ifontosh/DndGamePlayerLicenseServer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CORS support for landing download tracking endpoint.

Browse Source 
Browsers on ttrpgplayer.ru need preflight and Access-Control-Allow-Origin on POST /v1/track/download.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Ivan Fontosh
2026-07-06 15:08:21 +08:00
parent 6d4b74d410
commit 7538458677
2 changed files with 128 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server.mjs
+59 -11
View File
@@ -34,15 +34,49 @@ function writeData(data) {
fs.writeFileSync(p, `${JSON.stringify(data, null, 2)}\n`, 'utf8');
}
function json(res, code, obj) {
const DEFAULT_TRACK_DOWNLOAD_CORS_ORIGINS = [
'https://ttrpgplayer.ru',
'http://localhost:5173',
'http://127.0.0.1:5173',
];
function parseCorsOrigins(value) {
if (typeof value !== 'string' || !value.trim()) return null;
const list = value.split(',').map((s) => s.trim()).filter(Boolean);
return list.length ? list : null;
}
function resolveAllowedCorsOrigin(req, allowedOrigins) {
const origin = req.headers.origin;
if (typeof origin !== 'string' || !origin) return null;
return allowedOrigins.includes(origin) ? origin : null;
}
function trackDownloadCorsHeaders(origin) {
if (!origin) return {};
return {
'Access-Control-Allow-Origin': origin,
'Access-Control-Allow-Methods': 'POST, OPTIONS',
'Access-Control-Allow-Headers': 'Content-Type',
Vary: 'Origin',
};
}
function json(res, code, obj, extraHeaders = {}) {
const body = JSON.stringify(obj);
res.writeHead(code, {
'Content-Type': 'application/json; charset=utf-8',
'Content-Length': Buffer.byteLength(body),
...extraHeaders,
});
res.end(body);
}
function empty(res, code, headers = {}) {
res.writeHead(code, headers);
res.end();
}
function readBody(req) {
return new Promise((resolve, reject) => {
const chunks = [];
@@ -87,11 +121,35 @@ function isSubRevoked(data, sub) {
export function createServer(options = {}) {
const privateKeyPem = options.privateKeyPem ?? process.env.LICENSE_PRIVATE_KEY_PEM;
const adminToken = options.adminToken ?? process.env.LICENSE_ADMIN_TOKEN ?? 'change-me-admin';
const trackDownloadCorsOrigins =
options.trackDownloadCorsOrigins
?? parseCorsOrigins(process.env.LICENSE_TRACK_DOWNLOAD_CORS_ORIGINS)
?? DEFAULT_TRACK_DOWNLOAD_CORS_ORIGINS;
if (!privateKeyPem) throw new Error('LICENSE_PRIVATE_KEY_PEM required');
return http.createServer(async (req, res) => {
try {
const url = new URL(req.url ?? '/', `http://localhost`);
if (url.pathname === '/v1/track/download') {
const corsOrigin = resolveAllowedCorsOrigin(req, trackDownloadCorsOrigins);
const corsHeaders = trackDownloadCorsHeaders(corsOrigin);
if (req.method === 'OPTIONS') {
if (!corsOrigin) return json(res, 404, { error: 'not_found' });
return empty(res, 204, corsHeaders);
}
if (req.method === 'POST') {
const raw = await readBody(req);
const body = JSON.parse(raw || '{}');
const data = readData();
const result = recordDownload(data, body.platform);
if (!result.ok) return json(res, 400, { error: result.error }, corsHeaders);
writeData(data);
return json(res, 200, { ok: true, ...result }, corsHeaders);
}
}
if (req.method === 'GET' && url.pathname === '/v1/status') {
const sub = url.searchParams.get('sub');
if (!sub) return json(res, 400, { error: 'missing_sub' });
@@ -185,16 +243,6 @@ export function createServer(options = {}) {
});
}
if (req.method === 'POST' && url.pathname === '/v1/track/download') {
const raw = await readBody(req);
const body = JSON.parse(raw || '{}');
const data = readData();
const result = recordDownload(data, body.platform);
if (!result.ok) return json(res, 400, { error: result.error });
writeData(data);
return json(res, 200, { ok: true, ...result });
}
if (req.method === 'POST' && url.pathname === '/v1/admin/product-keys/delete') {
if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
const raw = await readBody(req);