Function cors

packages/platform/src/internal/httpMiddleware.ts:219–330

(options?: {
  readonly allowedOrigins?: ReadonlyArray<string> | Predicate.Predicate<string> | undefined
  readonly allowedMethods?: ReadonlyArray<string> | undefined
  readonly allowedHeaders?: ReadonlyArray<string> | undefined
  readonly exposedHeaders?: ReadonlyArray<string> | undefined
  readonly maxAge?: number | undefined
  readonly credentials?: boolean | undefined
})

/** @internal */
export const cors = (options?: {
  readonly allowedOrigins?: ReadonlyArray<string> | Predicate.Predicate<string> | undefined
  readonly allowedMethods?: ReadonlyArray<string> | undefined
  readonly allowedHeaders?: ReadonlyArray<string> | undefined
  readonly exposedHeaders?: ReadonlyArray<string> | undefined
  readonly maxAge?: number | undefined
  readonly credentials?: boolean | undefined
}) => {
  const opts = {
    allowedOrigins: [],
    allowedMethods: ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE"],
    allowedHeaders: [],
    exposedHeaders: [],
    credentials: false,
    ...options
  }

  const isAllowedOrigin = typeof opts.allowedOrigins === "function"
    ? opts.allowedOrigins
    : (origin: string) => (opts.allowedOrigins as ReadonlyArray<string>).includes(origin)

  const allowOrigin = typeof opts.allowedOrigins === "function" || opts.allowedOrigins.length > 1 ?
    (originHeader: string): ReadonlyRecord<string, string> | undefined => {
      if (isAllowedOrigin(originHeader)) {
        return {
          "access-control-allow-origin": originHeader,
          vary: "Origin"
        }
      }
      return undefined
    } :
    opts.allowedOrigins.length === 1 ?
    Function.constant({
      "access-control-allow-origin": opts.allowedOrigins[0],
      vary: "Origin"
    }) :
    Function.constant({
      "access-control-allow-origin": "*"
    })

  const allowMethods = opts.allowedMethods.length > 0
    ? { "access-control-allow-methods": opts.allowedMethods.join(", ") }
    : undefined

  const allowCredentials = opts.credentials
    ? { "access-control-allow-credentials": "true" }
    : undefined

  const allowHeaders = (
    accessControlRequestHeaders: string | undefined
  ): ReadonlyRecord<string, string> | undefined => {
    if (opts.allowedHeaders.length === 0 && accessControlRequestHeaders) {
      return {
        vary: "Access-Control-Request-Headers",
        "access-control-allow-headers": accessControlRequestHeaders
      }
    }