next-armored/dist/middlewares/cross-origin-resource-sharing/index.cjs.map

Security middlewares for Next.js

{"version":3,"sources":["../../../middlewares/cross-origin-resource-sharing/index.ts","../../../middlewares/cross-origin-resource-sharing/middleware.ts","../../../middlewares/cross-origin-resource-sharing/config.ts","../../../middlewares/cross-origin-resource-sharing/constants.ts","../../../middlewares/cross-origin-resource-sharing/utils.ts"],"sourcesContent":["import createCorsMiddleware from './middleware';\nimport type { CorsConfig } from './types';\nimport { DEFAULT_CORS_CONFIG } from './config';\n\nexport default createCorsMiddleware;\n\nexport { DEFAULT_CORS_CONFIG, type CorsConfig, createCorsMiddleware };\n","import { NextResponse, NextRequest } from 'next/server';\nimport type { CorsConfig, PathOptions } from './types';\nimport { DEFAULT_CORS_CONFIG } from './config';\nimport {\n  configureAllowCredentials,\n  configureAllowHeaders,\n  configureAllowMethods,\n  configureAllowOrigin,\n  configureExposedHeaders,\n  configureMaxAge,\n  getIsOriginAllowed,\n  isPathIncluded,\n} from './utils';\nimport type { Header, NextCorsMiddleware } from './types';\n\n/**\n * CORS middleware builder\n * @param config - The CORS configuration (origins, methods, headers, etc.)\n * @param pathOptions - Path options selector (includes, excludes) to enable or disable CORS for specific paths\n * @returns The corsMiddleware function\n * @usage\n * ```ts\n * export const corsMiddleware = createCorsMiddleware(config, pathOptions);\n * ```\n */\nconst createCorsMiddleware = (\n  config: CorsConfig,\n  pathOptions: PathOptions = {},\n): NextCorsMiddleware => {\n  const configWithDefaults = { ...DEFAULT_CORS_CONFIG, ...config };\n  const {\n    origins,\n    methods,\n    headers,\n    allowCredentials,\n    exposedHeaders,\n    maxAge,\n    optionsSuccessStatus,\n    preflightContinue,\n  } = configWithDefaults;\n\n  /**\n   * @description Middleware handling CORS\n   * @param request - The request object with information about the origin and the method\n   * @param response (optional) - If provided, the headers will be attached to the response. Unless in case of preflight request without preflightContinue set to true.\n   * @returns A NextResponse object with the headers attached\n   * @usage\n   * ```ts\n   * export const middleware = createCorsMiddleware(config);\n   * ```\n   */\n  const corsMiddleware = (request: NextRequest, response?: NextResponse) => {\n    const nextResponse = response ?? NextResponse.next();\n    const pathname = request.nextUrl.pathname;\n    if (\n      pathOptions.excludes !== undefined &&\n      isPathIncluded(pathname, pathOptions.excludes)\n    ) {\n      return nextResponse;\n    }\n\n    if (\n      pathOptions.includes !== undefined &&\n      !isPathIncluded(pathname, pathOptions.includes)\n    ) {\n      return nextResponse;\n    }\n\n    const origin = request.headers.get('origin') ?? '';\n    const isOriginAllowed = getIsOriginAllowed(origin, origins);\n    const optionsHeaders: Header[] = [];\n    optionsHeaders.push(configureMaxAge(maxAge));\n    optionsHeaders.push(configureExposedHeaders(exposedHeaders));\n    optionsHeaders.push(configureAllowCredentials(allowCredentials));\n    optionsHeaders.push(configureAllowMethods(methods));\n    optionsHeaders.push(configureAllowHeaders(headers));\n\n    if (isOriginAllowed.result) {\n      optionsHeaders.push(configureAllowOrigin(isOriginAllowed.origin));\n    }\n\n    const isPreflight = request.method === 'OPTIONS';\n\n    if (isPreflight && !preflightContinue) {\n      return NextResponse.json(\n        {},\n        {\n          headers: optionsHeaders.map(header => [header.key, header.value]),\n          status: