ifontosh/DndGamePlayerLicenseServer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CORS support for landing download tracking endpoint.

Browse Source 
Browsers on ttrpgplayer.ru need preflight and Access-Control-Allow-Origin on POST /v1/track/download.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Ivan Fontosh
2026-07-06 15:08:21 +08:00
parent 6d4b74d410
commit 7538458677
2 changed files with 128 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server.mjs
+59 -11
View File
@@ -34,15 +34,49 @@ function writeData(data) {
fs.writeFileSync(p, `${JSON.stringify(data, null, 2)}\n`, 'utf8');
}
function json(res, code, obj) {
const DEFAULT_TRACK_DOWNLOAD_CORS_ORIGINS = [
'https://ttrpgplayer.ru',
'http://localhost:5173',
'http://127.0.0.1:5173',
];
function parseCorsOrigins(value) {
if (typeof value !== 'string' || !value.trim()) return null;
const list = value.split(',').map((s) => s.trim()).filter(Boolean);
return list.length ? list : null;
}
function resolveAllowedCorsOrigin(req, allowedOrigins) {
const origin = req.headers.origin;
if (typeof origin !== 'string' || !origin) return null;
return allowedOrigins.includes(origin) ? origin : null;
}
function trackDownloadCorsHeaders(origin) {
if (!origin) return {};
return {
'Access-Control-Allow-Origin': origin,
'Access-Control-Allow-Methods': 'POST, OPTIONS',
'Access-Control-Allow-Headers': 'Content-Type',
Vary: 'Origin',
};
}
function json(res, code, obj, extraHeaders = {}) {
const body = JSON.stringify(obj);
res.writeHead(code, {
'Content-Type': 'application/json; charset=utf-8',
'Content-Length': Buffer.byteLength(body),
...extraHeaders,
});
res.end(body);
}
function empty(res, code, headers = {}) {
res.writeHead(code, headers);
res.end();
}
function readBody(req) {
return new Promise((resolve, reject) => {
const chunks = [];
@@ -87,11 +121,35 @@ function isSubRevoked(data, sub) {
export function createServer(options = {}) {
const privateKeyPem = options.privateKeyPem ?? process.env.LICENSE_PRIVATE_KEY_PEM;
const adminToken = options.adminToken ?? process.env.LICENSE_ADMIN_TOKEN ?? 'change-me-admin';
const trackDownloadCorsOrigins =
options.trackDownloadCorsOrigins
?? parseCorsOrigins(process.env.LICENSE_TRACK_DOWNLOAD_CORS_ORIGINS)
?? DEFAULT_TRACK_DOWNLOAD_CORS_ORIGINS;
if (!privateKeyPem) throw new Error('LICENSE_PRIVATE_KEY_PEM required');
return http.createServer(async (req, res) => {
try {
const url = new URL(req.url ?? '/', `http://localhost`);
if (url.pathname === '/v1/track/download') {
const corsOrigin = resolveAllowedCorsOrigin(req, trackDownloadCorsOrigins);
const corsHeaders = trackDownloadCorsHeaders(corsOrigin);
if (req.method === 'OPTIONS') {
if (!corsOrigin) return json(res, 404, { error: 'not_found' });
return empty(res, 204, corsHeaders);
}
if (req.method === 'POST') {
const raw = await readBody(req);
const body = JSON.parse(raw || '{}');
const data = readData();
const result = recordDownload(data, body.platform);
if (!result.ok) return json(res, 400, { error: result.error }, corsHeaders);
writeData(data);
return json(res, 200, { ok: true, ...result }, corsHeaders);
}
}
if (req.method === 'GET' && url.pathname === '/v1/status') {
const sub = url.searchParams.get('sub');
if (!sub) return json(res, 400, { error: 'missing_sub' });
@@ -185,16 +243,6 @@ export function createServer(options = {}) {
});
}
if (req.method === 'POST' && url.pathname === '/v1/track/download') {
const raw = await readBody(req);
const body = JSON.parse(raw || '{}');
const data = readData();
const result = recordDownload(data, body.platform);
if (!result.ok) return json(res, 400, { error: result.error });
writeData(data);
return json(res, 200, { ok: true, ...result });
}
if (req.method === 'POST' && url.pathname === '/v1/admin/product-keys/delete') {
if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
const raw = await readBody(req);
test/adminApi.test.mjs
+69 -3
View File
@@ -19,10 +19,12 @@ function listen(server) {
});
}
function request(port, method, pathname, { token, body } = {}) {
function request(port, method, pathname, { token, body, origin } = {}) {
return new Promise((resolve, reject) => {
const headers = { 'Content-Type': 'application/json' };
const headers = {};
if (body) headers['Content-Type'] = 'application/json';
if (token) headers.Authorization = `Bearer ${token}`;
if (origin) headers.Origin = origin;
const req = http.request(
{ hostname: '127.0.0.1', port, method, path: pathname, headers },
(res) => {
@@ -30,7 +32,11 @@ function request(port, method, pathname, { token, body } = {}) {
res.on('data', (c) => chunks.push(c));
res.on('end', () => {
const raw = Buffer.concat(chunks).toString('utf8');
resolve({ status: res.statusCode, body: raw ? JSON.parse(raw) : null });
resolve({
status: res.statusCode,
headers: res.headers,
body: raw ? JSON.parse(raw) : null,
});
});
},
);
@@ -320,6 +326,66 @@ void test('POST /v1/track/download and GET stats', async () => {
}
});
void test('OPTIONS /v1/track/download returns CORS preflight for allowed origin', async () => {
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
const dataPath = path.join(tmp, 'data.json');
fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
const { server } = await makeServer(dataPath);
const port = await listen(server);
try {
const res = await request(port, 'OPTIONS', '/v1/track/download', {
origin: 'https://ttrpgplayer.ru',
});
assert.equal(res.status, 204);
assert.equal(res.headers['access-control-allow-origin'], 'https://ttrpgplayer.ru');
assert.match(res.headers['access-control-allow-methods'], /POST/);
assert.equal(res.headers['access-control-allow-headers'], 'Content-Type');
} finally {
server.close();
fs.rmSync(tmp, { recursive: true, force: true });
}
});
void test('POST /v1/track/download includes CORS headers for allowed origin', async () => {
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
const dataPath = path.join(tmp, 'data.json');
fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
const { server } = await makeServer(dataPath);
const port = await listen(server);
try {
const res = await request(port, 'POST', '/v1/track/download', {
body: { platform: 'linux' },
origin: 'https://ttrpgplayer.ru',
});
assert.equal(res.status, 200);
assert.equal(res.headers['access-control-allow-origin'], 'https://ttrpgplayer.ru');
} finally {
server.close();
fs.rmSync(tmp, { recursive: true, force: true });
}
});
void test('OPTIONS /v1/track/download rejects unknown origin', async () => {
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
const dataPath = path.join(tmp, 'data.json');
fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
const { server } = await makeServer(dataPath);
const port = await listen(server);
try {
const res = await request(port, 'OPTIONS', '/v1/track/download', {
origin: 'https://evil.example',
});
assert.equal(res.status, 404);
assert.equal(res.body.error, 'not_found');
} finally {
server.close();
fs.rmSync(tmp, { recursive: true, force: true });
}
});
void test('admin endpoints reject missing token', async () => {
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
const dataPath = path.join(tmp, 'data.json');