`. See [CORS](docs/rest-api.md#cors).
 
 ---
 

package/dist/api/middleware/cors.d.ts

@@ -1,6 +1,9 @@
 import type { MiddlewareHandler } from 'hono';
 import type { AppEnv } from '../types.js';
 export declare function parseCorsOrigin(raw?: string | undefined): string | string[] | null;
+/** Extra headers from `CORS_ALLOW_HEADERS` (comma-separated). Does not include defaults. */
+export declare function parseCorsAllowHeaders(raw?: string | undefined): string[];
 export declare function createCorsMiddleware(options?: {
     origin?: string | string[] | null;
+    allowHeaders?: string[];
 }): MiddlewareHandler<AppEnv>;

package/dist/api/middleware/cors.js

@@ -1,7 +1,17 @@
 import { cors } from 'hono/cors';
-const CORS_ALLOW_HEADERS = ['Authorization', 'Content-Type'];
+const DEFAULT_CORS_ALLOW_HEADERS = ['Authorization', 'Content-Type', 'X-CSRF-Token'];
 const CORS_ALLOW_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'];
 const CORS_MAX_AGE_SECONDS = 86400;
+function parseCommaSeparatedList(raw) {
+    const trimmed = raw?.trim() ?? '';
+    if (!trimmed) {
+        return [];
+    }
+    return trimmed
+        .split(',')
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0);
+}
 export function parseCorsOrigin(raw = process.env.CORS_ORIGIN) {
     const trimmed = raw?.trim() ?? '';
     if (!trimmed) {
@@ -10,15 +20,36 @@ export function parseCorsOrigin(raw = process.env.CORS_ORIGIN) {
     if (trimmed === '*') {
         return '*';
     }
-    const origins = trimmed
-        .split(',')
-        .map((origin) => origin.trim())
-        .filter((origin) => origin.length > 0);
+    const origins = parseCommaSeparatedList(trimmed);
     if (origins.length === 0) {
         return null;
     }
     return origins.length === 1 ? origins[0] : origins;
 }
+/** Extra headers from `CORS_ALLOW_HEADERS` (comma-separated). Does not include defaults. */
+export function parseCorsAllowHeaders(raw = process.env.CORS_ALLOW_HEADERS) {
+    return parseCommaSeparatedList(raw);
+}
+function resolveAllowHeaders(optionsAllowHeaders) {
+    if (optionsAllowHeaders !== undefined) {
+        return optionsAllowHeaders;
+    }
+    const extras = parseCorsAllowHeaders();
+    if (extras.length === 0) {
+        return DEFAULT_CORS_ALLOW_HEADERS;
+    }
+    const seen = new Set(DEFAULT_CORS_ALLOW_HEADERS.map((header) => header.toLowerCase()));
+    const merged = [...DEFAULT_CORS_ALLOW_HEADERS];
+    for (const header of extras) {
+        const key = header.toLowerCase();
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        merged.push(header);
+    }
+    return merged;
+}
 export function createCorsMiddleware(options = {}) {
     const origin = options.origin !== undefined ? options.origin : parseCorsOrigin();
     if (origin == null) {
@@ -26,9 +57,12 @@ export function createCorsMiddleware(options = {}) {
             await next();
         };
     }
+    const allowHeaders = resolveAllowHeaders(options.allowHeaders);
+    const credentials = origin !== '*';
     return cors({
         origin,
-        allowHeaders: CORS_ALLOW_HEADERS,
+        credentials,
+        allowHeaders,
         allowMethods: CORS_ALLOW_METHODS,
         maxAge: CORS_MAX_AGE_SECONDS,
     });

package/dist/cli/templates/agents.md

@@ -59,7 +59,8 @@ npx schematic-pg dev
 | `JWT_SECRET` | HMAC secret for Bearer JWT auth |
 | `JWT_ROLE_CLAIM` | JWT claim for role (default `role`) |
 | `JWT_USER_ID_CLAIM` | JWT claim for user id (default `sub`) |
-| `CORS_ORIGIN` | Allowed browser origins (`*` or comma-separated). Unset disables CORS |
+| `CORS_ORIGIN` | Allowed browser origins (`*` or comma-separated). Unset disables CORS. Concrete origins enable credentialed CORS (cookies); `*` does not |
+| `CORS_ALLOW_HEADERS` | Extra allowed request headers (comma-separated), merged with Authorization, Content-Type, X-CSRF-Token |
 
