Improve cors headers handling for more complex scenarios

Author: azimux

CHANGELOG.md

@@ -1,3 +1,7 @@
+## [0.0.20] - 2025-04-14
+
+- Handle more cors scenarios
+
 ## [0.0.19] - 2025-03-31
 
 - Add SetHeader response mutator

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    foobara-http-command-connector (0.0.19)
+    foobara-http-command-connector (0.0.20)
       foobara (~> 0.0.88)
 
 GEM
@@ -20,7 +20,7 @@ GEM
     date (3.4.1)
     diff-lcs (1.6.1)
     docile (1.4.1)
-    dotenv (3.1.7)
+    dotenv (3.1.8)
     extract-repo (0.0.9)
       foobara
       foobara-sh-cli-connector
@@ -35,29 +35,31 @@ GEM
     ffi (1.17.1-x86_64-darwin)
     ffi (1.17.1-x86_64-linux-gnu)
     ffi (1.17.1-x86_64-linux-musl)
-    foob (0.0.12)
-      foobara
-      foobara-command-generator
-      foobara-domain-generator
-      foobara-domain-mapper-generator
-      foobara-empty-ruby-project-generator
-      foobara-empty-typescript-react-project-generator
-      foobara-local-files-crud-driver-generator
-      foobara-organization-generator
-      foobara-rack-connector-generator
-      foobara-redis-crud-driver-generator
-      foobara-remote-imports-generator
-      foobara-resque-connector-generator
-      foobara-resque-scheduler-connector-generator
+    foob (0.0.13)
+      foobara (~> 0.0.99)
+      foobara-command-generator (~> 0.0.1)
+      foobara-domain-generator (~> 0.0.1)
+      foobara-domain-mapper-generator (~> 0.0.1)
+      foobara-empty-ruby-project-generator (~> 0.0.1)
+      foobara-empty-typescript-react-project-generator (~> 0.0.1)
+      foobara-local-files-crud-driver-generator (~> 0.0.1)
+      foobara-mcp-connector-generator (~> 0.0.1)
+      foobara-organization-generator (~> 0.0.1)
+      foobara-rack-connector-generator (~> 0.0.1)
+      foobara-redis-crud-driver-generator (~> 0.0.1)
+      foobara-remote-imports-generator (~> 0.0.1)
+      foobara-resque-connector-generator (~> 0.0.1)
+      foobara-resque-scheduler-connector-generator (~> 0.0.1)
       foobara-sh-cli-connector (~> 0.0.10)
-      foobara-sh-cli-connector-generator
-      foobara-type-generator
-      foobara-typescript-react-command-form-generator
-      foobara-typescript-remote-command-generator
-    foobara (0.0.91)
+      foobara-sh-cli-connector-generator (~> 0.0.1)
+      foobara-type-generator (~> 0.0.1)
+      foobara-typescript-react-command-form-generator (~> 0.0.1)
+      foobara-typescript-remote-command-generator (~> 0.0.1)
+    foobara (0.0.102)
       bigdecimal
       foobara-lru-cache (~> 0.0.2)
       foobara-util (~> 0.0.11)
+      inheritable-thread-vars (~> 0.0.1)
     foobara-command-generator (0.0.3)
       foobara
       foobara-files-generator
@@ -69,10 +71,10 @@ GEM
       foobara-files-generator
     foobara-dotenv-loader (0.0.3)
       dotenv
-    foobara-empty-ruby-project-generator (0.0.14)
-      extract-repo
-      foobara
-      foobara-files-generator
+    foobara-empty-ruby-project-generator (0.0.15)
+      extract-repo (~> 0.0.1)
+      foobara (~> 0.0.94)
+      foobara-files-generator (~> 0.0.1)
     foobara-empty-typescript-react-project-generator (0.0.4)
       foobara
       foobara-files-generator
@@ -82,6 +84,8 @@ GEM
       foobara
       foobara-files-generator
     foobara-lru-cache (0.0.2)
+    foobara-mcp-connector-generator (0.0.6)
+      foobara (~> 0.0.99)
     foobara-organization-generator (0.0.2)
       foobara
       foobara-files-generator
@@ -102,7 +106,7 @@ GEM
     foobara-rubocop-rules (0.0.8)
       rubocop
       rubocop-rspec
-    foobara-sh-cli-connector (0.0.13)
+    foobara-sh-cli-connector (0.0.15)
       foobara (~> 0.0.88)
     foobara-sh-cli-connector-generator (0.0.4)
       foobara-files-generator (~> 0.0.1)
@@ -111,12 +115,9 @@ GEM
     foobara-type-generator (0.0.4)
       foobara
       foobara-files-generator
-    foobara-typescript-react-command-form-generator (0.0.8)
-      foobara
-      foobara-files-generator
-      foobara-typescript-remote-command-generator
-    foobara-typescript-remote-command-generator (0.0.16)
-      foobara (~> 0.0.88)
+    foobara-typescript-react-command-form-generator (0.0.11)
+      foobara-typescript-remote-command-generator (~> 0.0.1)
+    foobara-typescript-remote-command-generator (0.0.17)
       foobara-files-generator (~> 0.0.1)
     foobara-util (0.0.11)
     formatador (1.1.0)
@@ -137,8 +138,9 @@ GEM
       guard-compat (~> 1.1)
       rspec (>= 2.99.0, < 4.0)
     hashdiff (1.1.2)
+    inheritable-thread-vars (0.0.2)
     io-console (0.8.0)
-    irb (1.15.1)
+    irb (1.15.2)
       pp (>= 0.6.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
@@ -156,8 +158,8 @@ GEM
       nenv (~> 0.1)
       shellany (~> 0.0)
     ostruct (0.6.1)
-    parallel (1.26.3)
-    parser (3.3.7.4)
+    parallel (1.27.0)
+    parser (3.3.8.0)
       ast (~> 2.4.1)
       racc
     pp (0.6.2)
@@ -183,7 +185,7 @@ GEM
     rdoc (6.13.1)
       psych (>= 4.0.0)
     regexp_parser (2.10.0)
-    reline (0.6.0)
+    reline (0.6.1)
       io-console (~> 0.5)
     rexml (3.4.1)
     rspec (3.13.0)
@@ -202,18 +204,18 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.2)
-    rubocop (1.75.1)
+    rubocop (1.75.2)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
       parallel (~> 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.43.0, < 2.0)
+      rubocop-ast (>= 1.44.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.43.0)
+    rubocop-ast (1.44.1)
       parser (>= 3.3.7.2)
       prism (~> 1.4)
     rubocop-rake (0.7.1)

