[skip/server] Add option to disable CORS. (#779)

Closes #778.

Author: bennostein

skipruntime-ts/server/.mocharc.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://json.schemastore.org/mocharc.json",
+  "require": "tsx"
+}

skipruntime-ts/server/package.json

@@ -3,19 +3,24 @@
   "version": "0.0.11",
   "type": "module",
   "exports": {
-    ".": "./dist/server.js"
+    ".": "./dist/src/server.js"
   },
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist",
-    "lint": "eslint"
+    "lint": "eslint",
+    "test": "mocha test/**/*.spec.ts"
   },
   "devDependencies": {
-    "@types/express": "^5.0.0"
+    "@types/chai": "^5.0.1",
+    "@types/express": "^5.0.0",
+    "chai": "^5.2.0",
+    "mocha": "^11.1.0",
+    "tsx": "^4.19.3"
   },
   "dependencies": {
-    "express": "^4.21.1",
-    "@skipruntime/core": "0.0.11"
+    "@skipruntime/core": "0.0.11",
+    "express": "^4.21.1"
   },
   "optionalDependencies": {
     "@skipruntime/native": "0.0.11",

skipruntime-ts/server/src/rest.ts

@@ -109,7 +109,6 @@ export function controlService(service: ServiceInstance): express.Express {
 
 export function streamingService(service: ServiceInstance): express.Express {
   const app = express();
-  app.use(express.json());
 
   app.get("/v1/streams/:uuid", (req, res) => {
     if (!req.accepts("text/event-stream")) {
@@ -120,11 +119,10 @@ export function streamingService(service: ServiceInstance): express.Express {
       const uuid = req.params.uuid;
       const subscriptionID = service.subscribe(uuid, {
         subscribed: () => {
-          res.writeHead(200, {
-            "Content-Type": "text/event-stream",
-            Connection: "keep-alive",
-            "Cache-Control": "no-cache",
-          });
+          res.set("Content-Type", "text/event-stream");
+          res.set("Connection", "keep-alive");
+          res.set("Cache-Control", "no-cache");
+          res.status(200);
           res.flushHeaders();
         },
         notify: (update: CollectionUpdate<string, Json>) => {

skipruntime-ts/server/src/server.ts

@@ -4,8 +4,10 @@
  * @packageDocumentation
  */
 
-import { type SkipService, ServiceInstance } from "@skipruntime/core";
+import { type SkipService } from "@skipruntime/core";
 import { controlService, streamingService } from "./rest.js";
+import type { Express, Request, Response, NextFunction } from "express";
+import express from "express";
 
 /**
  * A running Skip server.
@@ -90,6 +92,7 @@ export type SkipServer = {
  * @param options.control_port - Port on which control service will listen.
  * @param options.streaming_port - Port on which streaming service will listen.
  * @param options.platform - Skip runtime platform to be used to run the service: either `wasm` (the default) or `native`.
+ * @param options.no_cors - Disable CORS for the streaming endpoint.
  * @returns Object to manage the running server.
  */
 export async function runService(
@@ -98,17 +101,18 @@ export async function runService(
     streaming_port: number;
     control_port: number;
     platform?: "wasm" | "native";
+    no_cors?: boolean;
   } = {
     streaming_port: 8080,
     control_port: 8081,
     platform: "wasm",
+    no_cors: false,
   },
 ): Promise<SkipServer> {
-  let instance: ServiceInstance;
+  let runtime;
   if (options.platform == "native") {
     try {
-      const runtime = await import("@skipruntime/native");
-      instance = await runtime.initService(service);
+      runtime = await import("@skipruntime/native");
     } catch (e) {
       console.error(
         'Error loading Skip runtime for specified "native" platform: ',
@@ -117,15 +121,15 @@ export async function runService(
     }
   } else {
     try {
-      const runtime = await import("@skipruntime/wasm");
-      instance = await runtime.initService(service);
+      runtime = await import("@skipruntime/wasm");
     } catch (e) {
       console.error(
         'Error loading Skip runtime for specified "wasm" platform: ',
       );
       throw e;
     }
   }
+  const instance = await runtime.initService(service);
   const controlHttpServer = controlService(instance).listen(
     options.control_port,
     () => {
@@ -134,7 +138,13 @@ export async function runService(
       );
     },
   );
-  const streamingHttpServer = streamingService(instance).listen(
+  const wrapMiddleware = (app: Express) => {
+    if (options.no_cors) {
+      return express().use(no_cors).use(app);
+    }
+    return app;
+  };
+  const streamingHttpServer = wrapMiddleware(streamingService(instance)).listen(
     options.streaming_port,
     () => {
       console.log(
@@ -151,3 +161,16 @@ export async function runService(
     },
   };
 }
+
+function no_cors(req: Request, res: Response, next: NextFunction) {
+  res.header("Access-Control-Allow-Credentials", "true");
+  res.header("Access-Control-Allow-Methods", "GET,OPTIONS");
+  res.header("Access-Control-Allow-Origin", "*");
+  if (req.method.toUpperCase() == "OPTIONS") {
+    res.statusCode = 204;
+    res.setHeader("Content-Length", "0");
+    res.end();
+  } else {
+    next();
+  }
+}

