feat: improve CORS validation with AWS S3 format detection

[devin-ai-integration]

feat: implement comprehensive CORS validation with AWS S3 format detection using zod

Summary

This PR implements comprehensive validation for the wrangler r2 bucket cors set command to address GitHub issue #8486. The key improvements include:

• AWS S3 format detection: Automatically detects when users provide AWS S3-style CORS configuration and provides a helpful conversion example showing the correct Cloudflare R2 format
• Zod-based validation: Uses zod schemas for robust type validation and error handling
• Comprehensive validation: Validates the complete structure of CORS rules including data types, required fields, and array contents
• Specific error messages: Provides detailed, actionable error messages that pinpoint exactly what's wrong and how to fix it
• Backward compatibility: Maintains support for existing valid Cloudflare R2 CORS configurations

The validation function detects AWS S3 format by checking for fields like AllowedOrigins, AllowedMethods, etc., and provides a converted example in the error message. It also validates rule structure, data types (ensuring maxAgeSeconds is a non-negative integer), and array contents (ensuring all items are strings).

Review & Testing Checklist for Human

• End-to-end testing: Test the wrangler r2 bucket cors set command with various CORS configuration files (AWS S3 format, valid R2 format, invalid formats) to ensure validation works correctly in practice
• Backward compatibility verification: Confirm that existing valid Cloudflare R2 CORS configurations continue to work without issues
• AWS S3 format detection accuracy: Test with real AWS S3 CORS configuration files to verify the detection logic works correctly and conversion examples are accurate
• Error message quality: Verify that error messages display properly in the terminal and provide clear, actionable guidance without being overwhelming
• Test suite validation: Run the new test cases to ensure they pass and provide adequate coverage of validation scenarios

Recommended test plan: Create sample CORS files in AWS S3 format, valid R2 format, and various invalid formats, then run wrangler r2 bucket cors set test-bucket --file <cors-file> to verify the validation behavior matches expectations.

---

Diagram

%%{ init : { "theme" : "default" }}%% graph TD CLI["wrangler r2 bucket cors set"] CorsCommand["packages/wrangler/src/r2/cors.ts<br/>r2BucketCORSSetCommand"]:::major-edit ValidateFunc["packages/wrangler/src/r2/helpers.ts<br/>validateCORSRules()"]:::major-edit Tests["packages/wrangler/src/__tests__/r2.test.ts<br/>CORS validation tests"]:::major-edit API["Cloudflare R2 API"]:::context CLI --> CorsCommand CorsCommand --> ValidateFunc ValidateFunc --> API Tests -.-> ValidateFunc CorsCommand --> |"reads JSON file<br/>calls validation"| ValidateFunc ValidateFunc --> |"throws UserError<br/>if invalid"| CorsCommand ValidateFunc --> |"returns validated<br/>rules if valid"| API subgraph Legend L1[Major Edit]:::major-edit L2[Minor Edit]:::minor-edit L3[Context/No Edit]:::context end classDef major-edit fill:#90EE90 classDef minor-edit fill:#87CEEB classDef context fill:#FFFFFF 

Loading

Notes

• Risk: The changes weren't tested locally due to development environment setup issues, so end-to-end validation is critical
• Breaking change potential: The new validation is much more strict than the previous simple "rules array" check, which could affect existing users
• AWS S3 detection: Uses field name presence to detect format - should be tested with real AWS S3 configurations to avoid false positives
• Zod dependency: Added zod as a new dependency to the wrangler package for robust schema validation

Session details: Requested by @emily-shen
Link to Devin run: https://app.devin.ai/sessions/4a61736e21ab4a3f9a708d833a99ff6c

---

• Tests
  • Tests included
  • Tests not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: This is an internal validation improvement that doesn't change the public API or user-facing behavior beyond better error messages
• Wrangler V3 Backport
  • Wrangler PR:
  • Not necessary because: This is a new feature enhancement, not a bug fix requiring backport

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[changeset-bot]

🦋 Changeset detected

Latest commit: 728ae1d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
wrangler	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@10111 

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@10111 

miniflare

npm i https://pkg.pr.new/miniflare@10111 

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@10111 

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@10111 

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@10111 

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@10111 

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@10111 

wrangler

npm i https://pkg.pr.new/wrangler@10111 

commit: 728ae1d

[github-actions]

Failed to automatically backport this PR's changes to Wrangler v3. Please manually create a PR targeting the v3-maintenance branch with your changes. Thank you for helping us keep Wrangler v3 supported!

Depending on your changes, running git rebase --onto v3-maintenance main devin/1753778614-cors-validation-enhancement might be a good starting point.

Notes:

• your PR branch should be named v3-backport-10111
• add the skip-v3-pr label to the current PR to stop this workflow from failing

[vicb]

comment: zod is used in miniflare so maybe we should add & use a catalog version - miniflare uses 3.22.3

[petebacondarwin]

Please can you rebase and fix the conflicts on this PR.

[CarmenPopoviciu]

Please can you rebase and fix the conflicts on this PR.