File size: 2,496 Bytes
4e23b01 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 | import type { FastifyReply, FastifyRequest } from 'fastify';
import { stripPort } from './hostnames';
const CORS_ALLOW_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
const CORS_ALLOW_HEADERS = 'Content-Type, Authorization, X-Kimi-Client-Id, X-Kimi-Client-Name, X-Kimi-Client-Version, X-Kimi-Client-Ui-Mode';
export interface OriginHookOptions {
readonly allowedOrigins?: readonly string[];
}
export function parseCorsOrigins(env: NodeJS.ProcessEnv = process.env): string[] {
const raw = env['KIMI_CODE_CORS_ORIGINS'];
if (raw === undefined) {
return [];
}
return raw
.split(',')
.map((entry) => entry.trim())
.filter((entry) => entry.length > 0);
}
export function originHost(origin: string | undefined): string | undefined {
if (origin === undefined) {
return undefined;
}
try {
return new URL(origin).host;
} catch {
return undefined;
}
}
export function isOriginAllowed(
origin: string | undefined,
host: string | undefined,
allowed: readonly string[],
): boolean {
const oh = originHost(origin);
if (oh === undefined) {
return true;
}
const ohStripped = stripPort(oh);
if (host !== undefined) {
const hostStripped = stripPort(host);
if (ohStripped === hostStripped) {
return true;
}
if (isLoopbackHost(ohStripped) && isLoopbackHost(hostStripped)) {
return true;
}
}
return allowed.includes(origin as string);
}
function isLoopbackHost(h: string): boolean {
return (
h === 'localhost' ||
h === '::1' ||
h === '[::1]' ||
h.startsWith('127.') ||
h.endsWith('.localhost')
);
}
export function createOriginHook(
opts: OriginHookOptions,
): (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply | void> {
const allowed = opts.allowedOrigins ?? [];
return async (req, reply) => {
const origin = req.headers.origin;
if (origin === undefined) {
return;
}
if (isOriginAllowed(origin, req.headers.host, allowed)) {
reply.header('Access-Control-Allow-Origin', origin);
reply.header('Access-Control-Allow-Methods', CORS_ALLOW_METHODS);
reply.header(
'Access-Control-Allow-Headers',
req.headers['access-control-request-headers'] ?? CORS_ALLOW_HEADERS,
);
reply.header('Vary', 'Origin');
if (req.method === 'OPTIONS') {
return reply.code(204).send();
}
return;
}
if (req.method === 'OPTIONS') {
return reply.code(204).send();
}
};
}
|