skipruntime-ts/server/test/no_cors.spec.ts

@@ -0,0 +1,90 @@
+import { runService, type SkipServer } from "../src/server.js";
+import type { Context, EagerCollection, Resource } from "@skipruntime/core";
+import { expect } from "chai";
+
+type Post = {
+  author_id: number;
+  title: string;
+  url: string;
+  body: string;
+  date: number;
+};
+
+type PostsResourceInputs = {
+  posts: EagerCollection<number, Post>;
+};
+
+class PostsResource implements Resource<PostsResourceInputs> {
+  instantiate(collections: PostsResourceInputs): EagerCollection<number, Post> {
+    return collections.posts;
+  }
+}
+
+describe("runService({ no_cors: true })", function () {
+  let service: SkipServer;
+  before(async function () {
+    service = await runService(
+      {
+        initialData: { posts: [] },
+        resources: { posts: PostsResource },
+        createGraph(
+          inputs: { posts: EagerCollection<number, Post> },
+          _context: Context,
+        ): PostsResourceInputs {
+          return {
+            posts: inputs.posts,
+          };
+        },
+      },
+      {
+        control_port: 8081,
+        streaming_port: 8080,
+        no_cors: true,
+      },
+    );
+  });
+  after(async function () {
+    await service.close();
+  });
+
+  try {
+    it("should set Access-Control-Allow-Credentials", async function () {
+      const uuid = await (
+        await fetch("http://localhost:8081/v1/streams/posts", {
+          method: "POST",
+        })
+      ).text();
+      const resp = await fetch(`http://localhost:8080/v1/streams/${uuid}`, {
+        headers: {
+          Accept: "text/event-stream",
+        },
+      });
+      expect(resp.headers.get("Access-Control-Allow-Credentials")).to.equal(
+        "true",
+      );
+    });
+
+    it("should set Access-Control-Allow-Origin", async function () {
+      const uuid = await (
+        await fetch("http://localhost:8081/v1/streams/posts", {
+          method: "POST",
+        })
+      ).text();
+      const resp = await fetch(`http://localhost:8080/v1/streams/${uuid}`, {
+        headers: {
+          Accept: "text/event-stream",
+        },
+      });
+      expect(resp.headers.get("Access-Control-Allow-Origin")).to.equal("*");
+    });
+
+    it("should respond to preflight requests", async function () {
+      const resp = await fetch(`http://localhost:8080/v1/streams`, {
+        method: "OPTIONS",
+      });
+      expect(resp.headers.get("Access-Control-Allow-Origin")).to.equal("*");
+    });
+  } catch (e) {
+    console.log(e);
+  }
+});