From f6fb6540e7d6b5e44459a91fccea57a6025be153 Mon Sep 17 00:00:00 2001 From: IliesAllali Date: Thu, 1 Oct 2026 11:13:07 +0200 Subject: [PATCH] =?UTF-8?q?API=20:=20@fastify/cors=2011.3.0,=20m=C3=A9thod?= =?UTF-8?q?es=20annonc=C3=A9es=20gard=C3=A9es?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reprend la PR Dependabot #32. Rupture de la 11.0.0 : la pré-vérification CORS n'annonce plus par défaut que GET, HEAD et POST, un navigateur d'une autre origine aurait refusé les PUT, PATCH et DELETE de l'API. La liste d'avant est maintenant écrite dans app.ts, et un test vérifie la réponse à un OPTIONS d'une origine autorisée (il échoue sans la ligne). Option origin inchangée. Les ajouts de la 11.x (logLevel du préflight, cors par route dans config.cors) ne sont pas utilisés. 113 tests. Co-Authored-By: Claude Opus 5.5 --- backend/package-lock.json | 46 +++++++-------------------------- backend/package.json | 2 +- backend/src/app.ts | 2 ++ backend/test/api-routes.test.ts | 17 ++++++++++++ 4 files changed, 29 insertions(+), 38 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index 0c7f800..008728d 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -8,7 +8,7 @@ "name": "backend", "version": "0.1.0", "dependencies": { - "@fastify/cors": "^10.1.0", + "@fastify/cors": "^11.3.0", "@fastify/jwt": "^10.2.2", "@fastify/rate-limit": "^11.2.0", "@prisma/client": "^6.15.0", @@ -498,7 +498,9 @@ } }, "node_modules/@fastify/cors": { - "version": "10.1.0", + "version": "11.3.0", + "resolved": "https://registry.npmjs.org/@fastify/cors/-/cors-11.3.0.tgz", + "integrity": "sha512-ggQGua+xHv1MvePbPr0v//xLYEsCXbWspquXCJS9Ot5YoRXq8J8ZWzHnxDBVnbtXosvistXo6LtNzOJswf64Fw==", "funding": [ { "type": "github", @@ -511,8 +513,8 @@ ], "license": "MIT", "dependencies": { - "fastify-plugin": "^5.0.0", - "mnemonist": "0.40.0" + "fastify-plugin": "^6.0.0", + "toad-cache": "^3.7.0" } }, "node_modules/@fastify/error": { @@ -583,22 +585,6 @@ "steed": "^1.1.3" } }, - "node_modules/@fastify/jwt/node_modules/fastify-plugin": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz", - "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ], - "license": "MIT" - }, "node_modules/@fastify/merge-json-schemas": { "version": "0.2.1", "funding": [ @@ -656,22 +642,6 @@ "toad-cache": "^3.7.0" } }, - "node_modules/@fastify/rate-limit/node_modules/fastify-plugin": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz", - "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ], - "license": "MIT" - }, "node_modules/@img/colour": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz", @@ -2135,7 +2105,9 @@ } }, "node_modules/fastify-plugin": { - "version": "5.1.0", + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz", + "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==", "funding": [ { "type": "github", diff --git a/backend/package.json b/backend/package.json index f992cab..31e005d 100644 --- a/backend/package.json +++ b/backend/package.json @@ -17,7 +17,7 @@ "prisma:deploy": "prisma migrate deploy" }, "dependencies": { - "@fastify/cors": "^10.1.0", + "@fastify/cors": "^11.3.0", "@fastify/jwt": "^10.2.2", "@fastify/rate-limit": "^11.2.0", "@prisma/client": "^6.15.0", diff --git a/backend/src/app.ts b/backend/src/app.ts index 6c08fdf..d54dae8 100644 --- a/backend/src/app.ts +++ b/backend/src/app.ts @@ -53,6 +53,8 @@ export function createApp() { app.register(cors, { origin: env.CORS_ORIGIN.length === 1 ? env.CORS_ORIGIN[0] : env.CORS_ORIGIN, + // @fastify/cors 11 n'annonce plus par défaut que GET, HEAD et POST : l'API sert aussi PUT, PATCH, DELETE + methods: 'GET,HEAD,PUT,PATCH,POST,DELETE', }) app.register(rateLimit, { diff --git a/backend/test/api-routes.test.ts b/backend/test/api-routes.test.ts index 8a97597..e0ea0b7 100644 --- a/backend/test/api-routes.test.ts +++ b/backend/test/api-routes.test.ts @@ -582,6 +582,23 @@ describe('Health check', () => { }) }) +describe('CORS', () => { + it('annonce PUT, PATCH et DELETE dans la réponse de pré-vérification', async () => { + const app = createApp() + + const response = await app.inject({ + method: 'OPTIONS', + url: '/trees/tree-1', + headers: { origin: 'http://localhost:5173', 'access-control-request-method': 'DELETE' }, + }) + + expect(response.statusCode).toBe(204) + expect(response.headers['access-control-allow-origin']).toBe('http://localhost:5173') + expect(response.headers['access-control-allow-methods']).toBe('GET,HEAD,PUT,PATCH,POST,DELETE') + await app.close() + }) +}) + describe('Tree CRUD', () => { it('creates a tree and returns it', async () => { const app = createApp()