fix: update CORS origin type

The second argument of the origin callback is not a boolean, but the "non-function value of the origin option".

NB: Passing `false` doesn't reject the origin, it evaluates to nothing, and then the library interpreters that as `*`, which allows everything.

Author: koenpunt

packages/common/interfaces/external/cors-options.interface.ts

@@ -1,3 +1,5 @@
+type StaticOrigin = boolean | string | RegExp | (string | RegExp)[];
+
 /**
  * Set origin to a function implementing some custom logic. The function takes the
  * request origin as the first parameter and a callback (which expects the signature
@@ -9,7 +11,7 @@
  */
 export type CustomOrigin = (
   requestOrigin: string,
-  callback: (err: Error | null, allow?: boolean) => void,
+  callback: (err: Error | null, origin?: StaticOrigin) => void,
 ) => void;
 
 /**
@@ -22,7 +24,7 @@ export interface CorsOptions {
   /**
    * Configures the `Access-Control-Allow-Origins` CORS header.  See [here for more detail.](https://github.com/expressjs/cors#configuration-options)
    */
-  origin?: boolean | string | RegExp | (string | RegExp)[] | CustomOrigin;
+  origin?: StaticOrigin | CustomOrigin;
   /**
    * Configures the Access-Control-Allow-Methods CORS header.
    */