File size: 2,757 Bytes
20f83d9 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 | /**
* CORS header generation -- TypeScript port of api/_cors.js.
*
* Identical ALLOWED_ORIGIN_PATTERNS and logic, with methods set
* to 'GET, POST, OPTIONS' (sebuf routes support GET and POST).
*/
const PRODUCTION_PATTERNS: RegExp[] = [
/^https:\/\/(.*\.)?worldmonitor\.app$/,
// Vercel preview deployments under the "eliewm" team scope, e.g.
// worldmonitor-git-<branch>-eliewm.vercel.app (git-branch alias)
// worldmonitor-<hash>-eliewm.vercel.app (deployment URL)
// Tight on purpose: never a bare *.vercel.app (this is a security allowlist).
/^https:\/\/worldmonitor-[a-z0-9-]+-eliewm\.vercel\.app$/,
/^https?:\/\/tauri\.localhost(:\d+)?$/,
/^https?:\/\/[a-z0-9-]+\.tauri\.localhost(:\d+)?$/i,
/^tauri:\/\/localhost$/,
/^asset:\/\/localhost$/,
];
const DEV_PATTERNS: RegExp[] = [
/^https?:\/\/localhost(:\d+)?$/,
/^https?:\/\/127\.0\.0\.1(:\d+)?$/,
];
const ALLOWED_ORIGIN_PATTERNS: RegExp[] =
process.env.NODE_ENV === 'production'
? PRODUCTION_PATTERNS
: [...PRODUCTION_PATTERNS, ...DEV_PATTERNS];
const ALLOWED_HEADERS = [
'Content-Type',
'Authorization',
'X-WorldMonitor-Key',
'X-Api-Key',
'X-Widget-Key',
'X-Pro-Key',
'X-WorldMonitor-Desktop-Timestamp',
'X-WorldMonitor-Desktop-Signature',
'Idempotency-Key',
'Mcp-Session-Id',
'MCP-Protocol-Version',
'Last-Event-ID',
].join(', ');
const EXPOSED_HEADERS = [
'Mcp-Session-Id',
'WWW-Authenticate',
'Retry-After',
'Idempotency-Key',
'Idempotent-Replayed',
'Location',
// See api/_cors.js — the gateway emits this on every billing-verification
// denial and cross-origin clients could not read it (#5622).
'X-Billing-Verification',
'X-RateLimit-Limit',
'X-RateLimit-Remaining',
'X-RateLimit-Reset',
'X-WorldMonitor-Bbox',
'X-WorldMonitor-Bbox-Missing',
'X-WorldMonitor-Bbox-Invalid',
'X-Military-Bbox',
].join(', ');
export function isAllowedOrigin(origin: string): boolean {
return Boolean(origin) && ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));
}
export function getCorsHeaders(req: Request): Record<string, string> {
const origin = req.headers.get('origin') || '';
const allowOrigin = isAllowedOrigin(origin) ? origin : 'https://worldmonitor.app';
return {
'Access-Control-Allow-Origin': allowOrigin,
'Access-Control-Allow-Credentials': 'true',
'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
'Access-Control-Allow-Headers': ALLOWED_HEADERS,
'Access-Control-Expose-Headers': EXPOSED_HEADERS,
'Access-Control-Max-Age': '3600',
'Vary': 'Origin',
};
}
export function isDisallowedOrigin(req: Request): boolean {
const origin = req.headers.get('origin');
if (!origin) return false;
return !isAllowedOrigin(origin);
}
|