feat: improve cors middleware

src/middleware.ts

@@ -7,6 +7,43 @@ const corsOptions = {
   "Access-Control-Allow-Headers": "Content-Type, Authorization, solana-client",
 };
 
+const cleanOrigin = (str: string) => {
+  try {
+    const url = new URL(str);
+    let domain = url.hostname;
+
+    // Remove www.
+    if (domain.startsWith("www.")) {
+      domain = domain.slice(4);
+    }
+
+    return domain;
+  } catch (error) {
+    return str; // Return the original string if it's not a valid URL
+  }
+};
+
+const isVercelPreview = (str: string) => {
+  if (str.endsWith("vercel.app")) {
+    return true;
+  }
+  return false;
+};
+
+const isCloudflarePreview = (str: string) => {
+  if (str.endsWith("pages.dev")) {
+    return true;
+  }
+  return false;
+};
+
+const isPreview = (str: string) => {
+  if (isVercelPreview(str) || isCloudflarePreview(str)) {
+    return true;
+  }
+  return false;
+};
+
 export async function middleware(request: NextRequest) {
   // Check the origin from the request
   const origin = request.headers.get("origin") ?? "";
@@ -16,16 +53,25 @@ export async function middleware(request: NextRequest) {
     return NextResponse.next();
   }
   const client = createClient(process.env.ALLOWED_LIST_EDGE_CONFIG);
-  const allowedOriginsData = await client.get("allowed-origins");
-  const allowedOrigins = await stringArraySchema.parseAsync(allowedOriginsData);
-  const isAllowedOrigin = allowedOrigins.includes(origin);
+  const isAllowed = await (async () => {
+    const domain = cleanOrigin(origin) || "";
+    if (isPreview(domain)) {
+      const allowedPreviewData = await client.get("preview-namespace");
+      const allowedPreview = await stringArraySchema.parseAsync(allowedPreviewData);
+      if (allowedPreview.find((d) => d.includes(domain))) {
+        return true;
+      }
+    }
 
+    const allowedOriginsData = await client.get("allowed-origins");
+    const allowedOrigins = await stringArraySchema.parseAsync(allowedOriginsData);
+    return allowedOrigins.includes(domain);
+  })();
   // Handle preflighted requests
   const isPreflight = request.method === "OPTIONS";
-
   if (isPreflight) {
     const preflightHeaders = {
-      ...(isAllowedOrigin && { "Access-Control-Allow-Origin": origin }),
+      ...(isAllowed && { "Access-Control-Allow-Origin": origin }),
       ...corsOptions,
     };
     return NextResponse.json({}, { headers: preflightHeaders });
@@ -34,7 +80,7 @@ export async function middleware(request: NextRequest) {
   // Handle simple requests
   const response = NextResponse.next();
 
-  if (isAllowedOrigin) {
+  if (isAllowed) {
     response.headers.set("Access-Control-Allow-Origin", origin);
   }