optionsSuccessStatus,\n        },\n      );\n    }\n\n    optionsHeaders.forEach(({ key, value }) => {\n      nextResponse.headers.set(key, value);\n    });\n\n    return nextResponse;\n  };\n\n  return corsMiddleware;\n};\n\nexport default createCorsMiddleware;\n","import type { Method } from './types';\n\ntype CorsConfigDefaults = {\n  origins: undefined;\n  methods: Method[];\n  headers: string[];\n  allowCredentials: boolean;\n  exposedHeaders: string[];\n  preflightContinue: boolean;\n  maxAge: number;\n  optionsSuccessStatus: number;\n};\n\n/**\n * @default origins is undefined, you must specify it manually to prevent unwanted * which can be a security risk\n * @default methods is ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS']\n * @default headers is ['Content-Type', 'Authorization']\n * @default allowCredentials is true\n * @default preflightContinue is false\n * @default optionsSuccessStatus is 204\n * @default exposedHeaders is []\n * @default maxAge is 1 day\n */\nexport const DEFAULT_CORS_CONFIG: CorsConfigDefaults = {\n  origins: undefined, // Required -> DO NOT USE * by default\n  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],\n  headers: ['Content-Type', 'Authorization'],\n  allowCredentials: true,\n  preflightContinue: false,\n  optionsSuccessStatus: 204,\n  exposedHeaders: [],\n  maxAge: 60 * 60 * 24, // 1 day\n};\n","export const ACCESS_CONTROL_ALLOW_ORIGIN = 'Access-Control-Allow-Origin';\nexport const ACCESS_CONTROL_ALLOW_CREDENTIALS =\n  'Access-Control-Allow-Credentials';\nexport const ACCESS_CONTROL_ALLOW_METHODS = 'Access-Control-Allow-Methods';\nexport const ACCESS_CONTROL_ALLOW_HEADERS = 'Access-Control-Allow-Headers';\nexport const ACCESS_CONTROL_EXPOSE_HEADERS = 'Access-Control-Expose-Headers';\nexport const ACCESS_CONTROL_MAX_AGE = 'Access-Control-Max-Age';\n","import {\n  ACCESS_CONTROL_MAX_AGE,\n  ACCESS_CONTROL_EXPOSE_HEADERS,\n  ACCESS_CONTROL_ALLOW_CREDENTIALS,\n  ACCESS_CONTROL_ALLOW_METHODS,\n  ACCESS_CONTROL_ALLOW_HEADERS,\n  ACCESS_CONTROL_ALLOW_ORIGIN,\n} from './constants';\nimport type {\n  Header,\n  IsOriginAllowedResult,\n  Method,\n  Origin,\n  PathMatcher,\n} from './types';\n\nexport function isPathMatching(\n  url: string,\n  pathMatcher: PathMatcher,\n  includeOption: 'every' | 'some' = 'every',\n) {\n  const { startWith, additionalIncludes } = pathMatcher;\n  const isMatching = url.startsWith(startWith);\n  if (isMatching && additionalIncludes !== undefined) {\n    if (includeOption === 'every') {\n      return additionalIncludes.every(path => url.includes(path));\n    }\n    return additionalIncludes.some(path => url.includes(path));\n  }\n  return isMatching;\n}\n\nexport function isPathIncluded(path: string, pathToMatch: PathMatcher[]) {\n  return pathToMatch.some(pathMatcher => isPathMatching(path, pathMatcher));\n}\n\nexport function configureMaxAge(maxAge: number): Header {\n  return {\n    key: ACCESS_CONTROL_MAX_AGE,\n    value: maxAge.toString(),\n  };\n}\n\nexport function configureExposedHeaders(exposedHeaders: string[]): Header {\n  return {\n    key: ACCESS_CONTROL_EXPOSE_HEADERS,\n    value: exposedHeaders.join(', '),\n  };\n}\n\nexport function configureAllowCredentials(allowCredentials: boolean): Header {\n  return {\n    key: ACCESS_CONTROL_ALLOW_CREDENTIALS,\n    value: allowCredentials ? 