feat(cors): allowedMethods by function

src/middleware/cors/index.test.ts

@@ -47,6 +47,17 @@ describe('CORS by Middleware', () => {
     })
   )
 
+  app.use(
+    '/api7/*',
+    cors({
+      origin: (origin) => (origin === 'http://example.com' ? origin : '*'),
+      allowMethods: (origin) =>
+        origin === 'http://example.com'
+          ? ['GET', 'HEAD', 'POST', 'PATCH', 'DELETE']
+          : ['GET', 'HEAD'],
+    })
+  )
+
   app.get('/api/abc', (c) => {
     return c.json({ success: true })
   })
@@ -67,6 +78,10 @@ describe('CORS by Middleware', () => {
     return new Response(JSON.stringify({ success: true }))
   })
 
+  app.get('/api7/abc', () => {
+    return new Response(JSON.stringify({ success: true }))
+  })
+
   it('GET default', async () => {
     const res = await app.request('http://localhost/api/abc')
 
@@ -203,4 +218,26 @@ describe('CORS by Middleware', () => {
 
     expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
   })
+
+  it('Allow methods by function', async () => {
+    const req = new Request('http://localhost/api7/abc', {
+      headers: {
+        Origin: 'http://example.com',
+      },
+      method: 'OPTIONS',
+    })
+    const res = await app.request(req)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://example.com')
+    expect(res.headers.get('Access-Control-Allow-Methods')).toBe('GET,HEAD,POST,PATCH,DELETE')
+
+    const req2 = new Request('http://localhost/api7/abc', {
+      headers: {
+        Origin: 'http://example.org',
+      },
+      method: 'OPTIONS',
+    })
+    const res2 = await app.request(req2)
+    expect(res2.headers.get('Access-Control-Allow-Origin')).toBe('*')
+    expect(res2.headers.get('Access-Control-Allow-Methods')).toBe('GET,HEAD')
+  })
 })

src/middleware/cors/index.ts

@@ -8,7 +8,7 @@ import type { MiddlewareHandler } from '../../types'
 
 type CORSOptions = {
   origin: string | string[] | ((origin: string, c: Context) => string | undefined | null)
-  allowMethods?: string[]
+  allowMethods?: string[] | ((origin: string, c: Context) => string[])
   allowHeaders?: string[]
   maxAge?: number
   credentials?: boolean
@@ -22,7 +22,7 @@ type CORSOptions = {
  *
  * @param {CORSOptions} [options] - The options for the CORS middleware.
  * @param {string | string[] | ((origin: string, c: Context) => string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
- * @param {string[]} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']] - The value of "Access-Control-Allow-Methods" CORS header.
+ * @param {string[] | ((origin: string, c: Context) => string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']] - The value of "Access-Control-Allow-Methods" CORS header.
  * @param {string[]} [options.allowHeaders=[]] - The value of "Access-Control-Allow-Headers" CORS header.
  * @param {number} [options.maxAge] - The value of "Access-Control-Max-Age" CORS header.
  * @param {boolean} [options.credentials] - The value of "Access-Control-Allow-Credentials" CORS header.
@@ -80,6 +80,16 @@ export const cors = (options?: CORSOptions): MiddlewareHandler => {
     }
   })(opts.origin)
 
+  const findAllowMethods = ((optsAllowMethods) => {
+    if (typeof optsAllowMethods === 'function') {
+      return optsAllowMethods
+    } else if (Array.isArray(optsAllowMethods)) {
+      return () => optsAllowMethods
+    } else {
+      return () => []
+    }
+  })(opts.allowMethods)
+
   return async function cors(c, next) {
     function set(key: string, value: string) {
       c.res.headers.set(key, value)
@@ -115,8 +125,9 @@ export const cors = (options?: CORSOptions): MiddlewareHandler => {
         set('Access-Control-Max-Age', opts.maxAge.toString())
       }
 
-      if (opts.allowMethods?.length) {
-        set('Access-Control-Allow-Methods', opts.allowMethods.join(','))
+      const allowMethods = findAllowMethods(c.req.header('origin') || '', c)
+      if (allowMethods.length) {
+        set('Access-Control-Allow-Methods', allowMethods.join(','))
       }
 
       let headers = opts.allowHeaders