Press n or j to go to the next uncovered block, b, p or k for the previous block.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | 1x 1x 1x 1x 4x 4x 4x 4x 4x 4x 1x 1x 1x 40x 40x 1x 1x 1x 1x 1x 1x 1x 1x 1x 29x 29x 29x 29x 29x 29x 29x 3x 3x 3x 29x 29x 1x 1x 5x 5x 5x 5x 5x 5x 1x 1x 1x 1x 5x 5x 5x 5x 5x 5x 5x 1x 1x | import type { HttpRequest, HttpResponseInit } from "@azure/functions";
/** Shared response helpers for the storage endpoints (contracts/storage-api.md, contracts/web-auth.md). */
function allowedOrigins(): string[] {
return (process.env.ALLOWED_ORIGINS ?? "")
.split(",")
.map((origin) => origin.trim())
.filter(Boolean);
}
/** The request's `Origin` header, or null (extension / server-to-server callers send none). */
export function requestOrigin(request: HttpRequest): string | null {
return request.headers.get("origin");
}
/**
* CORS headers for a response. A request `Origin` that matches the
* ALLOWED_ORIGINS allowlist is echoed back (+ `Vary: Origin`) — least-
* privilege hardening for the web app's Pages origin (contracts/web-auth.md,
* research.md R3). No Origin, or an unmatched one, preserves the existing
* permissive `*` behavior so the extension keeps working unaffected.
*/
export function corsHeaders(origin?: string | null): Record<string, string> {
const headers: Record<string, string> = {
"Content-Type": "application/json",
"Access-Control-Allow-Origin": "*",
"Access-Control-Allow-Methods": "GET, PUT, PATCH, POST, DELETE, OPTIONS",
"Access-Control-Allow-Headers": "Content-Type, x-functions-key, Authorization",
};
if (origin && allowedOrigins().includes(origin)) {
headers["Access-Control-Allow-Origin"] = origin;
headers["Vary"] = "Origin";
}
return headers;
}
export function jsonResponse(
status: number,
jsonBody: unknown,
origin?: string | null
): HttpResponseInit {
return { status, headers: corsHeaders(origin), jsonBody };
}
export function noContent(origin?: string | null): HttpResponseInit {
return { status: 204, headers: corsHeaders(origin) };
}
export function errorResponse(
status: number,
code: string,
message: string,
origin?: string | null
): HttpResponseInit {
return jsonResponse(status, { error: { code, message } }, origin);
}
export function preflightResponse(origin?: string | null): HttpResponseInit {
return noContent(origin);
}
|