 ## Schema DSL Essentials
 

package/dist/cli/templates.d.ts

@@ -1,6 +1,6 @@
 export declare const AGENTS_TEMPLATE: string;
 export declare const APP_SCHEMA_TEMPLATE = "extensions {\n\n}\n\nenums {\n  UserRole { ADMIN, USER }\n}\n\nmodels {\n  model User {\n    id:           UUID         @id @default(gen_random_uuid())\n    email:        VARCHAR(255) @unique @regex(pattern: \"^[\\w.-]+@[\\w.-]+\\.\\w+$\", message: \"Invalid email address\")\n    name:         VARCHAR(150)?\n    role:         UserRole     @default(USER)\n    passwordHash: VARCHAR(255)? @omit @unfilterable\n    createdAt:    TIMESTAMP    @default(now())\n\n    @rest(except: [create, update, delete])\n    @policy(role: USER, allow: [select], where: \"id = {{auth.user.id}}\")\n    @policy(role: ADMIN, allow: all)\n  }\n}\n";
-export declare const ENV_TEMPLATE = "DATABASE_URL=postgresql://postgrest:postgrest@localhost:5432/postgrest\nJWT_SECRET=\nAUTH_PEPPER=\nAUTH_ACCESS_TOKEN_TTL=1h\nJWT_ROLE_CLAIM=role\nJWT_USER_ID_CLAIM=sub\nCORS_ORIGIN=\n";
+export declare const ENV_TEMPLATE = "DATABASE_URL=postgresql://postgrest:postgrest@localhost:5432/postgrest\nJWT_SECRET=\nAUTH_PEPPER=\nAUTH_ACCESS_TOKEN_TTL=1h\nJWT_ROLE_CLAIM=role\nJWT_USER_ID_CLAIM=sub\nCORS_ORIGIN=\nCORS_ALLOW_HEADERS=\n";
 export declare const GITIGNORE_TEMPLATE = "node_modules/\ndist/\n.env\ndocker_data/\n.DS_Store\n*.log\nnpm-debug.log*\n";
 export declare const DOCKER_COMPOSE_TEMPLATE = "services:\n  postgres:\n    image: postgres:18.4-bookworm\n    container_name: schematic-pg\n    restart: unless-stopped\n    ports:\n      - \"5432:5432\"\n    environment:\n      POSTGRES_USER: postgrest\n      POSTGRES_PASSWORD: postgrest\n      POSTGRES_DB: postgrest\n    volumes:\n      - ./docker_data/postgres:/var/lib/postgresql\n    healthcheck:\n      test: [\"CMD-SHELL\", \"pg_isready -U postgrest -d postgrest\"]\n      interval: 5s\n      timeout: 5s\n      retries: 5\n";
 export declare const TSCONFIG_TEMPLATE = "{\n  \"compilerOptions\": {\n    \"target\": \"ES2022\",\n    \"module\": \"NodeNext\",\n    \"moduleResolution\": \"NodeNext\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true,\n    \"outDir\": \"dist\",\n    \"rootDir\": \".\"\n  },\n  \"include\": [\"generated/**/*\", \"src/**/*\"]\n}\n";

package/dist/cli/templates.js

@@ -34,6 +34,7 @@ AUTH_ACCESS_TOKEN_TTL=1h
 JWT_ROLE_CLAIM=role
 JWT_USER_ID_CLAIM=sub
 CORS_ORIGIN=
+CORS_ALLOW_HEADERS=
 `;
 export const GITIGNORE_TEMPLATE = `node_modules/
 dist/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "schematic-pg",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Single-file backend framework for PostgreSQL and Node.js",
   "type": "module",
   "license": "MIT",