Add CORS headers to the media endpoint

Squashed commit of the following:

commit 0a620148dfad998f7b00804cae1db8208b23cc02
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:08:36 2018 +0000

    Add tests for the Cors Headers

commit dd8518d279cdf3857597fa7ee6150bf383203fe1
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:08:20 2018 +0000

    Only add Cors Headers to requests to the media endpoint

commit 6c79ca5632581345ef406f211b1576a4b7f400fe
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:07:53 2018 +0000

    Add CorsHeaders to middleware array

commit e12d48ca1e837b14b75bbd87d6197d59d60cf32e
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:06:32 2018 +0000

    We need to send something to the OPTIONS request to the media endpoint

commit f11c638be464373bff09bf015d4a989e48e61f0c
Author: Jonny Barnes <jonny@jonnybarnes.uk>
Date:   Fri Mar 2 15:05:45 2018 +0000

    Change routes to allow for responses to an OPTIONS request to the media endpoint

app/Http/Controllers/MicropubController.php

@@ -211,6 +211,16 @@ class MicropubController extends Controller
         ], 201)->header('Location', $media->url);
     }
 
+    /**
+     * Return the relavent CORS headers to a pre-flight OPTIONS request.
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function mediaOptionsResponse(): Response
+    {
+        return response('OK', 200);
+    }
+
     /**
      * Get the file type from the mimetype of the uploaded file.
      *

app/Http/Kernel.php

@@ -62,5 +62,6 @@ class Kernel extends HttpKernel
         'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
         'micropub.token' => \App\Http\Middleware\VerifyMicropubToken::class,
         'myauth' => \App\Http\Middleware\MyAuthMiddleware::class,
+        'cors' => \App\Http\Middleware\CorsHeaders::class,
     ];
 }

app/Http/Middleware/CorsHeaders.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class CorsHeaders
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        $response = $next($request);
+        if ($request->path() === 'api/media') {
+            $response->header('Access-Control-Allow-Origin', '*');
+            $response->header('Access-Control-Allow-Methods', 'OPTIONS, POST');
+            $response->header('Access-Control-Allow-Headers', 'Authorization, Content-Type, DNT, X-CSRF-TOKEN, X-REQUESTED-WITH');
+            $response->header('Access-Control-Allow-Credentials', 'true');
+        }
+
+        return $response;
+    }
+}

routes/web.php

@@ -136,7 +136,8 @@ Route::group(['domain' => config('url.longurl')], function () {
     // Micropub Endpoints
     Route::get('api/post', 'MicropubController@get')->middleware('micropub.token');
     Route::post('api/post', 'MicropubController@post')->middleware('micropub.token');
-    Route::post('api/media', 'MicropubController@media')->middleware('micropub.token')->name('media-endpoint');
+    Route::post('api/media', 'MicropubController@media')->middleware('micropub.token', 'cors')->name('media-endpoint');
+    Route::options('/api/media', 'MicropubController@mediaOptionsResponse')->middleware('cors');
 
     //webmention
     Route::get('webmention', 'WebMentionsController@get');

tests/Feature/CorsHeadersTest.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Tests\Feature;
+
+use Tests\TestCase;
+use Tests\TestToken;
+use Illuminate\Foundation\Testing\WithFaker;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+class CorsHeadersTest extends TestCase
+{
+    use TestToken;
+
+    /** @test */
+    public function check_cors_headers_on_media_endpoint_options_request()
+    {
+        $response = $this->call(
+            'OPTIONS',
+            '/api/media',
+            [],
+            [],
+            [],
+            ['HTTP_Authorization' => 'Bearer ' . $this->getToken()]
+        );
+        $response->assertHeader('Access-Control-Allow-Origin', '*');
+    }
+
+    /** @test */
+    public function check_missing_on_other_route()
+    {
+        $response = $this->get('/');
+        $response->assertHeaderMissing('Access-Control-Allow-Origin');
+    }
+}