fix(cors): make origin optional in CORSOptions (#4905)

* fix(cors): make origin optional in CORSOptions

The CORS middleware applies a default of `origin: '*'` when no value is
provided, and the JSDoc already documents `[options.origin='*']` (square
brackets indicating optional). The type required `origin`, so calling
`cors({ allowMethods: ['GET', 'POST'] })` errored at compile time even
though the runtime worked correctly.

Make `origin` optional on `CORSOptions` so the type matches the runtime
default. No runtime change. Test verifies omitting `origin` produces
`Access-Control-Allow-Origin: *` and an explicit `allowMethods` value
still applies.

Closes #4904

* remove the type error

---------

Co-authored-by: Yusuke Wada <yusuke@kamawada.com>

Author: truffle-dev

src/middleware/cors/index.test.ts

@@ -418,4 +418,22 @@ describe('CORS by Middleware', () => {
     expect(res.headers.get('Access-Control-Allow-Origin')).toBe('null')
     expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true')
   })
+
+  it('Options without origin fall back to wildcard default', async () => {
+    const subApp = new Hono()
+    subApp.use('/api/*', cors({ allowMethods: ['GET', 'POST'] }))
+    subApp.get('/api/abc', (c) => c.json({ ok: true }))
+
+    const res = await subApp.request('http://localhost/api/abc')
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('*')
+
+    const preflight = await subApp.request(
+      new Request('http://localhost/api/abc', { method: 'OPTIONS' })
+    )
+    expect(preflight.headers.get('Access-Control-Allow-Methods')?.split(/\s*,\s*/)).toEqual([
+      'GET',
+      'POST',
+    ])
+  })
 })

src/middleware/cors/index.ts

@@ -7,7 +7,7 @@ import type { Context } from '../../context'
 import type { MiddlewareHandler } from '../../types'
 
 type CORSOptions = {
-  origin:
+  origin?:
     | string
     | string[]
     | ((
@@ -61,16 +61,13 @@ type CORSOptions = {
  * ```
  */
 export const cors = (options?: CORSOptions): MiddlewareHandler => {
-  const defaults: CORSOptions = {
+  const opts = {
     origin: '*',
     allowMethods: ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH'],
     allowHeaders: [],
     exposeHeaders: [],
-  }
-  const opts = {
-    ...defaults,
     ...options,
-  }
+  } satisfies CORSOptions
 
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === 'string') {