From c52f0e17d7efdac6817a8152fd28e0a77e0be0f9 Mon Sep 17 00:00:00 2001
From: Jonny Barnes <jonny@jonnybarnes.uk>
Date: Fri, 2 Mar 2018 15:49:07 +0000
Subject: [PATCH] Add CORS headers to the media endpoint

Squashed commit of the following:

commit 0a620148dfad998f7b00804cae1db8208b23cc02
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:08:36 2018 +0000

    Add tests for the Cors Headers

commit dd8518d279cdf3857597fa7ee6150bf383203fe1
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:08:20 2018 +0000

    Only add Cors Headers to requests to the media endpoint

commit 6c79ca5632581345ef406f211b1576a4b7f400fe
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:07:53 2018 +0000

    Add CorsHeaders to middleware array

commit e12d48ca1e837b14b75bbd87d6197d59d60cf32e
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:06:32 2018 +0000

    We need to send something to the OPTIONS request to the media endpoint

commit f11c638be464373bff09bf015d4a989e48e61f0c
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:05:45 2018 +0000

    Change routes to allow for responses to an OPTIONS request to the media endpoint
---
 app/Http/Controllers/MicropubController.php | 10 ++++++
 app/Http/Kernel.php                         |  1 +
 app/Http/Middleware/CorsHeaders.php         | 28 +++++++++++++++++
 routes/web.php                              |  3 +-
 tests/Feature/CorsHeadersTest.php           | 34 +++++++++++++++++++++
 5 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 app/Http/Middleware/CorsHeaders.php
 create mode 100644 tests/Feature/CorsHeadersTest.php

diff --git a/app/Http/Controllers/MicropubController.php b/app/Http/Controllers/MicropubController.php
index 7c26a615..69e45e35 100644
--- a/app/Http/Controllers/MicropubController.php
+++ b/app/Http/Controllers/MicropubController.php
@@ -211,6 +211,16 @@ class MicropubController extends Controller
         ], 201)->header('Location', $media->url);
     }
 
+    /**
+     * Return the relavent CORS headers to a pre-flight OPTIONS request.
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function mediaOptionsResponse(): Response
+    {
+        return response('OK', 200);
+    }
+
     /**
      * Get the file type from the mimetype of the uploaded file.
      *
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 005c0d69..3ef8070a 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -62,5 +62,6 @@ class Kernel extends HttpKernel
         'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
         'micropub.token' => \App\Http\Middleware\VerifyMicropubToken::class,
         'myauth' => \App\Http\Middleware\MyAuthMiddleware::class,
+        'cors' => \App\Http\Middleware\CorsHeaders::class,
     ];
 }
diff --git a/app/Http/Middleware/CorsHeaders.php b/app/Http/Middleware/CorsHeaders.php
new file mode 100644
index 00000000..61b3e1e3
--- /dev/null
+++ b/app/Http/Middleware/CorsHeaders.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class CorsHeaders
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        $response = $next($request);
+        if ($request->path() === 'api/media') {
+            $response->header('Access-Control-Allow-Origin', '*');
+            $response->header('Access-Control-Allow-Methods', 'OPTIONS, POST');
+            $response->header('Access-Control-Allow-Headers', 'Authorization, Content-Type, DNT, X-CSRF-TOKEN, X-REQUESTED-WITH');
+            $response->header('Access-Control-Allow-Credentials', 'true');
+        }
+
+        return $response;
+    }
+}
diff --git a/routes/web.php b/routes/web.php
index b1e077d2..96734fcf 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -136,7 +136,8 @@ Route::group(['domain' => config('url.longurl')], function () {
     // Micropub Endpoints
     Route::get('api/post', 'MicropubController@get')->middleware('micropub.token');
     Route::post('api/post', 'MicropubController@post')->middleware('micropub.token');
-    Route::post('api/media', 'MicropubController@media')->middleware('micropub.token')->name('media-endpoint');
+    Route::post('api/media', 'MicropubController@media')->middleware('micropub.token', 'cors')->name('media-endpoint');
+    Route::options('/api/media', 'MicropubController@mediaOptionsResponse')->middleware('cors');
 
     //webmention
     Route::get('webmention', 'WebMentionsController@get');
diff --git a/tests/Feature/CorsHeadersTest.php b/tests/Feature/CorsHeadersTest.php
new file mode 100644
index 00000000..3d3ef924
--- /dev/null
+++ b/tests/Feature/CorsHeadersTest.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace Tests\Feature;
+
+use Tests\TestCase;
+use Tests\TestToken;
+use Illuminate\Foundation\Testing\WithFaker;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+class CorsHeadersTest extends TestCase
+{
+    use TestToken;
+
+    /** @test */
+    public function check_cors_headers_on_media_endpoint_options_request()
+    {
+        $response = $this->call(
+            'OPTIONS',
+            '/api/media',
+            [],
+            [],
+            [],
+            ['HTTP_Authorization' => 'Bearer ' . $this->getToken()]
+        );
+        $response->assertHeader('Access-Control-Allow-Origin', '*');
+    }
+
+    /** @test */
+    public function check_missing_on_other_route()
+    {
+        $response = $this->get('/');
+        $response->assertHeaderMissing('Access-Control-Allow-Origin');
+    }
+}