'true' : 'false',\n  };\n}\n\nexport function configureAllowMethods(methods: Method[]): Header {\n  return {\n    key: ACCESS_CONTROL_ALLOW_METHODS,\n    value: methods.join(', '),\n  };\n}\n\nexport function configureAllowHeaders(headers: string[]): Header {\n  return {\n    key: ACCESS_CONTROL_ALLOW_HEADERS,\n    value: headers.join(', '),\n  };\n}\n\nexport function configureAllowOrigin(origin: string): Header {\n  return {\n    key: ACCESS_CONTROL_ALLOW_ORIGIN,\n    value: origin,\n  };\n}\n\nexport function getIsOriginAllowed(\n  origin: string,\n  allowedOrigins: Origin[],\n): IsOriginAllowedResult {\n  if (allowedOrigins.length === 0) {\n    return { result: false };\n  }\n  // if contains '*', allow all origins\n  if (allowedOrigins.includes('*')) {\n    return { result: true, origin };\n  }\n  for (const allowedOrigin of allowedOrigins) {\n    if (typeof allowedOrigin === 'string' && allowedOrigin === origin) {\n      return { result: true, origin };\n    }\n    if (allowedOrigin instanceof RegExp && allowedOrigin.test(origin)) {\n      return { result: true, origin };\n    }\n  }\n\n  return { result: false };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA0C;;;ACuBnC,IAAM,sBAA0C;AAAA,EACrD,SAAS;AAAA;AAAA,EACT,SAAS,CAAC,OAAO,QAAQ,OAAO,UAAU,SAAS,SAAS;AAAA,EAC5D,SAAS,CAAC,gBAAgB,eAAe;AAAA,EACzC,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,sBAAsB;AAAA,EACtB,gBAAgB,CAAC;AAAA,EACjB,QAAQ,KAAK,KAAK;AAAA;AACpB;;;AChCO,IAAM,8BAA8B;AACpC,IAAM,mCACX;AACK,IAAM,+BAA+B;AACrC,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,yBAAyB;;;ACU/B,SAAS,eACd,KACA,aACA,gBAAkC,SAClC;AACA,QAAM,EAAE,WAAW,mBAAmB,IAAI;AAC1C,QAAM,aAAa,IAAI,WAAW,SAAS;AAC3C,MAAI,cAAc,uBAAuB,QAAW;AAClD,QAAI,kBAAkB,SAAS;AAC7B,aAAO,mBAAmB,MAAM,UAAQ,IAAI,SAAS,IAAI,CAAC;AAAA,IAC5D;AACA,WAAO,mBAAmB,KAAK,UAAQ,IAAI,SAAS,IAAI,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEO,SAAS,eAAe,MAAc,aAA4B;AACvE,SAAO,YAAY,KAAK,iBAAe,eAAe,MAAM,WAAW,CAAC;AAC1E;AAEO,SAAS,gBAAgB,QAAwB;AACtD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,OAAO,OAAO,SAAS;AAAA,EACzB;AACF;AAEO,SAAS,wBAAwB,gBAAkC;AACxE,SAAO;AAAA,IACL,KAAK;AAAA,IACL,OAAO,eAAe,KAAK,IAAI;AAAA,EACjC;AACF;AAEO,SAAS,0BAA0B,kBAAmC;AAC3E,SAAO;AAAA,IACL,KAAK;AAAA,IACL,OAAO,mBAAmB,SAAS;AAAA,EACrC;AACF;AAEO,SAAS,sBAAsB,SAA2B;AAC/D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,OAAO,QAAQ,KAAK,IAAI;AAAA,EAC1B;AACF;AAEO,SAAS,sBAAsB,SAA2B;AAC/D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,OAAO,QAAQ,KAAK,IAAI;AAAA,EAC1B;AACF;AAEO,SAAS,qBAAqB,QAAwB;AAC3D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACF;AAEO,SAAS,mBACd,QACA,gBACuB;AACvB,MAAI,eAAe,WAAW,GAAG;AAC/B,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AAEA,MAAI,eAAe,SAAS,GAAG,GAAG;AAChC,WAAO,EAAE,QAAQ,MAAM,OAAO;AAAA,EAChC;AACA,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ;AACjE,aAAO,EAAE,QAAQ,MAAM,OAAO;AAAA,IAChC;AACA,QAAI,yBAAyB,UAAU,cAAc,KAAK,MAAM,GAAG;AACjE,aAAO,EAAE,QAAQ,MAAM,OAAO;AAAA,IAChC;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,MAAM;AACzB;;;AH1EA,IAAM,uBAAuB,CAC3B,QACA,cAA2B,CAAC,MACL;AACvB,QAAM,qBAAqB,EAAE,GAAG,qBAAqB,GAAG,OAAO;AAC/D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAYJ,QAAM,iBAAiB,CAAC,SAAsB,aAA4B;AACxE,UAAM,eAAe,YAAY,2BAAa,KAAK;AACnD,UAAM,WAAW,QAAQ,QAAQ;AACjC,QACE,YAAY,aAAa,UACzB,eAAe,UAAU,YAAY,QAAQ,GAC7C;AACA,aAAO;AAAA,IACT;AAEA,QACE,YAAY,aAAa,UACzB,CAAC,eAAe,UAAU,YAAY,QAAQ,GAC9C;AACA,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAChD,UAAM,kBAAkB,mBAAmB,QAAQ,OAAO;AAC1D,UAAM,iBAA2B,CAAC;AAClC,mBAAe,KAAK,gBAAgB,MAAM,CAAC;AAC3C,mBAAe,KAAK,wBAAwB,cAAc,CAAC;AAC3D,mBAAe,KAAK,0BAA0B,gBAAgB,CAAC;AAC/D,mBAAe,KAAK,sBAAsB,OAAO,CAAC;AAClD,mBAAe,KAAK,sBAAsB,OAAO,CAAC;AAElD,QAAI,gBAAgB,QAAQ;AAC1B,qBAAe,KAAK,qBAAqB,gBAAgB,MAAM,CAAC;AAAA,IAClE;AAEA,UAAM,cAAc,QAAQ,WAAW;AAEvC,QAAI,eAAe,CAAC,mBAAmB;AACrC,aAAO,2BAAa;AAAA,QAClB,CAAC;AAAA,QACD;AAAA,UACE,SAAS,eAAe,IAAI,YAAU,CAAC,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,UAChE,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAEA,mBAAe,QAAQ,CAAC,EAAE,KAAK,MAAM,MAAM;AACzC,mBAAa,QAAQ,IAAI,KAAK,KAAK;AAAA,IACrC,CAAC;AAED,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,IAAO,qBAAQ;;;ADnGf,IAAO,wCAAQ;","names":[]}