Fix CORS_ORIGIN wildcard patterns in @objectstack/hono adapter

CHANGELOG.md

@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- **CORS wildcard patterns in `@objectstack/hono` adapter (follow-up to PR #1177)** — `createHonoApp()` was the third CORS code path that still treated wildcard origins (e.g. `https://*.objectui.org`) as literal strings when passing them to Hono's `cors()` middleware. Because `apps/server` routes all non-OPTIONS requests through this adapter on Vercel, the browser would see a successful preflight (handled by the Vercel short-circuit) followed by a POST/GET response with no `Access-Control-Allow-Origin` header, blocking every real request. The adapter now imports `hasWildcardPattern` / `createOriginMatcher` from `@objectstack/plugin-hono-server` and uses the same matcher-function branch as `plugin-hono-server`, so all three Hono-based CORS paths share a single source of truth. (`packages/adapters/hono/src/index.ts`)
 - **CORS wildcard patterns on Vercel deployments** — `CORS_ORIGIN` values containing wildcard patterns (e.g. `https://*.objectui.org,https://*.objectstack.ai,http://localhost:*`) no longer cause browser CORS errors when `apps/server` is deployed to Vercel. The Vercel entrypoint's OPTIONS preflight short-circuit previously matched origins with a literal `Array.includes()`, treating `*` as a plain character and rejecting legitimate subdomains. It now shares the same pattern-matching logic as the Hono plugin's `cors()` middleware via new exports `createOriginMatcher` / `hasWildcardPattern` / `matchOriginPattern` / `normalizeOriginPatterns` from `@objectstack/plugin-hono-server`. (`apps/server/server/index.ts`, `packages/plugins/plugin-hono-server/src/pattern-matcher.ts`)
 
 ### Added

packages/adapters/hono/package.json

@@ -16,6 +16,9 @@
  "test": "vitest run",
  "test:watch": "vitest"
  },
+ "dependencies": {
+ "@objectstack/plugin-hono-server": "workspace:*"
+ },
  "peerDependencies": {
  "@objectstack/runtime": "workspace:^",
  "hono": "^4.12.8"

packages/adapters/hono/src/hono.test.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterAll } from 'vitest';
 import { Hono } from 'hono';
 
