{"version":3,"file":"cors.mjs","sources":["../../src/middlewares/cors.ts"],"sourcesContent":["import koaCors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = {\n  enabled?: boolean;\n  origin: string | string[] | ((ctx: any) => string | string[]);\n  expose?: string | string[];\n  maxAge?: number;\n  credentials?: boolean;\n  methods?: string | string[];\n  headers?: string | string[];\n  keepHeadersOnError?: boolean;\n};\n\nconst defaults: Config = {\n  origin: '*',\n  maxAge: 31536000,\n  credentials: true,\n  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],\n  headers: ['Content-Type', 'Authorization', 'Origin', 'Accept'],\n  keepHeadersOnError: false,\n};\n\nexport const cors: Core.MiddlewareFactory<Config> = (config) => {\n  const { origin, expose, maxAge, credentials, methods, headers, keepHeadersOnError } = {\n    ...defaults,\n    ...config,\n  };\n\n  if (config.enabled !== undefined) {\n    strapi.log.warn(\n      'The strapi::cors middleware no longer supports the `enabled` option. Using it' +\n        ' to conditionally enable CORS might cause an insecure default. To disable strapi::cors, remove it from' +\n        ' the exported array in config/middleware.js'\n    );\n  }\n\n  return koaCors({\n    async origin(ctx) {\n      if (!ctx.get('Origin')) {\n        return '*';\n      }\n\n      let originList: string | string[];\n\n      if (typeof origin === 'function') {\n        originList = await origin(ctx);\n      } else {\n        originList = origin;\n      }\n\n      if (Array.isArray(originList)) {\n        return originList.includes(ctx.get('Origin')) ? ctx.get('Origin') : '';\n      }\n\n      const parsedOrigin = originList.split(',').map((origin) => origin.trim());\n      if (parsedOrigin.length > 1) {\n        return parsedOrigin.includes(ctx.get('Origin')) ? ctx.get('Origin') : '';\n      }\n\n      return originList;\n    },\n    exposeHeaders: expose,\n    maxAge,\n    credentials,\n    allowMethods: methods,\n    allowHeaders: headers,\n    keepHeadersOnError,\n  });\n};\n"],"names":["defaults","origin","maxAge","credentials","methods","headers","keepHeadersOnError","cors","config","expose","enabled","undefined","strapi","log","warn","koaCors","ctx","get","originList","Array","isArray","includes","parsedOrigin","split","map","trim","length","exposeHeaders","allowMethods","allowHeaders"],"mappings":";;AAeA,MAAMA,QAAmB,GAAA;IACvBC,MAAQ,EAAA,GAAA;IACRC,MAAQ,EAAA,QAAA;IACRC,WAAa,EAAA,IAAA;IACbC,OAAS,EAAA;AAAC,QAAA,KAAA;AAAO,QAAA,MAAA;AAAQ,QAAA,KAAA;AAAO,QAAA,OAAA;AAAS,QAAA,QAAA;AAAU,QAAA,MAAA;AAAQ,QAAA;AAAU,KAAA;IACrEC,OAAS,EAAA;AAAC,QAAA,cAAA;AAAgB,QAAA,eAAA;AAAiB,QAAA,QAAA;AAAU,QAAA;AAAS,KAAA;IAC9DC,kBAAoB,EAAA;AACtB,CAAA;AAEO,MAAMC,OAAuC,CAACC,MAAAA,GAAAA;AACnD,IAAA,MAAM,EAAEP,MAAM,EAAEQ,MAAM,EAAEP,MAAM,EAAEC,WAAW,EAAEC,OAAO,EAAEC,OAAO,EAAEC,kBAAkB,EAAE,GAAG;AACpF,QAAA,GAAGN,QAAQ;AACX,QAAA,GAAGQ;AACL,KAAA;IAEA,IAAIA,MAAAA,CAAOE,OAAO,KAAKC,SAAW,EAAA;AAChCC,QAAAA,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,kFACE,wGACA,GAAA,6CAAA,CAAA;AAEN;AAEA,IAAA,OAAOC,OAAQ,CAAA;AACb,QAAA,MAAMd,QAAOe,GAAG,EAAA;AACd,YAAA,IAAI,CAACA,GAAAA,CAAIC,GAAG,CAAC,QAAW,CAAA,EAAA;gBACtB,OAAO,GAAA;AACT;YAEA,IAAIC,UAAAA;YAEJ,IAAI,OAAOjB,WAAW,UAAY,EAAA;AAChCiB,gBAAAA,UAAAA,GAAa,MAAMjB,MAAOe,CAAAA,GAAAA,CAAAA;aACrB,MAAA;gBACLE,UAAajB,GAAAA,MAAAA;AACf;YAEA,IAAIkB,KAAAA,CAAMC,OAAO,CAACF,UAAa,CAAA,EAAA;gBAC7B,OAAOA,UAAAA,CAAWG,QAAQ,CAACL,GAAIC,CAAAA,GAAG,CAAC,QAAaD,CAAAA,CAAAA,GAAAA,GAAAA,CAAIC,GAAG,CAAC,QAAY,CAAA,GAAA,EAAA;AACtE;YAEA,MAAMK,YAAAA,GAAeJ,UAAWK,CAAAA,KAAK,CAAC,GAAA,CAAA,CAAKC,GAAG,CAAC,CAACvB,MAAWA,GAAAA,MAAAA,CAAOwB,IAAI,EAAA,CAAA;YACtE,IAAIH,YAAAA,CAAaI,MAAM,GAAG,CAAG,EAAA;gBAC3B,OAAOJ,YAAAA,CAAaD,QAAQ,CAACL,GAAIC,CAAAA,GAAG,CAAC,QAAaD,CAAAA,CAAAA,GAAAA,GAAAA,CAAIC,GAAG,CAAC,QAAY,CAAA,GAAA,EAAA;AACxE;YAEA,OAAOC,UAAAA;AACT,SAAA;QACAS,aAAelB,EAAAA,MAAAA;AACfP,QAAAA,MAAAA;AACAC,QAAAA,WAAAA;QACAyB,YAAcxB,EAAAA,OAAAA;QACdyB,YAAcxB,EAAAA,OAAAA;AACdC,QAAAA;AACF,KAAA,CAAA;AACF;;;;"}