diesel-core/dist/middlewares/cors/cors.js

Web framework built on Web Standards

var d=["GET","POST","PUT","DELETE","OPTIONS"],A=["Content-Type","Authorization"],g=(s)=>{return async function(e){let o=e.req.headers.get("origin")??"*",r=s.origin,t=s.allowedHeaders??A,a=s.methods??d,i=s.credentials??!1,n=s.exposedHeaders??[],l=s.maxAge;if(e.setHeader("Access-Control-Allow-Methods",a.join(",")),e.setHeader("Access-Control-Allow-Headers",t.join(",")),e.setHeader("Access-Control-Allow-Credentials",i.toString()),n.length>0)e.setHeader("Access-Control-Expose-Headers",n.join(","));if(r==="*"||o==="*")e.setHeader("Access-Control-Allow-Origin","*");else if(Array.isArray(r))if(o&&r.includes(o))e.setHeader("Access-Control-Allow-Origin",o);else if(r.includes("*"))e.setHeader("Access-Control-Allow-Origin","*");else return e.json({message:"CORS not allowed"},403);else if(typeof r==="string")if(o===r)e.setHeader("Access-Control-Allow-Origin",o);else return e.json({message:"CORS not allowed"},403);else return e.json({message:"CORS not allowed"},403);if(e.req.method==="OPTIONS"){if(l)e.setHeader("Access-Control-Max-Age",l.toString());return e.text("",204)}return null}};export{g as cors};