From 120708ed47c56027175f08cb4d9efc98b595d809 Mon Sep 17 00:00:00 2001
From: Ian Troisi <56521951+Cincinnatus101010@users.noreply.github.com>
Date: Thu, 11 Jun 2026 12:58:59 -0400
Subject: [PATCH] perf: cache custom domain CORS origin lookups

Avoid hitting the database on every cross-origin request by caching
published custom domain checks for five minutes.
---
 .../api/middleware/statusPageCorsOrigin.ts    | 22 ++++++-
 .../middleware/statusPageCorsOrigin.test.ts   | 60 +++++++++++++++++++
 2 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 server/test/unit/middleware/statusPageCorsOrigin.test.ts

diff --git a/server/src/api/middleware/statusPageCorsOrigin.ts b/server/src/api/middleware/statusPageCorsOrigin.ts
index 7a48ca45f..acc515bf9 100644
--- a/server/src/api/middleware/statusPageCorsOrigin.ts
+++ b/server/src/api/middleware/statusPageCorsOrigin.ts
@@ -2,7 +2,16 @@ import type { CorsOptions } from "cors";
 import type { IStatusPagesRepository } from "@/domain/status-pages/status-page-repository.interface.js";
 import { normalizeStatusPageDomain } from "@/utils/statusPageDomain.js";
 
+const CUSTOM_DOMAIN_CORS_CACHE_TTL_MS = 5 * 60 * 1000;
+
+type CustomDomainCorsCacheEntry = {
+	allowed: boolean;
+	expiresAt: number;
+};
+
 export const createStatusPageCorsOrigin = (clientHost: string, statusPagesRepository: IStatusPagesRepository): CorsOptions["origin"] => {
+	const cache = new Map<string, CustomDomainCorsCacheEntry>();
+
 	return (origin, callback) => {
 		if (!origin) {
 			callback(null, true);
@@ -27,10 +36,21 @@ export const createStatusPageCorsOrigin = (clientHost: string, statusPagesReposi
 			return;
 		}
 
+		const cached = cache.get(customDomain);
+		if (cached && cached.expiresAt > Date.now()) {
+			callback(null, cached.allowed ? origin : false);
+			return;
+		}
+
 		statusPagesRepository
 			.findByCustomDomain(customDomain)
 			.then((statusPage) => {
-				callback(null, statusPage.isPublished ? origin : false);
+				const allowed = statusPage.isPublished;
+				cache.set(customDomain, {
+					allowed,
+					expiresAt: Date.now() + CUSTOM_DOMAIN_CORS_CACHE_TTL_MS,
+				});
+				callback(null, allowed ? origin : false);
 			})
 			.catch(() => {
 				callback(null, false);
diff --git a/server/test/unit/middleware/statusPageCorsOrigin.test.ts b/server/test/unit/middleware/statusPageCorsOrigin.test.ts
new file mode 100644
index 000000000..b0f92cac4
--- /dev/null
+++ b/server/test/unit/middleware/statusPageCorsOrigin.test.ts
@@ -0,0 +1,60 @@
+import { describe, expect, it, jest, beforeEach } from "@jest/globals";
+import { createStatusPageCorsOrigin } from "../../../src/api/middleware/statusPageCorsOrigin.ts";
+import type { IStatusPagesRepository } from "../../../src/domain/status-pages/status-page-repository.interface.ts";
+import type { StatusPage } from "../../../src/domain/status-pages/status-page.type.ts";
+
+const makeStatusPage = (overrides?: Partial<StatusPage>): StatusPage =>
+	({
+		id: "sp-1",
+		isPublished: true,
+		customDomain: "status.example.com",
+		...overrides,
+	}) as StatusPage;
+
+const createRepo = () =>
+	({
+		findByCustomDomain: jest.fn().mockResolvedValue(makeStatusPage()),
+	}) as unknown as jest.Mocked<Pick<IStatusPagesRepository, "findByCustomDomain">>;
+
+const invokeOrigin = (originFn: ReturnType<typeof createStatusPageCorsOrigin>, origin: string): Promise<boolean | string> =>
+	new Promise((resolve, reject) => {
+		originFn?.(origin, (error, result) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve(result ?? false);
+		});
+	});
+
+describe("createStatusPageCorsOrigin", () => {
+	let repo: jest.Mocked<Pick<IStatusPagesRepository, "findByCustomDomain">>;
+
+	beforeEach(() => {
+		repo = createRepo();
+	});
+
+	it("allows the configured client host without a repository lookup", async () => {
+		const originFn = createStatusPageCorsOrigin("https://checkmate.example.com", repo as IStatusPagesRepository);
+
+		await expect(invokeOrigin(originFn, "https://checkmate.example.com")).resolves.toBe(true);
+		expect(repo.findByCustomDomain).not.toHaveBeenCalled();
+	});
+
+	it("caches published custom domain lookups", async () => {
+		const originFn = createStatusPageCorsOrigin("https://checkmate.example.com", repo as IStatusPagesRepository);
+
+		await expect(invokeOrigin(originFn, "https://status.example.com")).resolves.toBe("https://status.example.com");
+		await expect(invokeOrigin(originFn, "https://status.example.com")).resolves.toBe("https://status.example.com");
+
+		expect(repo.findByCustomDomain).toHaveBeenCalledTimes(1);
+		expect(repo.findByCustomDomain).toHaveBeenCalledWith("status.example.com");
+	});
+
+	it("rejects unpublished custom domains", async () => {
+		repo.findByCustomDomain.mockResolvedValue(makeStatusPage({ isPublished: false }));
+		const originFn = createStatusPageCorsOrigin("https://checkmate.example.com", repo as IStatusPagesRepository);
+
+		await expect(invokeOrigin(originFn, "https://status.example.com")).resolves.toBe(false);
+	});
+});