streamby-core 0.24.4 → 0.24.5

package/dist/middleware/cors.js

@@ -18,19 +18,20 @@ const projectOriginMiddleware = async (req, res, next) => {
             return res.status(404).json({ message: 'Project not found' });
         }
         if (project.allowedOrigin && project.allowedOrigin.length > 0) {
-            if (project.allowedOrigin.includes(origin)) {
+            // Allow if public ('*') or origin is in the list
+            if (project.allowedOrigin.includes('*') || project.allowedOrigin.includes(origin)) {
                 res.header('Access-Control-Allow-Origin', origin);
                 res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
                 res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-                next();
+                return next();
             }
             else {
                 return res.status(403).json({ message: 'Origin not allowed' });
             }
         }
         else {
-            // If no origins are configured, allow the request
-            next();
+            // If allowedOrigin is empty, deny access for security.
+            return res.status(403).json({ message: 'Origin not allowed' });
         }
     }
     catch (error) {

package/dist/middleware/routes/export.js

@@ -157,8 +157,18 @@ function exportRouter(config) {
                 return res.status(404).json({ message: 'Export not found in this project' });
             }
             const origin = req.headers.origin;
-            const allowedOrigins = exportMetadata.allowedOrigin || project.allowedOrigin;
-            if (!allowedOrigins.includes(origin)) {
+            let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
+            // If export's allowedOrigin is ['*'] or it's not set, use the project's settings.
+            if (!effectiveAllowedOrigins || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
+                effectiveAllowedOrigins = project.allowedOrigin;
+            }
+            // If there's no origin, deny access unless it's public.
+            if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
+                return res.status(403).json({ message: 'Origin header required' });
+            }
+            // Check for public access ('*') or if the origin is in the list.
+            const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
+            if (!isAllowed) {
                 return res.status(403).json({ message: 'Unauthorized' });
             }
             const targetDb = config.databases?.find(db => db.type === project.dbType);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.24.4",
+  "version": "0.24.5",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",