streamby-core 0.24.5 → 0.24.6

package/dist/middleware/routes/export.js

@@ -158,15 +158,25 @@ function exportRouter(config) {
             }
             const origin = req.headers.origin;
             let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
-            // If export's allowedOrigin is ['*'] or it's not set, use the project's settings.
+            const projectOrigins = project.allowedOrigin;
+            // If export's allowedOrigin is ['*'] or it's not set, it inherits from the project.
             if (!effectiveAllowedOrigins || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
-                effectiveAllowedOrigins = project.allowedOrigin;
+                effectiveAllowedOrigins = projectOrigins;
             }
-            // If there's no origin, deny access unless it's public.
+            else {
+                // If the export has its own list, ensure it's a subset of the project's list (if project is not public).
+                if (projectOrigins && !projectOrigins.includes('*')) {
+                    const isSubset = effectiveAllowedOrigins.every((o) => projectOrigins.includes(o));
+                    if (!isSubset) {
+                        return res.status(403).json({ message: 'Unauthorized: Export origins are not allowed by the parent project.' });
+                    }
+                }
+            }
+            // If there's no origin header, deny access unless the effective scope is public.
             if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
                 return res.status(403).json({ message: 'Origin header required' });
             }
-            // Check for public access ('*') or if the origin is in the list.
+            // Check for public access ('*') or if the request's origin is in the effective list.
             const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
             if (!isAllowed) {
                 return res.status(403).json({ message: 'Unauthorized' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.24.5",
+  "version": "0.24.6",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",