streamby-core 0.24.4 → 0.24.6

package/dist/middleware/cors.js

@@ -18,19 +18,20 @@ const projectOriginMiddleware = async (req, res, next) => {
             return res.status(404).json({ message: 'Project not found' });
         }
         if (project.allowedOrigin && project.allowedOrigin.length > 0) {
-            if (project.allowedOrigin.includes(origin)) {
+            // Allow if public ('*') or origin is in the list
+            if (project.allowedOrigin.includes('*') || project.allowedOrigin.includes(origin)) {
                 res.header('Access-Control-Allow-Origin', origin);
                 res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
                 res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-                next();
+                return next();
             }
             else {
                 return res.status(403).json({ message: 'Origin not allowed' });
             }
         }
         else {
-            // If no origins are configured, allow the request
-            next();
+            // If allowedOrigin is empty, deny access for security.
+            return res.status(403).json({ message: 'Origin not allowed' });
         }
     }
     catch (error) {

package/dist/middleware/routes/export.js

@@ -157,8 +157,28 @@ function exportRouter(config) {
                 return res.status(404).json({ message: 'Export not found in this project' });
             }
             const origin = req.headers.origin;
-            const allowedOrigins = exportMetadata.allowedOrigin || project.allowedOrigin;
-            if (!allowedOrigins.includes(origin)) {
+            let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
+            const projectOrigins = project.allowedOrigin;
+            // If export's allowedOrigin is ['*'] or it's not set, it inherits from the project.
+            if (!effectiveAllowedOrigins || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
+                effectiveAllowedOrigins = projectOrigins;
+            }
+            else {
+                // If the export has its own list, ensure it's a subset of the project's list (if project is not public).
+                if (projectOrigins && !projectOrigins.includes('*')) {
+                    const isSubset = effectiveAllowedOrigins.every((o) => projectOrigins.includes(o));
+                    if (!isSubset) {
+                        return res.status(403).json({ message: 'Unauthorized: Export origins are not allowed by the parent project.' });
+                    }
+                }
+            }
+            // If there's no origin header, deny access unless the effective scope is public.
+            if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
+                return res.status(403).json({ message: 'Origin header required' });
+            }
+            // Check for public access ('*') or if the request's origin is in the effective list.
+            const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
+            if (!isAllowed) {
                 return res.status(403).json({ message: 'Unauthorized' });
             }
             const targetDb = config.databases?.find(db => db.type === project.dbType);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.24.4",
+  "version": "0.24.6",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",