P1B: Refactor (packages/server/src/cors.ts): Function with many returns

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {
+      "version": "1.3.8",
+      "resolved": "ghcr.io/devcontainers/features/git@sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2",
+      "integrity": "sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -0,0 +1,8 @@
+{
+  "name": "OpenCode Dev Container",
+  "image": "oven/bun:1.3",
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {}
+  },
+  "postCreateCommand": "apt-get update && apt-get install -y python3 make g++"
+}

.github/workflows/test.yml

@@ -64,6 +64,10 @@ jobs:
         # contention issue typecheck.yml already caps for tsgo.
         run: GITHUB_ACTIONS=false bun turbo test --concurrency=4
 
+      - name: Run server tests
+        working-directory: packages/server
+        run: bun test
+
       - name: Check generated client
         timeout-minutes: 5
         working-directory: packages/client

packages/server/src/cors.ts

@@ -1,21 +1,25 @@
 import { Context } from "effect"
 
 const opencodeOrigin = /^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/
+const allowedOriginPrefixes = ["http://localhost:", "http://127.0.0.1:", "oc://renderer"]
+
+const allowedOrigins = new Set(["tauri://localhost", "http://tauri.localhost", "https://tauri.localhost"])
 
 export type CorsOptions = { readonly cors?: ReadonlyArray<string> }
 
 export const CorsConfig = Context.Reference<CorsOptions | undefined>("@opencode/ServerCorsConfig", {
   defaultValue: () => undefined,
 })
 
+function isBuiltInAllowedOrigin(input: string) {
+  if (allowedOriginPrefixes.some((prefix) => input.startsWith(prefix))) return true
+  if (allowedOrigins.has(input)) return true
+  return opencodeOrigin.test(input)
+}
+
 export function isAllowedCorsOrigin(input: string | undefined, opts?: CorsOptions) {
   if (!input) return true
-  if (input.startsWith("http://localhost:")) return true
-  if (input.startsWith("http://127.0.0.1:")) return true
-  if (input.startsWith("oc://renderer")) return true
-  if (input === "tauri://localhost" || input === "http://tauri.localhost" || input === "https://tauri.localhost")
-    return true
-  if (opencodeOrigin.test(input)) return true
+  if (isBuiltInAllowedOrigin(input)) return true
   return opts?.cors?.includes(input) ?? false
 }
 

packages/server/test/cors.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from "bun:test"
+import { isAllowedCorsOrigin, isAllowedRequestOrigin } from "../src/cors"
+
+describe("isAllowedCorsOrigin", () => {
+  test("allows requests without an origin", () => {
+    expect(isAllowedCorsOrigin(undefined)).toBe(true)
+  })
+
+  test("allows built-in local and application origins", () => {
+    const allowedOrigins = [
+      "http://localhost:3000",
+      "http://127.0.0.1:4096",
+      "oc://renderer",
+      "tauri://localhost",
+      "http://tauri.localhost",
+      "https://tauri.localhost",
+    ]
+
+    for (const origin of allowedOrigins) {
+      expect(isAllowedCorsOrigin(origin)).toBe(true)
+    }
+  })
+
+  test("allows official OpenCode origins", () => {
+    expect(isAllowedCorsOrigin("https://opencode.ai")).toBe(true)
+    expect(isAllowedCorsOrigin("https://docs.opencode.ai")).toBe(true)
+  })
+
+  test("allows origins provided through configuration", () => {
+    const options = { cors: ["https://allowed.example.com"] }
+
+    expect(isAllowedCorsOrigin("https://allowed.example.com", options)).toBe(true)
+  })
+  test("rejects origins that are not allowed", () => {
+    expect(isAllowedCorsOrigin("https://example.com")).toBe(false)
+    expect(isAllowedCorsOrigin("https://opencode.ai.example.com")).toBe(false)
+  })
+})
+
+describe("isAllowedRequestOrigin", () => {
+  test("allows requests without an origin", () => {
+    expect(isAllowedRequestOrigin(undefined, undefined)).toBe(true)
+  })
+
+  test("allows requests from the same host", () => {
+    expect(isAllowedRequestOrigin("https://example.com", "example.com")).toBe(true)
+  })
+
+  test("falls back to CORS validation for a different or invalid host", () => {
+    const options = { cors: ["https://allowed.example.com"] }
+
+    expect(isAllowedRequestOrigin("https://allowed.example.com", "different.example.com", options)).toBe(true)
+    expect(isAllowedRequestOrigin("not-a-valid-url", "example.com")).toBe(false)
+  })
+})