fix: prioritize boolean cors value over debug flags (#1189)

* fix: prioritize boolean cors value over debug flags

As discussed in firebase/firebase-tools#4862 it's not possible to disable cors in v2 functions, because the emulator enables the debug feature for cors overriding `opts.cors`.

If we could prioritize the boolean flag over the debug feature, we could have both: The ability to disable cors and also prioritize the debug flag over user provided configuration.

* chore: use less conditions to check desired cors state

Co-authored-by: Daniel Lee <taeold@gmail.com>

* style: format

* chore: run prettier to follow formatting rules

* style: format https spec file

Co-authored-by: Daniel Lee <taeold@gmail.com>
Co-authored-by: Cole Rogers <colerogers@users.noreply.github.com>

Author: 3 people

spec/v2/providers/https.spec.ts

@@ -215,6 +215,33 @@ describe("onRequest", () => {
 
     sinon.restore();
   });
+
+  it("should NOT add CORS headers if debug feature is enabled and cors has value false", async () => {
+    sinon.stub(debug, "isDebugFeatureEnabled").withArgs("enableCors").returns(true);
+
+    const func = https.onRequest({ cors: false }, (req, res) => {
+      res.status(200).send("Good");
+    });
+
+    const req = new MockRequest(
+      {
+        data: {},
+      },
+      {
+        "Access-Control-Request-Method": "POST",
+        "Access-Control-Request-Headers": "origin",
+        origin: "example.com",
+      }
+    );
+    req.method = "OPTIONS";
+
+    const resp = await runHandler(func, req as any);
+    expect(resp.status).to.equal(200);
+    expect(resp.body).to.be.equal("Good");
+    expect(resp.headers).to.deep.equal({});
+
+    sinon.restore();
+  });
 });
 
 describe("onCall", () => {

src/v2/providers/https.ts

@@ -230,7 +230,12 @@ export function onRequest(
   }
 
   if (isDebugFeatureEnabled("enableCors") || "cors" in opts) {
-    const origin = isDebugFeatureEnabled("enableCors") ? true : opts.cors;
+    let origin = opts.cors;
+    if (isDebugFeatureEnabled("enableCors")) {
+      // Respect `cors: false` to turn off cors even if debug feature is enabled.
+      origin = opts.cors === false ? false : true;
+    }
+
     const userProvidedHandler = handler;
     handler = (req: Request, res: express.Response): void | Promise<void> => {
       return new Promise((resolve) => {