src/http.rb

@@ -60,13 +60,11 @@ def run(*, **)
 
       def request_to_command(request)
         if request.method == "OPTIONS"
-          # TODO: this feels a bit hacky and like overkill...
-          return Foobara::CommandConnectors::Http::Commands::GetOptions.new
+          return Foobara::CommandConnectors::Http::Commands::GetOptions.new(request:)
         end
 
         command = super
 
-        # TODO: We should kill these case statements and require connecting these commands
         if request.action == "help"
           command.class.serializers = [Commands::Help::ResultSerializer]
         end
@@ -136,6 +134,12 @@ def headers_for(request)
 
       def static_headers
         @static_headers ||= ENV.each_with_object({}) do |(key, value), headers|
+          next if %w[
+            FOOBARA_HTTP_RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS
+            FOOBARA_HTTP_RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS
+            FOOBARA_HTTP_RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE
+          ].include?(key)
+
           match = key.match(/\AFOOBARA_HTTP_RESPONSE_HEADER_(.*)\z/)
 
           if match

src/http/commands/get_options.rb

@@ -4,11 +4,49 @@ class Http < CommandConnector
       module Commands
         # TODO: this is a bit of a hack, just a total no-op... shouldn't really need this command at all ideally
         class GetOptions < Foobara::Command
+          inputs do
+            request :duck, :required
+          end
           result :string
 
           def execute
+            initialize_response_headers
+
+            set_allow_methods
+            set_allow_headers
+            set_access_control_max_age
+
+            # TODO: what's with this empty string?
             ""
           end
+
+          def initialize_response_headers
+            request.response_headers ||= {}
+          end
+
+          def set_allow_methods
+            allow_methods = ENV.fetch("FOOBARA_HTTP_RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS", nil)
+            if allow_methods
+              request.response_headers["access-control-allow-methods"] = allow_methods
+            end
+          end
+
+          def set_allow_headers
+            allow_headers = ENV.fetch("FOOBARA_HTTP_RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS", nil)
+            if allow_headers
+              if allow_headers == "*"
+                allow_headers = request.headers["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"]
+              end
+              request.response_headers["access-control-allow-headers"] = allow_headers
+            end
+          end
+
+          def set_access_control_max_age
+            access_control_max_age = ENV.fetch("FOOBARA_HTTP_RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE", nil)
+            if access_control_max_age
+              request.response_headers["access-control-max-age"] = access_control_max_age
+            end
+          end
         end
       end
     end

version.rb

@@ -1,6 +1,6 @@
 module Foobara
   module HttpCommandConnector
-    VERSION = "0.0.19".freeze
+    VERSION = "0.0.20".freeze
 
     local_ruby_version = File.read("#{__dir__}/.ruby-version").chomp
     local_ruby_version_minor = local_ruby_version[/\A(\d+\.\d+)\.\d+\z/, 1]