zengate 1.0.1 → 1.0.2

package/README.md

@@ -3,6 +3,7 @@
 [![CI](https://github.com/developingchet/zengate/actions/workflows/ci.yml/badge.svg)](https://github.com/developingchet/zengate/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/zengate)](https://www.npmjs.com/package/zengate)
 [![Docker Hub](https://img.shields.io/docker/v/developingchet/zengate?label=docker&sort=semver)](https://hub.docker.com/r/developingchet/zengate)
+[![Socket](https://socket.dev/api/badge/npm/package/zengate)](https://socket.dev/npm/package/zengate)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 An **OpenAI-compatible API for OpenCode's free Zen models: no Zen account or upstream API key needed.**

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "zengate",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Keyless OpenAI-compatible API (Chat Completions + Responses) for OpenCode's free Zen models, served through the real OpenCode CLI.",
+  "author": {
+    "name": "developingchet",
+    "url": "https://github.com/developingchet"
+  },
   "homepage": "https://github.com/developingchet/zengate#readme",
   "repository": {
     "type": "git",
@@ -46,12 +50,16 @@
     "self-hosted"
   ],
   "license": "MIT",
-  "engines": {
-    "node": ">=24.0.0"
-  },
   "dependencies": {
-    "cors": "^2.8.5",
     "express": "^5.1.0",
     "opencode-ai": "^1.18.32"
+  },
+  "overrides": {
+    "es-define-property": "npm:@socketregistry/es-define-property@^1",
+    "safer-buffer": "npm:@socketregistry/safer-buffer@^1",
+    "side-channel": "npm:@socketregistry/side-channel@^1"
+  },
+  "engines": {
+    "node": ">=24.0.0"
   }
 }

package/src/server/app.js

@@ -1,8 +1,8 @@
-import cors from 'cors';
 import express from 'express';
 import { chatCompletionsHandler } from '../openai/chat.js';
 import { modelsHandlers } from '../openai/models.js';
 import { responsesHandlers } from '../openai/responses.js';
+import { corsMiddleware } from './cors.js';
 import { ApiError, sendError, toApiError } from './errors.js';
 import { createLimiter } from './limiter.js';
 import { createMetrics } from './metrics.js';
@@ -68,7 +68,7 @@ export function createApp({ config, logger, backend, hub, catalog, runner, store
     app.set('trust proxy', config.TRUST_PROXY || false);
     app.use(requestId, securityHeaders, metrics.middleware, requestLogger(logger));
     if (config.CORS_ORIGINS.length) {
-        app.use(cors({ origin: config.CORS_ORIGINS, exposedHeaders: EXPOSED_HEADERS, maxAge: 600 }));
+        app.use(corsMiddleware({ origins: config.CORS_ORIGINS, exposedHeaders: EXPOSED_HEADERS, maxAge: 600 }));
     }
 
     app.get('/health', (req, res) => res.json({ status: 'ok' }));

package/src/server/cors.js

@@ -0,0 +1,33 @@
+const ALLOWED_METHODS = 'GET,HEAD,POST,DELETE,OPTIONS';
+// A comma-separated list of HTTP header names (RFC 9110 tokens).
+const HEADER_LIST = /^[!#$%&'*+.^`|~\w-]+(?:\s*,\s*[!#$%&'*+.^`|~\w-]+)*$/;
+
+/**
+ * CORS for an explicit list of browser origins. Origins are matched exactly,
+ * credentials are never allowed, and preflights are answered directly.
+ * @param {{ origins: string[], exposedHeaders: string[], maxAge: number }} options
+ */
+export function corsMiddleware({ origins, exposedHeaders, maxAge }) {
+    const allowed = new Set(origins);
+    const exposed = exposedHeaders.join(',');
+
+    return (req, res, next) => {
+        const origin = req.headers.origin;
+        if (!origin) return next();
+        res.vary('Origin');
+        const granted = allowed.has(origin);
+        const isPreflight = req.method === 'OPTIONS' && Boolean(req.headers['access-control-request-method']);
+
+        if (!isPreflight) {
+            if (granted) res.set({ 'Access-Control-Allow-Origin': origin, 'Access-Control-Expose-Headers': exposed });
+            return next();
+        }
+        if (granted) {
+            const requested = String(req.headers['access-control-request-headers'] || '').trim();
+            res.set({ 'Access-Control-Allow-Origin': origin, 'Access-Control-Allow-Methods': ALLOWED_METHODS, 'Access-Control-Max-Age': String(maxAge) });
+            if (requested && HEADER_LIST.test(requested)) res.set('Access-Control-Allow-Headers', requested);
+            res.vary('Access-Control-Request-Headers');
+        }
+        return res.status(204).end();
+    };
+}