Don't respond to OPTIONS requests for non-oauth requests

[APTy]

This middleware is a little overzealous with its responses to OPTIONS requests. It really shouldn't respond to every request with these default highly permissive CORS headers.

Instead, it should only respond in this way if the path matches the prefix, otherwise defer to the application to respond to the OPTIONS request with its own CORS headers.

Before the change?

OPTIONS calls to any API result in the headers defined by the oauth-app.js library.

$ curl localhost:3000/api/me -v -X OPTIONS
...
< HTTP/1.1 200 OK
< access-control-allow-origin: *
< access-control-allow-methods: *
< access-control-allow-headers: Content-Type, User-Agent, Authorization

After the change?

OPTIONS calls to any API result in headers defined by the application.

$ curl localhost:3000/api/me -v -X OPTIONS
...
< HTTP/1.1 200 OK
< Access-Control-Allow-Origin: http://localhost:5173
< Access-Control-Allow-Methods: GET, POST, OPTIONS
< Access-Control-Allow-Headers: content-type

And OPTIONS calls to this middleware's routes still return correct headers:

$ curl localhost:3000/github/oauth/login -X OPTIONS -v
...
< access-control-allow-origin: *
< access-control-allow-methods: *
< access-control-allow-headers: content-type

Pull request checklist

• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Low probability

• Yes
• No

---

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[wolfy1339]

I think line 34 needs to be moved as well NVM that. it is good as it is

[gr2m]

I think we need to add a test to avoid future regression. Could you look into that?

[APTy]

I think we need to add a test to avoid future regression. Could you look into that?

Great idea! Added

[gr2m]

Great PR, thank you Tyler 💐

[github-actions]

🎉 This PR is included in version 7.1.3 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