DebateOwl/supabase/functions/_shared/cors.ts at main · Programcode/DebateOwl · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
// Shared CORS policy for every browser-called Edge Function.
//
// This used to be copy-pasted into each function and had drifted: some lists
// omitted the Playwright port (18080).

export const PUBLIC_WEB_APP_ORIGIN = "https://debateowl.com";
/** The domain before the move to debateowl.com. It 301s to the new one, but open tabs and PWAs may still call from it. */
export const PREVIOUS_WEB_APP_ORIGIN = "https://debate.pi-stack.org";

/** Browser origins allowed to call the functions. Index 0 is the fallback. */
export const ALLOWED_ORIGINS = [
  PUBLIC_WEB_APP_ORIGIN,
  PREVIOUS_WEB_APP_ORIGIN,
  "http://localhost:8080",
  "http://127.0.0.1:8080",
  "http://localhost:18080",
  "http://127.0.0.1:18080",
  "http://127.0.0.1:18081", // Local full-stack browser gate
  "http://localhost:5173",
  "http://127.0.0.1:54321", // Local Supabase
] as const;

/**
 * Vercel preview and staging hosts for the two DebateLab projects. Preview
 * hosts end in this team's scope slug. Tokens live in the real origin's
 * storage, so a lookalike host gains nothing from being allowed here.
 */
const VERCEL_PREVIEW_ORIGIN =
  /^https:\/\/(?:debate-navigator|debatelab-staging)-[a-z0-9-]+-adam-gaborjanis-projects\.vercel\.app$/;
const STAGING_WEB_APP_ORIGIN = "https://debatelab-staging.vercel.app";

export function isAllowedOrigin(origin: string): boolean {
  return (ALLOWED_ORIGINS as readonly string[]).includes(origin) ||
    origin === STAGING_WEB_APP_ORIGIN ||
    VERCEL_PREVIEW_ORIGIN.test(origin) ||
    (isDevOrigin(origin) && (Deno.env.get("LOCAL_GATE_APP_ORIGINS") ?? "")
      .split(",").some((allowed) => allowed.trim() === origin));
}

export type CorsMethods = "POST, OPTIONS" | "GET, POST, OPTIONS" | "POST, GET, OPTIONS";

/**
 * Matches the exact hostname and requires http:, rather than a string prefix.
 * `startsWith("http://localhost")` also matches an attacker-controlled origin
 * like "http://localhost.evil.com".
 */
export function isDevOrigin(origin: string): boolean {
  let url: URL;
  try {
    url = new URL(origin);
  } catch {
    return false;
  }
  if (url.protocol !== "http:") return false;
  return (
    url.hostname === "localhost" ||
    url.hostname === "127.0.0.1" ||
    /^192\.168\.\d{1,3}\.\d{1,3}$/.test(url.hostname)
  );
}

export interface CorsOptions {
  /** Allow any localhost/127.0.0.1/192.168.x.x origin, for on-device testing. */
  allowDevOrigins?: boolean;
  methods?: CorsMethods;
}

export function getCorsHeaders(
  origin: string | null,
  { allowDevOrigins = false, methods = "POST, OPTIONS" }: CorsOptions = {},
): Record<string, string> {
  const permitted = Boolean(origin) && (
    isAllowedOrigin(origin as string) ||
    (allowDevOrigins && isDevOrigin(origin as string))
  );
  return {
    "Vary": "Origin",
    "Access-Control-Allow-Origin": permitted ? origin as string : ALLOWED_ORIGINS[0],
    "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
    "Access-Control-Allow-Methods": methods,
  };
}