 // Mock dispatcher instance accessible across tests
@@ -947,4 +947,82 @@ describe('createHonoApp', () => {
  expect(json.success).toBe(true);
  });
  });
+
+ describe('CORS wildcard origin patterns', () => {
+ const ORIG_CORS_ORIGIN = process.env.CORS_ORIGIN;
+ const ORIG_CORS_CREDENTIALS = process.env.CORS_CREDENTIALS;
+
+ beforeEach(() => {
+ delete process.env.CORS_ORIGIN;
+ delete process.env.CORS_CREDENTIALS;
+ });
+
+ afterAll(() => {
+ if (ORIG_CORS_ORIGIN === undefined) delete process.env.CORS_ORIGIN;
+ else process.env.CORS_ORIGIN = ORIG_CORS_ORIGIN;
+ if (ORIG_CORS_CREDENTIALS === undefined) delete process.env.CORS_CREDENTIALS;
+ else process.env.CORS_CREDENTIALS = ORIG_CORS_CREDENTIALS;
+ });
+
+ it('matches subdomain wildcard (https://*.example.com) for real subdomains', async () => {
+ process.env.CORS_ORIGIN = 'https://*.example.com';
+ const app = createHonoApp({ kernel: mockKernel, prefix: '/api/v1' });
+
+ const res = await app.request('/api/v1/meta', {
+ method: 'GET',
+ headers: { Origin: 'https://app.example.com' },
+ });
+ expect(res.headers.get('access-control-allow-origin')).toBe('https://app.example.com');
+ });
+
+ it('matches port wildcard (http://localhost:*) for any localhost port', async () => {
+ process.env.CORS_ORIGIN = 'http://localhost:*';
+ const app = createHonoApp({ kernel: mockKernel, prefix: '/api/v1' });
+
+ const res = await app.request('/api/v1/meta', {
+ method: 'GET',
+ headers: { Origin: 'http://localhost:5173' },
+ });
+ expect(res.headers.get('access-control-allow-origin')).toBe('http://localhost:5173');
+ });
+
+ it('matches the correct pattern from a comma-separated wildcard list', async () => {
+ process.env.CORS_ORIGIN =
+ 'https://*.objectui.org,https://*.objectstack.ai,http://localhost:*';
+ const app = createHonoApp({ kernel: mockKernel, prefix: '/api/v1' });
+
+ const res = await app.request('/api/v1/meta', {
+ method: 'GET',
+ headers: { Origin: 'https://studio.objectstack.ai' },
+ });
+ expect(res.headers.get('access-control-allow-origin')).toBe('https://studio.objectstack.ai');
+ });
+
+ it('rejects origins that do not match any wildcard pattern', async () => {
+ process.env.CORS_ORIGIN = 'https://*.example.com';
+ const app = createHonoApp({ kernel: mockKernel, prefix: '/api/v1' });
+
+ const res = await app.request('/api/v1/meta', {
+ method: 'GET',
+ headers: { Origin: 'https://evil.com' },
+ });
+ // Hono's cors() returns no allow-origin header when the matcher rejects
+ expect(res.headers.get('access-control-allow-origin')).toBeNull();
+ });
+
+ it('responds to preflight OPTIONS with matched wildcard origin', async () => {
+ process.env.CORS_ORIGIN = 'https://*.objectui.org';
+ const app = createHonoApp({ kernel: mockKernel, prefix: '/api/v1' });
+
+ const res = await app.request('/api/v1/meta', {
+ method: 'OPTIONS',
+ headers: {
+ Origin: 'https://app.objectui.org',
+ 'Access-Control-Request-Method': 'POST',
+ },
+ });
+ expect(res.status).toBe(204);
+ expect(res.headers.get('access-control-allow-origin')).toBe('https://app.objectui.org');
+ });
+ });
 });

packages/adapters/hono/src/index.ts

@@ -3,6 +3,7 @@
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { type ObjectKernel, HttpDispatcher, HttpDispatcherResult } from '@objectstack/runtime';
+import { createOriginMatcher, hasWildcardPattern } from '@objectstack/plugin-hono-server';
 
 export interface ObjectStackHonoCorsOptions {
  /** Enable or disable CORS. Defaults to true. */
@@ -96,11 +97,24 @@ export function createHonoApp(options: ObjectStackHonoOptions): Hono {
  const maxAge = corsOpts.maxAge ?? (process.env.CORS_MAX_AGE ? parseInt(process.env.CORS_MAX_AGE, 10) : 86400);
 
  // When credentials is true, browsers reject wildcard '*' for Access-Control-Allow-Origin.
- // Use a function to reflect the request's Origin header instead.
+ // For wildcard patterns (like "https://*.example.com" or "http://localhost:*") we must
+ // use a matcher function — Hono's cors() middleware does exact-string matching only and
+ // treats '*' in patterns as a literal character, so passing wildcard strings straight
+ // through would silently drop the Access-Control-Allow-Origin header on every real
+ // request (preflight can still succeed via apps/server's short-circuit, but the
+ // subsequent POST/GET would be blocked by the browser).
+ //
+ // This mirrors `plugin-hono-server`'s CORS wiring and uses the shared pattern matcher
+ // from `@objectstack/plugin-hono-server` so all Hono-based code paths stay in sync.
  let origin: string | string[] | ((origin: string) => string | undefined | null);
- if (credentials && configuredOrigin === '*') {
+ if (configuredOrigin === '*' && credentials) {
+ // Credentials mode with '*' — reflect the request origin
  origin = (requestOrigin: string) => requestOrigin || '*';
+ } else if (hasWildcardPattern(configuredOrigin)) {
+ // Wildcard patterns (e.g., "https://*.objectui.org", "http://localhost:*")
+ origin = createOriginMatcher(configuredOrigin);
  } else {
+ // Exact origin(s) — pass through as-is
  origin = configuredOrigin;
  }