Add maxAge and cacheControl options to @middy/http-cors

packages/http-cors/README.md

@@ -49,6 +49,8 @@ npm install --save @middy/http-cors
  - `origins` (array) (optional): An array of allowed origins. The incoming origin is matched against the list and is returned if present. 
  - `headers` (string) (optional): value to put in Access-Control-Allow-Headers (default: `null`)
  - `credentials` (bool) (optional): if true, sets the `Access-Control-Allow-Origin` as request header `Origin`, if present (default `false`)
+ - `maxAge` (string) (optional): value to put in Access-Control-Max-Age header (default: `null`)
+ - `cacheControl` (string) (optional): value to put in Cache-Control header on pre-flight (OPTIONS) requests (default: `null`)
 
 NOTES:
 - If another middleware does not handle and swallow errors, then it will bubble all the way up 

packages/http-cors/__tests__/index.js

@@ -432,4 +432,101 @@ describe('📦 Middleware CORS', () => {
 
     expect(response).toEqual({})
   })
+
+  test('it should set Cache-Control header if present in config and http method OPTIONS', async () => {
+    const handler = middy((event, context, cb) => {
+      cb(null, {})
+    })
+
+    handler.use(cors({ cacheControl: 'max-age=3600, s-maxage=3600, proxy-revalidate' }))
+
+    const event = {
+      httpMethod: 'OPTIONS'
+    }
+
+    const response = await invoke(handler, event)
+    expect(response).toEqual({
+      headers: {
+        'Access-Control-Allow-Origin': '*',
+        'Cache-Control': 'max-age=3600, s-maxage=3600, proxy-revalidate'
+      }
+    })
+  })
+
+  test.each(['GET', 'POST', 'PUT', 'PATCH'])('it should not set Cache-Control header on %s', async (httpMethod) => {
+    const handler = middy((event, context, cb) => {
+      cb(null, {})
+    })
+
+    handler.use(cors({ cacheControl: 'max-age=3600, s-maxage=3600, proxy-revalidate' }))
+
+    const event = { httpMethod }
+
+    const response = await invoke(handler, event)
+    expect(response).toEqual({
+      headers: {
+        'Access-Control-Allow-Origin': '*'
+      }
+    })
+  })
+
+  test('it should not overwrite Cache-Control header if already set', async () => {
+    const handler = middy((event, context, cb) => {
+      cb(null, { headers: { 'Cache-Control': 'max-age=1200' } })
+    })
+
+    handler.use(cors({ cacheControl: 'max-age=3600, s-maxage=3600, proxy-revalidate' }))
+
+    const event = {
+      httpMethod: 'OPTIONS'
+    }
+
+    const response = await invoke(handler, event)
+    expect(response).toEqual({
+      headers: {
+        'Access-Control-Allow-Origin': '*',
+        'Cache-Control': 'max-age=1200'
+      }
+    })
+  })
+
+  test('it should set Access-Control-Max-Age header if present in config', async () => {
+    const handler = middy((event, context, cb) => {
+      cb(null, {})
+    })
+
+    handler.use(cors({ maxAge: '3600' }))
+
+    const event = {
+      httpMethod: 'GET'
+    }
+
+    const response = await invoke(handler, event)
+    expect(response).toEqual({
+      headers: {
+        'Access-Control-Allow-Origin': '*',
+        'Access-Control-Max-Age': '3600'
+      }
+    })
+  })
+
+  test('it should not overwrite Access-Control-Max-Age header if already set', async () => {
+    const handler = middy((event, context, cb) => {
+      cb(null, { headers: { 'Access-Control-Max-Age': '-1' } })
+    })
+
+    handler.use(cors({ maxAge: '3600' }))
+
+    const event = {
+      httpMethod: 'GET'
+    }
+
+    const response = await invoke(handler, event)
+    expect(response).toEqual({
+      headers: {
+        'Access-Control-Allow-Origin': '*',
+        'Access-Control-Max-Age': '-1'
+      }
+    })
+  })
 })

packages/http-cors/index.d.ts

@@ -5,6 +5,8 @@ interface ICorsOptions {
   origins?: string[];
   headers?: string;
   credentials?: boolean;
+  maxAge?: string;
+  cacheControl?: string;
 }
 
 declare const cors : middy.Middleware<ICorsOptions, any, any>

packages/http-cors/index.js

@@ -17,7 +17,9 @@ const defaults = {
   getOrigin,
   origin: '*',
   headers: null,
-  credentials: false
+  credentials: false,
+  maxAge: null,
+  cacheControl: null
 }
 
 const addCorsHeaders = (opts, handler, next) => {
@@ -47,6 +49,16 @@ const addCorsHeaders = (opts, handler, next) => {
       const incomingOrigin = headers.origin || headers.Origin
       handler.response.headers['Access-Control-Allow-Origin'] = options.getOrigin(incomingOrigin, options)
     }
+
+    if (options.maxAge && !Object.prototype.hasOwnProperty.call(handler.response.headers, 'Access-Control-Max-Age')) {
+      handler.response.headers['Access-Control-Max-Age'] = String(options.maxAge)
+    }
+
+    if (handler.event.httpMethod === 'OPTIONS') {
+      if (options.cacheControl && !Object.prototype.hasOwnProperty.call(handler.response.headers, 'Cache-Control')) {
+        handler.response.headers['Cache-Control'] = String(options.cacheControl)
+      }
+    }
   }
 
   next(handler.error)